xref: /freebsd/sys/netgraph/ng_ppp.c (revision c68159a6d8eede11766cf13896d0f7670dbd51aa)
1 
2 /*
3  * ng_ppp.c
4  *
5  * Copyright (c) 1996-2000 Whistle Communications, Inc.
6  * All rights reserved.
7  *
8  * Subject to the following obligations and disclaimer of warranty, use and
9  * redistribution of this software, in source or object code forms, with or
10  * without modifications are expressly permitted by Whistle Communications;
11  * provided, however, that:
12  * 1. Any and all reproductions of the source or object code must include the
13  *    copyright notice above and the following disclaimer of warranties; and
14  * 2. No rights are granted, in any manner or form, to use Whistle
15  *    Communications, Inc. trademarks, including the mark "WHISTLE
16  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
17  *    such appears in the above copyright notice or in the software.
18  *
19  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
20  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
21  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
22  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
23  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
24  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
25  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
26  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
27  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
28  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
29  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
30  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
31  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
35  * OF SUCH DAMAGE.
36  *
37  * Author: Archie Cobbs <archie@freebsd.org>
38  *
39  * $FreeBSD$
40  * $Whistle: ng_ppp.c,v 1.24 1999/11/01 09:24:52 julian Exp $
41  */
42 
43 /*
44  * PPP node type.
45  */
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/time.h>
51 #include <sys/mbuf.h>
52 #include <sys/malloc.h>
53 #include <sys/errno.h>
54 #include <sys/ctype.h>
55 
56 #include <machine/limits.h>
57 
58 #include <netgraph/ng_message.h>
59 #include <netgraph/netgraph.h>
60 #include <netgraph/ng_parse.h>
61 #include <netgraph/ng_ppp.h>
62 #include <netgraph/ng_vjc.h>
63 
64 #define PROT_VALID(p)		(((p) & 0x0101) == 0x0001)
65 #define PROT_COMPRESSABLE(p)	(((p) & 0xff00) == 0x0000)
66 
67 /* Some PPP protocol numbers we're interested in */
68 #define PROT_APPLETALK		0x0029
69 #define PROT_COMPD		0x00fd
70 #define PROT_CRYPTD		0x0053
71 #define PROT_IP			0x0021
72 #define PROT_IPV6		0x0057
73 #define PROT_IPX		0x002b
74 #define PROT_LCP		0xc021
75 #define PROT_MP			0x003d
76 #define PROT_VJCOMP		0x002d
77 #define PROT_VJUNCOMP		0x002f
78 
79 /* Multilink PPP definitions */
80 #define MP_MIN_MRRU		1500		/* per RFC 1990 */
81 #define MP_INITIAL_SEQ		0		/* per RFC 1990 */
82 #define MP_MIN_LINK_MRU		32
83 
84 #define MP_SHORT_SEQ_MASK	0x00000fff	/* short seq # mask */
85 #define MP_SHORT_SEQ_HIBIT	0x00000800	/* short seq # high bit */
86 #define MP_SHORT_FIRST_FLAG	0x00008000	/* first fragment in frame */
87 #define MP_SHORT_LAST_FLAG	0x00004000	/* last fragment in frame */
88 
89 #define MP_LONG_SEQ_MASK	0x00ffffff	/* long seq # mask */
90 #define MP_LONG_SEQ_HIBIT	0x00800000	/* long seq # high bit */
91 #define MP_LONG_FIRST_FLAG	0x80000000	/* first fragment in frame */
92 #define MP_LONG_LAST_FLAG	0x40000000	/* last fragment in frame */
93 
94 #define MP_NOSEQ		0x7fffffff	/* impossible sequence number */
95 
96 /* Sign extension of MP sequence numbers */
97 #define MP_SHORT_EXTEND(s)	(((s) & MP_SHORT_SEQ_HIBIT) ?		\
98 				    ((s) | ~MP_SHORT_SEQ_MASK)		\
99 				    : ((s) & MP_SHORT_SEQ_MASK))
100 #define MP_LONG_EXTEND(s)	(((s) & MP_LONG_SEQ_HIBIT) ?		\
101 				    ((s) | ~MP_LONG_SEQ_MASK)		\
102 				    : ((s) & MP_LONG_SEQ_MASK))
103 
104 /* Comparision of MP sequence numbers. Note: all sequence numbers
105    except priv->xseq are stored with the sign bit extended. */
106 #define MP_SHORT_SEQ_DIFF(x,y)	MP_SHORT_EXTEND((x) - (y))
107 #define MP_LONG_SEQ_DIFF(x,y)	MP_LONG_EXTEND((x) - (y))
108 
109 #define MP_RECV_SEQ_DIFF(priv,x,y)					\
110 				((priv)->conf.recvShortSeq ?		\
111 				    MP_SHORT_SEQ_DIFF((x), (y)) :	\
112 				    MP_LONG_SEQ_DIFF((x), (y)))
113 
114 /* Increment receive sequence number */
115 #define MP_NEXT_RECV_SEQ(priv,seq)					    \
116 				(((seq) + 1) & ((priv)->conf.recvShortSeq ? \
117 				    MP_SHORT_SEQ_MASK : MP_LONG_SEQ_MASK))
118 
119 /* Don't fragment transmitted packets smaller than this */
120 #define MP_MIN_FRAG_LEN		6
121 
122 /* Maximum fragment reasssembly queue length */
123 #define MP_MAX_QUEUE_LEN	128
124 
125 /* Fragment queue scanner period */
126 #define MP_FRAGTIMER_INTERVAL	(hz/2)
127 
128 /* We store incoming fragments this way */
129 struct ng_ppp_frag {
130 	int				seq;		/* fragment seq# */
131 	u_char				first;		/* First in packet? */
132 	u_char				last;		/* Last in packet? */
133 	struct timeval			timestamp;	/* time of reception */
134 	struct mbuf			*data;		/* Fragment data */
135 	meta_p				meta;		/* Fragment meta */
136 	TAILQ_ENTRY(ng_ppp_frag)	f_qent;		/* Fragment queue */
137 };
138 
139 /* We use integer indicies to refer to the non-link hooks */
140 static const char *const ng_ppp_hook_names[] = {
141 	NG_PPP_HOOK_ATALK,
142 #define HOOK_INDEX_ATALK		0
143 	NG_PPP_HOOK_BYPASS,
144 #define HOOK_INDEX_BYPASS		1
145 	NG_PPP_HOOK_COMPRESS,
146 #define HOOK_INDEX_COMPRESS		2
147 	NG_PPP_HOOK_ENCRYPT,
148 #define HOOK_INDEX_ENCRYPT		3
149 	NG_PPP_HOOK_DECOMPRESS,
150 #define HOOK_INDEX_DECOMPRESS		4
151 	NG_PPP_HOOK_DECRYPT,
152 #define HOOK_INDEX_DECRYPT		5
153 	NG_PPP_HOOK_INET,
154 #define HOOK_INDEX_INET			6
155 	NG_PPP_HOOK_IPX,
156 #define HOOK_INDEX_IPX			7
157 	NG_PPP_HOOK_VJC_COMP,
158 #define HOOK_INDEX_VJC_COMP		8
159 	NG_PPP_HOOK_VJC_IP,
160 #define HOOK_INDEX_VJC_IP		9
161 	NG_PPP_HOOK_VJC_UNCOMP,
162 #define HOOK_INDEX_VJC_UNCOMP		10
163 	NG_PPP_HOOK_VJC_VJIP,
164 #define HOOK_INDEX_VJC_VJIP		11
165 	NG_PPP_HOOK_IPV6,
166 #define HOOK_INDEX_IPV6			12
167 	NULL
168 #define HOOK_INDEX_MAX			13
169 };
170 
171 /* We store index numbers in the hook private pointer. The HOOK_INDEX()
172    for a hook is either the index (above) for normal hooks, or the ones
173    complement of the link number for link hooks. */
174 #define HOOK_INDEX(hook)	(*((int16_t *) &(hook)->private))
175 
176 /* Per-link private information */
177 struct ng_ppp_link {
178 	struct ng_ppp_link_conf	conf;		/* link configuration */
179 	hook_p			hook;		/* connection to link data */
180 	int32_t			seq;		/* highest rec'd seq# - MSEQ */
181 	struct timeval		lastWrite;	/* time of last write */
182 	int			bytesInQueue;	/* bytes in the output queue */
183 	struct ng_ppp_link_stat	stats;		/* Link stats */
184 };
185 
186 /* Total per-node private information */
187 struct ng_ppp_private {
188 	struct ng_ppp_bund_conf	conf;			/* bundle config */
189 	struct ng_ppp_link_stat	bundleStats;		/* bundle stats */
190 	struct ng_ppp_link	links[NG_PPP_MAX_LINKS];/* per-link info */
191 	int32_t			xseq;			/* next out MP seq # */
192 	int32_t			mseq;			/* min links[i].seq */
193 	u_char			vjCompHooked;		/* VJ comp hooked up? */
194 	u_char			allLinksEqual;		/* all xmit the same? */
195 	u_char			timerActive;		/* frag timer active? */
196 	u_int			numActiveLinks;		/* how many links up */
197 	int			activeLinks[NG_PPP_MAX_LINKS];	/* indicies */
198 	u_int			lastLink;		/* for round robin */
199 	hook_p			hooks[HOOK_INDEX_MAX];	/* non-link hooks */
200 	TAILQ_HEAD(ng_ppp_fraglist, ng_ppp_frag)	/* fragment queue */
201 				frags;
202 	int			qlen;			/* fraq queue length */
203 	struct callout_handle	fragTimer;		/* fraq queue check */
204 };
205 typedef struct ng_ppp_private *priv_p;
206 
207 /* Netgraph node methods */
208 static ng_constructor_t	ng_ppp_constructor;
209 static ng_rcvmsg_t	ng_ppp_rcvmsg;
210 static ng_shutdown_t	ng_ppp_shutdown;
211 static ng_newhook_t	ng_ppp_newhook;
212 static ng_rcvdata_t	ng_ppp_rcvdata;
213 static ng_disconnect_t	ng_ppp_disconnect;
214 
215 /* Helper functions */
216 static int	ng_ppp_input(node_p node, int bypass,
217 			int linkNum, item_p item);
218 static int	ng_ppp_output(node_p node, int bypass, int proto,
219 			int linkNum, item_p item);
220 static int	ng_ppp_mp_input(node_p node, int linkNum, item_p item);
221 static int	ng_ppp_check_packet(node_p node);
222 static void	ng_ppp_get_packet(node_p node, struct mbuf **mp, meta_p *metap);
223 static int	ng_ppp_frag_process(node_p node);
224 static int	ng_ppp_frag_trim(node_p node);
225 static void	ng_ppp_frag_timeout(void *arg);
226 static void	ng_ppp_frag_checkstale(node_p node);
227 static void	ng_ppp_frag_reset(node_p node);
228 static int	ng_ppp_mp_output(node_p node, struct mbuf *m, meta_p meta);
229 static void	ng_ppp_mp_strategy(node_p node, int len, int *distrib);
230 static int	ng_ppp_intcmp(const void *v1, const void *v2);
231 static struct	mbuf *ng_ppp_addproto(struct mbuf *m, int proto, int compOK);
232 static struct	mbuf *ng_ppp_prepend(struct mbuf *m, const void *buf, int len);
233 static int	ng_ppp_config_valid(node_p node,
234 			const struct ng_ppp_node_conf *newConf);
235 static void	ng_ppp_update(node_p node, int newConf);
236 static void	ng_ppp_start_frag_timer(node_p node);
237 static void	ng_ppp_stop_frag_timer(node_p node);
238 
239 /* Parse type for struct ng_ppp_mp_state_type */
240 static const struct ng_parse_fixedarray_info ng_ppp_rseq_array_info = {
241 	&ng_parse_hint32_type,
242 	NG_PPP_MAX_LINKS
243 };
244 static const struct ng_parse_type ng_ppp_rseq_array_type = {
245 	&ng_parse_fixedarray_type,
246 	&ng_ppp_rseq_array_info,
247 };
248 static const struct ng_parse_struct_info ng_ppp_mp_state_type_info
249 	= NG_PPP_MP_STATE_TYPE_INFO(&ng_ppp_rseq_array_type);
250 static const struct ng_parse_type ng_ppp_mp_state_type = {
251 	&ng_parse_struct_type,
252 	&ng_ppp_mp_state_type_info,
253 };
254 
255 /* Parse type for struct ng_ppp_link_conf */
256 static const struct ng_parse_struct_info
257 	ng_ppp_link_type_info = NG_PPP_LINK_TYPE_INFO;
258 static const struct ng_parse_type ng_ppp_link_type = {
259 	&ng_parse_struct_type,
260 	&ng_ppp_link_type_info,
261 };
262 
263 /* Parse type for struct ng_ppp_bund_conf */
264 static const struct ng_parse_struct_info
265 	ng_ppp_bund_type_info = NG_PPP_BUND_TYPE_INFO;
266 static const struct ng_parse_type ng_ppp_bund_type = {
267 	&ng_parse_struct_type,
268 	&ng_ppp_bund_type_info,
269 };
270 
271 /* Parse type for struct ng_ppp_node_conf */
272 static const struct ng_parse_fixedarray_info ng_ppp_array_info = {
273 	&ng_ppp_link_type,
274 	NG_PPP_MAX_LINKS
275 };
276 static const struct ng_parse_type ng_ppp_link_array_type = {
277 	&ng_parse_fixedarray_type,
278 	&ng_ppp_array_info,
279 };
280 static const struct ng_parse_struct_info ng_ppp_conf_type_info
281 	= NG_PPP_CONFIG_TYPE_INFO(&ng_ppp_bund_type, &ng_ppp_link_array_type);
282 static const struct ng_parse_type ng_ppp_conf_type = {
283 	&ng_parse_struct_type,
284 	&ng_ppp_conf_type_info
285 };
286 
287 /* Parse type for struct ng_ppp_link_stat */
288 static const struct ng_parse_struct_info
289 	ng_ppp_stats_type_info = NG_PPP_STATS_TYPE_INFO;
290 static const struct ng_parse_type ng_ppp_stats_type = {
291 	&ng_parse_struct_type,
292 	&ng_ppp_stats_type_info
293 };
294 
295 /* List of commands and how to convert arguments to/from ASCII */
296 static const struct ng_cmdlist ng_ppp_cmds[] = {
297 	{
298 	  NGM_PPP_COOKIE,
299 	  NGM_PPP_SET_CONFIG,
300 	  "setconfig",
301 	  &ng_ppp_conf_type,
302 	  NULL
303 	},
304 	{
305 	  NGM_PPP_COOKIE,
306 	  NGM_PPP_GET_CONFIG,
307 	  "getconfig",
308 	  NULL,
309 	  &ng_ppp_conf_type
310 	},
311 	{
312 	  NGM_PPP_COOKIE,
313 	  NGM_PPP_GET_MP_STATE,
314 	  "getmpstate",
315 	  NULL,
316 	  &ng_ppp_mp_state_type
317 	},
318 	{
319 	  NGM_PPP_COOKIE,
320 	  NGM_PPP_GET_LINK_STATS,
321 	  "getstats",
322 	  &ng_parse_int16_type,
323 	  &ng_ppp_stats_type
324 	},
325 	{
326 	  NGM_PPP_COOKIE,
327 	  NGM_PPP_CLR_LINK_STATS,
328 	  "clrstats",
329 	  &ng_parse_int16_type,
330 	  NULL
331 	},
332 	{
333 	  NGM_PPP_COOKIE,
334 	  NGM_PPP_GETCLR_LINK_STATS,
335 	  "getclrstats",
336 	  &ng_parse_int16_type,
337 	  &ng_ppp_stats_type
338 	},
339 	{ 0 }
340 };
341 
342 /* Node type descriptor */
343 static struct ng_type ng_ppp_typestruct = {
344 	NG_ABI_VERSION,
345 	NG_PPP_NODE_TYPE,
346 	NULL,
347 	ng_ppp_constructor,
348 	ng_ppp_rcvmsg,
349 	ng_ppp_shutdown,
350 	ng_ppp_newhook,
351 	NULL,
352 	NULL,
353 	ng_ppp_rcvdata,
354 	ng_ppp_disconnect,
355 	ng_ppp_cmds
356 };
357 NETGRAPH_INIT(ppp, &ng_ppp_typestruct);
358 
359 static int *compareLatencies;			/* hack for ng_ppp_intcmp() */
360 
361 /* Address and control field header */
362 static const u_char ng_ppp_acf[2] = { 0xff, 0x03 };
363 
364 /* Maximum time we'll let a complete incoming packet sit in the queue */
365 static const struct timeval ng_ppp_max_staleness = { 2, 0 };	/* 2 seconds */
366 
367 #define ERROUT(x)	do { error = (x); goto done; } while (0)
368 
369 /************************************************************************
370 			NETGRAPH NODE STUFF
371  ************************************************************************/
372 
373 /*
374  * Node type constructor
375  */
376 static int
377 ng_ppp_constructor(node_p node)
378 {
379 	priv_p priv;
380 	int i;
381 
382 	/* Allocate private structure */
383 	MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH, M_NOWAIT | M_ZERO);
384 	if (priv == NULL)
385 		return (ENOMEM);
386 
387 	node->private = priv;
388 
389 	/* Initialize state */
390 	TAILQ_INIT(&priv->frags);
391 	for (i = 0; i < NG_PPP_MAX_LINKS; i++)
392 		priv->links[i].seq = MP_NOSEQ;
393 	callout_handle_init(&priv->fragTimer);
394 
395 	/* Done */
396 	return (0);
397 }
398 
399 /*
400  * Give our OK for a hook to be added
401  */
402 static int
403 ng_ppp_newhook(node_p node, hook_p hook, const char *name)
404 {
405 	const priv_p priv = node->private;
406 	int linkNum = -1;
407 	hook_p *hookPtr = NULL;
408 	int hookIndex = -1;
409 
410 	/* Figure out which hook it is */
411 	if (strncmp(name, NG_PPP_HOOK_LINK_PREFIX,	/* a link hook? */
412 	    strlen(NG_PPP_HOOK_LINK_PREFIX)) == 0) {
413 		const char *cp;
414 		char *eptr;
415 
416 		cp = name + strlen(NG_PPP_HOOK_LINK_PREFIX);
417 		if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
418 			return (EINVAL);
419 		linkNum = (int)strtoul(cp, &eptr, 10);
420 		if (*eptr != '\0' || linkNum < 0 || linkNum >= NG_PPP_MAX_LINKS)
421 			return (EINVAL);
422 		hookPtr = &priv->links[linkNum].hook;
423 		hookIndex = ~linkNum;
424 	} else {				/* must be a non-link hook */
425 		int i;
426 
427 		for (i = 0; ng_ppp_hook_names[i] != NULL; i++) {
428 			if (strcmp(name, ng_ppp_hook_names[i]) == 0) {
429 				hookPtr = &priv->hooks[i];
430 				hookIndex = i;
431 				break;
432 			}
433 		}
434 		if (ng_ppp_hook_names[i] == NULL)
435 			return (EINVAL);	/* no such hook */
436 	}
437 
438 	/* See if hook is already connected */
439 	if (*hookPtr != NULL)
440 		return (EISCONN);
441 
442 	/* Disallow more than one link unless multilink is enabled */
443 	if (linkNum != -1 && priv->links[linkNum].conf.enableLink
444 	    && !priv->conf.enableMultilink && priv->numActiveLinks >= 1)
445 		return (ENODEV);
446 
447 	/* OK */
448 	*hookPtr = hook;
449 	HOOK_INDEX(hook) = hookIndex;
450 	ng_ppp_update(node, 0);
451 	return (0);
452 }
453 
454 /*
455  * Receive a control message
456  */
457 static int
458 ng_ppp_rcvmsg(node_p node, item_p item, hook_p lasthook)
459 {
460 	const priv_p priv = node->private;
461 	struct ng_mesg *resp = NULL;
462 	int error = 0;
463 	struct ng_mesg *msg;
464 
465 	NGI_GET_MSG(item, msg);
466 	switch (msg->header.typecookie) {
467 	case NGM_PPP_COOKIE:
468 		switch (msg->header.cmd) {
469 		case NGM_PPP_SET_CONFIG:
470 		    {
471 			struct ng_ppp_node_conf *const conf =
472 			    (struct ng_ppp_node_conf *)msg->data;
473 			int i;
474 
475 			/* Check for invalid or illegal config */
476 			if (msg->header.arglen != sizeof(*conf))
477 				ERROUT(EINVAL);
478 			if (!ng_ppp_config_valid(node, conf))
479 				ERROUT(EINVAL);
480 
481 			/* Copy config */
482 			priv->conf = conf->bund;
483 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
484 				priv->links[i].conf = conf->links[i];
485 			ng_ppp_update(node, 1);
486 			break;
487 		    }
488 		case NGM_PPP_GET_CONFIG:
489 		    {
490 			struct ng_ppp_node_conf *conf;
491 			int i;
492 
493 			NG_MKRESPONSE(resp, msg, sizeof(*conf), M_NOWAIT);
494 			if (resp == NULL)
495 				ERROUT(ENOMEM);
496 			conf = (struct ng_ppp_node_conf *)resp->data;
497 			conf->bund = priv->conf;
498 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
499 				conf->links[i] = priv->links[i].conf;
500 			break;
501 		    }
502 		case NGM_PPP_GET_MP_STATE:
503 		    {
504 			struct ng_ppp_mp_state *info;
505 			int i;
506 
507 			NG_MKRESPONSE(resp, msg, sizeof(*info), M_NOWAIT);
508 			if (resp == NULL)
509 				ERROUT(ENOMEM);
510 			info = (struct ng_ppp_mp_state *)resp->data;
511 			bzero(info, sizeof(*info));
512 			for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
513 				if (priv->links[i].seq != MP_NOSEQ)
514 					info->rseq[i] = priv->links[i].seq;
515 			}
516 			info->mseq = priv->mseq;
517 			info->xseq = priv->xseq;
518 			break;
519 		    }
520 		case NGM_PPP_GET_LINK_STATS:
521 		case NGM_PPP_CLR_LINK_STATS:
522 		case NGM_PPP_GETCLR_LINK_STATS:
523 		    {
524 			struct ng_ppp_link_stat *stats;
525 			u_int16_t linkNum;
526 
527 			if (msg->header.arglen != sizeof(u_int16_t))
528 				ERROUT(EINVAL);
529 			linkNum = *((u_int16_t *) msg->data);
530 			if (linkNum >= NG_PPP_MAX_LINKS
531 			    && linkNum != NG_PPP_BUNDLE_LINKNUM)
532 				ERROUT(EINVAL);
533 			stats = (linkNum == NG_PPP_BUNDLE_LINKNUM) ?
534 			    &priv->bundleStats : &priv->links[linkNum].stats;
535 			if (msg->header.cmd != NGM_PPP_CLR_LINK_STATS) {
536 				NG_MKRESPONSE(resp, msg,
537 				    sizeof(struct ng_ppp_link_stat), M_NOWAIT);
538 				if (resp == NULL)
539 					ERROUT(ENOMEM);
540 				bcopy(stats, resp->data, sizeof(*stats));
541 			}
542 			if (msg->header.cmd != NGM_PPP_GET_LINK_STATS)
543 				bzero(stats, sizeof(*stats));
544 			break;
545 		    }
546 		default:
547 			error = EINVAL;
548 			break;
549 		}
550 		break;
551 	case NGM_VJC_COOKIE:
552 	    {
553 		/*
554 		 * Forward it to the vjc node. leave the
555 		 * old return address alone.
556 		 */
557 		NGI_MSG(item) = msg;	/* put it back in the item */
558 		if (priv->links[HOOK_INDEX_VJC_IP].hook) {
559 			NG_FWD_MSG_HOOK(error, NULL, item,
560 				priv->links[HOOK_INDEX_VJC_IP].hook, NULL);
561 		}
562 		return (error);
563 	    }
564 	default:
565 		error = EINVAL;
566 		break;
567 	}
568 done:
569 	NG_RESPOND_MSG(error, node, item, resp);
570 	NG_FREE_MSG(msg);
571 	return (error);
572 }
573 
574 /*
575  * Receive data on a hook
576  */
577 static int
578 ng_ppp_rcvdata(hook_p hook, item_p item)
579 {
580 	const node_p node = hook->node;
581 	const priv_p priv = node->private;
582 	const int index = HOOK_INDEX(hook);
583 	u_int16_t linkNum = NG_PPP_BUNDLE_LINKNUM;
584 	hook_p outHook = NULL;
585 	int proto = 0, error;
586 	struct mbuf *m;
587 
588 	NGI_GET_M(item, m);
589 	/* Did it come from a link hook? */
590 	if (index < 0) {
591 		struct ng_ppp_link *link;
592 
593 		/* Convert index into a link number */
594 		linkNum = (u_int16_t)~index;
595 		KASSERT(linkNum < NG_PPP_MAX_LINKS,
596 		    ("%s: bogus index 0x%x", __FUNCTION__, index));
597 		link = &priv->links[linkNum];
598 
599 		/* Stats */
600 		link->stats.recvFrames++;
601 		link->stats.recvOctets += m->m_pkthdr.len;
602 
603 		/* Strip address and control fields, if present */
604 		if (m->m_pkthdr.len >= 2) {
605 			if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
606 				NG_FREE_ITEM(item);
607 				return (ENOBUFS);
608 			}
609 			if (bcmp(mtod(m, u_char *), &ng_ppp_acf, 2) == 0)
610 				m_adj(m, 2);
611 		}
612 
613 		/* Dispatch incoming frame (if not enabled, to bypass) */
614 		NGI_M(item) = m; 	/* put changed m back in item */
615 		return ng_ppp_input(node,
616 		    !link->conf.enableLink, linkNum, item);
617 	}
618 
619 	/* Get protocol & check if data allowed from this hook */
620 	NGI_M(item) = m; 	/* put possibly changed m back in item */
621 	switch (index) {
622 
623 	/* Outgoing data */
624 	case HOOK_INDEX_ATALK:
625 		if (!priv->conf.enableAtalk) {
626 			NG_FREE_ITEM(item);
627 			return (ENXIO);
628 		}
629 		proto = PROT_APPLETALK;
630 		break;
631 	case HOOK_INDEX_IPX:
632 		if (!priv->conf.enableIPX) {
633 			NG_FREE_ITEM(item);
634 			return (ENXIO);
635 		}
636 		proto = PROT_IPX;
637 		break;
638 	case HOOK_INDEX_IPV6:
639 		if (!priv->conf.enableIPv6) {
640 			NG_FREE_ITEM(item);
641 			return (ENXIO);
642 		}
643 		proto = PROT_IPV6;
644 		break;
645 	case HOOK_INDEX_INET:
646 	case HOOK_INDEX_VJC_VJIP:
647 		if (!priv->conf.enableIP) {
648 			NG_FREE_ITEM(item);
649 			return (ENXIO);
650 		}
651 		proto = PROT_IP;
652 		break;
653 	case HOOK_INDEX_VJC_COMP:
654 		if (!priv->conf.enableVJCompression) {
655 			NG_FREE_ITEM(item);
656 			return (ENXIO);
657 		}
658 		proto = PROT_VJCOMP;
659 		break;
660 	case HOOK_INDEX_VJC_UNCOMP:
661 		if (!priv->conf.enableVJCompression) {
662 			NG_FREE_ITEM(item);
663 			return (ENXIO);
664 		}
665 		proto = PROT_VJUNCOMP;
666 		break;
667 	case HOOK_INDEX_COMPRESS:
668 		if (!priv->conf.enableCompression) {
669 			NG_FREE_ITEM(item);
670 			return (ENXIO);
671 		}
672 		proto = PROT_COMPD;
673 		break;
674 	case HOOK_INDEX_ENCRYPT:
675 		if (!priv->conf.enableEncryption) {
676 			NG_FREE_ITEM(item);
677 			return (ENXIO);
678 		}
679 		proto = PROT_CRYPTD;
680 		break;
681 	case HOOK_INDEX_BYPASS:
682 		if (m->m_pkthdr.len < 4) {
683 			NG_FREE_ITEM(item);
684 			return (EINVAL);
685 		}
686 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
687 			NGI_M(item) = NULL; /* don't free twice */
688 			NG_FREE_ITEM(item);
689 			return (ENOBUFS);
690 		}
691 		NGI_M(item) = m; /* m may have changed */
692 		linkNum = ntohs(mtod(m, u_int16_t *)[0]);
693 		proto = ntohs(mtod(m, u_int16_t *)[1]);
694 		m_adj(m, 4);
695 		if (linkNum >= NG_PPP_MAX_LINKS
696 		    && linkNum != NG_PPP_BUNDLE_LINKNUM) {
697 			NG_FREE_ITEM(item);
698 			return (EINVAL);
699 		}
700 		break;
701 
702 	/* Incoming data */
703 	case HOOK_INDEX_VJC_IP:
704 		if (!priv->conf.enableIP || !priv->conf.enableVJDecompression) {
705 			NG_FREE_ITEM(item);
706 			return (ENXIO);
707 		}
708 		break;
709 	case HOOK_INDEX_DECOMPRESS:
710 		if (!priv->conf.enableDecompression) {
711 			NG_FREE_ITEM(item);
712 			return (ENXIO);
713 		}
714 		break;
715 	case HOOK_INDEX_DECRYPT:
716 		if (!priv->conf.enableDecryption) {
717 			NG_FREE_ITEM(item);
718 			return (ENXIO);
719 		}
720 		break;
721 	default:
722 		panic("%s: bogus index 0x%x", __FUNCTION__, index);
723 	}
724 
725 	/* Now figure out what to do with the frame */
726 	switch (index) {
727 
728 	/* Outgoing data */
729 	case HOOK_INDEX_INET:
730 		if (priv->conf.enableVJCompression && priv->vjCompHooked) {
731 			outHook = priv->hooks[HOOK_INDEX_VJC_IP];
732 			break;
733 		}
734 		/* FALLTHROUGH */
735 	case HOOK_INDEX_ATALK:
736 	case HOOK_INDEX_IPV6:
737 	case HOOK_INDEX_IPX:
738 	case HOOK_INDEX_VJC_COMP:
739 	case HOOK_INDEX_VJC_UNCOMP:
740 	case HOOK_INDEX_VJC_VJIP:
741 		if (priv->conf.enableCompression
742 		    && priv->hooks[HOOK_INDEX_COMPRESS] != NULL) {
743 			if ((m = ng_ppp_addproto(m, proto, 1)) == NULL) {
744 				NGI_M(item) = NULL;
745 				NG_FREE_ITEM(item);
746 				return (ENOBUFS);
747 			}
748 			NGI_M(item) = m; /* m may have changed */
749 			outHook = priv->hooks[HOOK_INDEX_COMPRESS];
750 			break;
751 		}
752 		/* FALLTHROUGH */
753 	case HOOK_INDEX_COMPRESS:
754 		if (priv->conf.enableEncryption
755 		    && priv->hooks[HOOK_INDEX_ENCRYPT] != NULL) {
756 			if ((m = ng_ppp_addproto(m, proto, 1)) == NULL) {
757 				NGI_M(item) = NULL;
758 				NG_FREE_ITEM(item);
759 				return (ENOBUFS);
760 			}
761 			NGI_M(item) = m; /* m may have changed */
762 			outHook = priv->hooks[HOOK_INDEX_ENCRYPT];
763 			break;
764 		}
765 		/* FALLTHROUGH */
766 	case HOOK_INDEX_ENCRYPT:
767 		return ng_ppp_output(node, 0, proto, NG_PPP_BUNDLE_LINKNUM, item);
768 
769 	case HOOK_INDEX_BYPASS:
770 		return ng_ppp_output(node, 1, proto, linkNum, item);
771 
772 	/* Incoming data */
773 	case HOOK_INDEX_DECRYPT:
774 	case HOOK_INDEX_DECOMPRESS:
775 		return ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item);
776 
777 	case HOOK_INDEX_VJC_IP:
778 		outHook = priv->hooks[HOOK_INDEX_INET];
779 		break;
780 	}
781 
782 	/* Send packet out hook */
783 	NG_FWD_DATA(error, item, outHook);
784 #if 0
785 	/* help archie... what's going on? */
786 	/* Looks like you were acrually USING the stub functions
787 	(now gone again) */
788 		return ng_ppp_rcvdata(outHook, item);
789 #endif
790 	return (error);
791 }
792 
793 /*
794  * Destroy node
795  */
796 static int
797 ng_ppp_shutdown(node_p node)
798 {
799 	const priv_p priv = node->private;
800 
801 	/* Stop fragment queue timer */
802 	ng_ppp_stop_frag_timer(node);
803 
804 	/* Take down netgraph node */
805 	node->flags |= NG_INVALID;
806 	ng_ppp_frag_reset(node);
807 	bzero(priv, sizeof(*priv));
808 	FREE(priv, M_NETGRAPH);
809 	node->private = NULL;
810 	ng_unref(node);		/* let the node escape */
811 	return (0);
812 }
813 
814 /*
815  * Hook disconnection
816  */
817 static int
818 ng_ppp_disconnect(hook_p hook)
819 {
820 	const node_p node = hook->node;
821 	const priv_p priv = node->private;
822 	const int index = HOOK_INDEX(hook);
823 
824 	/* Zero out hook pointer */
825 	if (index < 0)
826 		priv->links[~index].hook = NULL;
827 	else
828 		priv->hooks[index] = NULL;
829 
830 	/* Update derived info (or go away if no hooks left) */
831 	if (node->numhooks > 0) {
832 		ng_ppp_update(node, 0);
833 	} else {
834 		if ((node->flags & NG_INVALID) == 0) {
835 			ng_rmnode_self(node);
836 		}
837 	}
838 	return (0);
839 }
840 
841 /************************************************************************
842 			HELPER STUFF
843  ************************************************************************/
844 
845 /*
846  * Handle an incoming frame.  Extract the PPP protocol number
847  * and dispatch accordingly.
848  */
849 static int
850 ng_ppp_input(node_p node, int bypass, int linkNum, item_p item)
851 {
852 	const priv_p priv = node->private;
853 	hook_p outHook = NULL;
854 	int proto, error;
855 	struct mbuf *m;
856 
857 
858 	NGI_GET_M(item, m);
859 	/* Extract protocol number */
860 	for (proto = 0; !PROT_VALID(proto) && m->m_pkthdr.len > 0; ) {
861 		if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL) {
862 			NG_FREE_ITEM(item);
863 			return (ENOBUFS);
864 		}
865 		proto = (proto << 8) + *mtod(m, u_char *);
866 		m_adj(m, 1);
867 	}
868 	if (!PROT_VALID(proto)) {
869 		if (linkNum == NG_PPP_BUNDLE_LINKNUM)
870 			priv->bundleStats.badProtos++;
871 		else
872 			priv->links[linkNum].stats.badProtos++;
873 		NG_FREE_ITEM(item);
874 		NG_FREE_M(m);
875 		return (EINVAL);
876 	}
877 
878 	/* Bypass frame? */
879 	if (bypass)
880 		goto bypass;
881 
882 	/* Check protocol */
883 	switch (proto) {
884 	case PROT_COMPD:
885 		if (priv->conf.enableDecompression)
886 			outHook = priv->hooks[HOOK_INDEX_DECOMPRESS];
887 		break;
888 	case PROT_CRYPTD:
889 		if (priv->conf.enableDecryption)
890 			outHook = priv->hooks[HOOK_INDEX_DECRYPT];
891 		break;
892 	case PROT_VJCOMP:
893 		if (priv->conf.enableVJDecompression && priv->vjCompHooked)
894 			outHook = priv->hooks[HOOK_INDEX_VJC_COMP];
895 		break;
896 	case PROT_VJUNCOMP:
897 		if (priv->conf.enableVJDecompression && priv->vjCompHooked)
898 			outHook = priv->hooks[HOOK_INDEX_VJC_UNCOMP];
899 		break;
900 	case PROT_MP:
901 		if (priv->conf.enableMultilink
902 		    && linkNum != NG_PPP_BUNDLE_LINKNUM)
903 			return ng_ppp_mp_input(node, linkNum, item);
904 		break;
905 	case PROT_APPLETALK:
906 		if (priv->conf.enableAtalk)
907 			outHook = priv->hooks[HOOK_INDEX_ATALK];
908 		break;
909 	case PROT_IPX:
910 		if (priv->conf.enableIPX)
911 			outHook = priv->hooks[HOOK_INDEX_IPX];
912 		break;
913 	case PROT_IP:
914 		if (priv->conf.enableIP)
915 			outHook = priv->hooks[HOOK_INDEX_INET];
916 		break;
917 	case PROT_IPV6:
918 		if (priv->conf.enableIPv6)
919 			outHook = priv->hooks[HOOK_INDEX_IPV6];
920 		break;
921 	}
922 
923 bypass:
924 	/* For unknown/inactive protocols, forward out the bypass hook */
925 	if (outHook == NULL) {
926 		u_int16_t hdr[2];
927 
928 		hdr[0] = htons(linkNum);
929 		hdr[1] = htons((u_int16_t)proto);
930 		if ((m = ng_ppp_prepend(m, &hdr, 4)) == NULL) {
931 			NG_FREE_ITEM(item);
932 			return (ENOBUFS);
933 		}
934 		outHook = priv->hooks[HOOK_INDEX_BYPASS];
935 	}
936 
937 	/* Forward frame */
938 	NG_FWD_NEW_DATA(error, item, outHook, m);
939 	return (error);
940 }
941 
942 /*
943  * Deliver a frame out a link, either a real one or NG_PPP_BUNDLE_LINKNUM
944  * If the link is not enabled then ENXIO is returned, unless "bypass" is != 0.
945  */
946 static int
947 ng_ppp_output(node_p node, int bypass,
948 	int proto, int linkNum, item_p item)
949 {
950 	const priv_p priv = node->private;
951 	struct ng_ppp_link *link;
952 	int len, error;
953 	struct mbuf *m;
954 
955 	 NGI_GET_M(item, m); 	/* separate them for a while */
956 	/* If not doing MP, map bundle virtual link to (the only) link */
957 	if (linkNum == NG_PPP_BUNDLE_LINKNUM && !priv->conf.enableMultilink)
958 		linkNum = priv->activeLinks[0];
959 
960 	/* Get link pointer (optimization) */
961 	link = (linkNum != NG_PPP_BUNDLE_LINKNUM) ?
962 	    &priv->links[linkNum] : NULL;
963 
964 	/* Check link status (if real) */
965 	if (linkNum != NG_PPP_BUNDLE_LINKNUM) {
966 		if (!bypass && !link->conf.enableLink) {
967 			NG_FREE_M(m);
968 			NG_FREE_ITEM(item);
969 			return (ENXIO);
970 		}
971 		if (link->hook == NULL) {
972 			NG_FREE_M(m);
973 			NG_FREE_ITEM(item);
974 			return (ENETDOWN);
975 		}
976 	}
977 
978 	/* Prepend protocol number, possibly compressed */
979 	if ((m = ng_ppp_addproto(m, proto,
980 	    linkNum == NG_PPP_BUNDLE_LINKNUM
981 	      || link->conf.enableProtoComp)) == NULL) {
982 		NG_FREE_ITEM(item);
983 		return (ENOBUFS);
984 	}
985 
986 	/* Special handling for the MP virtual link */
987 	if (linkNum == NG_PPP_BUNDLE_LINKNUM) {
988 		meta_p meta;
989 
990 		/* strip off and discard the queue item */
991 		NGI_GET_META(item, meta);
992 		NG_FREE_ITEM(item);
993 		return ng_ppp_mp_output(node, m, meta);
994 	}
995 
996 	/* Prepend address and control field (unless compressed) */
997 	if (proto == PROT_LCP || !link->conf.enableACFComp) {
998 		if ((m = ng_ppp_prepend(m, &ng_ppp_acf, 2)) == NULL) {
999 			NG_FREE_ITEM(item);
1000 			return (ENOBUFS);
1001 		}
1002 	}
1003 
1004 	/* Deliver frame */
1005 	len = m->m_pkthdr.len;
1006 	NG_FWD_NEW_DATA(error, item,  link->hook, m);
1007 
1008 	/* Update stats and 'bytes in queue' counter */
1009 	if (error == 0) {
1010 		link->stats.xmitFrames++;
1011 		link->stats.xmitOctets += len;
1012 		link->bytesInQueue += len;
1013 		getmicrouptime(&link->lastWrite);
1014 	}
1015 	return error;
1016 }
1017 
1018 /*
1019  * Handle an incoming multi-link fragment
1020  *
1021  * The fragment reassembly algorithm is somewhat complex. This is mainly
1022  * because we are required not to reorder the reconstructed packets, yet
1023  * fragments are only guaranteed to arrive in order on a per-link basis.
1024  * In other words, when we have a complete packet ready, but the previous
1025  * packet is still incomplete, we have to decide between delivering the
1026  * complete packet and throwing away the incomplete one, or waiting to
1027  * see if the remainder of the incomplete one arrives, at which time we
1028  * can deliver both packets, in order.
1029  *
1030  * This problem is exacerbated by "sequence number slew", which is when
1031  * the sequence numbers coming in from different links are far apart from
1032  * each other. In particular, certain unnamed equipment (*cough* Ascend)
1033  * has been seen to generate sequence number slew of up to 10 on an ISDN
1034  * 2B-channel MP link. There is nothing invalid about sequence number slew
1035  * but it makes the reasssembly process have to work harder.
1036  *
1037  * However, the peer is required to transmit fragments in order on each
1038  * link. That means if we define MSEQ as the minimum over all links of
1039  * the highest sequence number received on that link, then we can always
1040  * give up any hope of receiving a fragment with sequence number < MSEQ in
1041  * the future (all of this using 'wraparound' sequence number space).
1042  * Therefore we can always immediately throw away incomplete packets
1043  * missing fragments with sequence numbers < MSEQ.
1044  *
1045  * Here is an overview of our algorithm:
1046  *
1047  *    o Received fragments are inserted into a queue, for which we
1048  *	maintain these invariants between calls to this function:
1049  *
1050  *	- Fragments are ordered in the queue by sequence number
1051  *	- If a complete packet is at the head of the queue, then
1052  *	  the first fragment in the packet has seq# > MSEQ + 1
1053  *	  (otherwise, we could deliver it immediately)
1054  *	- If any fragments have seq# < MSEQ, then they are necessarily
1055  *	  part of a packet whose missing seq#'s are all > MSEQ (otherwise,
1056  *	  we can throw them away because they'll never be completed)
1057  *	- The queue contains at most MP_MAX_QUEUE_LEN fragments
1058  *
1059  *    o We have a periodic timer that checks the queue for the first
1060  *	complete packet that has been sitting in the queue "too long".
1061  *	When one is detected, all previous (incomplete) fragments are
1062  *	discarded, their missing fragments are declared lost and MSEQ
1063  *	is increased.
1064  *
1065  *    o If we recieve a fragment with seq# < MSEQ, we throw it away
1066  *	because we've already delcared it lost.
1067  *
1068  * This assumes linkNum != NG_PPP_BUNDLE_LINKNUM.
1069  */
1070 static int
1071 ng_ppp_mp_input(node_p node, int linkNum, item_p item)
1072 {
1073 	const priv_p priv = node->private;
1074 	struct ng_ppp_link *const link = &priv->links[linkNum];
1075 	struct ng_ppp_frag frag0, *frag = &frag0;
1076 	struct ng_ppp_frag *qent;
1077 	int i, diff, inserted;
1078 	struct mbuf *m;
1079 	meta_p meta;
1080 
1081 	NGI_GET_M(item, m);
1082 	NGI_GET_META(item, meta);
1083 	NG_FREE_ITEM(item);
1084 	/* Stats */
1085 	priv->bundleStats.recvFrames++;
1086 	priv->bundleStats.recvOctets += m->m_pkthdr.len;
1087 
1088 	/* Extract fragment information from MP header */
1089 	if (priv->conf.recvShortSeq) {
1090 		u_int16_t shdr;
1091 
1092 		if (m->m_pkthdr.len < 2) {
1093 			link->stats.runts++;
1094 			NG_FREE_M(m);
1095 			NG_FREE_META(meta);
1096 			return (EINVAL);
1097 		}
1098 		if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
1099 			NG_FREE_META(meta);
1100 			return (ENOBUFS);
1101 		}
1102 		shdr = ntohs(*mtod(m, u_int16_t *));
1103 		frag->seq = MP_SHORT_EXTEND(shdr);
1104 		frag->first = (shdr & MP_SHORT_FIRST_FLAG) != 0;
1105 		frag->last = (shdr & MP_SHORT_LAST_FLAG) != 0;
1106 		diff = MP_SHORT_SEQ_DIFF(frag->seq, priv->mseq);
1107 		m_adj(m, 2);
1108 	} else {
1109 		u_int32_t lhdr;
1110 
1111 		if (m->m_pkthdr.len < 4) {
1112 			link->stats.runts++;
1113 			NG_FREE_M(m);
1114 			NG_FREE_META(meta);
1115 			return (EINVAL);
1116 		}
1117 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
1118 			NG_FREE_META(meta);
1119 			return (ENOBUFS);
1120 		}
1121 		lhdr = ntohl(*mtod(m, u_int32_t *));
1122 		frag->seq = MP_LONG_EXTEND(lhdr);
1123 		frag->first = (lhdr & MP_LONG_FIRST_FLAG) != 0;
1124 		frag->last = (lhdr & MP_LONG_LAST_FLAG) != 0;
1125 		diff = MP_LONG_SEQ_DIFF(frag->seq, priv->mseq);
1126 		m_adj(m, 4);
1127 	}
1128 	frag->data = m;
1129 	frag->meta = meta;
1130 	getmicrouptime(&frag->timestamp);
1131 
1132 	/* If sequence number is < MSEQ, we've already declared this
1133 	   fragment as lost, so we have no choice now but to drop it */
1134 	if (diff < 0) {
1135 		link->stats.dropFragments++;
1136 		NG_FREE_M(m);
1137 		NG_FREE_META(meta);
1138 		return (0);
1139 	}
1140 
1141 	/* Update highest received sequence number on this link and MSEQ */
1142 	priv->mseq = link->seq = frag->seq;
1143 	for (i = 0; i < priv->numActiveLinks; i++) {
1144 		struct ng_ppp_link *const alink =
1145 		    &priv->links[priv->activeLinks[i]];
1146 
1147 		if (MP_RECV_SEQ_DIFF(priv, alink->seq, priv->mseq) < 0)
1148 			priv->mseq = alink->seq;
1149 	}
1150 
1151 	/* Allocate a new frag struct for the queue */
1152 	MALLOC(frag, struct ng_ppp_frag *, sizeof(*frag), M_NETGRAPH, M_NOWAIT);
1153 	if (frag == NULL) {
1154 		NG_FREE_M(m);
1155 		NG_FREE_META(meta);
1156 		ng_ppp_frag_process(node);
1157 		return (ENOMEM);
1158 	}
1159 	*frag = frag0;
1160 
1161 	/* Add fragment to queue, which is sorted by sequence number */
1162 	inserted = 0;
1163 	TAILQ_FOREACH_REVERSE(qent, &priv->frags, ng_ppp_fraglist, f_qent) {
1164 		diff = MP_RECV_SEQ_DIFF(priv, frag->seq, qent->seq);
1165 		if (diff > 0) {
1166 			TAILQ_INSERT_AFTER(&priv->frags, qent, frag, f_qent);
1167 			inserted = 1;
1168 			break;
1169 		} else if (diff == 0) {	     /* should never happen! */
1170 			link->stats.dupFragments++;
1171 			NG_FREE_M(frag->data);
1172 			NG_FREE_META(frag->meta);
1173 			FREE(frag, M_NETGRAPH);
1174 			return (EINVAL);
1175 		}
1176 	}
1177 	if (!inserted)
1178 		TAILQ_INSERT_HEAD(&priv->frags, frag, f_qent);
1179 	priv->qlen++;
1180 
1181 	/* Process the queue */
1182 	return ng_ppp_frag_process(node);
1183 }
1184 
1185 /*
1186  * Examine our list of fragments, and determine if there is a
1187  * complete and deliverable packet at the head of the list.
1188  * Return 1 if so, zero otherwise.
1189  */
1190 static int
1191 ng_ppp_check_packet(node_p node)
1192 {
1193 	const priv_p priv = node->private;
1194 	struct ng_ppp_frag *qent, *qnext;
1195 
1196 	/* Check for empty queue */
1197 	if (TAILQ_EMPTY(&priv->frags))
1198 		return (0);
1199 
1200 	/* Check first fragment is the start of a deliverable packet */
1201 	qent = TAILQ_FIRST(&priv->frags);
1202 	if (!qent->first || MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) > 1)
1203 		return (0);
1204 
1205 	/* Check that all the fragments are there */
1206 	while (!qent->last) {
1207 		qnext = TAILQ_NEXT(qent, f_qent);
1208 		if (qnext == NULL)	/* end of queue */
1209 			return (0);
1210 		if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq))
1211 			return (0);
1212 		qent = qnext;
1213 	}
1214 
1215 	/* Got one */
1216 	return (1);
1217 }
1218 
1219 /*
1220  * Pull a completed packet off the head of the incoming fragment queue.
1221  * This assumes there is a completed packet there to pull off.
1222  */
1223 static void
1224 ng_ppp_get_packet(node_p node, struct mbuf **mp, meta_p *metap)
1225 {
1226 	const priv_p priv = node->private;
1227 	struct ng_ppp_frag *qent, *qnext;
1228 	struct mbuf *m = NULL, *tail;
1229 
1230 	qent = TAILQ_FIRST(&priv->frags);
1231 	KASSERT(!TAILQ_EMPTY(&priv->frags) && qent->first,
1232 	    ("%s: no packet", __FUNCTION__));
1233 	for (tail = NULL; qent != NULL; qent = qnext) {
1234 		qnext = TAILQ_NEXT(qent, f_qent);
1235 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1236 		    ("%s: empty q", __FUNCTION__));
1237 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1238 		if (tail == NULL) {
1239 			tail = m = qent->data;
1240 			*metap = qent->meta;	/* inherit first frag's meta */
1241 		} else {
1242 			m->m_pkthdr.len += qent->data->m_pkthdr.len;
1243 			tail->m_next = qent->data;
1244 			NG_FREE_META(qent->meta); /* drop other frags' metas */
1245 		}
1246 		while (tail->m_next != NULL)
1247 			tail = tail->m_next;
1248 		if (qent->last)
1249 			qnext = NULL;
1250 		FREE(qent, M_NETGRAPH);
1251 		priv->qlen--;
1252 	}
1253 	*mp = m;
1254 }
1255 
1256 /*
1257  * Trim fragments from the queue whose packets can never be completed.
1258  * This assumes a complete packet is NOT at the beginning of the queue.
1259  * Returns 1 if fragments were removed, zero otherwise.
1260  */
1261 static int
1262 ng_ppp_frag_trim(node_p node)
1263 {
1264 	const priv_p priv = node->private;
1265 	struct ng_ppp_frag *qent, *qnext = NULL;
1266 	int removed = 0;
1267 
1268 	/* Scan for "dead" fragments and remove them */
1269 	while (1) {
1270 		int dead = 0;
1271 
1272 		/* If queue is empty, we're done */
1273 		if (TAILQ_EMPTY(&priv->frags))
1274 			break;
1275 
1276 		/* Determine whether first fragment can ever be completed */
1277 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1278 			if (MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) >= 0)
1279 				break;
1280 			qnext = TAILQ_NEXT(qent, f_qent);
1281 			KASSERT(qnext != NULL,
1282 			    ("%s: last frag < MSEQ?", __FUNCTION__));
1283 			if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq)
1284 			    || qent->last || qnext->first) {
1285 				dead = 1;
1286 				break;
1287 			}
1288 		}
1289 		if (!dead)
1290 			break;
1291 
1292 		/* Remove fragment and all others in the same packet */
1293 		while ((qent = TAILQ_FIRST(&priv->frags)) != qnext) {
1294 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1295 			    ("%s: empty q", __FUNCTION__));
1296 			priv->bundleStats.dropFragments++;
1297 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1298 			NG_FREE_M(qent->data);
1299 			NG_FREE_META(qent->meta);
1300 			FREE(qent, M_NETGRAPH);
1301 			priv->qlen--;
1302 			removed = 1;
1303 		}
1304 	}
1305 	return (removed);
1306 }
1307 
1308 /*
1309  * Run the queue, restoring the queue invariants
1310  */
1311 static int
1312 ng_ppp_frag_process(node_p node)
1313 {
1314 	const priv_p priv = node->private;
1315 	struct mbuf *m;
1316 	meta_p meta;
1317 	item_p item;
1318 
1319 	/* Deliver any deliverable packets */
1320 	while (ng_ppp_check_packet(node)) {
1321 		ng_ppp_get_packet(node, &m, &meta);
1322 		item = ng_package_data(m, meta);
1323 		ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item);
1324 	}
1325 
1326 	/* Delete dead fragments and try again */
1327 	if (ng_ppp_frag_trim(node)) {
1328 		while (ng_ppp_check_packet(node)) {
1329 			ng_ppp_get_packet(node, &m, &meta);
1330 			item = ng_package_data(m, meta);
1331 			ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item);
1332 		}
1333 	}
1334 
1335 	/* Check for stale fragments while we're here */
1336 	ng_ppp_frag_checkstale(node);
1337 
1338 	/* Check queue length */
1339 	if (priv->qlen > MP_MAX_QUEUE_LEN) {
1340 		struct ng_ppp_frag *qent;
1341 		int i;
1342 
1343 		/* Get oldest fragment */
1344 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1345 		    ("%s: empty q", __FUNCTION__));
1346 		qent = TAILQ_FIRST(&priv->frags);
1347 
1348 		/* Bump MSEQ if necessary */
1349 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, qent->seq) < 0) {
1350 			priv->mseq = qent->seq;
1351 			for (i = 0; i < priv->numActiveLinks; i++) {
1352 				struct ng_ppp_link *const alink =
1353 				    &priv->links[priv->activeLinks[i]];
1354 
1355 				if (MP_RECV_SEQ_DIFF(priv,
1356 				    alink->seq, priv->mseq) < 0)
1357 					alink->seq = priv->mseq;
1358 			}
1359 		}
1360 
1361 		/* Drop it */
1362 		priv->bundleStats.dropFragments++;
1363 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1364 		NG_FREE_M(qent->data);
1365 		NG_FREE_META(qent->meta);
1366 		FREE(qent, M_NETGRAPH);
1367 		priv->qlen--;
1368 
1369 		/* Process queue again */
1370 		return ng_ppp_frag_process(node);
1371 	}
1372 
1373 	/* Done */
1374 	return (0);
1375 }
1376 
1377 /*
1378  * Check for 'stale' completed packets that need to be delivered
1379  *
1380  * If a link goes down or has a temporary failure, MSEQ can get
1381  * "stuck", because no new incoming fragments appear on that link.
1382  * This can cause completed packets to never get delivered if
1383  * their sequence numbers are all > MSEQ + 1.
1384  *
1385  * This routine checks how long all of the completed packets have
1386  * been sitting in the queue, and if too long, removes fragments
1387  * from the queue and increments MSEQ to allow them to be delivered.
1388  */
1389 static void
1390 ng_ppp_frag_checkstale(node_p node)
1391 {
1392 	const priv_p priv = node->private;
1393 	struct ng_ppp_frag *qent, *beg, *end;
1394 	struct timeval now, age;
1395 	struct mbuf *m;
1396 	meta_p meta;
1397 	int i, seq;
1398 	item_p item;
1399 
1400 	now.tv_sec = 0;			/* uninitialized state */
1401 	while (1) {
1402 
1403 		/* If queue is empty, we're done */
1404 		if (TAILQ_EMPTY(&priv->frags))
1405 			break;
1406 
1407 		/* Find the first complete packet in the queue */
1408 		beg = end = NULL;
1409 		seq = TAILQ_FIRST(&priv->frags)->seq;
1410 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1411 			if (qent->first)
1412 				beg = qent;
1413 			else if (qent->seq != seq)
1414 				beg = NULL;
1415 			if (beg != NULL && qent->last) {
1416 				end = qent;
1417 				break;
1418 			}
1419 			seq = MP_NEXT_RECV_SEQ(priv, seq);
1420 		}
1421 
1422 		/* If none found, exit */
1423 		if (end == NULL)
1424 			break;
1425 
1426 		/* Get current time (we assume we've been up for >= 1 second) */
1427 		if (now.tv_sec == 0)
1428 			getmicrouptime(&now);
1429 
1430 		/* Check if packet has been queued too long */
1431 		age = now;
1432 		timevalsub(&age, &beg->timestamp);
1433 		if (timevalcmp(&age, &ng_ppp_max_staleness, < ))
1434 			break;
1435 
1436 		/* Throw away junk fragments in front of the completed packet */
1437 		while ((qent = TAILQ_FIRST(&priv->frags)) != beg) {
1438 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1439 			    ("%s: empty q", __FUNCTION__));
1440 			priv->bundleStats.dropFragments++;
1441 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1442 			NG_FREE_M(qent->data);
1443 			NG_FREE_META(qent->meta);
1444 			FREE(qent, M_NETGRAPH);
1445 			priv->qlen--;
1446 		}
1447 
1448 		/* Extract completed packet */
1449 		ng_ppp_get_packet(node, &m, &meta);
1450 
1451 		/* Bump MSEQ if necessary */
1452 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, end->seq) < 0) {
1453 			priv->mseq = end->seq;
1454 			for (i = 0; i < priv->numActiveLinks; i++) {
1455 				struct ng_ppp_link *const alink =
1456 				    &priv->links[priv->activeLinks[i]];
1457 
1458 				if (MP_RECV_SEQ_DIFF(priv,
1459 				    alink->seq, priv->mseq) < 0)
1460 					alink->seq = priv->mseq;
1461 			}
1462 		}
1463 
1464 		/* Deliver packet */
1465 		item = ng_package_data(m, meta);
1466 		ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item);
1467 	}
1468 }
1469 
1470 /*
1471  * Periodically call ng_ppp_frag_checkstale()
1472  */
1473 static void
1474 ng_ppp_frag_timeout(void *arg)
1475 {
1476 	const node_p node = arg;
1477 	const priv_p priv = node->private;
1478 	int s = splnet();
1479 
1480 	/* Handle the race where shutdown happens just before splnet() above */
1481 	if ((node->flags & NG_INVALID) != 0) {
1482 		ng_unref(node);
1483 		splx(s);
1484 		return;
1485 	}
1486 
1487 	/* Reset timer state after timeout */
1488 	KASSERT(priv->timerActive, ("%s: !timerActive", __FUNCTION__));
1489 	priv->timerActive = 0;
1490 	KASSERT(node->refs > 1, ("%s: refs=%d", __FUNCTION__, node->refs));
1491 	ng_unref(node);
1492 
1493 	/* Start timer again */
1494 	ng_ppp_start_frag_timer(node);
1495 
1496 	/* Scan the fragment queue */
1497 	ng_ppp_frag_checkstale(node);
1498 	splx(s);
1499 }
1500 
1501 /*
1502  * Deliver a frame out on the bundle, i.e., figure out how to fragment
1503  * the frame across the individual PPP links and do so.
1504  */
1505 static int
1506 ng_ppp_mp_output(node_p node, struct mbuf *m, meta_p meta)
1507 {
1508 	const priv_p priv = node->private;
1509 	int distrib[NG_PPP_MAX_LINKS];
1510 	int firstFragment;
1511 	int activeLinkNum;
1512 	item_p item;
1513 
1514 	/* At least one link must be active */
1515 	if (priv->numActiveLinks == 0) {
1516 		NG_FREE_M(m);
1517 		NG_FREE_META(meta);
1518 		return (ENETDOWN);
1519 	}
1520 
1521 	/* Round-robin strategy */
1522 	if (priv->conf.enableRoundRobin || m->m_pkthdr.len < MP_MIN_FRAG_LEN) {
1523 		activeLinkNum = priv->lastLink++ % priv->numActiveLinks;
1524 		bzero(&distrib, priv->numActiveLinks * sizeof(distrib[0]));
1525 		distrib[activeLinkNum] = m->m_pkthdr.len;
1526 		goto deliver;
1527 	}
1528 
1529 	/* Strategy when all links are equivalent (optimize the common case) */
1530 	if (priv->allLinksEqual) {
1531 		const int fraction = m->m_pkthdr.len / priv->numActiveLinks;
1532 		int i, remain;
1533 
1534 		for (i = 0; i < priv->numActiveLinks; i++)
1535 			distrib[priv->lastLink++ % priv->numActiveLinks]
1536 			    = fraction;
1537 		remain = m->m_pkthdr.len - (fraction * priv->numActiveLinks);
1538 		while (remain > 0) {
1539 			distrib[priv->lastLink++ % priv->numActiveLinks]++;
1540 			remain--;
1541 		}
1542 		goto deliver;
1543 	}
1544 
1545 	/* Strategy when all links are not equivalent */
1546 	ng_ppp_mp_strategy(node, m->m_pkthdr.len, distrib);
1547 
1548 deliver:
1549 	/* Update stats */
1550 	priv->bundleStats.xmitFrames++;
1551 	priv->bundleStats.xmitOctets += m->m_pkthdr.len;
1552 
1553 	/* Send alloted portions of frame out on the link(s) */
1554 	for (firstFragment = 1, activeLinkNum = priv->numActiveLinks - 1;
1555 	    activeLinkNum >= 0; activeLinkNum--) {
1556 		const int linkNum = priv->activeLinks[activeLinkNum];
1557 		struct ng_ppp_link *const link = &priv->links[linkNum];
1558 
1559 		/* Deliver fragment(s) out the next link */
1560 		for ( ; distrib[activeLinkNum] > 0; firstFragment = 0) {
1561 			int len, lastFragment, error;
1562 			struct mbuf *m2;
1563 			meta_p meta2;
1564 
1565 			/* Calculate fragment length; don't exceed link MTU */
1566 			len = distrib[activeLinkNum];
1567 			if (len > link->conf.mru)
1568 				len = link->conf.mru;
1569 			distrib[activeLinkNum] -= len;
1570 			lastFragment = (len == m->m_pkthdr.len);
1571 
1572 			/* Split off next fragment as "m2" */
1573 			m2 = m;
1574 			if (!lastFragment) {
1575 				struct mbuf *n = m_split(m, len, M_NOWAIT);
1576 
1577 				if (n == NULL) {
1578 					NG_FREE_M(m);
1579 					NG_FREE_META(meta);
1580 					return (ENOMEM);
1581 				}
1582 				m = n;
1583 			}
1584 
1585 			/* Prepend MP header */
1586 			if (priv->conf.xmitShortSeq) {
1587 				u_int16_t shdr;
1588 
1589 				shdr = priv->xseq;
1590 				priv->xseq =
1591 				    (priv->xseq + 1) & MP_SHORT_SEQ_MASK;
1592 				if (firstFragment)
1593 					shdr |= MP_SHORT_FIRST_FLAG;
1594 				if (lastFragment)
1595 					shdr |= MP_SHORT_LAST_FLAG;
1596 				shdr = htons(shdr);
1597 				m2 = ng_ppp_prepend(m2, &shdr, 2);
1598 			} else {
1599 				u_int32_t lhdr;
1600 
1601 				lhdr = priv->xseq;
1602 				priv->xseq =
1603 				    (priv->xseq + 1) & MP_LONG_SEQ_MASK;
1604 				if (firstFragment)
1605 					lhdr |= MP_LONG_FIRST_FLAG;
1606 				if (lastFragment)
1607 					lhdr |= MP_LONG_LAST_FLAG;
1608 				lhdr = htonl(lhdr);
1609 				m2 = ng_ppp_prepend(m2, &lhdr, 4);
1610 			}
1611 			if (m2 == NULL) {
1612 				if (!lastFragment)
1613 					m_freem(m);
1614 				NG_FREE_META(meta);
1615 				return (ENOBUFS);
1616 			}
1617 
1618 			/* Copy the meta information, if any */
1619 			meta2 = lastFragment ? meta : ng_copy_meta(meta);
1620 
1621 			/* Send fragment */
1622 			item = ng_package_data(m2, meta2);
1623 			error = ng_ppp_output(node, 0, PROT_MP, linkNum, item);
1624 			if (error != 0) {
1625 				if (!lastFragment) {
1626 					NG_FREE_M(m);
1627 					NG_FREE_META(meta);
1628 				}
1629 				return (error);
1630 			}
1631 		}
1632 	}
1633 
1634 	/* Done */
1635 	return (0);
1636 }
1637 
1638 /*
1639  * Computing the optimal fragmentation
1640  * -----------------------------------
1641  *
1642  * This routine tries to compute the optimal fragmentation pattern based
1643  * on each link's latency, bandwidth, and calculated additional latency.
1644  * The latter quantity is the additional latency caused by previously
1645  * written data that has not been transmitted yet.
1646  *
1647  * This algorithm is only useful when not all of the links have the
1648  * same latency and bandwidth values.
1649  *
1650  * The essential idea is to make the last bit of each fragment of the
1651  * frame arrive at the opposite end at the exact same time. This greedy
1652  * algorithm is optimal, in that no other scheduling could result in any
1653  * packet arriving any sooner unless packets are delivered out of order.
1654  *
1655  * Suppose link i has bandwidth b_i (in tens of bytes per milisecond) and
1656  * latency l_i (in miliseconds). Consider the function function f_i(t)
1657  * which is equal to the number of bytes that will have arrived at
1658  * the peer after t miliseconds if we start writing continuously at
1659  * time t = 0. Then f_i(t) = b_i * (t - l_i) = ((b_i * t) - (l_i * b_i).
1660  * That is, f_i(t) is a line with slope b_i and y-intersect -(l_i * b_i).
1661  * Note that the y-intersect is always <= zero because latency can't be
1662  * negative.  Note also that really the function is f_i(t) except when
1663  * f_i(t) is negative, in which case the function is zero.  To take
1664  * care of this, let Q_i(t) = { if (f_i(t) > 0) return 1; else return 0; }.
1665  * So the actual number of bytes that will have arrived at the peer after
1666  * t miliseconds is f_i(t) * Q_i(t).
1667  *
1668  * At any given time, each link has some additional latency a_i >= 0
1669  * due to previously written fragment(s) which are still in the queue.
1670  * This value is easily computed from the time since last transmission,
1671  * the previous latency value, the number of bytes written, and the
1672  * link's bandwidth.
1673  *
1674  * Assume that l_i includes any a_i already, and that the links are
1675  * sorted by latency, so that l_i <= l_{i+1}.
1676  *
1677  * Let N be the total number of bytes in the current frame we are sending.
1678  *
1679  * Suppose we were to start writing bytes at time t = 0 on all links
1680  * simultaneously, which is the most we can possibly do.  Then let
1681  * F(t) be equal to the total number of bytes received by the peer
1682  * after t miliseconds. Then F(t) = Sum_i (f_i(t) * Q_i(t)).
1683  *
1684  * Our goal is simply this: fragment the frame across the links such
1685  * that the peer is able to reconstruct the completed frame as soon as
1686  * possible, i.e., at the least possible value of t. Call this value t_0.
1687  *
1688  * Then it follows that F(t_0) = N. Our strategy is first to find the value
1689  * of t_0, and then deduce how many bytes to write to each link.
1690  *
1691  * Rewriting F(t_0):
1692  *
1693  *   t_0 = ( N + Sum_i ( l_i * b_i * Q_i(t_0) ) ) / Sum_i ( b_i * Q_i(t_0) )
1694  *
1695  * Now, we note that Q_i(t) is constant for l_i <= t <= l_{i+1}. t_0 will
1696  * lie in one of these ranges.  To find it, we just need to find the i such
1697  * that F(l_i) <= N <= F(l_{i+1}).  Then we compute all the constant values
1698  * for Q_i() in this range, plug in the remaining values, solving for t_0.
1699  *
1700  * Once t_0 is known, then the number of bytes to send on link i is
1701  * just f_i(t_0) * Q_i(t_0).
1702  *
1703  * In other words, we start allocating bytes to the links one at a time.
1704  * We keep adding links until the frame is completely sent.  Some links
1705  * may not get any bytes because their latency is too high.
1706  *
1707  * Is all this work really worth the trouble?  Depends on the situation.
1708  * The bigger the ratio of computer speed to link speed, and the more
1709  * important total bundle latency is (e.g., for interactive response time),
1710  * the more it's worth it.  There is however the cost of calling this
1711  * function for every frame.  The running time is O(n^2) where n is the
1712  * number of links that receive a non-zero number of bytes.
1713  *
1714  * Since latency is measured in miliseconds, the "resolution" of this
1715  * algorithm is one milisecond.
1716  *
1717  * To avoid this algorithm altogether, configure all links to have the
1718  * same latency and bandwidth.
1719  */
1720 static void
1721 ng_ppp_mp_strategy(node_p node, int len, int *distrib)
1722 {
1723 	const priv_p priv = node->private;
1724 	int latency[NG_PPP_MAX_LINKS];
1725 	int sortByLatency[NG_PPP_MAX_LINKS];
1726 	int activeLinkNum;
1727 	int t0, total, topSum, botSum;
1728 	struct timeval now;
1729 	int i, numFragments;
1730 
1731 	/* If only one link, this gets real easy */
1732 	if (priv->numActiveLinks == 1) {
1733 		distrib[0] = len;
1734 		return;
1735 	}
1736 
1737 	/* Get current time */
1738 	getmicrouptime(&now);
1739 
1740 	/* Compute latencies for each link at this point in time */
1741 	for (activeLinkNum = 0;
1742 	    activeLinkNum < priv->numActiveLinks; activeLinkNum++) {
1743 		struct ng_ppp_link *alink;
1744 		struct timeval diff;
1745 		int xmitBytes;
1746 
1747 		/* Start with base latency value */
1748 		alink = &priv->links[priv->activeLinks[activeLinkNum]];
1749 		latency[activeLinkNum] = alink->conf.latency;
1750 		sortByLatency[activeLinkNum] = activeLinkNum;	/* see below */
1751 
1752 		/* Any additional latency? */
1753 		if (alink->bytesInQueue == 0)
1754 			continue;
1755 
1756 		/* Compute time delta since last write */
1757 		diff = now;
1758 		timevalsub(&diff, &alink->lastWrite);
1759 		if (now.tv_sec < 0 || diff.tv_sec >= 10) {	/* sanity */
1760 			alink->bytesInQueue = 0;
1761 			continue;
1762 		}
1763 
1764 		/* How many bytes could have transmitted since last write? */
1765 		xmitBytes = (alink->conf.bandwidth * diff.tv_sec)
1766 		    + (alink->conf.bandwidth * (diff.tv_usec / 1000)) / 100;
1767 		alink->bytesInQueue -= xmitBytes;
1768 		if (alink->bytesInQueue < 0)
1769 			alink->bytesInQueue = 0;
1770 		else
1771 			latency[activeLinkNum] +=
1772 			    (100 * alink->bytesInQueue) / alink->conf.bandwidth;
1773 	}
1774 
1775 	/* Sort active links by latency */
1776 	compareLatencies = latency;
1777 	qsort(sortByLatency,
1778 	    priv->numActiveLinks, sizeof(*sortByLatency), ng_ppp_intcmp);
1779 	compareLatencies = NULL;
1780 
1781 	/* Find the interval we need (add links in sortByLatency[] order) */
1782 	for (numFragments = 1;
1783 	    numFragments < priv->numActiveLinks; numFragments++) {
1784 		for (total = i = 0; i < numFragments; i++) {
1785 			int flowTime;
1786 
1787 			flowTime = latency[sortByLatency[numFragments]]
1788 			    - latency[sortByLatency[i]];
1789 			total += ((flowTime * priv->links[
1790 			    priv->activeLinks[sortByLatency[i]]].conf.bandwidth)
1791 			    	+ 99) / 100;
1792 		}
1793 		if (total >= len)
1794 			break;
1795 	}
1796 
1797 	/* Solve for t_0 in that interval */
1798 	for (topSum = botSum = i = 0; i < numFragments; i++) {
1799 		int bw = priv->links[
1800 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1801 
1802 		topSum += latency[sortByLatency[i]] * bw;	/* / 100 */
1803 		botSum += bw;					/* / 100 */
1804 	}
1805 	t0 = ((len * 100) + topSum + botSum / 2) / botSum;
1806 
1807 	/* Compute f_i(t_0) all i */
1808 	bzero(distrib, priv->numActiveLinks * sizeof(*distrib));
1809 	for (total = i = 0; i < numFragments; i++) {
1810 		int bw = priv->links[
1811 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1812 
1813 		distrib[sortByLatency[i]] =
1814 		    (bw * (t0 - latency[sortByLatency[i]]) + 50) / 100;
1815 		total += distrib[sortByLatency[i]];
1816 	}
1817 
1818 	/* Deal with any rounding error */
1819 	if (total < len) {
1820 		struct ng_ppp_link *fastLink =
1821 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1822 		int fast = 0;
1823 
1824 		/* Find the fastest link */
1825 		for (i = 1; i < numFragments; i++) {
1826 			struct ng_ppp_link *const link =
1827 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1828 
1829 			if (link->conf.bandwidth > fastLink->conf.bandwidth) {
1830 				fast = i;
1831 				fastLink = link;
1832 			}
1833 		}
1834 		distrib[sortByLatency[fast]] += len - total;
1835 	} else while (total > len) {
1836 		struct ng_ppp_link *slowLink =
1837 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1838 		int delta, slow = 0;
1839 
1840 		/* Find the slowest link that still has bytes to remove */
1841 		for (i = 1; i < numFragments; i++) {
1842 			struct ng_ppp_link *const link =
1843 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1844 
1845 			if (distrib[sortByLatency[slow]] == 0
1846 			  || (distrib[sortByLatency[i]] > 0
1847 			    && link->conf.bandwidth <
1848 			      slowLink->conf.bandwidth)) {
1849 				slow = i;
1850 				slowLink = link;
1851 			}
1852 		}
1853 		delta = total - len;
1854 		if (delta > distrib[sortByLatency[slow]])
1855 			delta = distrib[sortByLatency[slow]];
1856 		distrib[sortByLatency[slow]] -= delta;
1857 		total -= delta;
1858 	}
1859 }
1860 
1861 /*
1862  * Compare two integers
1863  */
1864 static int
1865 ng_ppp_intcmp(const void *v1, const void *v2)
1866 {
1867 	const int index1 = *((const int *) v1);
1868 	const int index2 = *((const int *) v2);
1869 
1870 	return compareLatencies[index1] - compareLatencies[index2];
1871 }
1872 
1873 /*
1874  * Prepend a possibly compressed PPP protocol number in front of a frame
1875  */
1876 static struct mbuf *
1877 ng_ppp_addproto(struct mbuf *m, int proto, int compOK)
1878 {
1879 	if (compOK && PROT_COMPRESSABLE(proto)) {
1880 		u_char pbyte = (u_char)proto;
1881 
1882 		return ng_ppp_prepend(m, &pbyte, 1);
1883 	} else {
1884 		u_int16_t pword = htons((u_int16_t)proto);
1885 
1886 		return ng_ppp_prepend(m, &pword, 2);
1887 	}
1888 }
1889 
1890 /*
1891  * Prepend some bytes to an mbuf
1892  */
1893 static struct mbuf *
1894 ng_ppp_prepend(struct mbuf *m, const void *buf, int len)
1895 {
1896 	M_PREPEND(m, len, M_NOWAIT);
1897 	if (m == NULL || (m->m_len < len && (m = m_pullup(m, len)) == NULL))
1898 		return (NULL);
1899 	bcopy(buf, mtod(m, u_char *), len);
1900 	return (m);
1901 }
1902 
1903 /*
1904  * Update private information that is derived from other private information
1905  */
1906 static void
1907 ng_ppp_update(node_p node, int newConf)
1908 {
1909 	const priv_p priv = node->private;
1910 	int i;
1911 
1912 	/* Update active status for VJ Compression */
1913 	priv->vjCompHooked = priv->hooks[HOOK_INDEX_VJC_IP] != NULL
1914 	    && priv->hooks[HOOK_INDEX_VJC_COMP] != NULL
1915 	    && priv->hooks[HOOK_INDEX_VJC_UNCOMP] != NULL
1916 	    && priv->hooks[HOOK_INDEX_VJC_VJIP] != NULL;
1917 
1918 	/* Increase latency for each link an amount equal to one MP header */
1919 	if (newConf) {
1920 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1921 			int hdrBytes;
1922 
1923 			hdrBytes = (priv->links[i].conf.enableACFComp ? 0 : 2)
1924 			    + (priv->links[i].conf.enableProtoComp ? 1 : 2)
1925 			    + (priv->conf.xmitShortSeq ? 2 : 4);
1926 			priv->links[i].conf.latency +=
1927 			    ((hdrBytes * priv->links[i].conf.bandwidth) + 50)
1928 				/ 100;
1929 		}
1930 	}
1931 
1932 	/* Update list of active links */
1933 	bzero(&priv->activeLinks, sizeof(priv->activeLinks));
1934 	priv->numActiveLinks = 0;
1935 	priv->allLinksEqual = 1;
1936 	for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1937 		struct ng_ppp_link *const link = &priv->links[i];
1938 
1939 		/* Is link active? */
1940 		if (link->conf.enableLink && link->hook != NULL) {
1941 			struct ng_ppp_link *link0;
1942 
1943 			/* Add link to list of active links */
1944 			priv->activeLinks[priv->numActiveLinks++] = i;
1945 			link0 = &priv->links[priv->activeLinks[0]];
1946 
1947 			/* Determine if all links are still equal */
1948 			if (link->conf.latency != link0->conf.latency
1949 			  || link->conf.bandwidth != link0->conf.bandwidth)
1950 				priv->allLinksEqual = 0;
1951 
1952 			/* Initialize rec'd sequence number */
1953 			if (link->seq == MP_NOSEQ) {
1954 				link->seq = (link == link0) ?
1955 				    MP_INITIAL_SEQ : link0->seq;
1956 			}
1957 		} else
1958 			link->seq = MP_NOSEQ;
1959 	}
1960 
1961 	/* Update MP state as multi-link is active or not */
1962 	if (priv->conf.enableMultilink && priv->numActiveLinks > 0)
1963 		ng_ppp_start_frag_timer(node);
1964 	else {
1965 		ng_ppp_stop_frag_timer(node);
1966 		ng_ppp_frag_reset(node);
1967 		priv->xseq = MP_INITIAL_SEQ;
1968 		priv->mseq = MP_INITIAL_SEQ;
1969 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1970 			struct ng_ppp_link *const link = &priv->links[i];
1971 
1972 			bzero(&link->lastWrite, sizeof(link->lastWrite));
1973 			link->bytesInQueue = 0;
1974 			link->seq = MP_NOSEQ;
1975 		}
1976 	}
1977 }
1978 
1979 /*
1980  * Determine if a new configuration would represent a valid change
1981  * from the current configuration and link activity status.
1982  */
1983 static int
1984 ng_ppp_config_valid(node_p node, const struct ng_ppp_node_conf *newConf)
1985 {
1986 	const priv_p priv = node->private;
1987 	int i, newNumLinksActive;
1988 
1989 	/* Check per-link config and count how many links would be active */
1990 	for (newNumLinksActive = i = 0; i < NG_PPP_MAX_LINKS; i++) {
1991 		if (newConf->links[i].enableLink && priv->links[i].hook != NULL)
1992 			newNumLinksActive++;
1993 		if (!newConf->links[i].enableLink)
1994 			continue;
1995 		if (newConf->links[i].mru < MP_MIN_LINK_MRU)
1996 			return (0);
1997 		if (newConf->links[i].bandwidth == 0)
1998 			return (0);
1999 		if (newConf->links[i].bandwidth > NG_PPP_MAX_BANDWIDTH)
2000 			return (0);
2001 		if (newConf->links[i].latency > NG_PPP_MAX_LATENCY)
2002 			return (0);
2003 	}
2004 
2005 	/* Check bundle parameters */
2006 	if (newConf->bund.enableMultilink && newConf->bund.mrru < MP_MIN_MRRU)
2007 		return (0);
2008 
2009 	/* Disallow changes to multi-link configuration while MP is active */
2010 	if (priv->numActiveLinks > 0 && newNumLinksActive > 0) {
2011 		if (!priv->conf.enableMultilink
2012 				!= !newConf->bund.enableMultilink
2013 		    || !priv->conf.xmitShortSeq != !newConf->bund.xmitShortSeq
2014 		    || !priv->conf.recvShortSeq != !newConf->bund.recvShortSeq)
2015 			return (0);
2016 	}
2017 
2018 	/* At most one link can be active unless multi-link is enabled */
2019 	if (!newConf->bund.enableMultilink && newNumLinksActive > 1)
2020 		return (0);
2021 
2022 	/* Configuration change would be valid */
2023 	return (1);
2024 }
2025 
2026 /*
2027  * Free all entries in the fragment queue
2028  */
2029 static void
2030 ng_ppp_frag_reset(node_p node)
2031 {
2032 	const priv_p priv = node->private;
2033 	struct ng_ppp_frag *qent, *qnext;
2034 
2035 	for (qent = TAILQ_FIRST(&priv->frags); qent; qent = qnext) {
2036 		qnext = TAILQ_NEXT(qent, f_qent);
2037 		NG_FREE_M(qent->data);
2038 		NG_FREE_META(qent->meta);
2039 		FREE(qent, M_NETGRAPH);
2040 	}
2041 	TAILQ_INIT(&priv->frags);
2042 	priv->qlen = 0;
2043 }
2044 
2045 /*
2046  * Start fragment queue timer
2047  */
2048 static void
2049 ng_ppp_start_frag_timer(node_p node)
2050 {
2051 	const priv_p priv = node->private;
2052 
2053 	if (!priv->timerActive) {
2054 		priv->fragTimer = timeout(ng_ppp_frag_timeout,
2055 		    node, MP_FRAGTIMER_INTERVAL);
2056 		priv->timerActive = 1;
2057 		node->refs++;
2058 	}
2059 }
2060 
2061 /*
2062  * Stop fragment queue timer
2063  */
2064 static void
2065 ng_ppp_stop_frag_timer(node_p node)
2066 {
2067 	const priv_p priv = node->private;
2068 
2069 	if (priv->timerActive) {
2070 		untimeout(ng_ppp_frag_timeout, node, priv->fragTimer);
2071 		priv->timerActive = 0;
2072 		KASSERT(node->refs > 1,
2073 		    ("%s: refs=%d", __FUNCTION__, node->refs));
2074 		ng_unref(node);
2075 	}
2076 }
2077 
2078