xref: /freebsd/sys/netgraph/ng_ppp.c (revision f856af0466c076beef4ea9b15d088e1119a945b8)
1 /*
2  * ng_ppp.c
3  */
4 
5 /*-
6  * Copyright (c) 1996-2000 Whistle Communications, Inc.
7  * All rights reserved.
8  *
9  * Subject to the following obligations and disclaimer of warranty, use and
10  * redistribution of this software, in source or object code forms, with or
11  * without modifications are expressly permitted by Whistle Communications;
12  * provided, however, that:
13  * 1. Any and all reproductions of the source or object code must include the
14  *    copyright notice above and the following disclaimer of warranties; and
15  * 2. No rights are granted, in any manner or form, to use Whistle
16  *    Communications, Inc. trademarks, including the mark "WHISTLE
17  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
18  *    such appears in the above copyright notice or in the software.
19  *
20  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
21  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
22  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
23  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
24  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
25  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
26  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
27  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
28  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
29  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
30  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
31  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
32  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
36  * OF SUCH DAMAGE.
37  *
38  * Author: Archie Cobbs <archie@freebsd.org>
39  *
40  * $FreeBSD$
41  * $Whistle: ng_ppp.c,v 1.24 1999/11/01 09:24:52 julian Exp $
42  */
43 
44 /*
45  * PPP node type.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/kernel.h>
51 #include <sys/limits.h>
52 #include <sys/time.h>
53 #include <sys/mbuf.h>
54 #include <sys/malloc.h>
55 #include <sys/errno.h>
56 #include <sys/ctype.h>
57 
58 #include <netgraph/ng_message.h>
59 #include <netgraph/netgraph.h>
60 #include <netgraph/ng_parse.h>
61 #include <netgraph/ng_ppp.h>
62 #include <netgraph/ng_vjc.h>
63 
64 #ifdef NG_SEPARATE_MALLOC
65 MALLOC_DEFINE(M_NETGRAPH_PPP, "netgraph_ppp", "netgraph ppp node");
66 #else
67 #define M_NETGRAPH_PPP M_NETGRAPH
68 #endif
69 
70 #define PROT_VALID(p)		(((p) & 0x0101) == 0x0001)
71 #define PROT_COMPRESSABLE(p)	(((p) & 0xff00) == 0x0000)
72 
73 /* Some PPP protocol numbers we're interested in */
74 #define PROT_APPLETALK		0x0029
75 #define PROT_COMPD		0x00fd
76 #define PROT_CRYPTD		0x0053
77 #define PROT_IP			0x0021
78 #define PROT_IPV6		0x0057
79 #define PROT_IPX		0x002b
80 #define PROT_LCP		0xc021
81 #define PROT_MP			0x003d
82 #define PROT_VJCOMP		0x002d
83 #define PROT_VJUNCOMP		0x002f
84 
85 /* Multilink PPP definitions */
86 #define MP_MIN_MRRU		1500		/* per RFC 1990 */
87 #define MP_INITIAL_SEQ		0		/* per RFC 1990 */
88 #define MP_MIN_LINK_MRU		32
89 
90 #define MP_SHORT_SEQ_MASK	0x00000fff	/* short seq # mask */
91 #define MP_SHORT_SEQ_HIBIT	0x00000800	/* short seq # high bit */
92 #define MP_SHORT_FIRST_FLAG	0x00008000	/* first fragment in frame */
93 #define MP_SHORT_LAST_FLAG	0x00004000	/* last fragment in frame */
94 
95 #define MP_LONG_SEQ_MASK	0x00ffffff	/* long seq # mask */
96 #define MP_LONG_SEQ_HIBIT	0x00800000	/* long seq # high bit */
97 #define MP_LONG_FIRST_FLAG	0x80000000	/* first fragment in frame */
98 #define MP_LONG_LAST_FLAG	0x40000000	/* last fragment in frame */
99 
100 #define MP_NOSEQ		0x7fffffff	/* impossible sequence number */
101 
102 /* Sign extension of MP sequence numbers */
103 #define MP_SHORT_EXTEND(s)	(((s) & MP_SHORT_SEQ_HIBIT) ?		\
104 				    ((s) | ~MP_SHORT_SEQ_MASK)		\
105 				    : ((s) & MP_SHORT_SEQ_MASK))
106 #define MP_LONG_EXTEND(s)	(((s) & MP_LONG_SEQ_HIBIT) ?		\
107 				    ((s) | ~MP_LONG_SEQ_MASK)		\
108 				    : ((s) & MP_LONG_SEQ_MASK))
109 
110 /* Comparision of MP sequence numbers. Note: all sequence numbers
111    except priv->xseq are stored with the sign bit extended. */
112 #define MP_SHORT_SEQ_DIFF(x,y)	MP_SHORT_EXTEND((x) - (y))
113 #define MP_LONG_SEQ_DIFF(x,y)	MP_LONG_EXTEND((x) - (y))
114 
115 #define MP_RECV_SEQ_DIFF(priv,x,y)					\
116 				((priv)->conf.recvShortSeq ?		\
117 				    MP_SHORT_SEQ_DIFF((x), (y)) :	\
118 				    MP_LONG_SEQ_DIFF((x), (y)))
119 
120 /* Increment receive sequence number */
121 #define MP_NEXT_RECV_SEQ(priv,seq)					\
122 				((priv)->conf.recvShortSeq ?		\
123 				    MP_SHORT_EXTEND((seq) + 1) :	\
124 				    MP_LONG_EXTEND((seq) + 1))
125 
126 /* Don't fragment transmitted packets smaller than this */
127 #define MP_MIN_FRAG_LEN		6
128 
129 /* Maximum fragment reasssembly queue length */
130 #define MP_MAX_QUEUE_LEN	128
131 
132 /* Fragment queue scanner period */
133 #define MP_FRAGTIMER_INTERVAL	(hz/2)
134 
135 /* We store incoming fragments this way */
136 struct ng_ppp_frag {
137 	int				seq;		/* fragment seq# */
138 	u_char				first;		/* First in packet? */
139 	u_char				last;		/* Last in packet? */
140 	struct timeval			timestamp;	/* time of reception */
141 	struct mbuf			*data;		/* Fragment data */
142 	TAILQ_ENTRY(ng_ppp_frag)	f_qent;		/* Fragment queue */
143 };
144 
145 /* We use integer indicies to refer to the non-link hooks */
146 static const char *const ng_ppp_hook_names[] = {
147 	NG_PPP_HOOK_ATALK,
148 #define HOOK_INDEX_ATALK		0
149 	NG_PPP_HOOK_BYPASS,
150 #define HOOK_INDEX_BYPASS		1
151 	NG_PPP_HOOK_COMPRESS,
152 #define HOOK_INDEX_COMPRESS		2
153 	NG_PPP_HOOK_ENCRYPT,
154 #define HOOK_INDEX_ENCRYPT		3
155 	NG_PPP_HOOK_DECOMPRESS,
156 #define HOOK_INDEX_DECOMPRESS		4
157 	NG_PPP_HOOK_DECRYPT,
158 #define HOOK_INDEX_DECRYPT		5
159 	NG_PPP_HOOK_INET,
160 #define HOOK_INDEX_INET			6
161 	NG_PPP_HOOK_IPX,
162 #define HOOK_INDEX_IPX			7
163 	NG_PPP_HOOK_VJC_COMP,
164 #define HOOK_INDEX_VJC_COMP		8
165 	NG_PPP_HOOK_VJC_IP,
166 #define HOOK_INDEX_VJC_IP		9
167 	NG_PPP_HOOK_VJC_UNCOMP,
168 #define HOOK_INDEX_VJC_UNCOMP		10
169 	NG_PPP_HOOK_VJC_VJIP,
170 #define HOOK_INDEX_VJC_VJIP		11
171 	NG_PPP_HOOK_IPV6,
172 #define HOOK_INDEX_IPV6			12
173 	NULL
174 #define HOOK_INDEX_MAX			13
175 };
176 
177 /* We store index numbers in the hook private pointer. The HOOK_INDEX()
178    for a hook is either the index (above) for normal hooks, or the ones
179    complement of the link number for link hooks.
180 XXX Not any more.. (what a hack)
181 #define HOOK_INDEX(hook)	(*((int16_t *) &(hook)->private))
182 */
183 
184 /* Per-link private information */
185 struct ng_ppp_link {
186 	struct ng_ppp_link_conf	conf;		/* link configuration */
187 	hook_p			hook;		/* connection to link data */
188 	int32_t			seq;		/* highest rec'd seq# - MSEQ */
189 	u_int32_t		latency;	/* calculated link latency */
190 	struct timeval		lastWrite;	/* time of last write */
191 	int			bytesInQueue;	/* bytes in the output queue */
192 	struct ng_ppp_link_stat	stats;		/* Link stats */
193 };
194 
195 /* Total per-node private information */
196 struct ng_ppp_private {
197 	struct ng_ppp_bund_conf	conf;			/* bundle config */
198 	struct ng_ppp_link_stat	bundleStats;		/* bundle stats */
199 	struct ng_ppp_link	links[NG_PPP_MAX_LINKS];/* per-link info */
200 	int32_t			xseq;			/* next out MP seq # */
201 	int32_t			mseq;			/* min links[i].seq */
202 	u_char			vjCompHooked;		/* VJ comp hooked up? */
203 	u_char			allLinksEqual;		/* all xmit the same? */
204 	u_int			numActiveLinks;		/* how many links up */
205 	int			activeLinks[NG_PPP_MAX_LINKS];	/* indicies */
206 	u_int			lastLink;		/* for round robin */
207 	hook_p			hooks[HOOK_INDEX_MAX];	/* non-link hooks */
208 	TAILQ_HEAD(ng_ppp_fraglist, ng_ppp_frag)	/* fragment queue */
209 				frags;
210 	int			qlen;			/* fraq queue length */
211 	struct callout		fragTimer;		/* fraq queue check */
212 };
213 typedef struct ng_ppp_private *priv_p;
214 
215 /* Netgraph node methods */
216 static ng_constructor_t	ng_ppp_constructor;
217 static ng_rcvmsg_t	ng_ppp_rcvmsg;
218 static ng_shutdown_t	ng_ppp_shutdown;
219 static ng_newhook_t	ng_ppp_newhook;
220 static ng_rcvdata_t	ng_ppp_rcvdata;
221 static ng_disconnect_t	ng_ppp_disconnect;
222 
223 /* Helper functions */
224 static int	ng_ppp_input(node_p node, int bypass,
225 			int linkNum, item_p item, int index);
226 static int	ng_ppp_output(node_p node, int bypass, int proto,
227 			int linkNum, item_p item);
228 static int	ng_ppp_mp_input(node_p node, int linkNum, item_p item);
229 static int	ng_ppp_check_packet(node_p node);
230 static void	ng_ppp_get_packet(node_p node, struct mbuf **mp);
231 static int	ng_ppp_frag_process(node_p node);
232 static int	ng_ppp_frag_trim(node_p node);
233 static void	ng_ppp_frag_timeout(node_p node, hook_p hook, void *arg1,
234 			int arg2);
235 static void	ng_ppp_frag_checkstale(node_p node);
236 static void	ng_ppp_frag_reset(node_p node);
237 static int	ng_ppp_mp_output(node_p node, struct mbuf *m);
238 static void	ng_ppp_mp_strategy(node_p node, int len, int *distrib);
239 static int	ng_ppp_intcmp(void *latency, const void *v1, const void *v2);
240 static struct	mbuf *ng_ppp_addproto(struct mbuf *m, int proto, int compOK);
241 static struct	mbuf *ng_ppp_prepend(struct mbuf *m, const void *buf, int len);
242 static int	ng_ppp_config_valid(node_p node,
243 			const struct ng_ppp_node_conf *newConf);
244 static void	ng_ppp_update(node_p node, int newConf);
245 static void	ng_ppp_start_frag_timer(node_p node);
246 static void	ng_ppp_stop_frag_timer(node_p node);
247 
248 /* Parse type for struct ng_ppp_mp_state_type */
249 static const struct ng_parse_fixedarray_info ng_ppp_rseq_array_info = {
250 	&ng_parse_hint32_type,
251 	NG_PPP_MAX_LINKS
252 };
253 static const struct ng_parse_type ng_ppp_rseq_array_type = {
254 	&ng_parse_fixedarray_type,
255 	&ng_ppp_rseq_array_info,
256 };
257 static const struct ng_parse_struct_field ng_ppp_mp_state_type_fields[]
258 	= NG_PPP_MP_STATE_TYPE_INFO(&ng_ppp_rseq_array_type);
259 static const struct ng_parse_type ng_ppp_mp_state_type = {
260 	&ng_parse_struct_type,
261 	&ng_ppp_mp_state_type_fields
262 };
263 
264 /* Parse type for struct ng_ppp_link_conf */
265 static const struct ng_parse_struct_field ng_ppp_link_type_fields[]
266 	= NG_PPP_LINK_TYPE_INFO;
267 static const struct ng_parse_type ng_ppp_link_type = {
268 	&ng_parse_struct_type,
269 	&ng_ppp_link_type_fields
270 };
271 
272 /* Parse type for struct ng_ppp_bund_conf */
273 static const struct ng_parse_struct_field ng_ppp_bund_type_fields[]
274 	= NG_PPP_BUND_TYPE_INFO;
275 static const struct ng_parse_type ng_ppp_bund_type = {
276 	&ng_parse_struct_type,
277 	&ng_ppp_bund_type_fields
278 };
279 
280 /* Parse type for struct ng_ppp_node_conf */
281 static const struct ng_parse_fixedarray_info ng_ppp_array_info = {
282 	&ng_ppp_link_type,
283 	NG_PPP_MAX_LINKS
284 };
285 static const struct ng_parse_type ng_ppp_link_array_type = {
286 	&ng_parse_fixedarray_type,
287 	&ng_ppp_array_info,
288 };
289 static const struct ng_parse_struct_field ng_ppp_conf_type_fields[]
290 	= NG_PPP_CONFIG_TYPE_INFO(&ng_ppp_bund_type, &ng_ppp_link_array_type);
291 static const struct ng_parse_type ng_ppp_conf_type = {
292 	&ng_parse_struct_type,
293 	&ng_ppp_conf_type_fields
294 };
295 
296 /* Parse type for struct ng_ppp_link_stat */
297 static const struct ng_parse_struct_field ng_ppp_stats_type_fields[]
298 	= NG_PPP_STATS_TYPE_INFO;
299 static const struct ng_parse_type ng_ppp_stats_type = {
300 	&ng_parse_struct_type,
301 	&ng_ppp_stats_type_fields
302 };
303 
304 /* List of commands and how to convert arguments to/from ASCII */
305 static const struct ng_cmdlist ng_ppp_cmds[] = {
306 	{
307 	  NGM_PPP_COOKIE,
308 	  NGM_PPP_SET_CONFIG,
309 	  "setconfig",
310 	  &ng_ppp_conf_type,
311 	  NULL
312 	},
313 	{
314 	  NGM_PPP_COOKIE,
315 	  NGM_PPP_GET_CONFIG,
316 	  "getconfig",
317 	  NULL,
318 	  &ng_ppp_conf_type
319 	},
320 	{
321 	  NGM_PPP_COOKIE,
322 	  NGM_PPP_GET_MP_STATE,
323 	  "getmpstate",
324 	  NULL,
325 	  &ng_ppp_mp_state_type
326 	},
327 	{
328 	  NGM_PPP_COOKIE,
329 	  NGM_PPP_GET_LINK_STATS,
330 	  "getstats",
331 	  &ng_parse_int16_type,
332 	  &ng_ppp_stats_type
333 	},
334 	{
335 	  NGM_PPP_COOKIE,
336 	  NGM_PPP_CLR_LINK_STATS,
337 	  "clrstats",
338 	  &ng_parse_int16_type,
339 	  NULL
340 	},
341 	{
342 	  NGM_PPP_COOKIE,
343 	  NGM_PPP_GETCLR_LINK_STATS,
344 	  "getclrstats",
345 	  &ng_parse_int16_type,
346 	  &ng_ppp_stats_type
347 	},
348 	{ 0 }
349 };
350 
351 /* Node type descriptor */
352 static struct ng_type ng_ppp_typestruct = {
353 	.version =	NG_ABI_VERSION,
354 	.name =		NG_PPP_NODE_TYPE,
355 	.constructor =	ng_ppp_constructor,
356 	.rcvmsg =	ng_ppp_rcvmsg,
357 	.shutdown =	ng_ppp_shutdown,
358 	.newhook =	ng_ppp_newhook,
359 	.rcvdata =	ng_ppp_rcvdata,
360 	.disconnect =	ng_ppp_disconnect,
361 	.cmdlist =	ng_ppp_cmds,
362 };
363 NETGRAPH_INIT(ppp, &ng_ppp_typestruct);
364 
365 /* Address and control field header */
366 static const u_char ng_ppp_acf[2] = { 0xff, 0x03 };
367 
368 /* Maximum time we'll let a complete incoming packet sit in the queue */
369 static const struct timeval ng_ppp_max_staleness = { 2, 0 };	/* 2 seconds */
370 
371 #define ERROUT(x)	do { error = (x); goto done; } while (0)
372 
373 /************************************************************************
374 			NETGRAPH NODE STUFF
375  ************************************************************************/
376 
377 /*
378  * Node type constructor
379  */
380 static int
381 ng_ppp_constructor(node_p node)
382 {
383 	priv_p priv;
384 	int i;
385 
386 	/* Allocate private structure */
387 	MALLOC(priv, priv_p, sizeof(*priv), M_NETGRAPH_PPP, M_NOWAIT | M_ZERO);
388 	if (priv == NULL)
389 		return (ENOMEM);
390 
391 	NG_NODE_SET_PRIVATE(node, priv);
392 
393 	/* Initialize state */
394 	TAILQ_INIT(&priv->frags);
395 	for (i = 0; i < NG_PPP_MAX_LINKS; i++)
396 		priv->links[i].seq = MP_NOSEQ;
397 	ng_callout_init(&priv->fragTimer);
398 
399 	/* Done */
400 	return (0);
401 }
402 
403 /*
404  * Give our OK for a hook to be added
405  */
406 static int
407 ng_ppp_newhook(node_p node, hook_p hook, const char *name)
408 {
409 	const priv_p priv = NG_NODE_PRIVATE(node);
410 	int linkNum = -1;
411 	hook_p *hookPtr = NULL;
412 	int hookIndex = -1;
413 
414 	/* Figure out which hook it is */
415 	if (strncmp(name, NG_PPP_HOOK_LINK_PREFIX,	/* a link hook? */
416 	    strlen(NG_PPP_HOOK_LINK_PREFIX)) == 0) {
417 		const char *cp;
418 		char *eptr;
419 
420 		cp = name + strlen(NG_PPP_HOOK_LINK_PREFIX);
421 		if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
422 			return (EINVAL);
423 		linkNum = (int)strtoul(cp, &eptr, 10);
424 		if (*eptr != '\0' || linkNum < 0 || linkNum >= NG_PPP_MAX_LINKS)
425 			return (EINVAL);
426 		hookPtr = &priv->links[linkNum].hook;
427 		hookIndex = ~linkNum;
428 	} else {				/* must be a non-link hook */
429 		int i;
430 
431 		for (i = 0; ng_ppp_hook_names[i] != NULL; i++) {
432 			if (strcmp(name, ng_ppp_hook_names[i]) == 0) {
433 				hookPtr = &priv->hooks[i];
434 				hookIndex = i;
435 				break;
436 			}
437 		}
438 		if (ng_ppp_hook_names[i] == NULL)
439 			return (EINVAL);	/* no such hook */
440 	}
441 
442 	/* See if hook is already connected */
443 	if (*hookPtr != NULL)
444 		return (EISCONN);
445 
446 	/* Disallow more than one link unless multilink is enabled */
447 	if (linkNum != -1 && priv->links[linkNum].conf.enableLink
448 	    && !priv->conf.enableMultilink && priv->numActiveLinks >= 1)
449 		return (ENODEV);
450 
451 	/* OK */
452 	*hookPtr = hook;
453 	NG_HOOK_SET_PRIVATE(hook, (void *)(intptr_t)hookIndex);
454 	ng_ppp_update(node, 0);
455 	return (0);
456 }
457 
458 /*
459  * Receive a control message
460  */
461 static int
462 ng_ppp_rcvmsg(node_p node, item_p item, hook_p lasthook)
463 {
464 	const priv_p priv = NG_NODE_PRIVATE(node);
465 	struct ng_mesg *resp = NULL;
466 	int error = 0;
467 	struct ng_mesg *msg;
468 
469 	NGI_GET_MSG(item, msg);
470 	switch (msg->header.typecookie) {
471 	case NGM_PPP_COOKIE:
472 		switch (msg->header.cmd) {
473 		case NGM_PPP_SET_CONFIG:
474 		    {
475 			struct ng_ppp_node_conf *const conf =
476 			    (struct ng_ppp_node_conf *)msg->data;
477 			int i;
478 
479 			/* Check for invalid or illegal config */
480 			if (msg->header.arglen != sizeof(*conf))
481 				ERROUT(EINVAL);
482 			if (!ng_ppp_config_valid(node, conf))
483 				ERROUT(EINVAL);
484 
485 			/* Copy config */
486 			priv->conf = conf->bund;
487 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
488 				priv->links[i].conf = conf->links[i];
489 			ng_ppp_update(node, 1);
490 			break;
491 		    }
492 		case NGM_PPP_GET_CONFIG:
493 		    {
494 			struct ng_ppp_node_conf *conf;
495 			int i;
496 
497 			NG_MKRESPONSE(resp, msg, sizeof(*conf), M_NOWAIT);
498 			if (resp == NULL)
499 				ERROUT(ENOMEM);
500 			conf = (struct ng_ppp_node_conf *)resp->data;
501 			conf->bund = priv->conf;
502 			for (i = 0; i < NG_PPP_MAX_LINKS; i++)
503 				conf->links[i] = priv->links[i].conf;
504 			break;
505 		    }
506 		case NGM_PPP_GET_MP_STATE:
507 		    {
508 			struct ng_ppp_mp_state *info;
509 			int i;
510 
511 			NG_MKRESPONSE(resp, msg, sizeof(*info), M_NOWAIT);
512 			if (resp == NULL)
513 				ERROUT(ENOMEM);
514 			info = (struct ng_ppp_mp_state *)resp->data;
515 			bzero(info, sizeof(*info));
516 			for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
517 				if (priv->links[i].seq != MP_NOSEQ)
518 					info->rseq[i] = priv->links[i].seq;
519 			}
520 			info->mseq = priv->mseq;
521 			info->xseq = priv->xseq;
522 			break;
523 		    }
524 		case NGM_PPP_GET_LINK_STATS:
525 		case NGM_PPP_CLR_LINK_STATS:
526 		case NGM_PPP_GETCLR_LINK_STATS:
527 		    {
528 			struct ng_ppp_link_stat *stats;
529 			u_int16_t linkNum;
530 
531 			if (msg->header.arglen != sizeof(u_int16_t))
532 				ERROUT(EINVAL);
533 			linkNum = *((u_int16_t *) msg->data);
534 			if (linkNum >= NG_PPP_MAX_LINKS
535 			    && linkNum != NG_PPP_BUNDLE_LINKNUM)
536 				ERROUT(EINVAL);
537 			stats = (linkNum == NG_PPP_BUNDLE_LINKNUM) ?
538 			    &priv->bundleStats : &priv->links[linkNum].stats;
539 			if (msg->header.cmd != NGM_PPP_CLR_LINK_STATS) {
540 				NG_MKRESPONSE(resp, msg,
541 				    sizeof(struct ng_ppp_link_stat), M_NOWAIT);
542 				if (resp == NULL)
543 					ERROUT(ENOMEM);
544 				bcopy(stats, resp->data, sizeof(*stats));
545 			}
546 			if (msg->header.cmd != NGM_PPP_GET_LINK_STATS)
547 				bzero(stats, sizeof(*stats));
548 			break;
549 		    }
550 		default:
551 			error = EINVAL;
552 			break;
553 		}
554 		break;
555 	case NGM_VJC_COOKIE:
556 	    {
557 		/*
558 		 * Forward it to the vjc node. leave the
559 		 * old return address alone.
560 		 * If we have no hook, let NG_RESPOND_MSG
561 		 * clean up any remaining resources.
562 		 * Because we have no resp, the item will be freed
563 		 * along with anything it references. Don't
564 		 * let msg be freed twice.
565 		 */
566 		NGI_MSG(item) = msg;	/* put it back in the item */
567 		msg = NULL;
568 		if ((lasthook = priv->links[HOOK_INDEX_VJC_IP].hook)) {
569 			NG_FWD_ITEM_HOOK(error, item, lasthook);
570 		}
571 		return (error);
572 	    }
573 	default:
574 		error = EINVAL;
575 		break;
576 	}
577 done:
578 	NG_RESPOND_MSG(error, node, item, resp);
579 	NG_FREE_MSG(msg);
580 	return (error);
581 }
582 
583 /*
584  * Receive data on a hook
585  */
586 static int
587 ng_ppp_rcvdata(hook_p hook, item_p item)
588 {
589 	const node_p node = NG_HOOK_NODE(hook);
590 	const priv_p priv = NG_NODE_PRIVATE(node);
591 	const int index = (intptr_t)NG_HOOK_PRIVATE(hook);
592 	u_int16_t linkNum = NG_PPP_BUNDLE_LINKNUM;
593 	hook_p outHook = NULL;
594 	int proto = 0, error;
595 	struct mbuf *m;
596 
597 	NGI_GET_M(item, m);
598 	/* Did it come from a link hook? */
599 	if (index < 0) {
600 		struct ng_ppp_link *link;
601 
602 		/* Convert index into a link number */
603 		linkNum = (u_int16_t)~index;
604 		KASSERT(linkNum < NG_PPP_MAX_LINKS,
605 		    ("%s: bogus index 0x%x", __func__, index));
606 		link = &priv->links[linkNum];
607 
608 		/* Stats */
609 		link->stats.recvFrames++;
610 		link->stats.recvOctets += m->m_pkthdr.len;
611 
612 		/* Strip address and control fields, if present */
613 		if (m->m_pkthdr.len >= 2) {
614 			if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
615 				NG_FREE_ITEM(item);
616 				return (ENOBUFS);
617 			}
618 			if (bcmp(mtod(m, u_char *), &ng_ppp_acf, 2) == 0)
619 				m_adj(m, 2);
620 		}
621 
622 		/* Dispatch incoming frame (if not enabled, to bypass) */
623 		NGI_M(item) = m; 	/* put changed m back in item */
624 		return ng_ppp_input(node,
625 		    !link->conf.enableLink, linkNum, item, index);
626 	}
627 
628 	/* Get protocol & check if data allowed from this hook */
629 	NGI_M(item) = m; 	/* put possibly changed m back in item */
630 	switch (index) {
631 
632 	/* Outgoing data */
633 	case HOOK_INDEX_ATALK:
634 		if (!priv->conf.enableAtalk) {
635 			NG_FREE_ITEM(item);
636 			return (ENXIO);
637 		}
638 		proto = PROT_APPLETALK;
639 		break;
640 	case HOOK_INDEX_IPX:
641 		if (!priv->conf.enableIPX) {
642 			NG_FREE_ITEM(item);
643 			return (ENXIO);
644 		}
645 		proto = PROT_IPX;
646 		break;
647 	case HOOK_INDEX_IPV6:
648 		if (!priv->conf.enableIPv6) {
649 			NG_FREE_ITEM(item);
650 			return (ENXIO);
651 		}
652 		proto = PROT_IPV6;
653 		break;
654 	case HOOK_INDEX_INET:
655 	case HOOK_INDEX_VJC_VJIP:
656 		if (!priv->conf.enableIP) {
657 			NG_FREE_ITEM(item);
658 			return (ENXIO);
659 		}
660 		proto = PROT_IP;
661 		break;
662 	case HOOK_INDEX_VJC_COMP:
663 		if (!priv->conf.enableVJCompression) {
664 			NG_FREE_ITEM(item);
665 			return (ENXIO);
666 		}
667 		proto = PROT_VJCOMP;
668 		break;
669 	case HOOK_INDEX_VJC_UNCOMP:
670 		if (!priv->conf.enableVJCompression) {
671 			NG_FREE_ITEM(item);
672 			return (ENXIO);
673 		}
674 		proto = PROT_VJUNCOMP;
675 		break;
676 	case HOOK_INDEX_COMPRESS:
677 		switch (priv->conf.enableCompression) {
678 		case NG_PPP_COMPRESS_FULL:
679 			/*
680 			 * In full compression mode sending of uncompressed
681 			 * frames is permitted, so compressor must prepend
682 			 * actual protocol number.
683 	    		 */
684 			if (m->m_pkthdr.len < 2) {
685 				NG_FREE_ITEM(item);
686 				return (EINVAL);
687 			}
688 			if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
689 				NGI_M(item) = NULL; /* don't free twice */
690 				NG_FREE_ITEM(item);
691 				return (ENOBUFS);
692 			}
693 			NGI_M(item) = m; /* m may have changed */
694 			proto = ntohs(mtod(m, uint16_t *)[0]);
695 			m_adj(m, 2);
696 			break;
697 
698 		case NG_PPP_COMPRESS_SIMPLE:
699 			proto = PROT_COMPD;
700 			break;
701 
702 		case NG_PPP_COMPRESS_NONE:
703 			NG_FREE_ITEM(item);
704 			return (ENXIO);
705 		}
706 		break;
707 	case HOOK_INDEX_ENCRYPT:
708 		if (!priv->conf.enableEncryption) {
709 			NG_FREE_ITEM(item);
710 			return (ENXIO);
711 		}
712 		proto = PROT_CRYPTD;
713 		break;
714 	case HOOK_INDEX_BYPASS:
715 		if (m->m_pkthdr.len < 4) {
716 			NG_FREE_ITEM(item);
717 			return (EINVAL);
718 		}
719 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
720 			NGI_M(item) = NULL; /* don't free twice */
721 			NG_FREE_ITEM(item);
722 			return (ENOBUFS);
723 		}
724 		NGI_M(item) = m; /* m may have changed */
725 		linkNum = ntohs(mtod(m, u_int16_t *)[0]);
726 		proto = ntohs(mtod(m, u_int16_t *)[1]);
727 		m_adj(m, 4);
728 		if (linkNum >= NG_PPP_MAX_LINKS
729 		    && linkNum != NG_PPP_BUNDLE_LINKNUM) {
730 			NG_FREE_ITEM(item);
731 			return (EINVAL);
732 		}
733 		break;
734 
735 	/* Incoming data */
736 	case HOOK_INDEX_VJC_IP:
737 		if (!priv->conf.enableIP || !priv->conf.enableVJDecompression) {
738 			NG_FREE_ITEM(item);
739 			return (ENXIO);
740 		}
741 		break;
742 	case HOOK_INDEX_DECOMPRESS:
743 		if (!priv->conf.enableDecompression) {
744 			NG_FREE_ITEM(item);
745 			return (ENXIO);
746 		}
747 		break;
748 	case HOOK_INDEX_DECRYPT:
749 		if (!priv->conf.enableDecryption) {
750 			NG_FREE_ITEM(item);
751 			return (ENXIO);
752 		}
753 		break;
754 	default:
755 		panic("%s: bogus index 0x%x", __func__, index);
756 	}
757 
758 	/* Now figure out what to do with the frame */
759 	switch (index) {
760 
761 	/* Outgoing data */
762 	case HOOK_INDEX_INET:
763 		if (priv->conf.enableVJCompression && priv->vjCompHooked) {
764 			outHook = priv->hooks[HOOK_INDEX_VJC_IP];
765 			break;
766 		}
767 		/* FALLTHROUGH */
768 	case HOOK_INDEX_ATALK:
769 	case HOOK_INDEX_IPV6:
770 	case HOOK_INDEX_IPX:
771 	case HOOK_INDEX_VJC_COMP:
772 	case HOOK_INDEX_VJC_UNCOMP:
773 	case HOOK_INDEX_VJC_VJIP:
774 		if (priv->conf.enableCompression
775 		    && priv->hooks[HOOK_INDEX_COMPRESS] != NULL) {
776 			if ((m = ng_ppp_addproto(m, proto, 0)) == NULL) {
777 				NGI_M(item) = NULL;
778 				NG_FREE_ITEM(item);
779 				return (ENOBUFS);
780 			}
781 			NGI_M(item) = m; /* m may have changed */
782 			outHook = priv->hooks[HOOK_INDEX_COMPRESS];
783 			break;
784 		}
785 		/* FALLTHROUGH */
786 	case HOOK_INDEX_COMPRESS:
787 		if (priv->conf.enableEncryption
788 		    && priv->hooks[HOOK_INDEX_ENCRYPT] != NULL) {
789 			if ((m = ng_ppp_addproto(m, proto, 1)) == NULL) {
790 				NGI_M(item) = NULL;
791 				NG_FREE_ITEM(item);
792 				return (ENOBUFS);
793 			}
794 			NGI_M(item) = m; /* m may have changed */
795 			outHook = priv->hooks[HOOK_INDEX_ENCRYPT];
796 			break;
797 		}
798 		/* FALLTHROUGH */
799 	case HOOK_INDEX_ENCRYPT:
800 		return ng_ppp_output(node, 0, proto, NG_PPP_BUNDLE_LINKNUM, item);
801 
802 	case HOOK_INDEX_BYPASS:
803 		return ng_ppp_output(node, 1, proto, linkNum, item);
804 
805 	/* Incoming data */
806 	case HOOK_INDEX_DECRYPT:
807 	case HOOK_INDEX_DECOMPRESS:
808 		return ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item, index);
809 
810 	case HOOK_INDEX_VJC_IP:
811 		outHook = priv->hooks[HOOK_INDEX_INET];
812 		break;
813 	}
814 
815 	/* Send packet out hook */
816 	NG_FWD_ITEM_HOOK(error, item, outHook);
817 	return (error);
818 }
819 
820 /*
821  * Destroy node
822  */
823 static int
824 ng_ppp_shutdown(node_p node)
825 {
826 	const priv_p priv = NG_NODE_PRIVATE(node);
827 
828 	/* Stop fragment queue timer */
829 	ng_ppp_stop_frag_timer(node);
830 
831 	/* Take down netgraph node */
832 	ng_ppp_frag_reset(node);
833 	bzero(priv, sizeof(*priv));
834 	FREE(priv, M_NETGRAPH_PPP);
835 	NG_NODE_SET_PRIVATE(node, NULL);
836 	NG_NODE_UNREF(node);		/* let the node escape */
837 	return (0);
838 }
839 
840 /*
841  * Hook disconnection
842  */
843 static int
844 ng_ppp_disconnect(hook_p hook)
845 {
846 	const node_p node = NG_HOOK_NODE(hook);
847 	const priv_p priv = NG_NODE_PRIVATE(node);
848 	const int index = (intptr_t)NG_HOOK_PRIVATE(hook);
849 
850 	/* Zero out hook pointer */
851 	if (index < 0)
852 		priv->links[~index].hook = NULL;
853 	else
854 		priv->hooks[index] = NULL;
855 
856 	/* Update derived info (or go away if no hooks left) */
857 	if (NG_NODE_NUMHOOKS(node) > 0) {
858 		ng_ppp_update(node, 0);
859 	} else {
860 		if (NG_NODE_IS_VALID(node)) {
861 			ng_rmnode_self(node);
862 		}
863 	}
864 	return (0);
865 }
866 
867 /************************************************************************
868 			HELPER STUFF
869  ************************************************************************/
870 
871 /*
872  * Handle an incoming frame.  Extract the PPP protocol number
873  * and dispatch accordingly.
874  */
875 static int
876 ng_ppp_input(node_p node, int bypass, int linkNum, item_p item, int index)
877 {
878 	const priv_p priv = NG_NODE_PRIVATE(node);
879 	hook_p outHook = NULL;
880 	int proto, error;
881 	struct mbuf *m;
882 
883 
884 	NGI_GET_M(item, m);
885 	/* Extract protocol number */
886 	for (proto = 0; !PROT_VALID(proto) && m->m_pkthdr.len > 0; ) {
887 		if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL) {
888 			NG_FREE_ITEM(item);
889 			return (ENOBUFS);
890 		}
891 		proto = (proto << 8) + *mtod(m, u_char *);
892 		m_adj(m, 1);
893 	}
894 	if (!PROT_VALID(proto)) {
895 		if (linkNum == NG_PPP_BUNDLE_LINKNUM)
896 			priv->bundleStats.badProtos++;
897 		else
898 			priv->links[linkNum].stats.badProtos++;
899 		NG_FREE_ITEM(item);
900 		NG_FREE_M(m);
901 		return (EINVAL);
902 	}
903 
904 	/* Bypass frame? */
905 	if (bypass)
906 		goto bypass;
907 
908 	/*
909 	 * In full decompression mode we should pass any packet
910 	 * to decompressor for dictionary update.
911 	 */
912 	if ((priv->conf.enableDecompression == NG_PPP_DECOMPRESS_FULL) &&
913 	    (index < 0 || index == HOOK_INDEX_DECRYPT)) {
914 
915 		/* Check protocol */
916 		switch (proto) {
917 		case PROT_CRYPTD:
918 			if (priv->conf.enableDecryption)
919 				outHook = priv->hooks[HOOK_INDEX_DECRYPT];
920 			break;
921 		case PROT_MP:
922 			if (priv->conf.enableMultilink &&
923 			    linkNum != NG_PPP_BUNDLE_LINKNUM) {
924 				NGI_M(item) = m;
925 				return ng_ppp_mp_input(node, linkNum, item);
926 			}
927 			break;
928 		case PROT_COMPD:
929 		case PROT_VJCOMP:
930 		case PROT_VJUNCOMP:
931 		case PROT_APPLETALK:
932 		case PROT_IPX:
933 		case PROT_IP:
934 		case PROT_IPV6:
935 			if ((m = ng_ppp_addproto(m, proto, 0)) == NULL) {
936 				NG_FREE_ITEM(item);
937 				return (ENOBUFS);
938 			}
939 			outHook = priv->hooks[HOOK_INDEX_DECOMPRESS];
940 			break;
941 		}
942 	} else {
943 
944 		/* Check protocol */
945 		switch (proto) {
946 		case PROT_COMPD:
947 			if (priv->conf.enableDecompression)
948 				outHook = priv->hooks[HOOK_INDEX_DECOMPRESS];
949 			break;
950 		case PROT_CRYPTD:
951 			if (priv->conf.enableDecryption)
952 				outHook = priv->hooks[HOOK_INDEX_DECRYPT];
953 			break;
954 		case PROT_VJCOMP:
955 			if (priv->conf.enableVJDecompression &&
956 			    priv->vjCompHooked)
957 				outHook = priv->hooks[HOOK_INDEX_VJC_COMP];
958 			break;
959 		case PROT_VJUNCOMP:
960 			if (priv->conf.enableVJDecompression &&
961 			    priv->vjCompHooked)
962 				outHook = priv->hooks[HOOK_INDEX_VJC_UNCOMP];
963 			break;
964 		case PROT_MP:
965 			if (priv->conf.enableMultilink &&
966 			    linkNum != NG_PPP_BUNDLE_LINKNUM) {
967 				NGI_M(item) = m;
968 				return ng_ppp_mp_input(node, linkNum, item);
969 			}
970 			break;
971 		case PROT_APPLETALK:
972 			if (priv->conf.enableAtalk)
973 				outHook = priv->hooks[HOOK_INDEX_ATALK];
974 			break;
975 		case PROT_IPX:
976 			if (priv->conf.enableIPX)
977 				outHook = priv->hooks[HOOK_INDEX_IPX];
978 			break;
979 		case PROT_IP:
980 			if (priv->conf.enableIP)
981 				outHook = priv->hooks[HOOK_INDEX_INET];
982 			break;
983 		case PROT_IPV6:
984 			if (priv->conf.enableIPv6)
985 				outHook = priv->hooks[HOOK_INDEX_IPV6];
986 			break;
987 		}
988 	}
989 
990 bypass:
991 	/* For unknown/inactive protocols, forward out the bypass hook */
992 	if (outHook == NULL) {
993 		u_int16_t hdr[2];
994 
995 		hdr[0] = htons(linkNum);
996 		hdr[1] = htons((u_int16_t)proto);
997 		if ((m = ng_ppp_prepend(m, &hdr, 4)) == NULL) {
998 			NG_FREE_ITEM(item);
999 			return (ENOBUFS);
1000 		}
1001 		outHook = priv->hooks[HOOK_INDEX_BYPASS];
1002 	}
1003 
1004 	/* Forward frame */
1005 	NG_FWD_NEW_DATA(error, item, outHook, m);
1006 	return (error);
1007 }
1008 
1009 /*
1010  * Deliver a frame out a link, either a real one or NG_PPP_BUNDLE_LINKNUM.
1011  * If the link is not enabled then ENXIO is returned, unless "bypass" is != 0.
1012  *
1013  * If the frame is too big for the particular link, return EMSGSIZE.
1014  */
1015 static int
1016 ng_ppp_output(node_p node, int bypass,
1017 	int proto, int linkNum, item_p item)
1018 {
1019 	const priv_p priv = NG_NODE_PRIVATE(node);
1020 	struct ng_ppp_link *link;
1021 	int len, error;
1022 	struct mbuf *m;
1023 	u_int16_t mru;
1024 
1025 	/* Extract mbuf */
1026 	NGI_GET_M(item, m);
1027 
1028 	/* If not doing MP, map bundle virtual link to (the only) link */
1029 	if (linkNum == NG_PPP_BUNDLE_LINKNUM && !priv->conf.enableMultilink)
1030 		linkNum = priv->activeLinks[0];
1031 
1032 	/* Get link pointer (optimization) */
1033 	link = (linkNum != NG_PPP_BUNDLE_LINKNUM) ?
1034 	    &priv->links[linkNum] : NULL;
1035 
1036 	/* Check link status (if real) */
1037 	if (linkNum != NG_PPP_BUNDLE_LINKNUM) {
1038 		if (!bypass && !link->conf.enableLink) {
1039 			NG_FREE_M(m);
1040 			NG_FREE_ITEM(item);
1041 			return (ENXIO);
1042 		}
1043 		if (link->hook == NULL) {
1044 			NG_FREE_M(m);
1045 			NG_FREE_ITEM(item);
1046 			return (ENETDOWN);
1047 		}
1048 	}
1049 
1050 	/* Check peer's MRU for this link */
1051 	mru = (link != NULL) ? link->conf.mru : priv->conf.mrru;
1052 	if (mru != 0 && m->m_pkthdr.len > mru) {
1053 		NG_FREE_M(m);
1054 		NG_FREE_ITEM(item);
1055 		return (EMSGSIZE);
1056 	}
1057 
1058 	/* Prepend protocol number, possibly compressed */
1059 	if ((m = ng_ppp_addproto(m, proto,
1060 	    linkNum == NG_PPP_BUNDLE_LINKNUM
1061 	      || link->conf.enableProtoComp)) == NULL) {
1062 		NG_FREE_ITEM(item);
1063 		return (ENOBUFS);
1064 	}
1065 
1066 	/* Special handling for the MP virtual link */
1067 	if (linkNum == NG_PPP_BUNDLE_LINKNUM) {
1068 		/* discard the queue item */
1069 		NG_FREE_ITEM(item);
1070 		return ng_ppp_mp_output(node, m);
1071 	}
1072 
1073 	/* Prepend address and control field (unless compressed) */
1074 	if (proto == PROT_LCP || !link->conf.enableACFComp) {
1075 		if ((m = ng_ppp_prepend(m, &ng_ppp_acf, 2)) == NULL) {
1076 			NG_FREE_ITEM(item);
1077 			return (ENOBUFS);
1078 		}
1079 	}
1080 
1081 	/* Deliver frame */
1082 	len = m->m_pkthdr.len;
1083 	NG_FWD_NEW_DATA(error, item,  link->hook, m);
1084 
1085 	/* Update stats and 'bytes in queue' counter */
1086 	if (error == 0) {
1087 		link->stats.xmitFrames++;
1088 		link->stats.xmitOctets += len;
1089 		link->bytesInQueue += len;
1090 		getmicrouptime(&link->lastWrite);
1091 	}
1092 	return error;
1093 }
1094 
1095 /*
1096  * Handle an incoming multi-link fragment
1097  *
1098  * The fragment reassembly algorithm is somewhat complex. This is mainly
1099  * because we are required not to reorder the reconstructed packets, yet
1100  * fragments are only guaranteed to arrive in order on a per-link basis.
1101  * In other words, when we have a complete packet ready, but the previous
1102  * packet is still incomplete, we have to decide between delivering the
1103  * complete packet and throwing away the incomplete one, or waiting to
1104  * see if the remainder of the incomplete one arrives, at which time we
1105  * can deliver both packets, in order.
1106  *
1107  * This problem is exacerbated by "sequence number slew", which is when
1108  * the sequence numbers coming in from different links are far apart from
1109  * each other. In particular, certain unnamed equipment (*cough* Ascend)
1110  * has been seen to generate sequence number slew of up to 10 on an ISDN
1111  * 2B-channel MP link. There is nothing invalid about sequence number slew
1112  * but it makes the reasssembly process have to work harder.
1113  *
1114  * However, the peer is required to transmit fragments in order on each
1115  * link. That means if we define MSEQ as the minimum over all links of
1116  * the highest sequence number received on that link, then we can always
1117  * give up any hope of receiving a fragment with sequence number < MSEQ in
1118  * the future (all of this using 'wraparound' sequence number space).
1119  * Therefore we can always immediately throw away incomplete packets
1120  * missing fragments with sequence numbers < MSEQ.
1121  *
1122  * Here is an overview of our algorithm:
1123  *
1124  *    o Received fragments are inserted into a queue, for which we
1125  *	maintain these invariants between calls to this function:
1126  *
1127  *	- Fragments are ordered in the queue by sequence number
1128  *	- If a complete packet is at the head of the queue, then
1129  *	  the first fragment in the packet has seq# > MSEQ + 1
1130  *	  (otherwise, we could deliver it immediately)
1131  *	- If any fragments have seq# < MSEQ, then they are necessarily
1132  *	  part of a packet whose missing seq#'s are all > MSEQ (otherwise,
1133  *	  we can throw them away because they'll never be completed)
1134  *	- The queue contains at most MP_MAX_QUEUE_LEN fragments
1135  *
1136  *    o We have a periodic timer that checks the queue for the first
1137  *	complete packet that has been sitting in the queue "too long".
1138  *	When one is detected, all previous (incomplete) fragments are
1139  *	discarded, their missing fragments are declared lost and MSEQ
1140  *	is increased.
1141  *
1142  *    o If we recieve a fragment with seq# < MSEQ, we throw it away
1143  *	because we've already delcared it lost.
1144  *
1145  * This assumes linkNum != NG_PPP_BUNDLE_LINKNUM.
1146  */
1147 static int
1148 ng_ppp_mp_input(node_p node, int linkNum, item_p item)
1149 {
1150 	const priv_p priv = NG_NODE_PRIVATE(node);
1151 	struct ng_ppp_link *const link = &priv->links[linkNum];
1152 	struct ng_ppp_frag frag0, *frag = &frag0;
1153 	struct ng_ppp_frag *qent;
1154 	int i, diff, inserted;
1155 	struct mbuf *m;
1156 
1157 	NGI_GET_M(item, m);
1158 	NG_FREE_ITEM(item);
1159 	/* Stats */
1160 	priv->bundleStats.recvFrames++;
1161 	priv->bundleStats.recvOctets += m->m_pkthdr.len;
1162 
1163 	/* Extract fragment information from MP header */
1164 	if (priv->conf.recvShortSeq) {
1165 		u_int16_t shdr;
1166 
1167 		if (m->m_pkthdr.len < 2) {
1168 			link->stats.runts++;
1169 			NG_FREE_M(m);
1170 			return (EINVAL);
1171 		}
1172 		if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL)
1173 			return (ENOBUFS);
1174 
1175 		shdr = ntohs(*mtod(m, u_int16_t *));
1176 		frag->seq = MP_SHORT_EXTEND(shdr);
1177 		frag->first = (shdr & MP_SHORT_FIRST_FLAG) != 0;
1178 		frag->last = (shdr & MP_SHORT_LAST_FLAG) != 0;
1179 		diff = MP_SHORT_SEQ_DIFF(frag->seq, priv->mseq);
1180 		m_adj(m, 2);
1181 	} else {
1182 		u_int32_t lhdr;
1183 
1184 		if (m->m_pkthdr.len < 4) {
1185 			link->stats.runts++;
1186 			NG_FREE_M(m);
1187 			return (EINVAL);
1188 		}
1189 		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL)
1190 			return (ENOBUFS);
1191 
1192 		lhdr = ntohl(*mtod(m, u_int32_t *));
1193 		frag->seq = MP_LONG_EXTEND(lhdr);
1194 		frag->first = (lhdr & MP_LONG_FIRST_FLAG) != 0;
1195 		frag->last = (lhdr & MP_LONG_LAST_FLAG) != 0;
1196 		diff = MP_LONG_SEQ_DIFF(frag->seq, priv->mseq);
1197 		m_adj(m, 4);
1198 	}
1199 	frag->data = m;
1200 	getmicrouptime(&frag->timestamp);
1201 
1202 	/* If sequence number is < MSEQ, we've already declared this
1203 	   fragment as lost, so we have no choice now but to drop it */
1204 	if (diff < 0) {
1205 		link->stats.dropFragments++;
1206 		NG_FREE_M(m);
1207 		return (0);
1208 	}
1209 
1210 	/* Update highest received sequence number on this link and MSEQ */
1211 	priv->mseq = link->seq = frag->seq;
1212 	for (i = 0; i < priv->numActiveLinks; i++) {
1213 		struct ng_ppp_link *const alink =
1214 		    &priv->links[priv->activeLinks[i]];
1215 
1216 		if (MP_RECV_SEQ_DIFF(priv, alink->seq, priv->mseq) < 0)
1217 			priv->mseq = alink->seq;
1218 	}
1219 
1220 	/* Allocate a new frag struct for the queue */
1221 	MALLOC(frag, struct ng_ppp_frag *, sizeof(*frag), M_NETGRAPH_PPP, M_NOWAIT);
1222 	if (frag == NULL) {
1223 		NG_FREE_M(m);
1224 		ng_ppp_frag_process(node);
1225 		return (ENOMEM);
1226 	}
1227 	*frag = frag0;
1228 
1229 	/* Add fragment to queue, which is sorted by sequence number */
1230 	inserted = 0;
1231 	TAILQ_FOREACH_REVERSE(qent, &priv->frags, ng_ppp_fraglist, f_qent) {
1232 		diff = MP_RECV_SEQ_DIFF(priv, frag->seq, qent->seq);
1233 		if (diff > 0) {
1234 			TAILQ_INSERT_AFTER(&priv->frags, qent, frag, f_qent);
1235 			inserted = 1;
1236 			break;
1237 		} else if (diff == 0) {	     /* should never happen! */
1238 			link->stats.dupFragments++;
1239 			NG_FREE_M(frag->data);
1240 			FREE(frag, M_NETGRAPH_PPP);
1241 			return (EINVAL);
1242 		}
1243 	}
1244 	if (!inserted)
1245 		TAILQ_INSERT_HEAD(&priv->frags, frag, f_qent);
1246 	priv->qlen++;
1247 
1248 	/* Process the queue */
1249 	return ng_ppp_frag_process(node);
1250 }
1251 
1252 /*
1253  * Examine our list of fragments, and determine if there is a
1254  * complete and deliverable packet at the head of the list.
1255  * Return 1 if so, zero otherwise.
1256  */
1257 static int
1258 ng_ppp_check_packet(node_p node)
1259 {
1260 	const priv_p priv = NG_NODE_PRIVATE(node);
1261 	struct ng_ppp_frag *qent, *qnext;
1262 
1263 	/* Check for empty queue */
1264 	if (TAILQ_EMPTY(&priv->frags))
1265 		return (0);
1266 
1267 	/* Check first fragment is the start of a deliverable packet */
1268 	qent = TAILQ_FIRST(&priv->frags);
1269 	if (!qent->first || MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) > 1)
1270 		return (0);
1271 
1272 	/* Check that all the fragments are there */
1273 	while (!qent->last) {
1274 		qnext = TAILQ_NEXT(qent, f_qent);
1275 		if (qnext == NULL)	/* end of queue */
1276 			return (0);
1277 		if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq))
1278 			return (0);
1279 		qent = qnext;
1280 	}
1281 
1282 	/* Got one */
1283 	return (1);
1284 }
1285 
1286 /*
1287  * Pull a completed packet off the head of the incoming fragment queue.
1288  * This assumes there is a completed packet there to pull off.
1289  */
1290 static void
1291 ng_ppp_get_packet(node_p node, struct mbuf **mp)
1292 {
1293 	const priv_p priv = NG_NODE_PRIVATE(node);
1294 	struct ng_ppp_frag *qent, *qnext;
1295 	struct mbuf *m = NULL, *tail;
1296 
1297 	qent = TAILQ_FIRST(&priv->frags);
1298 	KASSERT(!TAILQ_EMPTY(&priv->frags) && qent->first,
1299 	    ("%s: no packet", __func__));
1300 	for (tail = NULL; qent != NULL; qent = qnext) {
1301 		qnext = TAILQ_NEXT(qent, f_qent);
1302 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1303 		    ("%s: empty q", __func__));
1304 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1305 		if (tail == NULL)
1306 			tail = m = qent->data;
1307 		else {
1308 			m->m_pkthdr.len += qent->data->m_pkthdr.len;
1309 			tail->m_next = qent->data;
1310 		}
1311 		while (tail->m_next != NULL)
1312 			tail = tail->m_next;
1313 		if (qent->last)
1314 			qnext = NULL;
1315 		FREE(qent, M_NETGRAPH_PPP);
1316 		priv->qlen--;
1317 	}
1318 	*mp = m;
1319 }
1320 
1321 /*
1322  * Trim fragments from the queue whose packets can never be completed.
1323  * This assumes a complete packet is NOT at the beginning of the queue.
1324  * Returns 1 if fragments were removed, zero otherwise.
1325  */
1326 static int
1327 ng_ppp_frag_trim(node_p node)
1328 {
1329 	const priv_p priv = NG_NODE_PRIVATE(node);
1330 	struct ng_ppp_frag *qent, *qnext = NULL;
1331 	int removed = 0;
1332 
1333 	/* Scan for "dead" fragments and remove them */
1334 	while (1) {
1335 		int dead = 0;
1336 
1337 		/* If queue is empty, we're done */
1338 		if (TAILQ_EMPTY(&priv->frags))
1339 			break;
1340 
1341 		/* Determine whether first fragment can ever be completed */
1342 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1343 			if (MP_RECV_SEQ_DIFF(priv, qent->seq, priv->mseq) >= 0)
1344 				break;
1345 			qnext = TAILQ_NEXT(qent, f_qent);
1346 			KASSERT(qnext != NULL,
1347 			    ("%s: last frag < MSEQ?", __func__));
1348 			if (qnext->seq != MP_NEXT_RECV_SEQ(priv, qent->seq)
1349 			    || qent->last || qnext->first) {
1350 				dead = 1;
1351 				break;
1352 			}
1353 		}
1354 		if (!dead)
1355 			break;
1356 
1357 		/* Remove fragment and all others in the same packet */
1358 		while ((qent = TAILQ_FIRST(&priv->frags)) != qnext) {
1359 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1360 			    ("%s: empty q", __func__));
1361 			priv->bundleStats.dropFragments++;
1362 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1363 			NG_FREE_M(qent->data);
1364 			FREE(qent, M_NETGRAPH_PPP);
1365 			priv->qlen--;
1366 			removed = 1;
1367 		}
1368 	}
1369 	return (removed);
1370 }
1371 
1372 /*
1373  * Run the queue, restoring the queue invariants
1374  */
1375 static int
1376 ng_ppp_frag_process(node_p node)
1377 {
1378 	const priv_p priv = NG_NODE_PRIVATE(node);
1379 	struct mbuf *m;
1380 	item_p item;
1381 
1382 	/* Deliver any deliverable packets */
1383 	while (ng_ppp_check_packet(node)) {
1384 		ng_ppp_get_packet(node, &m);
1385 		if ((item = ng_package_data(m, NG_NOFLAGS)) != NULL)
1386 			ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item,
1387 			    ~((int)NG_PPP_BUNDLE_LINKNUM));
1388 	}
1389 
1390 	/* Delete dead fragments and try again */
1391 	if (ng_ppp_frag_trim(node)) {
1392 		while (ng_ppp_check_packet(node)) {
1393 			ng_ppp_get_packet(node, &m);
1394 			if ((item = ng_package_data(m, NG_NOFLAGS)) != NULL)
1395 				ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM,
1396 				    item, ~((int)NG_PPP_BUNDLE_LINKNUM));
1397 		}
1398 	}
1399 
1400 	/* Check for stale fragments while we're here */
1401 	ng_ppp_frag_checkstale(node);
1402 
1403 	/* Check queue length */
1404 	if (priv->qlen > MP_MAX_QUEUE_LEN) {
1405 		struct ng_ppp_frag *qent;
1406 		int i;
1407 
1408 		/* Get oldest fragment */
1409 		KASSERT(!TAILQ_EMPTY(&priv->frags),
1410 		    ("%s: empty q", __func__));
1411 		qent = TAILQ_FIRST(&priv->frags);
1412 
1413 		/* Bump MSEQ if necessary */
1414 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, qent->seq) < 0) {
1415 			priv->mseq = qent->seq;
1416 			for (i = 0; i < priv->numActiveLinks; i++) {
1417 				struct ng_ppp_link *const alink =
1418 				    &priv->links[priv->activeLinks[i]];
1419 
1420 				if (MP_RECV_SEQ_DIFF(priv,
1421 				    alink->seq, priv->mseq) < 0)
1422 					alink->seq = priv->mseq;
1423 			}
1424 		}
1425 
1426 		/* Drop it */
1427 		priv->bundleStats.dropFragments++;
1428 		TAILQ_REMOVE(&priv->frags, qent, f_qent);
1429 		NG_FREE_M(qent->data);
1430 		FREE(qent, M_NETGRAPH_PPP);
1431 		priv->qlen--;
1432 
1433 		/* Process queue again */
1434 		return ng_ppp_frag_process(node);
1435 	}
1436 
1437 	/* Done */
1438 	return (0);
1439 }
1440 
1441 /*
1442  * Check for 'stale' completed packets that need to be delivered
1443  *
1444  * If a link goes down or has a temporary failure, MSEQ can get
1445  * "stuck", because no new incoming fragments appear on that link.
1446  * This can cause completed packets to never get delivered if
1447  * their sequence numbers are all > MSEQ + 1.
1448  *
1449  * This routine checks how long all of the completed packets have
1450  * been sitting in the queue, and if too long, removes fragments
1451  * from the queue and increments MSEQ to allow them to be delivered.
1452  */
1453 static void
1454 ng_ppp_frag_checkstale(node_p node)
1455 {
1456 	const priv_p priv = NG_NODE_PRIVATE(node);
1457 	struct ng_ppp_frag *qent, *beg, *end;
1458 	struct timeval now, age;
1459 	struct mbuf *m;
1460 	int i, seq;
1461 	item_p item;
1462 	int endseq;
1463 
1464 	now.tv_sec = 0;			/* uninitialized state */
1465 	while (1) {
1466 
1467 		/* If queue is empty, we're done */
1468 		if (TAILQ_EMPTY(&priv->frags))
1469 			break;
1470 
1471 		/* Find the first complete packet in the queue */
1472 		beg = end = NULL;
1473 		seq = TAILQ_FIRST(&priv->frags)->seq;
1474 		TAILQ_FOREACH(qent, &priv->frags, f_qent) {
1475 			if (qent->first)
1476 				beg = qent;
1477 			else if (qent->seq != seq)
1478 				beg = NULL;
1479 			if (beg != NULL && qent->last) {
1480 				end = qent;
1481 				break;
1482 			}
1483 			seq = MP_NEXT_RECV_SEQ(priv, seq);
1484 		}
1485 
1486 		/* If none found, exit */
1487 		if (end == NULL)
1488 			break;
1489 
1490 		/* Get current time (we assume we've been up for >= 1 second) */
1491 		if (now.tv_sec == 0)
1492 			getmicrouptime(&now);
1493 
1494 		/* Check if packet has been queued too long */
1495 		age = now;
1496 		timevalsub(&age, &beg->timestamp);
1497 		if (timevalcmp(&age, &ng_ppp_max_staleness, < ))
1498 			break;
1499 
1500 		/* Throw away junk fragments in front of the completed packet */
1501 		while ((qent = TAILQ_FIRST(&priv->frags)) != beg) {
1502 			KASSERT(!TAILQ_EMPTY(&priv->frags),
1503 			    ("%s: empty q", __func__));
1504 			priv->bundleStats.dropFragments++;
1505 			TAILQ_REMOVE(&priv->frags, qent, f_qent);
1506 			NG_FREE_M(qent->data);
1507 			FREE(qent, M_NETGRAPH_PPP);
1508 			priv->qlen--;
1509 		}
1510 
1511 		/* Extract completed packet */
1512 		endseq = end->seq;
1513 		ng_ppp_get_packet(node, &m);
1514 
1515 		/* Bump MSEQ if necessary */
1516 		if (MP_RECV_SEQ_DIFF(priv, priv->mseq, endseq) < 0) {
1517 			priv->mseq = endseq;
1518 			for (i = 0; i < priv->numActiveLinks; i++) {
1519 				struct ng_ppp_link *const alink =
1520 				    &priv->links[priv->activeLinks[i]];
1521 
1522 				if (MP_RECV_SEQ_DIFF(priv,
1523 				    alink->seq, priv->mseq) < 0)
1524 					alink->seq = priv->mseq;
1525 			}
1526 		}
1527 
1528 		/* Deliver packet */
1529 		if ((item = ng_package_data(m, NG_NOFLAGS)) != NULL)
1530 			ng_ppp_input(node, 0, NG_PPP_BUNDLE_LINKNUM, item,
1531 			    ~((int)NG_PPP_BUNDLE_LINKNUM));
1532 	}
1533 }
1534 
1535 /*
1536  * Periodically call ng_ppp_frag_checkstale()
1537  */
1538 static void
1539 ng_ppp_frag_timeout(node_p node, hook_p hook, void *arg1, int arg2)
1540 {
1541 	/* XXX: is this needed? */
1542 	if (NG_NODE_NOT_VALID(node))
1543 		return;
1544 
1545 	/* Scan the fragment queue */
1546 	ng_ppp_frag_checkstale(node);
1547 
1548 	/* Start timer again */
1549 	ng_ppp_start_frag_timer(node);
1550 }
1551 
1552 /*
1553  * Deliver a frame out on the bundle, i.e., figure out how to fragment
1554  * the frame across the individual PPP links and do so.
1555  */
1556 static int
1557 ng_ppp_mp_output(node_p node, struct mbuf *m)
1558 {
1559 	const priv_p priv = NG_NODE_PRIVATE(node);
1560 	const int hdr_len = priv->conf.xmitShortSeq ? 2 : 4;
1561 	int distrib[NG_PPP_MAX_LINKS];
1562 	int firstFragment;
1563 	int activeLinkNum;
1564 	item_p item;
1565 
1566 	/* At least one link must be active */
1567 	if (priv->numActiveLinks == 0) {
1568 		NG_FREE_M(m);
1569 		return (ENETDOWN);
1570 	}
1571 
1572 	/* Round-robin strategy */
1573 	if (priv->conf.enableRoundRobin || m->m_pkthdr.len < MP_MIN_FRAG_LEN) {
1574 		activeLinkNum = priv->lastLink++ % priv->numActiveLinks;
1575 		bzero(&distrib, priv->numActiveLinks * sizeof(distrib[0]));
1576 		distrib[activeLinkNum] = m->m_pkthdr.len;
1577 		goto deliver;
1578 	}
1579 
1580 	/* Strategy when all links are equivalent (optimize the common case) */
1581 	if (priv->allLinksEqual) {
1582 		const int fraction = m->m_pkthdr.len / priv->numActiveLinks;
1583 		int i, remain;
1584 
1585 		for (i = 0; i < priv->numActiveLinks; i++)
1586 			distrib[priv->lastLink++ % priv->numActiveLinks]
1587 			    = fraction;
1588 		remain = m->m_pkthdr.len - (fraction * priv->numActiveLinks);
1589 		while (remain > 0) {
1590 			distrib[priv->lastLink++ % priv->numActiveLinks]++;
1591 			remain--;
1592 		}
1593 		goto deliver;
1594 	}
1595 
1596 	/* Strategy when all links are not equivalent */
1597 	ng_ppp_mp_strategy(node, m->m_pkthdr.len, distrib);
1598 
1599 deliver:
1600 	/* Update stats */
1601 	priv->bundleStats.xmitFrames++;
1602 	priv->bundleStats.xmitOctets += m->m_pkthdr.len;
1603 
1604 	/* Send alloted portions of frame out on the link(s) */
1605 	for (firstFragment = 1, activeLinkNum = priv->numActiveLinks - 1;
1606 	    activeLinkNum >= 0; activeLinkNum--) {
1607 		const int linkNum = priv->activeLinks[activeLinkNum];
1608 		struct ng_ppp_link *const link = &priv->links[linkNum];
1609 
1610 		/* Deliver fragment(s) out the next link */
1611 		for ( ; distrib[activeLinkNum] > 0; firstFragment = 0) {
1612 			int len, lastFragment, error;
1613 			struct mbuf *m2;
1614 
1615 			/* Calculate fragment length; don't exceed link MTU */
1616 			len = distrib[activeLinkNum];
1617 			if (len > link->conf.mru - hdr_len)
1618 				len = link->conf.mru - hdr_len;
1619 			distrib[activeLinkNum] -= len;
1620 			lastFragment = (len == m->m_pkthdr.len);
1621 
1622 			/* Split off next fragment as "m2" */
1623 			m2 = m;
1624 			if (!lastFragment) {
1625 				struct mbuf *n = m_split(m, len, M_DONTWAIT);
1626 
1627 				if (n == NULL) {
1628 					NG_FREE_M(m);
1629 					return (ENOMEM);
1630 				}
1631 				m = n;
1632 			}
1633 
1634 			/* Prepend MP header */
1635 			if (priv->conf.xmitShortSeq) {
1636 				u_int16_t shdr;
1637 
1638 				shdr = priv->xseq;
1639 				priv->xseq =
1640 				    (priv->xseq + 1) & MP_SHORT_SEQ_MASK;
1641 				if (firstFragment)
1642 					shdr |= MP_SHORT_FIRST_FLAG;
1643 				if (lastFragment)
1644 					shdr |= MP_SHORT_LAST_FLAG;
1645 				shdr = htons(shdr);
1646 				m2 = ng_ppp_prepend(m2, &shdr, 2);
1647 			} else {
1648 				u_int32_t lhdr;
1649 
1650 				lhdr = priv->xseq;
1651 				priv->xseq =
1652 				    (priv->xseq + 1) & MP_LONG_SEQ_MASK;
1653 				if (firstFragment)
1654 					lhdr |= MP_LONG_FIRST_FLAG;
1655 				if (lastFragment)
1656 					lhdr |= MP_LONG_LAST_FLAG;
1657 				lhdr = htonl(lhdr);
1658 				m2 = ng_ppp_prepend(m2, &lhdr, 4);
1659 			}
1660 			if (m2 == NULL) {
1661 				if (!lastFragment)
1662 					m_freem(m);
1663 				return (ENOBUFS);
1664 			}
1665 
1666 			/* Send fragment */
1667 			if ((item = ng_package_data(m2, NG_NOFLAGS)) != NULL) {
1668 				error = ng_ppp_output(node, 0, PROT_MP,
1669 				    linkNum, item);
1670 				if (error != 0) {
1671 					if (!lastFragment)
1672 						NG_FREE_M(m);
1673 					return (error);
1674 				}
1675 			}
1676 		}
1677 	}
1678 
1679 	/* Done */
1680 	return (0);
1681 }
1682 
1683 /*
1684  * Computing the optimal fragmentation
1685  * -----------------------------------
1686  *
1687  * This routine tries to compute the optimal fragmentation pattern based
1688  * on each link's latency, bandwidth, and calculated additional latency.
1689  * The latter quantity is the additional latency caused by previously
1690  * written data that has not been transmitted yet.
1691  *
1692  * This algorithm is only useful when not all of the links have the
1693  * same latency and bandwidth values.
1694  *
1695  * The essential idea is to make the last bit of each fragment of the
1696  * frame arrive at the opposite end at the exact same time. This greedy
1697  * algorithm is optimal, in that no other scheduling could result in any
1698  * packet arriving any sooner unless packets are delivered out of order.
1699  *
1700  * Suppose link i has bandwidth b_i (in tens of bytes per milisecond) and
1701  * latency l_i (in miliseconds). Consider the function function f_i(t)
1702  * which is equal to the number of bytes that will have arrived at
1703  * the peer after t miliseconds if we start writing continuously at
1704  * time t = 0. Then f_i(t) = b_i * (t - l_i) = ((b_i * t) - (l_i * b_i).
1705  * That is, f_i(t) is a line with slope b_i and y-intersect -(l_i * b_i).
1706  * Note that the y-intersect is always <= zero because latency can't be
1707  * negative.  Note also that really the function is f_i(t) except when
1708  * f_i(t) is negative, in which case the function is zero.  To take
1709  * care of this, let Q_i(t) = { if (f_i(t) > 0) return 1; else return 0; }.
1710  * So the actual number of bytes that will have arrived at the peer after
1711  * t miliseconds is f_i(t) * Q_i(t).
1712  *
1713  * At any given time, each link has some additional latency a_i >= 0
1714  * due to previously written fragment(s) which are still in the queue.
1715  * This value is easily computed from the time since last transmission,
1716  * the previous latency value, the number of bytes written, and the
1717  * link's bandwidth.
1718  *
1719  * Assume that l_i includes any a_i already, and that the links are
1720  * sorted by latency, so that l_i <= l_{i+1}.
1721  *
1722  * Let N be the total number of bytes in the current frame we are sending.
1723  *
1724  * Suppose we were to start writing bytes at time t = 0 on all links
1725  * simultaneously, which is the most we can possibly do.  Then let
1726  * F(t) be equal to the total number of bytes received by the peer
1727  * after t miliseconds. Then F(t) = Sum_i (f_i(t) * Q_i(t)).
1728  *
1729  * Our goal is simply this: fragment the frame across the links such
1730  * that the peer is able to reconstruct the completed frame as soon as
1731  * possible, i.e., at the least possible value of t. Call this value t_0.
1732  *
1733  * Then it follows that F(t_0) = N. Our strategy is first to find the value
1734  * of t_0, and then deduce how many bytes to write to each link.
1735  *
1736  * Rewriting F(t_0):
1737  *
1738  *   t_0 = ( N + Sum_i ( l_i * b_i * Q_i(t_0) ) ) / Sum_i ( b_i * Q_i(t_0) )
1739  *
1740  * Now, we note that Q_i(t) is constant for l_i <= t <= l_{i+1}. t_0 will
1741  * lie in one of these ranges.  To find it, we just need to find the i such
1742  * that F(l_i) <= N <= F(l_{i+1}).  Then we compute all the constant values
1743  * for Q_i() in this range, plug in the remaining values, solving for t_0.
1744  *
1745  * Once t_0 is known, then the number of bytes to send on link i is
1746  * just f_i(t_0) * Q_i(t_0).
1747  *
1748  * In other words, we start allocating bytes to the links one at a time.
1749  * We keep adding links until the frame is completely sent.  Some links
1750  * may not get any bytes because their latency is too high.
1751  *
1752  * Is all this work really worth the trouble?  Depends on the situation.
1753  * The bigger the ratio of computer speed to link speed, and the more
1754  * important total bundle latency is (e.g., for interactive response time),
1755  * the more it's worth it.  There is however the cost of calling this
1756  * function for every frame.  The running time is O(n^2) where n is the
1757  * number of links that receive a non-zero number of bytes.
1758  *
1759  * Since latency is measured in miliseconds, the "resolution" of this
1760  * algorithm is one milisecond.
1761  *
1762  * To avoid this algorithm altogether, configure all links to have the
1763  * same latency and bandwidth.
1764  */
1765 static void
1766 ng_ppp_mp_strategy(node_p node, int len, int *distrib)
1767 {
1768 	const priv_p priv = NG_NODE_PRIVATE(node);
1769 	int latency[NG_PPP_MAX_LINKS];
1770 	int sortByLatency[NG_PPP_MAX_LINKS];
1771 	int activeLinkNum;
1772 	int t0, total, topSum, botSum;
1773 	struct timeval now;
1774 	int i, numFragments;
1775 
1776 	/* If only one link, this gets real easy */
1777 	if (priv->numActiveLinks == 1) {
1778 		distrib[0] = len;
1779 		return;
1780 	}
1781 
1782 	/* Get current time */
1783 	getmicrouptime(&now);
1784 
1785 	/* Compute latencies for each link at this point in time */
1786 	for (activeLinkNum = 0;
1787 	    activeLinkNum < priv->numActiveLinks; activeLinkNum++) {
1788 		struct ng_ppp_link *alink;
1789 		struct timeval diff;
1790 		int xmitBytes;
1791 
1792 		/* Start with base latency value */
1793 		alink = &priv->links[priv->activeLinks[activeLinkNum]];
1794 		latency[activeLinkNum] = alink->latency;
1795 		sortByLatency[activeLinkNum] = activeLinkNum;	/* see below */
1796 
1797 		/* Any additional latency? */
1798 		if (alink->bytesInQueue == 0)
1799 			continue;
1800 
1801 		/* Compute time delta since last write */
1802 		diff = now;
1803 		timevalsub(&diff, &alink->lastWrite);
1804 		if (now.tv_sec < 0 || diff.tv_sec >= 10) {	/* sanity */
1805 			alink->bytesInQueue = 0;
1806 			continue;
1807 		}
1808 
1809 		/* How many bytes could have transmitted since last write? */
1810 		xmitBytes = (alink->conf.bandwidth * diff.tv_sec)
1811 		    + (alink->conf.bandwidth * (diff.tv_usec / 1000)) / 100;
1812 		alink->bytesInQueue -= xmitBytes;
1813 		if (alink->bytesInQueue < 0)
1814 			alink->bytesInQueue = 0;
1815 		else
1816 			latency[activeLinkNum] +=
1817 			    (100 * alink->bytesInQueue) / alink->conf.bandwidth;
1818 	}
1819 
1820 	/* Sort active links by latency */
1821 	qsort_r(sortByLatency,
1822 	    priv->numActiveLinks, sizeof(*sortByLatency), latency, ng_ppp_intcmp);
1823 
1824 	/* Find the interval we need (add links in sortByLatency[] order) */
1825 	for (numFragments = 1;
1826 	    numFragments < priv->numActiveLinks; numFragments++) {
1827 		for (total = i = 0; i < numFragments; i++) {
1828 			int flowTime;
1829 
1830 			flowTime = latency[sortByLatency[numFragments]]
1831 			    - latency[sortByLatency[i]];
1832 			total += ((flowTime * priv->links[
1833 			    priv->activeLinks[sortByLatency[i]]].conf.bandwidth)
1834 			    	+ 99) / 100;
1835 		}
1836 		if (total >= len)
1837 			break;
1838 	}
1839 
1840 	/* Solve for t_0 in that interval */
1841 	for (topSum = botSum = i = 0; i < numFragments; i++) {
1842 		int bw = priv->links[
1843 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1844 
1845 		topSum += latency[sortByLatency[i]] * bw;	/* / 100 */
1846 		botSum += bw;					/* / 100 */
1847 	}
1848 	t0 = ((len * 100) + topSum + botSum / 2) / botSum;
1849 
1850 	/* Compute f_i(t_0) all i */
1851 	bzero(distrib, priv->numActiveLinks * sizeof(*distrib));
1852 	for (total = i = 0; i < numFragments; i++) {
1853 		int bw = priv->links[
1854 		    priv->activeLinks[sortByLatency[i]]].conf.bandwidth;
1855 
1856 		distrib[sortByLatency[i]] =
1857 		    (bw * (t0 - latency[sortByLatency[i]]) + 50) / 100;
1858 		total += distrib[sortByLatency[i]];
1859 	}
1860 
1861 	/* Deal with any rounding error */
1862 	if (total < len) {
1863 		struct ng_ppp_link *fastLink =
1864 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1865 		int fast = 0;
1866 
1867 		/* Find the fastest link */
1868 		for (i = 1; i < numFragments; i++) {
1869 			struct ng_ppp_link *const link =
1870 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1871 
1872 			if (link->conf.bandwidth > fastLink->conf.bandwidth) {
1873 				fast = i;
1874 				fastLink = link;
1875 			}
1876 		}
1877 		distrib[sortByLatency[fast]] += len - total;
1878 	} else while (total > len) {
1879 		struct ng_ppp_link *slowLink =
1880 		    &priv->links[priv->activeLinks[sortByLatency[0]]];
1881 		int delta, slow = 0;
1882 
1883 		/* Find the slowest link that still has bytes to remove */
1884 		for (i = 1; i < numFragments; i++) {
1885 			struct ng_ppp_link *const link =
1886 			    &priv->links[priv->activeLinks[sortByLatency[i]]];
1887 
1888 			if (distrib[sortByLatency[slow]] == 0
1889 			  || (distrib[sortByLatency[i]] > 0
1890 			    && link->conf.bandwidth <
1891 			      slowLink->conf.bandwidth)) {
1892 				slow = i;
1893 				slowLink = link;
1894 			}
1895 		}
1896 		delta = total - len;
1897 		if (delta > distrib[sortByLatency[slow]])
1898 			delta = distrib[sortByLatency[slow]];
1899 		distrib[sortByLatency[slow]] -= delta;
1900 		total -= delta;
1901 	}
1902 }
1903 
1904 /*
1905  * Compare two integers
1906  */
1907 static int
1908 ng_ppp_intcmp(void *latency, const void *v1, const void *v2)
1909 {
1910 	const int index1 = *((const int *) v1);
1911 	const int index2 = *((const int *) v2);
1912 
1913 	return ((int *)latency)[index1] - ((int *)latency)[index2];
1914 }
1915 
1916 /*
1917  * Prepend a possibly compressed PPP protocol number in front of a frame
1918  */
1919 static struct mbuf *
1920 ng_ppp_addproto(struct mbuf *m, int proto, int compOK)
1921 {
1922 	if (compOK && PROT_COMPRESSABLE(proto)) {
1923 		u_char pbyte = (u_char)proto;
1924 
1925 		return ng_ppp_prepend(m, &pbyte, 1);
1926 	} else {
1927 		u_int16_t pword = htons((u_int16_t)proto);
1928 
1929 		return ng_ppp_prepend(m, &pword, 2);
1930 	}
1931 }
1932 
1933 /*
1934  * Prepend some bytes to an mbuf
1935  */
1936 static struct mbuf *
1937 ng_ppp_prepend(struct mbuf *m, const void *buf, int len)
1938 {
1939 	M_PREPEND(m, len, M_DONTWAIT);
1940 	if (m == NULL || (m->m_len < len && (m = m_pullup(m, len)) == NULL))
1941 		return (NULL);
1942 	bcopy(buf, mtod(m, u_char *), len);
1943 	return (m);
1944 }
1945 
1946 /*
1947  * Update private information that is derived from other private information
1948  */
1949 static void
1950 ng_ppp_update(node_p node, int newConf)
1951 {
1952 	const priv_p priv = NG_NODE_PRIVATE(node);
1953 	int i;
1954 
1955 	/* Update active status for VJ Compression */
1956 	priv->vjCompHooked = priv->hooks[HOOK_INDEX_VJC_IP] != NULL
1957 	    && priv->hooks[HOOK_INDEX_VJC_COMP] != NULL
1958 	    && priv->hooks[HOOK_INDEX_VJC_UNCOMP] != NULL
1959 	    && priv->hooks[HOOK_INDEX_VJC_VJIP] != NULL;
1960 
1961 	/* Increase latency for each link an amount equal to one MP header */
1962 	if (newConf) {
1963 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1964 			int hdrBytes;
1965 
1966 			hdrBytes = (priv->links[i].conf.enableACFComp ? 0 : 2)
1967 			    + (priv->links[i].conf.enableProtoComp ? 1 : 2)
1968 			    + (priv->conf.xmitShortSeq ? 2 : 4);
1969 			priv->links[i].latency =
1970 			    priv->links[i].conf.latency +
1971 			    ((hdrBytes * priv->links[i].conf.bandwidth) + 50)
1972 				/ 100;
1973 		}
1974 	}
1975 
1976 	/* Update list of active links */
1977 	bzero(&priv->activeLinks, sizeof(priv->activeLinks));
1978 	priv->numActiveLinks = 0;
1979 	priv->allLinksEqual = 1;
1980 	for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
1981 		struct ng_ppp_link *const link = &priv->links[i];
1982 
1983 		/* Is link active? */
1984 		if (link->conf.enableLink && link->hook != NULL) {
1985 			struct ng_ppp_link *link0;
1986 
1987 			/* Add link to list of active links */
1988 			priv->activeLinks[priv->numActiveLinks++] = i;
1989 			link0 = &priv->links[priv->activeLinks[0]];
1990 
1991 			/* Determine if all links are still equal */
1992 			if (link->latency != link0->latency
1993 			  || link->conf.bandwidth != link0->conf.bandwidth)
1994 				priv->allLinksEqual = 0;
1995 
1996 			/* Initialize rec'd sequence number */
1997 			if (link->seq == MP_NOSEQ) {
1998 				link->seq = (link == link0) ?
1999 				    MP_INITIAL_SEQ : link0->seq;
2000 			}
2001 		} else
2002 			link->seq = MP_NOSEQ;
2003 	}
2004 
2005 	/* Update MP state as multi-link is active or not */
2006 	if (priv->conf.enableMultilink && priv->numActiveLinks > 0)
2007 		ng_ppp_start_frag_timer(node);
2008 	else {
2009 		ng_ppp_stop_frag_timer(node);
2010 		ng_ppp_frag_reset(node);
2011 		priv->xseq = MP_INITIAL_SEQ;
2012 		priv->mseq = MP_INITIAL_SEQ;
2013 		for (i = 0; i < NG_PPP_MAX_LINKS; i++) {
2014 			struct ng_ppp_link *const link = &priv->links[i];
2015 
2016 			bzero(&link->lastWrite, sizeof(link->lastWrite));
2017 			link->bytesInQueue = 0;
2018 			link->seq = MP_NOSEQ;
2019 		}
2020 	}
2021 }
2022 
2023 /*
2024  * Determine if a new configuration would represent a valid change
2025  * from the current configuration and link activity status.
2026  */
2027 static int
2028 ng_ppp_config_valid(node_p node, const struct ng_ppp_node_conf *newConf)
2029 {
2030 	const priv_p priv = NG_NODE_PRIVATE(node);
2031 	int i, newNumLinksActive;
2032 
2033 	/* Check per-link config and count how many links would be active */
2034 	for (newNumLinksActive = i = 0; i < NG_PPP_MAX_LINKS; i++) {
2035 		if (newConf->links[i].enableLink && priv->links[i].hook != NULL)
2036 			newNumLinksActive++;
2037 		if (!newConf->links[i].enableLink)
2038 			continue;
2039 		if (newConf->links[i].mru < MP_MIN_LINK_MRU)
2040 			return (0);
2041 		if (newConf->links[i].bandwidth == 0)
2042 			return (0);
2043 		if (newConf->links[i].bandwidth > NG_PPP_MAX_BANDWIDTH)
2044 			return (0);
2045 		if (newConf->links[i].latency > NG_PPP_MAX_LATENCY)
2046 			return (0);
2047 	}
2048 
2049 	/* Check bundle parameters */
2050 	if (newConf->bund.enableMultilink && newConf->bund.mrru < MP_MIN_MRRU)
2051 		return (0);
2052 
2053 	/* Disallow changes to multi-link configuration while MP is active */
2054 	if (priv->numActiveLinks > 0 && newNumLinksActive > 0) {
2055 		if (!priv->conf.enableMultilink
2056 				!= !newConf->bund.enableMultilink
2057 		    || !priv->conf.xmitShortSeq != !newConf->bund.xmitShortSeq
2058 		    || !priv->conf.recvShortSeq != !newConf->bund.recvShortSeq)
2059 			return (0);
2060 	}
2061 
2062 	/* At most one link can be active unless multi-link is enabled */
2063 	if (!newConf->bund.enableMultilink && newNumLinksActive > 1)
2064 		return (0);
2065 
2066 	/* Configuration change would be valid */
2067 	return (1);
2068 }
2069 
2070 /*
2071  * Free all entries in the fragment queue
2072  */
2073 static void
2074 ng_ppp_frag_reset(node_p node)
2075 {
2076 	const priv_p priv = NG_NODE_PRIVATE(node);
2077 	struct ng_ppp_frag *qent, *qnext;
2078 
2079 	for (qent = TAILQ_FIRST(&priv->frags); qent; qent = qnext) {
2080 		qnext = TAILQ_NEXT(qent, f_qent);
2081 		NG_FREE_M(qent->data);
2082 		FREE(qent, M_NETGRAPH_PPP);
2083 	}
2084 	TAILQ_INIT(&priv->frags);
2085 	priv->qlen = 0;
2086 }
2087 
2088 /*
2089  * Start fragment queue timer
2090  */
2091 static void
2092 ng_ppp_start_frag_timer(node_p node)
2093 {
2094 	const priv_p priv = NG_NODE_PRIVATE(node);
2095 
2096 	if (!(callout_pending(&priv->fragTimer)))
2097 		ng_callout(&priv->fragTimer, node, NULL, MP_FRAGTIMER_INTERVAL,
2098 		    ng_ppp_frag_timeout, NULL, 0);
2099 }
2100 
2101 /*
2102  * Stop fragment queue timer
2103  */
2104 static void
2105 ng_ppp_stop_frag_timer(node_p node)
2106 {
2107 	const priv_p priv = NG_NODE_PRIVATE(node);
2108 
2109 	if (callout_pending(&priv->fragTimer))
2110 		ng_uncallout(&priv->fragTimer, node);
2111 }
2112