1/*
2 * Perform PPPoE discovery
3 *
4 * Copyright (C) 2000-2001 by Roaring Penguin Software Inc.
5 * Copyright (C) 2004 Marco d'Itri <md@linux.it>
6 *
7 * This program may be distributed according to the terms of the GNU
8 * General Public License, version 2 or (at your option) any later version.
9 *
10 */
11
12#include <stdio.h>
13#include <stdlib.h>
14#include <unistd.h>
15#include <errno.h>
16#include <string.h>
17
18#include "pppoe.h"
19
20#ifdef HAVE_UNISTD_H
21#include <unistd.h>
22#endif
23
24#ifdef HAVE_NETPACKET_PACKET_H
25#include <netpacket/packet.h>
26#elif defined(HAVE_LINUX_IF_PACKET_H)
27#include <linux/if_packet.h>
28#endif
29
30#ifdef HAVE_NET_ETHERNET_H
31#include <net/ethernet.h>
32#endif
33
34#ifdef HAVE_ASM_TYPES_H
35#include <asm/types.h>
36#endif
37
38#ifdef HAVE_SYS_IOCTL_H
39#include <sys/ioctl.h>
40#endif
41
42#include <errno.h>
43#include <stdlib.h>
44#include <string.h>
45
46#ifdef HAVE_NET_IF_ARP_H
47#include <net/if_arp.h>
48#endif
49
50char *xstrdup(const char *s);
51void usage(void);
52
53void die(int status)
54{
55	exit(status);
56}
57
58/* Initialize frame types to RFC 2516 values.  Some broken peers apparently
59   use different frame types... sigh... */
60
61UINT16_t Eth_PPPOE_Discovery = ETH_PPPOE_DISCOVERY;
62UINT16_t Eth_PPPOE_Session   = ETH_PPPOE_SESSION;
63
64/**********************************************************************
65*%FUNCTION: etherType
66*%ARGUMENTS:
67* packet -- a received PPPoE packet
68*%RETURNS:
69* ethernet packet type (see /usr/include/net/ethertypes.h)
70*%DESCRIPTION:
71* Checks the ethernet packet header to determine its type.
72* We should only be receveing DISCOVERY and SESSION types if the BPF
73* is set up correctly.  Logs an error if an unexpected type is received.
74* Note that the ethernet type names come from "pppoe.h" and the packet
75* packet structure names use the LINUX dialect to maintain consistency
76* with the rest of this file.  See the BSD section of "pppoe.h" for
77* translations of the data structure names.
78***********************************************************************/
79UINT16_t
80etherType(PPPoEPacket *packet)
81{
82    UINT16_t type = (UINT16_t) ntohs(packet->ethHdr.h_proto);
83    if (type != Eth_PPPOE_Discovery && type != Eth_PPPOE_Session) {
84	fprintf(stderr, "Invalid ether type 0x%x\n", type);
85    }
86    return type;
87}
88
89/**********************************************************************
90*%FUNCTION: openInterface
91*%ARGUMENTS:
92* ifname -- name of interface
93* type -- Ethernet frame type
94* hwaddr -- if non-NULL, set to the hardware address
95*%RETURNS:
96* A raw socket for talking to the Ethernet card.  Exits on error.
97*%DESCRIPTION:
98* Opens a raw Ethernet socket
99***********************************************************************/
100int
101openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr)
102{
103    int optval=1;
104    int fd;
105    struct ifreq ifr;
106    int domain, stype;
107
108#ifdef HAVE_STRUCT_SOCKADDR_LL
109    struct sockaddr_ll sa;
110#else
111    struct sockaddr sa;
112#endif
113
114    memset(&sa, 0, sizeof(sa));
115
116#ifdef HAVE_STRUCT_SOCKADDR_LL
117    domain = PF_PACKET;
118    stype = SOCK_RAW;
119#else
120    domain = PF_INET;
121    stype = SOCK_PACKET;
122#endif
123
124    if ((fd = socket(domain, stype, htons(type))) < 0) {
125	/* Give a more helpful message for the common error case */
126	if (errno == EPERM) {
127	    rp_fatal("Cannot create raw socket -- pppoe must be run as root.");
128	}
129	fatalSys("socket");
130    }
131
132    if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &optval, sizeof(optval)) < 0) {
133	fatalSys("setsockopt");
134    }
135
136    /* Fill in hardware address */
137    if (hwaddr) {
138	strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
139	if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) {
140	    fatalSys("ioctl(SIOCGIFHWADDR)");
141	}
142	memcpy(hwaddr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
143#ifdef ARPHRD_ETHER
144	if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
145	    char buffer[256];
146	    sprintf(buffer, "Interface %.16s is not Ethernet", ifname);
147	    rp_fatal(buffer);
148	}
149#endif
150	if (NOT_UNICAST(hwaddr)) {
151	    char buffer[256];
152	    sprintf(buffer,
153		    "Interface %.16s has broadcast/multicast MAC address??",
154		    ifname);
155	    rp_fatal(buffer);
156	}
157    }
158
159    /* Sanity check on MTU */
160    strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
161    if (ioctl(fd, SIOCGIFMTU, &ifr) < 0) {
162	fatalSys("ioctl(SIOCGIFMTU)");
163    }
164    if (ifr.ifr_mtu < ETH_DATA_LEN) {
165	fprintf(stderr, "Interface %.16s has MTU of %d -- should be %d.\n",
166	      ifname, ifr.ifr_mtu, ETH_DATA_LEN);
167	fprintf(stderr, "You may have serious connection problems.\n");
168    }
169
170#ifdef HAVE_STRUCT_SOCKADDR_LL
171    /* Get interface index */
172    sa.sll_family = AF_PACKET;
173    sa.sll_protocol = htons(type);
174
175    strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
176    if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) {
177	fatalSys("ioctl(SIOCFIGINDEX): Could not get interface index");
178    }
179    sa.sll_ifindex = ifr.ifr_ifindex;
180
181#else
182    strcpy(sa.sa_data, ifname);
183#endif
184
185    /* We're only interested in packets on specified interface */
186    if (bind(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
187	fatalSys("bind");
188    }
189
190    return fd;
191}
192
193
194/***********************************************************************
195*%FUNCTION: sendPacket
196*%ARGUMENTS:
197* sock -- socket to send to
198* pkt -- the packet to transmit
199* size -- size of packet (in bytes)
200*%RETURNS:
201* 0 on success; -1 on failure
202*%DESCRIPTION:
203* Transmits a packet
204***********************************************************************/
205int
206sendPacket(PPPoEConnection *conn, int sock, PPPoEPacket *pkt, int size)
207{
208#if defined(HAVE_STRUCT_SOCKADDR_LL)
209    if (send(sock, pkt, size, 0) < 0) {
210	sysErr("send (sendPacket)");
211	return -1;
212    }
213#else
214    struct sockaddr sa;
215
216    if (!conn) {
217	rp_fatal("relay and server not supported on Linux 2.0 kernels");
218    }
219    strcpy(sa.sa_data, conn->ifName);
220    if (sendto(sock, pkt, size, 0, &sa, sizeof(sa)) < 0) {
221	sysErr("sendto (sendPacket)");
222	return -1;
223    }
224#endif
225    return 0;
226}
227
228/***********************************************************************
229*%FUNCTION: receivePacket
230*%ARGUMENTS:
231* sock -- socket to read from
232* pkt -- place to store the received packet
233* size -- set to size of packet in bytes
234*%RETURNS:
235* >= 0 if all OK; < 0 if error
236*%DESCRIPTION:
237* Receives a packet
238***********************************************************************/
239int
240receivePacket(int sock, PPPoEPacket *pkt, int *size)
241{
242    if ((*size = recv(sock, pkt, sizeof(PPPoEPacket), 0)) < 0) {
243	sysErr("recv (receivePacket)");
244	return -1;
245    }
246    return 0;
247}
248
249/**********************************************************************
250*%FUNCTION: parsePacket
251*%ARGUMENTS:
252* packet -- the PPPoE discovery packet to parse
253* func -- function called for each tag in the packet
254* extra -- an opaque data pointer supplied to parsing function
255*%RETURNS:
256* 0 if everything went well; -1 if there was an error
257*%DESCRIPTION:
258* Parses a PPPoE discovery packet, calling "func" for each tag in the packet.
259* "func" is passed the additional argument "extra".
260***********************************************************************/
261int
262parsePacket(PPPoEPacket *packet, ParseFunc *func, void *extra)
263{
264    UINT16_t len = ntohs(packet->length);
265    unsigned char *curTag;
266    UINT16_t tagType, tagLen;
267
268    if (PPPOE_VER(packet->vertype) != 1) {
269	fprintf(stderr, "Invalid PPPoE version (%d)\n",
270		PPPOE_VER(packet->vertype));
271	return -1;
272    }
273    if (PPPOE_TYPE(packet->vertype) != 1) {
274	fprintf(stderr, "Invalid PPPoE type (%d)\n",
275		PPPOE_TYPE(packet->vertype));
276	return -1;
277    }
278
279    /* Do some sanity checks on packet */
280    if (len > ETH_JUMBO_LEN - PPPOE_OVERHEAD) { /* 6-byte overhead for PPPoE header */
281	fprintf(stderr, "Invalid PPPoE packet length (%u)\n", len);
282	return -1;
283    }
284
285    /* Step through the tags */
286    curTag = packet->payload;
287    while(curTag - packet->payload < len) {
288	/* Alignment is not guaranteed, so do this by hand... */
289	tagType = (curTag[0] << 8) + curTag[1];
290	tagLen = (curTag[2] << 8) + curTag[3];
291	if (tagType == TAG_END_OF_LIST) {
292	    return 0;
293	}
294	if ((curTag - packet->payload) + tagLen + TAG_HDR_SIZE > len) {
295	    fprintf(stderr, "Invalid PPPoE tag length (%u)\n", tagLen);
296	    return -1;
297	}
298	func(tagType, tagLen, curTag+TAG_HDR_SIZE, extra);
299	curTag = curTag + TAG_HDR_SIZE + tagLen;
300    }
301    return 0;
302}
303
304/**********************************************************************
305*%FUNCTION: parseForHostUniq
306*%ARGUMENTS:
307* type -- tag type
308* len -- tag length
309* data -- tag data.
310* extra -- user-supplied pointer.  This is assumed to be a pointer to int.
311*%RETURNS:
312* Nothing
313*%DESCRIPTION:
314* If a HostUnique tag is found which matches our PID, sets *extra to 1.
315***********************************************************************/
316void
317parseForHostUniq(UINT16_t type, UINT16_t len, unsigned char *data,
318		 void *extra)
319{
320    int *val = (int *) extra;
321    if (type == TAG_HOST_UNIQ && len == sizeof(pid_t)) {
322	pid_t tmp;
323	memcpy(&tmp, data, len);
324	if (tmp == getpid()) {
325	    *val = 1;
326	}
327    }
328}
329
330/**********************************************************************
331*%FUNCTION: packetIsForMe
332*%ARGUMENTS:
333* conn -- PPPoE connection info
334* packet -- a received PPPoE packet
335*%RETURNS:
336* 1 if packet is for this PPPoE daemon; 0 otherwise.
337*%DESCRIPTION:
338* If we are using the Host-Unique tag, verifies that packet contains
339* our unique identifier.
340***********************************************************************/
341int
342packetIsForMe(PPPoEConnection *conn, PPPoEPacket *packet)
343{
344    int forMe = 0;
345
346    /* If packet is not directed to our MAC address, forget it */
347    if (memcmp(packet->ethHdr.h_dest, conn->myEth, ETH_ALEN)) return 0;
348
349    /* If we're not using the Host-Unique tag, then accept the packet */
350    if (!conn->useHostUniq) return 1;
351
352    parsePacket(packet, parseForHostUniq, &forMe);
353    return forMe;
354}
355
356/**********************************************************************
357*%FUNCTION: parsePADOTags
358*%ARGUMENTS:
359* type -- tag type
360* len -- tag length
361* data -- tag data
362* extra -- extra user data.  Should point to a PacketCriteria structure
363*          which gets filled in according to selected AC name and service
364*          name.
365*%RETURNS:
366* Nothing
367*%DESCRIPTION:
368* Picks interesting tags out of a PADO packet
369***********************************************************************/
370void
371parsePADOTags(UINT16_t type, UINT16_t len, unsigned char *data,
372	      void *extra)
373{
374    struct PacketCriteria *pc = (struct PacketCriteria *) extra;
375    PPPoEConnection *conn = pc->conn;
376    int i;
377
378    switch(type) {
379    case TAG_AC_NAME:
380	pc->seenACName = 1;
381	printf("Access-Concentrator: %.*s\n", (int) len, data);
382	if (conn->acName && len == strlen(conn->acName) &&
383	    !strncmp((char *) data, conn->acName, len)) {
384	    pc->acNameOK = 1;
385	}
386	break;
387    case TAG_SERVICE_NAME:
388	pc->seenServiceName = 1;
389	if (len > 0) {
390	    printf("       Service-Name: %.*s\n", (int) len, data);
391	}
392	if (conn->serviceName && len == strlen(conn->serviceName) &&
393	    !strncmp((char *) data, conn->serviceName, len)) {
394	    pc->serviceNameOK = 1;
395	}
396	break;
397    case TAG_AC_COOKIE:
398	printf("Got a cookie:");
399	/* Print first 20 bytes of cookie */
400	for (i=0; i<len && i < 20; i++) {
401	    printf(" %02x", (unsigned) data[i]);
402	}
403	if (i < len) printf("...");
404	printf("\n");
405	conn->cookie.type = htons(type);
406	conn->cookie.length = htons(len);
407	memcpy(conn->cookie.payload, data, len);
408	break;
409    case TAG_RELAY_SESSION_ID:
410	printf("Got a Relay-ID:");
411	/* Print first 20 bytes of relay ID */
412	for (i=0; i<len && i < 20; i++) {
413	    printf(" %02x", (unsigned) data[i]);
414	}
415	if (i < len) printf("...");
416	printf("\n");
417	conn->relayId.type = htons(type);
418	conn->relayId.length = htons(len);
419	memcpy(conn->relayId.payload, data, len);
420	break;
421    case TAG_SERVICE_NAME_ERROR:
422	printf("Got a Service-Name-Error tag: %.*s\n", (int) len, data);
423	break;
424    case TAG_AC_SYSTEM_ERROR:
425	printf("Got a System-Error tag: %.*s\n", (int) len, data);
426	break;
427    case TAG_GENERIC_ERROR:
428	printf("Got a Generic-Error tag: %.*s\n", (int) len, data);
429	break;
430    }
431}
432
433/***********************************************************************
434*%FUNCTION: sendPADI
435*%ARGUMENTS:
436* conn -- PPPoEConnection structure
437*%RETURNS:
438* Nothing
439*%DESCRIPTION:
440* Sends a PADI packet
441***********************************************************************/
442void
443sendPADI(PPPoEConnection *conn)
444{
445    PPPoEPacket packet;
446    unsigned char *cursor = packet.payload;
447    PPPoETag *svc = (PPPoETag *) (&packet.payload);
448    UINT16_t namelen = 0;
449    UINT16_t plen;
450
451    if (conn->serviceName) {
452	namelen = (UINT16_t) strlen(conn->serviceName);
453    }
454    plen = TAG_HDR_SIZE + namelen;
455    CHECK_ROOM(cursor, packet.payload, plen);
456
457    /* Set destination to Ethernet broadcast address */
458    memset(packet.ethHdr.h_dest, 0xFF, ETH_ALEN);
459    memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN);
460
461    packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery);
462    packet.vertype = PPPOE_VER_TYPE(1, 1);
463    packet.code = CODE_PADI;
464    packet.session = 0;
465
466    svc->type = TAG_SERVICE_NAME;
467    svc->length = htons(namelen);
468    CHECK_ROOM(cursor, packet.payload, namelen+TAG_HDR_SIZE);
469
470    if (conn->serviceName) {
471	memcpy(svc->payload, conn->serviceName, strlen(conn->serviceName));
472    }
473    cursor += namelen + TAG_HDR_SIZE;
474
475    /* If we're using Host-Uniq, copy it over */
476    if (conn->useHostUniq) {
477	PPPoETag hostUniq;
478	pid_t pid = getpid();
479	hostUniq.type = htons(TAG_HOST_UNIQ);
480	hostUniq.length = htons(sizeof(pid));
481	memcpy(hostUniq.payload, &pid, sizeof(pid));
482	CHECK_ROOM(cursor, packet.payload, sizeof(pid) + TAG_HDR_SIZE);
483	memcpy(cursor, &hostUniq, sizeof(pid) + TAG_HDR_SIZE);
484	cursor += sizeof(pid) + TAG_HDR_SIZE;
485	plen += sizeof(pid) + TAG_HDR_SIZE;
486    }
487
488    packet.length = htons(plen);
489
490    sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE));
491    if (conn->debugFile) {
492	dumpPacket(conn->debugFile, &packet, "SENT");
493	fprintf(conn->debugFile, "\n");
494	fflush(conn->debugFile);
495    }
496}
497
498/**********************************************************************
499*%FUNCTION: waitForPADO
500*%ARGUMENTS:
501* conn -- PPPoEConnection structure
502* timeout -- how long to wait (in seconds)
503*%RETURNS:
504* Nothing
505*%DESCRIPTION:
506* Waits for a PADO packet and copies useful information
507***********************************************************************/
508void
509waitForPADO(PPPoEConnection *conn, int timeout)
510{
511    fd_set readable;
512    int r;
513    struct timeval tv;
514    PPPoEPacket packet;
515    int len;
516
517    struct PacketCriteria pc;
518    pc.conn          = conn;
519    pc.acNameOK      = (conn->acName)      ? 0 : 1;
520    pc.serviceNameOK = (conn->serviceName) ? 0 : 1;
521    pc.seenACName    = 0;
522    pc.seenServiceName = 0;
523    conn->error = 0;
524
525    do {
526	if (BPF_BUFFER_IS_EMPTY) {
527	    tv.tv_sec = timeout;
528	    tv.tv_usec = 0;
529
530	    FD_ZERO(&readable);
531	    FD_SET(conn->discoverySocket, &readable);
532
533	    while(1) {
534		r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
535		if (r >= 0 || errno != EINTR) break;
536	    }
537	    if (r < 0) {
538		perror("select (waitForPADO)");
539		return;
540	    }
541	    if (r == 0) return;        /* Timed out */
542	}
543
544	/* Get the packet */
545	receivePacket(conn->discoverySocket, &packet, &len);
546
547	/* Check length */
548	if (ntohs(packet.length) + HDR_SIZE > len) {
549	    fprintf(stderr, "Bogus PPPoE length field (%u)\n",
550		   (unsigned int) ntohs(packet.length));
551	    continue;
552	}
553
554#ifdef USE_BPF
555	/* If it's not a Discovery packet, loop again */
556	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
557#endif
558
559	if (conn->debugFile) {
560	    dumpPacket(conn->debugFile, &packet, "RCVD");
561	    fprintf(conn->debugFile, "\n");
562	    fflush(conn->debugFile);
563	}
564	/* If it's not for us, loop again */
565	if (!packetIsForMe(conn, &packet)) continue;
566
567	if (packet.code == CODE_PADO) {
568	    if (BROADCAST(packet.ethHdr.h_source)) {
569		fprintf(stderr, "Ignoring PADO packet from broadcast MAC address\n");
570		continue;
571	    }
572	    parsePacket(&packet, parsePADOTags, &pc);
573	    if (conn->error)
574		return;
575	    if (!pc.seenACName) {
576		fprintf(stderr, "Ignoring PADO packet with no AC-Name tag\n");
577		continue;
578	    }
579	    if (!pc.seenServiceName) {
580		fprintf(stderr, "Ignoring PADO packet with no Service-Name tag\n");
581		continue;
582	    }
583	    conn->numPADOs++;
584	    printf("--------------------------------------------------\n");
585	    if (pc.acNameOK && pc.serviceNameOK) {
586		memcpy(conn->peerEth, packet.ethHdr.h_source, ETH_ALEN);
587		if (conn->printACNames) {
588		    printf("AC-Ethernet-Address: %02x:%02x:%02x:%02x:%02x:%02x\n",
589			   (unsigned) conn->peerEth[0],
590			   (unsigned) conn->peerEth[1],
591			   (unsigned) conn->peerEth[2],
592			   (unsigned) conn->peerEth[3],
593			   (unsigned) conn->peerEth[4],
594			   (unsigned) conn->peerEth[5]);
595		    continue;
596		}
597		conn->discoveryState = STATE_RECEIVED_PADO;
598		break;
599	    }
600	}
601    } while (conn->discoveryState != STATE_RECEIVED_PADO);
602}
603
604/**********************************************************************
605*%FUNCTION: discovery
606*%ARGUMENTS:
607* conn -- PPPoE connection info structure
608*%RETURNS:
609* Nothing
610*%DESCRIPTION:
611* Performs the PPPoE discovery phase
612***********************************************************************/
613void
614discovery(PPPoEConnection *conn)
615{
616    int padiAttempts = 0;
617    int timeout = PADI_TIMEOUT;
618
619    conn->discoverySocket =
620	openInterface(conn->ifName, Eth_PPPOE_Discovery, conn->myEth);
621
622    do {
623	padiAttempts++;
624	if (padiAttempts > MAX_PADI_ATTEMPTS) {
625	    fprintf(stderr, "Timeout waiting for PADO packets\n");
626	    close(conn->discoverySocket);
627	    conn->discoverySocket = -1;
628	    return;
629	}
630	sendPADI(conn);
631	conn->discoveryState = STATE_SENT_PADI;
632	waitForPADO(conn, timeout);
633    } while (!conn->numPADOs);
634}
635
636int main(int argc, char *argv[])
637{
638    int opt;
639    PPPoEConnection *conn;
640
641    conn = malloc(sizeof(PPPoEConnection));
642    if (!conn)
643	fatalSys("malloc");
644
645    memset(conn, 0, sizeof(PPPoEConnection));
646
647    while ((opt = getopt(argc, argv, "I:D:VUAS:C:h")) > 0) {
648	switch(opt) {
649	case 'S':
650	    conn->serviceName = xstrdup(optarg);
651	    break;
652	case 'C':
653	    conn->acName = xstrdup(optarg);
654	    break;
655	case 'U':
656	    conn->useHostUniq = 1;
657	    break;
658	case 'D':
659	    conn->debugFile = fopen(optarg, "w");
660	    if (!conn->debugFile) {
661		fprintf(stderr, "Could not open %s: %s\n",
662			optarg, strerror(errno));
663		exit(1);
664	    }
665	    fprintf(conn->debugFile, "pppoe-discovery %s\n", RP_VERSION);
666	    break;
667	case 'I':
668	    conn->ifName = xstrdup(optarg);
669	    break;
670	case 'A':
671	    /* this is the default */
672	    break;
673	case 'V':
674	case 'h':
675	    usage();
676	    exit(0);
677	default:
678	    usage();
679	    exit(1);
680	}
681    }
682
683    /* default interface name */
684    if (!conn->ifName)
685	conn->ifName = strdup("eth0");
686
687    conn->discoverySocket = -1;
688    conn->sessionSocket = -1;
689    conn->printACNames = 1;
690
691    discovery(conn);
692    exit(0);
693}
694
695void rp_fatal(char const *str)
696{
697    fprintf(stderr, "%s\n", str);
698    exit(1);
699}
700
701void fatalSys(char const *str)
702{
703    perror(str);
704    exit(1);
705}
706
707void sysErr(char const *str)
708{
709    rp_fatal(str);
710}
711
712char *xstrdup(const char *s)
713{
714    register char *ret = strdup(s);
715    if (!ret)
716	sysErr("strdup");
717    return ret;
718}
719
720void usage(void)
721{
722    fprintf(stderr, "Usage: pppoe-discovery [options]\n");
723    fprintf(stderr, "\nVersion " RP_VERSION "\n");
724}
725