/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * PPPoE Client-mode "chat" utility for use with Solaris PPP 4.0.
 *
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <ctype.h>
#include <strings.h>
#include <fcntl.h>
#include <errno.h>
#include <signal.h>
#include <stropts.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>

#include <net/sppptun.h>
#include <net/pppoe.h>

#include "common.h"
#include "logging.h"

/*
 * This value, currently set to the characters "POE1," is used to
 * distinguish among control messages from multiple lower streams
 * under /dev/sppp.  This feature is needed to support PPP translation
 * (LAC-like behavior), but isn't currently used.
 */
#define PPPOE_DISCRIM   0x504F4531

/* milliseconds between retries */
#define PADI_RESTART_TIME       500
#define PADR_RESTART_TIME       2000

/* default inquiry mode timer in milliseconds. */
#define PADI_INQUIRY_DWELL      3000

/* maximum timer value in milliseconds */
#define RESTART_LIMIT   5000

char *myname;           /* copy of argv[0] for error messages */
static int verbose;     /* -v flag given */
static int onlyflag;    /* keyword "only" at end of command line */
static char *service = "";      /* saved service name from command line */

static int pado_wait_time = 0;  /* see main() */
static int pads_wait_time = PADR_RESTART_TIME;

static int tunfd;       /* open connection to sppptun driver */

static struct timeval tvstart;  /* time of last PADI/PADR transmission */

struct server_filter {
        struct server_filter *sf_next;  /* Next filter in list */
        struct ether_addr sf_mac;       /* Ethernet address */
        struct ether_addr sf_mask;      /* Mask (0 or 0xFF in each byte) */
        const char *sf_name;            /* String for AC-Name compare */
        boolean_t sf_hasmac;            /* Set if string could be MAC */
        boolean_t sf_isexcept;          /* Ignore server if matching */
};

/* List of filters defined on command line. */
static struct server_filter *sfhead, *sftail;

/*
 * PPPoE Client State Machine
 */

/* Client events */
#define PCSME_CLOSE     0       /* User close */
#define PCSME_OPEN      1       /* User open */
#define PCSME_TOP       2       /* Timeout+ (counter non-zero) */
#define PCSME_TOM       3       /* Timeout- (counter zero) */
#define PCSME_RPADT     4       /* Receive PADT (unexpected here) */
#define PCSME_RPADOP    5       /* Receive desired PADO */
#define PCSME_RPADO     6       /* Receive ordinary PADO */
#define PCSME_RPADS     7       /* Receive PADS */
#define PCSME_RPADSN    8       /* Receive bad (errored) PADS */
#define PCSME__MAX      9

/* Client states */
#define PCSMS_DEAD      0       /* Initial state */
#define PCSMS_INITSENT  1       /* PADI sent */
#define PCSMS_OFFRRCVD  2       /* PADO received */
#define PCSMS_REQSENT   3       /* PADR sent */
#define PCSMS_CONVERS   4       /* Conversational */
#define PCSMS__MAX      5

/* Client actions */
#define PCSMA_NONE      0       /* Do nothing */
#define PCSMA_FAIL      1       /* Unrecoverable error */
#define PCSMA_SPADI     2       /* Send PADI */
#define PCSMA_ADD       3       /* Add ordinary server to list */
#define PCSMA_SPADR     4       /* Send PADR to top server */
#define PCSMA_SPADRP    5       /* Send PADR to this server (make top) */
#define PCSMA_SPADRN    6       /* Send PADR to next (or terminate) */
#define PCSMA_OPEN      7       /* Start PPP */
#define PCSMA__MAX      8

static uint8_t client_next_state[PCSMS__MAX][PCSME__MAX] = {
/* 0 PCSMS_DEAD Initial state */
        {
                PCSMS_DEAD,     /* PCSME_CLOSE  User close */
                PCSMS_INITSENT, /* PCSME_OPEN   User open */
                PCSMS_DEAD,     /* PCSME_TOP    Timeout+ */
                PCSMS_DEAD,     /* PCSME_TOM    Timeout- */
                PCSMS_DEAD,     /* PCSME_RPADT  Receive PADT */
                PCSMS_DEAD,     /* PCSME_RPADOP Receive desired PADO */
                PCSMS_DEAD,     /* PCSME_RPADO  Receive ordinary PADO */
                PCSMS_DEAD,     /* PCSME_RPADS  Receive PADS */
                PCSMS_DEAD,     /* PCSME_RPADSN Receive bad PADS */
        },
/* 1 PCSMS_INITSENT PADI sent */
        {
                PCSMS_DEAD,     /* PCSME_CLOSE  User close */
                PCSMS_INITSENT, /* PCSME_OPEN   User open */
                PCSMS_INITSENT, /* PCSME_TOP    Timeout+ */
                PCSMS_DEAD,     /* PCSME_TOM    Timeout- */
                PCSMS_DEAD,     /* PCSME_RPADT  Receive PADT */
                PCSMS_REQSENT,  /* PCSME_RPADOP Receive desired PADO */
                PCSMS_OFFRRCVD, /* PCSME_RPADO  Receive ordinary PADO */
                PCSMS_INITSENT, /* PCSME_RPADS  Receive PADS */
                PCSMS_INITSENT, /* PCSME_RPADSN Receive bad PADS */
        },
/* 2 PCSMS_OFFRRCVD PADO received */
        {
                PCSMS_DEAD,     /* PCSME_CLOSE  User close */
                PCSMS_INITSENT, /* PCSME_OPEN   User open */
                PCSMS_REQSENT,  /* PCSME_TOP    Timeout+ */
                PCSMS_REQSENT,  /* PCSME_TOM    Timeout- */
                PCSMS_DEAD,     /* PCSME_RPADT  Receive PADT */
                PCSMS_REQSENT,  /* PCSME_RPADOP Receive desired PADO */
                PCSMS_OFFRRCVD, /* PCSME_RPADO  Receive ordinary PADO */
                PCSMS_OFFRRCVD, /* PCSME_RPADS  Receive PADS */
                PCSMS_OFFRRCVD, /* PCSME_RPADSN Receive bad PADS */
        },
/* 3 PCSMS_REQSENT  PADR sent */
        {
                PCSMS_DEAD,     /* PCSME_CLOSE  User close */
                PCSMS_INITSENT, /* PCSME_OPEN   User open */
                PCSMS_REQSENT,  /* PCSME_TOP    Timeout+ */
                PCSMS_REQSENT,  /* PCSME_TOM    Timeout- */
                PCSMS_DEAD,     /* PCSME_RPADT  Receive PADT */
                PCSMS_REQSENT,  /* PCSME_RPADOP Receive desired PADO */
                PCSMS_REQSENT,  /* PCSME_RPADO  Receive ordinary PADO */
                PCSMS_CONVERS,  /* PCSME_RPADS  Receive PADS */
                PCSMS_REQSENT,  /* PCSME_RPADSN Receive bad PADS */
        },
/* 4 PCSMS_CONVERS  Conversational */
        {
                PCSMS_DEAD,     /* PCSME_CLOSE  User close */
                PCSMS_INITSENT, /* PCSME_OPEN   User open */
                PCSMS_CONVERS,  /* PCSME_TOP    Timeout+ */
                PCSMS_CONVERS,  /* PCSME_TOM    Timeout- */
                PCSMS_DEAD,     /* PCSME_RPADT  Receive PADT */
                PCSMS_CONVERS,  /* PCSME_RPADOP Receive desired PADO */
                PCSMS_CONVERS,  /* PCSME_RPADO  Receive ordinary PADO */
                PCSMS_CONVERS,  /* PCSME_RPADS  Receive PADS */
                PCSMS_CONVERS,  /* PCSME_RPADSN Receive bad PADS */
        },
};

static uint8_t client_action[PCSMS__MAX][PCSME__MAX] = {
/* 0 PCSMS_DEAD Initial state */
        {
                PCSMA_NONE,     /* PCSME_CLOSE  User close */
                PCSMA_SPADI,    /* PCSME_OPEN   User open */
                PCSMA_NONE,     /* PCSME_TOP    Timeout+ */
                PCSMA_NONE,     /* PCSME_TOM    Timeout- */
                PCSMA_NONE,     /* PCSME_RPADT  Receive PADT */
                PCSMA_NONE,     /* PCSME_RPADOP Receive desired PADO */
                PCSMA_NONE,     /* PCSME_RPADO  Receive ordinary PADO */
                PCSMA_NONE,     /* PCSME_RPADS  Receive PADS */
                PCSMA_NONE,     /* PCSME_RPADSN Receive bad PADS */
        },
/* 1 PCSMS_INITSENT PADI sent */
        {
                PCSMA_FAIL,     /* PCSME_CLOSE  User close */
                PCSMA_SPADI,    /* PCSME_OPEN   User open */
                PCSMA_SPADI,    /* PCSME_TOP    Timeout+ */
                PCSMA_FAIL,     /* PCSME_TOM    Timeout- */
                PCSMA_FAIL,     /* PCSME_RPADT  Receive PADT */
                PCSMA_SPADRP,   /* PCSME_RPADOP Receive desired PADO */
                PCSMA_ADD,      /* PCSME_RPADO  Receive ordinary PADO */
                PCSMA_NONE,     /* PCSME_RPADS  Receive PADS */
                PCSMA_NONE,     /* PCSME_RPADSN Receive bad PADS */
        },
/* 2 PCSMS_OFFRRCVD PADO received */
        {
                PCSMA_FAIL,     /* PCSME_CLOSE  User close */
                PCSMA_SPADI,    /* PCSME_OPEN   User open */
                PCSMA_SPADR,    /* PCSME_TOP    Timeout+ */
                PCSMA_SPADR,    /* PCSME_TOM    Timeout- */
                PCSMA_FAIL,     /* PCSME_RPADT  Receive PADT */
                PCSMA_SPADRP,   /* PCSME_RPADOP Receive desired PADO */
                PCSMA_ADD,      /* PCSME_RPADO  Receive ordinary PADO */
                PCSMA_NONE,     /* PCSME_RPADS  Receive PADS */
                PCSMA_NONE,     /* PCSME_RPADSN Receive bad PADS */
        },
/* 3 PCSMS_REQSENT  PADR sent */
        {
                PCSMA_FAIL,     /* PCSME_CLOSE  User close */
                PCSMA_SPADI,    /* PCSME_OPEN   User open */
                PCSMA_SPADR,    /* PCSME_TOP    Timeout+ */
                PCSMA_SPADRN,   /* PCSME_TOM    Timeout- */
                PCSMA_FAIL,     /* PCSME_RPADT  Receive PADT */
                PCSMA_ADD,      /* PCSME_RPADOP Receive desired PADO */
                PCSMA_ADD,      /* PCSME_RPADO  Receive ordinary PADO */
                PCSMA_OPEN,     /* PCSME_RPADS  Receive PADS */
                PCSMA_SPADRN,   /* PCSME_RPADSN Receive bad PADS */
        },
/* 4 PCSMS_CONVERS  Conversational */
        {
                PCSMA_FAIL,     /* PCSME_CLOSE  User close */
                PCSMA_SPADI,    /* PCSME_OPEN   User open */
                PCSMA_FAIL,     /* PCSME_TOP    Timeout+ */
                PCSMA_FAIL,     /* PCSME_TOM    Timeout- */
                PCSMA_FAIL,     /* PCSME_RPADT  Receive PADT */
                PCSMA_NONE,     /* PCSME_RPADOP Receive desired PADO */
                PCSMA_NONE,     /* PCSME_RPADO  Receive ordinary PADO */
                PCSMA_NONE,     /* PCSME_RPADS  Receive PADS */
                PCSMA_NONE,     /* PCSME_RPADSN Receive bad PADS */
        },
};

/*
 * PPPoE Message structure -- holds data from a received PPPoE
 * message.  These are copied and saved when queuing offers from
 * possible servers.
 */
typedef struct poesm_s {
        struct poesm_s  *poemsg_next;   /* Next message in list */
        const poep_t    *poemsg_data;   /* Pointer to PPPoE packet */
        int             poemsg_len;     /* Length of packet */
        ppptun_atype    poemsg_sender;  /* Address of sender */
        const char      *poemsg_iname;  /* Name of input interface */
} poemsg_t;

/*
 * PPPoE State Machine structure -- holds state of PPPoE negotiation;
 * currently, there's exactly one of these per pppoec instance.
 */
typedef struct {
        int             poesm_state;            /* PCSMS_* */
        int             poesm_timer;            /* Milliseconds to next TO */
        int             poesm_count;            /* Retry countdown */
        int             poesm_interval;         /* Reload value */
        uint32_t        poesm_sequence;         /* Sequence for PADR */

        poemsg_t        *poesm_firstoff;        /* Queue of valid offers; */
        poemsg_t        *poesm_lastoff;         /* first is best offer */
        poemsg_t        *poesm_tried;           /* Tried and failed offers */

        int             poesm_localid;          /* Local session ID (driver) */
} poesm_t;

/*
 * Convert an internal PPPoE event code number into a printable
 * string.
 */
static const char *
poe_event(int event)
{
        static const char *poeevent[PCSME__MAX] = {
                "Close", "Open", "TO+", "TO-", "rPADT",
                "rPADO+", "rPADO", "rPADS", "rPADS-"
        };

        if (event < 0 || event >= PCSME__MAX) {
                return ("?");
        }
        return (poeevent[event]);
}

/*
 * Convert an internal PPPoE state number into a printable string.
 */
static const char *
poe_state(int state)
{
        static const char *poestate[PCSMS__MAX] = {
                "Dead", "InitSent", "OffrRcvd", "ReqSent", "Convers",
        };

        if (state < 0 || state >= PCSMS__MAX) {
                return ("?");
        }
        return (poestate[state]);
}

/*
 * Convert an internal PPPoE action number into a printable string.
 */
static const char *
poe_action(int act)
{
        static const char *poeaction[PCSMA__MAX] = {
                "None", "Fail", "SendPADI", "Add", "SendPADR",
                "SendPADR+", "SendPADR-", "Open"
        };

        if (act < 0 || act >= PCSMA__MAX) {
                return ("?");
        }
        return (poeaction[act]);
}

/*
 * This calls mygetmsg (which discards partial messages as needed) and
 * logs errors as appropriate.
 */
static int
pppoec_getmsg(int fd, struct strbuf *ctrl, struct strbuf *data, int *flags)
{
        int retv;

        for (;;) {
                retv = mygetmsg(fd, ctrl, data, flags);
                if (retv == 0)
                        break;
                if (retv < 0) {
                        if (errno == EINTR)
                                continue;
                        logstrerror("getmsg");
                        break;
                }
                if (verbose) {
                        if (!(retv & (MORECTL | MOREDATA)))
                                logerr("%s: discard: "
                                    "unexpected status %d\n", myname, retv);
                        else
                                logerr("%s: discard: "
                                    "truncated %s%smessage\n", myname,
                                    retv & MORECTL ? "control " : "",
                                    retv & MOREDATA ? "data " : "");
                }
        }
        return (retv);
}

/*
 * Connect the control path to the lower stream of interest.  This
 * must be called after opening the tunnel driver in order to
 * establish the interface to be used for signaling.  Returns local
 * session ID number.
 */
static int
set_control(const char *dname)
{
        struct ppptun_peer ptp;
        union ppptun_name ptn;

        /* Fetch the local session ID first. */
        (void) memset(&ptp, '\0', sizeof (ptp));
        ptp.ptp_style = PTS_PPPOE;
        if (strioctl(tunfd, PPPTUN_SPEER, &ptp, sizeof (ptp), sizeof (ptp)) <
            0) {
                logstrerror("PPPTUN_SPEER");
                exit(1);
        }

        /* Connect to lower stream. */
        (void) snprintf(ptn.ptn_name, sizeof (ptn.ptn_name), "%s:pppoed",
            dname);
        if (strioctl(tunfd, PPPTUN_SCTL, &ptn, sizeof (ptn), 0) < 0) {
                logerr("%s: PPPTUN_SCTL %s: %s\n", myname,
                    ptn.ptn_name, mystrerror(errno));
                exit(1);
        }
        return (ptp.ptp_lsessid);
}

/*
 * Check if standard input is actually a viable connection to the
 * tunnel driver.  This is the normal mode of operation with pppd; the
 * tunnel driver is opened by pppd as the tty and pppoec is exec'd as
 * the connect script.
 */
static void
check_stdin(void)
{
        struct ppptun_info pti;
        union ppptun_name ptn;

        if (strioctl(0, PPPTUN_GDATA, &ptn, 0, sizeof (ptn)) < 0) {
                if (errno == EINVAL)
                        logerr("%s: PPPoE operation requires "
                            "the use of a tunneling device\n", myname);
                else
                        logstrerror("PPPTUN_GDATA");
                exit(1);
        }
        if (ptn.ptn_name[0] != '\0') {
                if (strioctl(0, PPPTUN_GINFO, &pti, 0, sizeof (pti)) < 0) {
                        logstrerror("PPPTUN_GINFO");
                        exit(1);
                }
                if (pti.pti_style != PTS_PPPOE) {
                        logerr("%s: Cannot connect to server "
                            "using PPPoE; stream already set to style %d\n",
                            myname, pti.pti_style);
                        exit(1);
                }
                if (verbose)
                        logerr("%s: Warning:  PPPoE data link "
                            "already connected\n", myname);
                exit(0);
        }
        /* Standard input is the tunnel driver; use it. */
        tunfd = 0;
}

/*
 * Write a summary of a PPPoE message to the given file.  This is used
 * for logging and to display received offers in the inquiry (-i) mode.
 */
static void
display_pppoe(FILE *out, const poep_t *poep, int plen, const ppptun_atype *pap)
{
        int ttyp;
        int tlen;
        const uint8_t *tagp;
        const uint8_t *dp;
        const char *str;
        poer_t poer;
        uint32_t mask;

        if (out == stderr)
                logerr(" ");    /* Give us a timestamp */
        /* Print name of sender. */
        (void) fprintf(out, "%-16s ", ehost(pap));

        /* Loop through tags and print each. */
        tagp = (const uint8_t *)(poep + 1);
        while (poe_tagcheck(poep, plen, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                tlen = POET_GET_LENG(tagp);
                dp = POET_DATA(tagp);
                str = NULL;
                switch (ttyp) {
                case POETT_SERVICE:     /* Service-Name */
                        str = "Svc";
                        break;
                case POETT_ACCESS:      /* AC-Name */
                        str = "Name";
                        break;
                case POETT_UNIQ:        /* Host-Uniq */
                        str = "Uniq";
                        break;
                case POETT_COOKIE:      /* AC-Cookie */
                        str = "Cookie";
                        break;
                case POETT_VENDOR:      /* Vendor-Specific */
                        break;
                case POETT_RELAY:       /* Relay-Session-Id */
                        str = "Relay";
                        break;
                case POETT_NAMERR:      /* Service-Name-Error */
                        str = "SvcNameErr";
                        break;
                case POETT_SYSERR:      /* AC-System-Error */
                        str = "SysErr";
                        break;
                case POETT_GENERR:      /* Generic-Error */
                        str = "GenErr";
                        break;
                case POETT_MULTI:       /* Multicast-Capable */
                        break;
                case POETT_HURL:        /* Host-URL */
                        str = "URL";
                        break;
                case POETT_MOTM:        /* Message-Of-The-Minute */
                        str = "Mesg";
                        break;
                case POETT_RTEADD:      /* IP-Route-Add */
                        break;
                }
                switch (ttyp) {
                case POETT_NAMERR:      /* Service-Name-Error */
                case POETT_SYSERR:      /* AC-System-Error */
                        if (tlen > 0 && *dp == '\0')
                                tlen = 0;
                        /* FALLTHROUGH */
                case POETT_SERVICE:     /* Service-Name */
                case POETT_ACCESS:      /* AC-Name */
                case POETT_GENERR:      /* Generic-Error */
                case POETT_MOTM:        /* Message-Of-The-Minute */
                case POETT_HURL:        /* Host-URL */
                        (void) fprintf(out, "%s:\"%.*s\" ", str, tlen, dp);
                        break;
                case POETT_UNIQ:        /* Host-Uniq */
                case POETT_COOKIE:      /* AC-Cookie */
                case POETT_RELAY:       /* Relay-Session-Id */
                        (void) fprintf(out, "%s:", str);
                        while (--tlen >= 0)
                                (void) fprintf(out, "%02X", *dp++);
                        (void) putc(' ', out);
                        break;
                case POETT_VENDOR:      /* Vendor-Specific */
                        (void) fputs("Vendor:", out);
                        if (tlen >= 4) {
                                if (*dp++ != 0) {
                                        (void) fprintf(out, "(%02X?)", dp[-1]);
                                }
                                (void) fprintf(out, "%x-%x-%x:", dp[0], dp[1],
                                    dp[2]);
                                tlen -= 4;
                                dp += 3;
                        }
                        while (--tlen >= 0)
                                (void) fprintf(out, "%02X", *dp++);
                        (void) putc(' ', out);
                        break;
                case POETT_MULTI:       /* Multicast-Capable */
                        (void) fprintf(out, "Multi:%d ", *dp);
                        break;
                case POETT_RTEADD:      /* IP-Route-Add */
                        if (tlen != sizeof (poer)) {
                                (void) fprintf(out, "RTE%d? ", tlen);
                                break;
                        }
                        (void) memcpy(&poer, dp, sizeof (poer));
                        (void) fputs("RTE:", out);
                        if (poer.poer_dest_network == 0)
                                (void) fputs("default", out);
                        else
                                (void) fputs(ihost(poer.poer_dest_network),
                                    out);
                        mask = ntohl(poer.poer_subnet_mask);
                        if (mask != 0 && mask != (uint32_t)~0) {
                                if ((~mask & (~mask + 1)) == 0)
                                        (void) fprintf(out, "/%d",
                                            sizeof (struct in_addr) * NBBY +
                                            1 - ffs(mask));
                                else
                                        (void) fprintf(out, "/%s",
                                            ihost(poer.poer_subnet_mask));
                        }
                        (void) fprintf(out, ",%s,%u ",
                            ihost(poer.poer_gateway), ntohl(poer.poer_metric));
                        break;
                default:
                        (void) fprintf(out, "%s:%d ", poe_tagname(ttyp), tlen);
                        break;
                }
                tagp = POET_NEXT(tagp);
        }
        (void) putc('\n', out);
}

/*
 * Transmit a PPPoE message to the indicated destination.  Used for
 * PADI and PADR messages.
 */
static int
send_pppoe(const poep_t *poep, const char *msgname,
    const ppptun_atype *destaddr)
{
        struct strbuf ctrl;
        struct strbuf data;
        struct ppptun_control *ptc;

        /* Set up the control data expected by the driver. */
        ptc = (struct ppptun_control *)pkt_octl;
        (void) memset(ptc, '\0', sizeof (*ptc));
        ptc->ptc_discrim = PPPOE_DISCRIM;
        ptc->ptc_action = PTCA_CONTROL;
        ptc->ptc_address = *destaddr;
        ctrl.len = sizeof (*ptc);
        ctrl.buf = (caddr_t)ptc;
        data.len = poe_length(poep) + sizeof (*poep);
        data.buf = (caddr_t)poep;
        if (verbose)
                logerr("%s: Sending %s to %s: %d bytes\n",
                    myname, msgname, ehost(destaddr), data.len);
        if (putmsg(tunfd, &ctrl, &data, 0) < 0) {
                logstrerror("putmsg");
                return (-1);
        }
        return (0);
}

/*
 * Create and transmit a PPPoE Active Discovery Initiation packet.
 * This is broadcasted to all hosts on the LAN.
 */
static int
send_padi(int localid)
{
        poep_t *poep;
        ppptun_atype destaddr;

        poep = poe_mkheader(pkt_output, POECODE_PADI, 0);
        (void) poe_add_str(poep, POETT_SERVICE, service);
        (void) poe_add_long(poep, POETT_UNIQ, localid);
        (void) memset(&destaddr, '\0', sizeof (destaddr));
        (void) memcpy(destaddr.pta_pppoe.ptma_mac, ether_bcast,
            sizeof (destaddr.pta_pppoe.ptma_mac));
        return (send_pppoe(poep, "PADI", &destaddr));
}

/*
 * This is used by the procedure below -- when the alarm goes off,
 * just exit.  (This was once a dummy procedure and used the EINTR
 * side-effect to terminate the loop, but that's not reliable, since
 * the EINTR could be caught and ignored by the calls to standard
 * output.)
 */
/* ARGSUSED */
static void
alarm_hand(int dummy)
{
        exit(0);
}

/*
 * Send out a single PADI and listen for servers.  This implements the
 * "inquiry" (-i) mode.
 */
static void
find_all_servers(int localid)
{
        struct strbuf ctrl;
        struct strbuf data;
        poep_t *poep;
        int flags;
        struct sigaction act;
        struct ppptun_control *ptc;

        /* Set a default 3-second timer */
        (void) memset(&act, '\0', sizeof (act));
        act.sa_handler = alarm_hand;
        (void) sigaction(SIGALRM, &act, NULL);
        (void) alarm((pado_wait_time + 999) / 1000);

        /* Broadcast a single request. */
        if (send_padi(localid) != 0)
                return;

        /* Loop over responses and print them. */
        for (;;) {
                ctrl.maxlen = PKT_OCTL_LEN;
                ctrl.buf = (caddr_t)pkt_octl;
                data.maxlen = PKT_INPUT_LEN;
                data.buf = (caddr_t)pkt_input;
                flags = 0;

                if (pppoec_getmsg(tunfd, &ctrl, &data, &flags) < 0)
                        break;

                /* Ignore unwanted responses from the driver. */
                if (ctrl.len != sizeof (*ptc)) {
                        if (verbose)
                                logerr("%s: unexpected %d byte"
                                    " control message from driver.\n", myname,
                                    ctrl.len);
                        continue;
                }
                ptc = (struct ppptun_control *)pkt_octl;
                poep = (poep_t *)pkt_input;

                /* If it's an offer, then print it out. */
                if (poe_code(poep) == POECODE_PADO) {
                        display_pppoe(stdout, poep, data.len,
                            &ptc->ptc_address);
                }
        }
}

/*
 * Parse a server filter from the command line.  The passed-in string
 * must be allocated and unchanged, since a pointer to it is saved in
 * the filter data structure.  The string is also parsed for a MAC
 * address, if possible.
 */
static void
parse_filter(const char *str, int exceptflag)
{
        struct server_filter *sfnew;
        const char *cp;
        const char *wordstart;
        const char *wordend;
        int len;
        char hbuf[MAXHOSTNAMELEN];
        uchar_t *ucp;
        uchar_t *mcp;

        /* Allocate the new filter structure. */
        sfnew = (struct server_filter *)calloc(1, sizeof (*sfnew));
        if (sfnew == NULL) {
                logstrerror("filter allocation");
                exit(1);
        }

        /* Save the string for AC-Name comparison. */
        sfnew->sf_name = str;

        sfnew->sf_isexcept = exceptflag == 0 ? 0 : 1;

        /* Extract just one word. */
        cp = str;
        while (isspace(*cp))
                cp++;
        wordstart = cp;
        while (*cp != '\0' && !isspace(*cp))
                cp++;
        wordend = cp;
        if ((len = wordend - wordstart) >= sizeof (hbuf))
                len = sizeof (hbuf) - 1;
        (void) strlcpy(hbuf, wordstart, len);
        hbuf[len] = '\0';

        /* Try to translate this as an Ethernet host or address. */
        mcp = sfnew->sf_mask.ether_addr_octet;
        if (ether_hostton(hbuf, &sfnew->sf_mac) == 0) {
                mcp[0] = mcp[1] = mcp[2] = mcp[3] = mcp[4] = mcp[5] = 0xFF;
                sfnew->sf_hasmac = 1;
        } else {
                ucp = sfnew->sf_mac.ether_addr_octet;
                len = wordend - wordstart;
                cp = wordstart;
                while (cp < wordend) {
                        if (ucp >= sfnew->sf_mac.ether_addr_octet +
                            sizeof (sfnew->sf_mac))
                                break;
                        if (*cp == '*') {
                                *mcp++ = *ucp++ = 0;
                                cp++;
                        } else {
                                if (!isxdigit(*cp))
                                        break;
                                *ucp = hexdecode(*cp++);
                                if (cp < wordend && isxdigit(*cp)) {
                                        *ucp = (*ucp << 4) |
                                            hexdecode(*cp++);
                                }
                                ucp++;
                                *mcp++ = 0xFF;
                        }
                        if (cp < wordend) {
                                if (*cp != ':' || cp + 1 == wordend)
                                        break;
                                cp++;
                        }
                }
                if (cp >= wordend)
                        sfnew->sf_hasmac = 1;
                else if (verbose)
                        logerr("%s: treating '%.*s' as server "
                            "name only, not MAC address\n", myname, len,
                            wordstart);
        }

        /* Add to end of list. */
        if (sftail == NULL)
                sfhead = sfnew;
        else
                sftail->sf_next = sfnew;
        sftail = sfnew;
}

/*
 * Create a copy of a given PPPoE message.  This is used for enqueuing
 * received PADO (offers) from possible servers.
 */
static poemsg_t *
save_message(const poemsg_t *pmsg)
{
        poemsg_t *newmsg;
        char *cp;

        newmsg = (poemsg_t *)malloc(sizeof (*pmsg) + pmsg->poemsg_len +
            strlen(pmsg->poemsg_iname) + 1);
        if (newmsg != NULL) {
                newmsg->poemsg_next = NULL;
                newmsg->poemsg_data = (const poep_t *)(newmsg + 1);
                (void) memcpy(newmsg + 1, pmsg->poemsg_data, pmsg->poemsg_len);
                newmsg->poemsg_len = pmsg->poemsg_len;
                cp = (char *)newmsg->poemsg_data + pmsg->poemsg_len;
                newmsg->poemsg_iname = (const char *)cp;
                (void) strcpy(cp, pmsg->poemsg_iname);
                (void) memcpy(&newmsg->poemsg_sender, &pmsg->poemsg_sender,
                    sizeof (newmsg->poemsg_sender));
        }
        return (newmsg);
}

/*
 * Create and send a PPPoE Active Discovery Request (PADR) message to
 * the sender of the given PADO.  Some tags -- Service-Name,
 * AC-Cookie, and Relay-Session-Id -- must be copied from PADO to
 * PADR.  Others are not.  The Service-Name must be selected from the
 * offered services in the PADO based on the user's requested service
 * name.  If the server offered "wildcard" service, then we ask for
 * this only if we can't find the user's requested service.
 *
 * Returns 1 if we can't send a valid PADR in response to the given
 * PADO.  The offer should be ignored and the next one tried.
 */
static int
send_padr(poesm_t *psm, const poemsg_t *pado)
{
        poep_t *poep;
        boolean_t haswild;
        boolean_t hassvc;
        const uint8_t *tagp;
        int ttyp;
        int tlen;

        /*
         * Increment sequence number for PADR so that we don't mistake
         * old replies for valid ones if the server is very slow.
         */
        psm->poesm_sequence++;

        poep = poe_mkheader(pkt_output, POECODE_PADR, 0);
        (void) poe_two_longs(poep, POETT_UNIQ, psm->poesm_localid,
            psm->poesm_sequence);

        haswild = B_FALSE;
        hassvc = B_FALSE;
        tagp = (const uint8_t *)(pado->poemsg_data + 1);
        while (poe_tagcheck(pado->poemsg_data, pado->poemsg_len, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                tlen = POET_GET_LENG(tagp);
                switch (ttyp) {
                case POETT_SERVICE:     /* Service-Name */
                        /* Allow only one */
                        if (hassvc)
                                break;
                        if (tlen == 0) {
                                haswild = B_TRUE;
                                break;
                        }
                        if (service[0] == '\0' ||
                            (tlen == strlen(service) &&
                            memcmp(service, POET_DATA(tagp), tlen) == 0)) {
                                (void) poe_tag_copy(poep, tagp);
                                hassvc = B_TRUE;
                        }
                        break;
                /* Ones we should discard */
                case POETT_ACCESS:      /* AC-Name */
                case POETT_UNIQ:        /* Host-Uniq */
                case POETT_NAMERR:      /* Service-Name-Error */
                case POETT_SYSERR:      /* AC-System-Error */
                case POETT_GENERR:      /* Generic-Error */
                case POETT_HURL:        /* Host-URL */
                case POETT_MOTM:        /* Message-Of-The-Minute */
                case POETT_RTEADD:      /* IP-Route-Add */
                case POETT_VENDOR:      /* Vendor-Specific */
                case POETT_MULTI:       /* Multicast-Capable */
                default:                /* Anything else we don't understand */
                        break;
                /* Ones we should copy */
                case POETT_COOKIE:      /* AC-Cookie */
                case POETT_RELAY:       /* Relay-Session-Id */
                        (void) poe_tag_copy(poep, tagp);
                        break;
                }
                tagp = POET_NEXT(tagp);
        }
        if (!hassvc) {
                if (haswild && service[0] == '\0')
                        (void) poe_add_str(poep, POETT_SERVICE, "");
                else
                        return (1);
        }

        return (send_pppoe(poep, "PADR", &pado->poemsg_sender));
}

/*
 * ********************************************************************
 * act_* functions implement the actions driven by the state machine
 * tables.  See "action_table" below.
 *
 * All action routines must return the next state value.
 * ********************************************************************
 */

/* ARGSUSED */
static int
act_none(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        return (nextst);
}

/* ARGSUSED */
static int
act_fail(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        if (verbose)
                logerr("%s: unrecoverable error\n", myname);
        return (PCSMS_DEAD);
}

/* ARGSUSED */
static int
act_spadi(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        if (send_padi(psm->poesm_localid) != 0)
                return (PCSMS_DEAD);
        /*
         * If this is the first time, then initialize the retry count
         * and interval.
         */
        if (psm->poesm_state == PCSMS_DEAD) {
                psm->poesm_count = 3;
                psm->poesm_interval = pado_wait_time;
        } else {
                if ((psm->poesm_interval <<= 1) > RESTART_LIMIT)
                        psm->poesm_interval = RESTART_LIMIT;
        }
        psm->poesm_timer = psm->poesm_interval;
        (void) gettimeofday(&tvstart, NULL);
        return (nextst);
}

/* ARGSUSED */
static int
act_add(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        pmsg = save_message(pmsg);
        if (pmsg != NULL) {
                if (psm->poesm_lastoff == NULL)
                        psm->poesm_firstoff = pmsg;
                else
                        psm->poesm_lastoff->poemsg_next = pmsg;
                psm->poesm_lastoff = pmsg;
        }
        return (nextst);
}

/* ARGSUSED */
static int
act_spadr(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        poemsg_t *msgp;
        int retv;

        for (;;) {
                if ((msgp = psm->poesm_firstoff) == NULL)
                        return (PCSMS_DEAD);
                retv = send_padr(psm, msgp);
                if (retv < 0)
                        return (PCSMS_DEAD);
                if (retv == 0)
                        break;
                /* Can't send this request; try looking at next offer. */
                psm->poesm_firstoff = msgp->poemsg_next;
                msgp->poemsg_next = psm->poesm_tried;
                psm->poesm_tried = msgp;
        }
        if (psm->poesm_state != PCSMS_REQSENT) {
                psm->poesm_count = 3;
                psm->poesm_interval = pads_wait_time;
        } else {
                if ((psm->poesm_interval <<= 1) > RESTART_LIMIT)
                        psm->poesm_interval = RESTART_LIMIT;
        }
        psm->poesm_timer = psm->poesm_interval;
        (void) gettimeofday(&tvstart, NULL);
        return (nextst);
}

/* ARGSUSED */
static int
act_spadrp(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        int retv;

        retv = send_padr(psm, pmsg);
        if (retv < 0)
                return (PCSMS_DEAD);
        pmsg = save_message(pmsg);
        if (retv > 0) {
                /*
                 * Cannot use this one; mark as tried and continue as
                 * if we never saw it.
                 */
                pmsg->poemsg_next = psm->poesm_tried;
                psm->poesm_tried = pmsg;
                return (psm->poesm_state);
        }
        pmsg->poemsg_next = psm->poesm_firstoff;
        psm->poesm_firstoff = pmsg;
        if (psm->poesm_lastoff == NULL)
                psm->poesm_lastoff = pmsg;
        psm->poesm_count = 3;
        psm->poesm_timer = psm->poesm_interval = pads_wait_time;
        (void) gettimeofday(&tvstart, NULL);
        return (nextst);
}

/* ARGSUSED */
static int
act_spadrn(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        poemsg_t *msgp;
        int retv;

        if ((msgp = psm->poesm_firstoff) == NULL)
                return (PCSMS_DEAD);
        do {
                psm->poesm_firstoff = msgp->poemsg_next;
                msgp->poemsg_next = psm->poesm_tried;
                psm->poesm_tried = msgp;
                if ((msgp = psm->poesm_firstoff) == NULL)
                        return (PCSMS_DEAD);
                retv = send_padr(psm, msgp);
                if (retv < 0)
                        return (PCSMS_DEAD);
        } while (retv != 0);
        psm->poesm_count = 3;
        psm->poesm_timer = psm->poesm_interval = pads_wait_time;
        (void) gettimeofday(&tvstart, NULL);
        return (nextst);
}

/*
 * For safety -- remove end of line from strings passed back to pppd.
 */
static void
remove_eol(char *str, size_t len)
{
        while (len > 0) {
                if (*str == '\n')
                        *str = '$';
                str++;
                len--;
        }
}

/* ARGSUSED */
static int
act_open(poesm_t *psm, poemsg_t *pmsg, int event, int nextst)
{
        struct ppptun_peer ptp;
        union ppptun_name ptn;
        const char *cp;
        FILE *fp;
        const uint8_t *tagp, *vp;
        int tlen, ttyp;
        char *access;
        uint32_t val;
        size_t acc_len, serv_len;

        /*
         * The server has now assigned its session ID for the data
         * (PPP) portion of this tunnel.  Send that ID down to the
         * driver.
         */
        (void) memset(&ptp, '\0', sizeof (ptp));
        ptp.ptp_lsessid = psm->poesm_localid;
        ptp.ptp_rsessid = poe_session_id(pmsg->poemsg_data);
        (void) memcpy(&ptp.ptp_address, &pmsg->poemsg_sender,
            sizeof (ptp.ptp_address));
        ptp.ptp_style = PTS_PPPOE;
        if (strioctl(tunfd, PPPTUN_SPEER, &ptp, sizeof (ptp), sizeof (ptp)) <
            0) {
                logstrerror("PPPTUN_SPEER");
                return (PCSMS_DEAD);
        }

        /*
         * Data communication is now possible on this session.
         * Connect the data portion to the correct lower stream.
         */
        if ((cp = strchr(pmsg->poemsg_iname, ':')) == NULL)
                cp = pmsg->poemsg_iname + strlen(pmsg->poemsg_iname);
        (void) snprintf(ptn.ptn_name, sizeof (ptn.ptn_name), "%.*s:pppoe",
            cp - pmsg->poemsg_iname, pmsg->poemsg_iname);
        if (strioctl(tunfd, PPPTUN_SDATA, &ptn, sizeof (ptn), 0) < 0) {
                logerr("%s: PPPTUN_SDATA %s: %s\n",
                    myname, ptn.ptn_name, mystrerror(errno));
                return (PCSMS_DEAD);
        }
        if (verbose)
                logerr("%s: Connection open; session %04X on "
                    "%s\n", myname, ptp.ptp_rsessid, ptn.ptn_name);

        /*
         * Walk through the PADS message to get the access server name
         * and the service.  If there are multiple instances of either
         * tag, then take the last access server and the first
         * non-null service.
         */
        access = "";
        acc_len = 0;
        serv_len = strlen(service);
        tagp = (const uint8_t *)(pmsg->poemsg_data + 1);
        while (poe_tagcheck(pmsg->poemsg_data, pmsg->poemsg_len, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                tlen = POET_GET_LENG(tagp);
                if (ttyp == POETT_ACCESS) {
                        access = (char *)POET_DATA(tagp);
                        acc_len = tlen;
                }
                if (serv_len == 0 && ttyp == POETT_SERVICE && tlen != 0) {
                        service = (char *)POET_DATA(tagp);
                        serv_len = tlen;
                }
                tagp = POET_NEXT(tagp);
        }

        /*
         * Remove end of line to make sure that integrity of values
         * passed back to pppd can't be compromised by the PPPoE
         * server.
         */
        remove_eol(service, serv_len);
        remove_eol(access, acc_len);

        /*
         * pppd has given us a pipe as fd 3, and we're expected to
         * write out the values of the following environment
         * variables:
         *      IF_AND_SERVICE
         *      SERVICE_NAME
         *      AC_NAME
         *      AC_MAC
         *      SESSION_ID
         *      VENDOR_SPECIFIC_1 ... N
         * See usr.bin/pppd/plugins/pppoe.c for more information.
         */
        if ((fp = fdopen(3, "w")) != NULL) {
                (void) fprintf(fp, "%.*s:%.*s\n",
                    cp - pmsg->poemsg_iname, pmsg->poemsg_iname, serv_len,
                    service);
                (void) fprintf(fp, "%.*s\n", serv_len, service);
                (void) fprintf(fp, "%.*s\n", acc_len, access);
                (void) fprintf(fp, "%s\n", ehost(&pmsg->poemsg_sender));
                (void) fprintf(fp, "%d\n", poe_session_id(pmsg->poemsg_data));
                tagp = (const uint8_t *)(pmsg->poemsg_data + 1);
                while (poe_tagcheck(pmsg->poemsg_data, pmsg->poemsg_len,
                    tagp)) {
                        ttyp = POET_GET_TYPE(tagp);
                        if (ttyp == POETT_END)
                                break;
                        tlen = POET_GET_LENG(tagp);
                        if (ttyp == POETT_VENDOR && tlen >= 4) {
                                (void) memcpy(&val, POET_DATA(tagp), 4);
                                (void) fprintf(fp, "%08lX:",
                                    (unsigned long)ntohl(val));
                                tlen -= 4;
                                vp = POET_DATA(tagp) + 4;
                                while (--tlen >= 0)
                                        (void) fprintf(fp, "%02X", *vp++);
                                (void) putc('\n', fp);
                        }
                        tagp = POET_NEXT(tagp);
                }
                (void) fclose(fp);
        }

        return (nextst);
}

static int (* const action_table[PCSMA__MAX])(poesm_t *psm, poemsg_t *pmsg,
    int event, int nextst) = {
            act_none, act_fail, act_spadi, act_add, act_spadr, act_spadrp,
            act_spadrn, act_open
};

/*
 * Dispatch an event and a corresponding message on a given state
 * machine.
 */
static void
handle_event(poesm_t *psm, int event, poemsg_t *pmsg)
{
        int nextst;

        if (verbose)
                logerr("%s: PPPoE Event %s (%d) in state %s "
                    "(%d): action %s (%d)\n", myname, poe_event(event), event,
                    poe_state(psm->poesm_state), psm->poesm_state,
                    poe_action(client_action[psm->poesm_state][event]),
                    client_action[psm->poesm_state][event]);

        nextst = (*action_table[client_action[psm->poesm_state][event]])(psm,
            pmsg, event, client_next_state[psm->poesm_state][event]);

        if (verbose)
                logerr("%s: PPPoE State change %s (%d) -> %s (%d)\n", myname,
                    poe_state(psm->poesm_state), psm->poesm_state,
                    poe_state(nextst), nextst);

        psm->poesm_state = nextst;

        /*
         * Life-altering states are handled here.  If we reach dead
         * state again after starting, then we failed.  If we reach
         * conversational state, then we're open.
         */
        if (nextst == PCSMS_DEAD) {
                if (verbose)
                        logerr("%s: action failed\n", myname);
                exit(1);
        }
        if (nextst == PCSMS_CONVERS) {
                if (verbose)
                        logerr("%s: connected\n", myname);
                exit(0);
        }
}

/*
 * Check for error message tags in the PPPoE packet.  We must ignore
 * offers that merely report errors, and need to log errors in any
 * case.
 */
static int
error_check(poemsg_t *pmsg)
{
        const uint8_t *tagp;
        int ttyp;

        tagp = (const uint8_t *)(pmsg->poemsg_data + 1);
        while (poe_tagcheck(pmsg->poemsg_data, pmsg->poemsg_len, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                if (ttyp == POETT_NAMERR || ttyp == POETT_SYSERR ||
                    ttyp == POETT_GENERR) {
                        if (verbose)
                                display_pppoe(stderr, pmsg->poemsg_data,
                                    pmsg->poemsg_len, &pmsg->poemsg_sender);
                        return (-1);
                }
                tagp = POET_NEXT(tagp);
        }
        return (0);
}

/*
 * Extract sequence number, if any, from PADS message, so that we can
 * relate it to the PADR that we sent.
 */
static uint32_t
get_sequence(const poemsg_t *pmsg)
{
        const uint8_t *tagp;
        int ttyp;
        uint32_t vals[2];

        tagp = (const uint8_t *)(pmsg->poemsg_data + 1);
        while (poe_tagcheck(pmsg->poemsg_data, pmsg->poemsg_len, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                if (ttyp == POETT_UNIQ) {
                        if (POET_GET_LENG(tagp) < sizeof (vals))
                                break;
                        (void) memcpy(vals, POET_DATA(tagp), sizeof (vals));
                        return (ntohl(vals[1]));
                }
                tagp = POET_NEXT(tagp);
        }
        return (0);
}

/*
 * Server filter cases:
 *
 *      No filters -- all servers generate RPADO+ event; select the
 *      first responding server.
 *
 *      Only "except" filters -- matching servers are RPADO, others
 *      are RPADO+.
 *
 *      Mix of filters -- those matching "pass" are RPADO+, those
 *      matching "except" are RPADO, and all others are also RPADO.
 *
 * If the "only" keyword was given, then RPADO becomes -1; only RPADO+
 * events occur.
 */
static int
use_server(poemsg_t *pado, const ppptun_atype *pap)
{
        struct server_filter *sfp;
        const uchar_t *sndp;
        const uchar_t *macp;
        const uchar_t *maskp;
        int i;
        int passmatched;
        int tlen;
        const uint8_t *tagp;
        int ttyp;

        /*
         * If no service mentioned in offer, then we can't use it.
         */
        tagp = (const uint8_t *)(pado->poemsg_data + 1);
        ttyp = POETT_END;
        while (poe_tagcheck(pado->poemsg_data, pado->poemsg_len, tagp)) {
                ttyp = POET_GET_TYPE(tagp);
                if (ttyp == POETT_END)
                        break;
                if (ttyp == POETT_SERVICE) {
                        /*
                         * If the user has requested a specific service, then
                         * this selection is exclusive.  We never use the
                         * wildcard for this.
                         */
                        tlen = POET_GET_LENG(tagp);
                        if (service[0] == '\0' || (strlen(service) == tlen &&
                            memcmp(service, POET_DATA(tagp), tlen) == 0))
                                break;
                        /* just in case we run off the end */
                        ttyp = POETT_END;
                }
                tagp = POET_NEXT(tagp);
        }
        if (ttyp != POETT_SERVICE) {
                if (verbose)
                        logerr("%s: Discard unusable offer from %s; service "
                            "'%s' not seen\n", myname, ehost(pap), service);
                return (-1);
        }

        passmatched = 0;
        for (sfp = sfhead; sfp != NULL; sfp = sfp->sf_next) {
                passmatched |= !sfp->sf_isexcept;
                if (sfp->sf_hasmac) {
                        sndp = pado->poemsg_sender.pta_pppoe.ptma_mac;
                        macp = sfp->sf_mac.ether_addr_octet;
                        maskp = sfp->sf_mask.ether_addr_octet;
                        i = sizeof (pado->poemsg_sender.pta_pppoe.ptma_mac);
                        for (; i > 0; i--)
                                if (((*macp++ ^ *sndp++) & *maskp++) != 0)
                                        break;
                        if (i <= 0)
                                break;
                }
        }

        if (sfp == NULL) {
                /*
                 * No match encountered; if only exclude rules have
                 * been seen, then accept this offer.
                 */
                if (!passmatched)
                        return (PCSME_RPADOP);
        } else {
                if (!sfp->sf_isexcept)
                        return (PCSME_RPADOP);
        }
        if (onlyflag) {
                if (verbose)
                        logerr("%s: Discard unusable offer from %s; server not "
                            "matched\n", myname, ehost(pap));
                return (-1);
        }
        return (PCSME_RPADO);
}

/*
 * This is the normal event loop.  It initializes the state machine
 * and sends in an Open event to kick things off.  Then it drops into
 * a loop to dispatch events for the state machine.
 */
static void
find_server(int localid)
{
        poesm_t psm;
        struct pollfd pfd[1];
        struct timeval tv, tvnow;
        int retv;
        poemsg_t pmsg;
        struct strbuf ctrl;
        struct strbuf data;
        poep_t *poep;
        int flags;
        uint32_t seqval;
        struct ppptun_control *ptc;

        (void) memset(&psm, '\0', sizeof (psm));

        /*
         * Initialize the sequence number with something handy.  It
         * doesn't need to be absolutely unique, since the localid
         * value actually demultiplexes everything.  This just makes
         * the operation a little safer.
         */
        psm.poesm_sequence = getpid() << 16;
        psm.poesm_localid = localid;

        /* Start the state machine */
        handle_event(&psm, PCSME_OPEN, NULL);

        /* Enter event polling loop. */
        pfd[0].fd = tunfd;
        pfd[0].events = POLLIN;
        for (;;) {
                /* Wait for timeout or message */
                retv = poll(pfd, 1, psm.poesm_timer > 0 ? psm.poesm_timer :
                    INFTIM);
                if (retv < 0) {
                        logstrerror("poll");
                        break;
                }

                /* Handle a timeout */
                if (retv == 0) {
                        psm.poesm_timer = 0;
                        handle_event(&psm, --psm.poesm_count > 0 ? PCSME_TOP :
                            PCSME_TOM, NULL);
                        continue;
                }

                /* Adjust the timer for the time we slept. */
                if (psm.poesm_timer > 0) {
                        (void) gettimeofday(&tvnow, NULL);
                        tv = tvnow;
                        if ((tv.tv_sec -= tvstart.tv_sec) < 0) {
                                /* Darn */
                                tv.tv_sec = 1;
                                tv.tv_usec = 0;
                        } else if ((tv.tv_usec -= tvstart.tv_usec) < 0) {
                                tv.tv_usec += 1000000;
                                if (--tv.tv_sec < 0)
                                        tv.tv_sec = 0;
                        }
                        psm.poesm_timer -= tv.tv_sec*1000 + tv.tv_usec/1000;
                        tvstart = tvnow;
                }

                /* Read in the message from the server. */
                ctrl.maxlen = PKT_OCTL_LEN;
                ctrl.buf = (caddr_t)pkt_octl;
                data.maxlen = PKT_INPUT_LEN;
                data.buf = (caddr_t)pkt_input;
                flags = 0;

                if (pppoec_getmsg(tunfd, &ctrl, &data, &flags) < 0)
                        break;

                if (ctrl.len != sizeof (*ptc)) {
                        if (verbose)
                                logerr("%s: discard: ctrl len %d\n", myname,
                                    ctrl.len);
                        continue;
                }
                poep = (poep_t *)pkt_input;
                (void) memset(&pmsg, '\0', sizeof (pmsg));
                pmsg.poemsg_next = NULL;
                pmsg.poemsg_data = poep;
                pmsg.poemsg_len = data.len;
                ptc = (struct ppptun_control *)pkt_octl;
                if (ptc->ptc_action != PTCA_CONTROL) {
                        if (verbose)
                                logerr("%s: discard: unexpected action %d\n",
                                    myname, ptc->ptc_action);
                        continue;
                }
                pmsg.poemsg_iname = ptc->ptc_name;
                if (verbose)
                        logerr("%s: Received %s from %s/%s\n",
                            myname, poe_codename(poep->poep_code),
                            ehost(&ptc->ptc_address), pmsg.poemsg_iname);
                pmsg.poemsg_sender = ptc->ptc_address;

                /* Check for messages from unexpected peers. */
                if ((poep->poep_code == POECODE_PADT ||
                    poep->poep_code == POECODE_PADS) &&
                    (psm.poesm_firstoff == NULL ||
                    memcmp(&psm.poesm_firstoff->poemsg_sender,
                    &pmsg.poemsg_sender, sizeof (pmsg.poemsg_sender)) != 0)) {
                        if (verbose) {
                                logerr("%s: Unexpected peer %s", myname,
                                    ehost(&ptc->ptc_address));
                                logerr(" != %s\n",
                                    ehost(&psm.poesm_firstoff->poemsg_sender));
                        }
                        continue;
                }

                /* Eliminate stale PADS responses. */
                if (poep->poep_code == POECODE_PADS) {
                        seqval = get_sequence(&pmsg);
                        if (seqval != psm.poesm_sequence) {
                                if (verbose) {
                                        if (seqval == 0)
                                                logerr(
                                                    "%s: PADS has no sequence "
                                                    "number.\n", myname);
                                        else
                                                logerr(
                                                    "%s: PADS has sequence "
                                                    "%08X instead of %08X.\n",
                                                    myname, seqval,
                                                    psm.poesm_sequence);
                                }
                                continue;
                        }
                }

                /* Dispatch message event. */
                retv = error_check(&pmsg);
                switch (poep->poep_code) {
                case POECODE_PADT:
                        handle_event(&psm, PCSME_RPADT, &pmsg);
                        break;
                case POECODE_PADS:
                        /*
                         * Got a PPPoE Active Discovery Session-
                         * confirmation message.  It's a PADS event if
                         * everything's in order.  It's a PADS- event
                         * if the message is merely reporting an
                         * error.
                         */
                        handle_event(&psm, retv != 0 ? PCSME_RPADSN :
                            PCSME_RPADS, &pmsg);
                        break;
                case POECODE_PADO:
                        /* Ignore offers that merely report errors. */
                        if (retv != 0)
                                break;
                        /* Ignore offers from servers we don't want. */
                        if ((retv = use_server(&pmsg, &ptc->ptc_address)) < 0)
                                break;
                        /* Dispatch either RPADO or RAPDO+ event. */
                        handle_event(&psm, retv, &pmsg);
                        break;

                default:
                        if (verbose)
                                logerr("%s: Unexpected code %s (%d)\n", myname,
                                    poe_codename(poep->poep_code),
                                    poep->poep_code);
                        break;
                }
        }
        exit(1);
}

static void
usage(void)
{
        logerr("Usage:\n"
            "\t%s [-os#] [-v] <dev> [<service> [<server> [only]]]\n\n"
            "    or\n\n"
            "\t%s [-o#] [-v] -i <dev>\n", myname, myname);
        exit(1);
}

/*
 * In addition to the usual 0-2 file descriptors, pppd will leave fd 3
 * open on a pipe to receive the environment variables.  See
 * pppoe_device_pipe() in pppd/plugins/pppoe.c and device_pipe_hook in
 * pppd/main.c.
 */
int
main(int argc, char **argv)
{
        int inquiry_mode, exceptflag, arg, localid;
        char *cp;

        log_to_stderr(LOGLVL_DBG);

        if ((myname = *argv) == NULL)
                myname = "pppoec";

        inquiry_mode = 0;
        while ((arg = getopt(argc, argv, "io:s:v")) != EOF)
                switch (arg) {
                case 'i':
                        inquiry_mode++;
                        break;
                case 'v':
                        verbose++;
                        break;
                case 'o':
                        pado_wait_time = strtol(optarg, &cp, 0);
                        if (pado_wait_time <= 0 || *cp != '\0' ||
                            cp == optarg) {
                                logerr("%s: illegal PADO wait time: %s\n",
                                    myname, optarg);
                                exit(1);
                        }
                        break;
                case 's':
                        pads_wait_time = strtol(optarg, &cp, 0);
                        if (pads_wait_time <= 0 || *cp != '\0' ||
                            cp == optarg) {
                                logerr("%s: illegal PADS wait time: %s\n",
                                    myname, optarg);
                                exit(1);
                        }
                        break;
                case '?':
                        usage();
                }

        /* Handle inquiry mode. */
        if (inquiry_mode) {
                if (optind != argc-1)
                        usage();
                if (pado_wait_time == 0)
                        pado_wait_time = PADI_INQUIRY_DWELL;

                /* Invoked by user; open the tunnel driver myself. */
                tunfd = open(tunnam, O_RDWR | O_NOCTTY);
                if (tunfd == -1) {
                        logstrerror(tunnam);
                        exit(1);
                }

                /*
                 * Set up the control stream for PPPoE negotiation
                 * (set_control), then broadcast a query for all servers
                 * and listen for replies (find_all_servers).
                 */
                find_all_servers(set_control(argv[optind]));
                return (0);
        }

        if (pado_wait_time == 0)
                pado_wait_time = PADI_RESTART_TIME;

        if (optind >= argc)
                usage();

        /* Make sure we've got a usable tunnel driver on stdin. */
        check_stdin();

        /* Set up the control stream for PPPoE negotiation. */
        localid = set_control(argv[optind++]);

        /* Pick the service, if any. */
        if (optind < argc)
                service = argv[optind++];

        /* Parse out the filters. */
        if (optind < argc) {
                if (strcasecmp(argv[argc - 1], "only") == 0) {
                        argc--;
                        onlyflag = 1;
                }
                exceptflag = 0;
                for (; optind < argc; optind++) {
                        if (!exceptflag &&
                            strcasecmp(argv[optind], "except") == 0) {
                                exceptflag = 1;
                        } else {
                                parse_filter(argv[optind], exceptflag);
                                exceptflag = 0;
                        }
                }
        }

        /* Enter the main loop. */
        find_server(localid);

        return (0);
}