MPPP: Discard fragments even when reassembling failed
[l2tpns.git] / ppp.c
diff --git a/ppp.c b/ppp.c
index 7be79ce..ee299cb 100644 (file)
--- a/ppp.c
+++ b/ppp.c
@@ -79,7 +79,7 @@ void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        if (session[s].ppp.phase != Authenticate)
        {
-               LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
+               LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
                return;
        }
 
@@ -194,7 +194,7 @@ void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        if (session[s].ppp.phase != Authenticate)
        {
-               LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
+               LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
                return;
        }
 
@@ -400,7 +400,7 @@ void lcp_open(sessionidt s, tunnelidt t)
                        sessionidt first_ses = bundle[session[s].bundle].members[0];
                        LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n",s,first_ses);
                        ipcp_open(s, t);
-                }
+               }
        }
 }
 
@@ -440,7 +440,7 @@ static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t m
        uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
        uint8_t *value, size_t vlen)
 {
-       int *nak_sent;
+       int *nak_sent;
        switch (mtype)
        {
        case PPPLCP:    nak_sent = &sess_local[s].lcp.nak_sent;    break;
@@ -451,7 +451,7 @@ static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t m
 
        if (*response && **response != ConfigNak)
        {
-               if (*nak_sent < config->ppp_max_failure) // reject queued
+               if (*nak_sent < config->ppp_max_failure) // reject queued
                        return queued;
 
                return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
@@ -459,7 +459,7 @@ static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t m
 
        if (!*response)
        {
-               if (*nak_sent >= config->ppp_max_failure)
+               if (*nak_sent >= config->ppp_max_failure)
                        return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
 
                queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype, 0, 0, 0);
@@ -577,13 +577,13 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                switch (session[s].ppp.lcp)
                {
                case RequestSent:
-                       initialise_restart_count(s, lcp);
+                       initialise_restart_count(s, lcp);
                        change_state(s, lcp, AckReceived);
                        break;
 
                case AckReceived:
                case Opened:
-                       LOG(2, s, t, "LCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
                        if (session[s].ppp.lcp == Opened)
                                lcp_restart(s);
 
@@ -596,7 +596,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                }
        }
        else if (*p == ConfigReq)
@@ -680,7 +680,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                                        config->radius_authtypes != config->radius_authprefer)
                                                {
                                                        // alternate type
-                                                       alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
+                                                       alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
                                                        if (alen < 2) break;
                                                        q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
                                                }
@@ -787,7 +787,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Stopped:
-                       initialise_restart_count(s, lcp);
+                       initialise_restart_count(s, lcp);
                        sendlcp(s, t);
                        if (*response == ConfigAck)
                                change_state(s, lcp, AckSent);
@@ -809,7 +809,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Opened:
-                       lcp_restart(s);
+                       lcp_restart(s);
                        sendlcp(s, t);
                        /* fallthrough */
 
@@ -826,7 +826,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                        return;
                }
 
@@ -896,7 +896,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                        else
                                        {
                                                LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
-                                               authtype = 0; // shutdown
+                                               authtype = 0; // shutdown
                                        }
 
                                        break;
@@ -962,7 +962,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                break;
 
                                default:
-                                       LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
+                                       LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
                                        sessionshutdown(s, "Unable to negotiate LCP.", CDN_ADMIN_DISC, TERM_USER_ERROR);
                                        return;
                        }
@@ -983,7 +983,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                {
                case Closed:
                case Stopped:
-                       {
+                       {
                                uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP, 0, 0, 0);
                                if (!response) return;
                                *response = TerminateAck;
@@ -998,22 +998,22 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
                case RequestSent:
                case AckSent:
-                       initialise_restart_count(s, lcp);
+                       initialise_restart_count(s, lcp);
                        sendlcp(s, t);
                        break;
 
                case AckReceived:
-                       LOG(2, s, t, "LCP: ConfigNak in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ConfigNak in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
                        sendlcp(s, t);
                        break;
 
                case Opened:
-                       lcp_restart(s);
+                       lcp_restart(s);
                        sendlcp(s, t);
                        break;
 
                default:
-                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                        return;
                }
        }
@@ -1028,16 +1028,16 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                case RequestSent:
                case AckReceived:
                case AckSent:
-                       break;
+                       break;
 
                case Opened:
-                       lcp_restart(s);
-                       zero_restart_count(s, lcp);
+                       lcp_restart(s);
+                       zero_restart_count(s, lcp);
                        change_state(s, lcp, Closing);
                        break;
 
                default:
-                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
+                       LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                        return;
                }
 
@@ -1052,7 +1052,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
        }
        else if (*p == ProtocolRej)
        {
-               uint16_t proto = 0;
+               uint16_t proto = 0;
 
                if (l > 4)
                {
@@ -1182,24 +1182,24 @@ static void setepdis(epdist *ep1, epdist ep2)
 
 static bundleidt new_bundle()
 {
-        bundleidt i;
-        for (i = 1; i < MAXBUNDLE; i++)
-        {
-                if (bundle[i].state == BUNDLEFREE)
-                {
-                        LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
-                        bundle[i].num_of_links = 1;
-                        bundle[i].last_check = time_now;        // Initialize last_check value
-                        bundle[i].state = BUNDLEOPEN;
-                        bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first
+       bundleidt i;
+       for (i = 1; i < MAXBUNDLE; i++)
+       {
+               if (bundle[i].state == BUNDLEFREE)
+               {
+                       LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
+                       bundle[i].num_of_links = 1;
+                       bundle[i].last_check = time_now;        // Initialize last_check value
+                       bundle[i].state = BUNDLEOPEN;
+                       bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first
                        memset(&frag[i], 0, sizeof(fragmentationt));
-                        if (i > config->cluster_highest_bundleid)
-                                config->cluster_highest_bundleid = i;
-                        return i;
-                }
-        }
-        LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
-        return 0;
+                       if (i > config->cluster_highest_bundleid)
+                               config->cluster_highest_bundleid = i;
+                       return i;
+               }
+       }
+       LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
+       return 0;
 }
 
 static void ipcp_open(sessionidt s, tunnelidt t)
@@ -1256,7 +1256,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        if (session[s].ppp.phase < Network)
        {
-               LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
+               LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
                return;
        }
 
@@ -1267,13 +1267,13 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                switch (session[s].ppp.ipcp)
                {
                case RequestSent:
-                       initialise_restart_count(s, ipcp);
+                       initialise_restart_count(s, ipcp);
                        change_state(s, ipcp, AckReceived);
                        break;
 
                case AckReceived:
                case Opened:
-                       LOG(2, s, t, "IPCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
+                       LOG(2, s, t, "IPCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
                        sendipcp(s, t);
                        change_state(s, ipcp, RequestSent);
                        break;
@@ -1283,7 +1283,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
+                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
                }
        }
        else if (*p == ConfigReq)
@@ -1381,7 +1381,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Stopped:
-                       initialise_restart_count(s, ipcp);
+                       initialise_restart_count(s, ipcp);
                        sendipcp(s, t);
                        if (*response == ConfigAck)
                                change_state(s, ipcp, AckSent);
@@ -1403,7 +1403,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Opened:
-                       initialise_restart_count(s, ipcp);
+                       initialise_restart_count(s, ipcp);
                        sendipcp(s, t);
                        /* fallthrough */
 
@@ -1416,7 +1416,7 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
+                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
                        return;
                }
 
@@ -1434,15 +1434,15 @@ void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                case RequestSent:
                case AckReceived:
                case AckSent:
-                       break;
+                       break;
 
                case Opened:
-                       zero_restart_count(s, ipcp);
+                       zero_restart_count(s, ipcp);
                        change_state(s, ipcp, Closing);
                        break;
 
                default:
-                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
+                       LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
                        return;
                }
 
@@ -1498,7 +1498,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        if (session[s].ppp.phase < Network)
        {
-               LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
+               LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
                return;
        }
 
@@ -1515,13 +1515,13 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                switch (session[s].ppp.ipv6cp)
                {
                case RequestSent:
-                       initialise_restart_count(s, ipv6cp);
+                       initialise_restart_count(s, ipv6cp);
                        change_state(s, ipv6cp, AckReceived);
                        break;
 
                case AckReceived:
                case Opened:
-                       LOG(2, s, t, "IPV6CP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
+                       LOG(2, s, t, "IPV6CP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
                        sendipv6cp(s, t);
                        change_state(s, ipv6cp, RequestSent);
                        break;
@@ -1531,7 +1531,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
+                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
                }
        }
        else if (*p == ConfigReq)
@@ -1540,7 +1540,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                uint8_t *o = p + 4;
                int length = l - 4;
                int gotip = 0;
-               uint8_t ident[8];
+               uint32_t ident[2];
 
                while (length > 2)
                {
@@ -1552,12 +1552,12 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                gotip++; // seen address
                                if (o[1] != 10) return;
 
-                               *(uint32_t *) ident = htonl(session[s].ip);
-                               *(uint32_t *) (ident + 4) = 0;
+                               ident[0] = htonl(session[s].ip);
+                               ident[1] = 0;
 
                                if (memcmp(o + 2, ident, sizeof(ident)))
                                {
-                                       q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
+                                       q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, (uint8_t *)ident, sizeof(ident));
                                        if (!q) return;
                                }
 
@@ -1602,7 +1602,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Stopped:
-                       initialise_restart_count(s, ipv6cp);
+                       initialise_restart_count(s, ipv6cp);
                        sendipv6cp(s, t);
                        if (*response == ConfigAck)
                                change_state(s, ipv6cp, AckSent);
@@ -1624,7 +1624,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Opened:
-                       initialise_restart_count(s, ipv6cp);
+                       initialise_restart_count(s, ipv6cp);
                        sendipv6cp(s, t);
                        /* fallthrough */
 
@@ -1637,7 +1637,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
+                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
                        return;
                }
 
@@ -1655,15 +1655,15 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                case RequestSent:
                case AckReceived:
                case AckSent:
-                       break;
+                       break;
 
                case Opened:
-                       zero_restart_count(s, ipv6cp);
+                       zero_restart_count(s, ipv6cp);
                        change_state(s, ipv6cp, Closing);
                        break;
 
                default:
-                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
+                       LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
                        return;
                }
 
@@ -1686,11 +1686,11 @@ static void update_sessions_in_stat(sessionidt s, uint16_t l)
        if (!b)
        {
                increment_counter(&session[s].cin, &session[s].cin_wrap, l);
-               session[s].cin_delta += l;
-                       session[s].pin++;
+               session[s].cin_delta += l;
+               session[s].pin++;
 
-               sess_local[s].cin += l;
-               sess_local[s].pin++;
+               sess_local[s].cin += l;
+               sess_local[s].pin++;
        }
        else
        {
@@ -1701,11 +1701,11 @@ static void update_sessions_in_stat(sessionidt s, uint16_t l)
                        l = frag[b].fragment[i].length;
                        s = frag[b].fragment[i].sid;
                        increment_counter(&session[s].cin, &session[s].cin_wrap, l);
-                       session[s].cin_delta += l;
-                               session[s].pin++;
+                       session[s].cin_delta += l;
+                       session[s].pin++;
 
-                       sess_local[s].cin += l;
-                       sess_local[s].pin++;
+                       sess_local[s].cin += l;
+                       sess_local[s].pin++;
                        if (i == end)
                                return;
                        i = (i + 1) & MAXFRAGNUM_MASK;
@@ -1811,73 +1811,91 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 // process Multilink PPP packet received
 void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {
-        bundleidt b = session[s].bundle;
+       bundleidt b = session[s].bundle;
        bundlet * this_bundle = &bundle[b];
        uint32_t frag_offset, M_offset;
        uint16_t frag_index, M_index;
        fragmentationt *this_fragmentation = &frag[b];
        uint8_t begin_frame = (*p & MP_BEGIN);
-        uint8_t end_frame = (*p & MP_END);
-        uint32_t seq_num;
+       uint8_t end_frame = (*p & MP_END);
+       uint32_t seq_num;
        uint8_t flags = *p;
        uint16_t begin_index, end_index;
 
        // Perform length checking
-        if(l > MAXFRAGLEN)
-        {
-               LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
-               return;
-        }
-
-        if(!b)
-        {
-                LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
-                return;
-        }
+       if(l > MAXFRAGLEN)
+       {
+               LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
+               return;
+       }
+
+       if(!b)
+       {
+               LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
+               return;
+       }
        // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf
-        /* if(session[s].mssf)
-        {
-                // Get 12 bit for seq number
-                seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
-                p += 2;
-                l -= 2;
-                // After this point the pointer should be advanced 2 bytes
-                LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
-        }
-        else */
-        {
-                // Get 24 bit for seq number
-                seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
-                p += 4;
-                l -= 4;
-                // After this point the pointer should be advanced 4 bytes
-                LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
-        }
+       /* if(session[s].mssf)
+       {
+               // Get 12 bit for seq number
+               seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
+               p += 2;
+               l -= 2;
+               // After this point the pointer should be advanced 2 bytes
+               LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
+       }
+       else */
+       {
+               // Get 24 bit for seq number
+               seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
+               p += 4;
+               l -= 4;
+               // After this point the pointer should be advanced 4 bytes
+               LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
+       }
 
        // calculate this fragment's offset from the begin seq in the bundle
        frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
 
        // discard this fragment if frag_offset is bigger that the fragmentation buffer size
        if (frag_offset >= MAXFRAGNUM)
-        {
-               LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
-                return;
-        }
+       {
+               LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
+               return;
+       }
        
        // update M
        sess_local[s].last_seq = seq_num;
-       if (seq_num < this_fragmentation->M)
-               this_fragmentation->M = seq_num;
-       else
        {
-               uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;;
-               for (i = 1; i < this_bundle->num_of_links; i++)
+               /* seq # can be spread over the wrapping limit, and we must
+                  choose the "lowest" one, taking into account the wrapping:
+
+                  |-#-##--#----------------------M--###-#|
+
+                  but we must also care when the last highest seq # wraps,
+                  so we keep two minimums: one for the higher limit, and
+                  one for the lower one.
+
+                  In the nominal case, low_min = high_min.
+               */
+               uint32_t i, low_min, high_min;
+               low_min = sess_local[(this_bundle->members[0])].last_seq;;
+               high_min = this_bundle->max_seq; // max_seq is impossible to reach
+
+               for (i = 0; i < this_bundle->num_of_links; i++)
                {
                        uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq; 
-                       if (s_seq < min)
-                               min = s_seq;
+                       if (s_seq < low_min)
+                               low_min = s_seq;
+                       if (s_seq >= this_fragmentation->M && s_seq < high_min)
+                               high_min = s_seq;
                }
-               this_fragmentation->M = min;
+
+               // if high_min was found, it's the "lowest" one
+               if (high_min < this_bundle->max_seq)
+                       this_fragmentation->M = high_min;
+               else
+                       this_fragmentation->M = low_min;
        }
 
        LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M); 
@@ -1894,7 +1912,7 @@ void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
        if (begin_frame && end_frame)
        {
                // process and reset fragmentation
-                LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
+               LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
                this_fragmentation->fragment[frag_index].length = l;
                this_fragmentation->fragment[frag_index].sid = s;
                this_fragmentation->fragment[frag_index].flags = flags;
@@ -1914,7 +1932,7 @@ void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                this_frag->sid = s;
                this_frag->flags = flags;
                this_frag->seq = seq_num;
-                memcpy(this_frag->data, p, l);
+               memcpy(this_frag->data, p, l);
 
                // try to assemble the frame that has the received fragment as a member         
                // get the beginning of this frame
@@ -1928,7 +1946,7 @@ void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
                // return if a lost fragment is found
                if (!(this_fragmentation->fragment[begin_index].length))
-                       return; // assembling frame failed
+                       goto discard_lost_frames; // assembling frame failed
                // get the end of his frame
                while (this_fragmentation->fragment[end_index].length)
                {
@@ -1939,40 +1957,40 @@ void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
                // return if a lost fragment is found
                if (!(this_fragmentation->fragment[end_index].length))
-                       return; // assembling frame failed
+                       goto discard_lost_frames; // assembling frame failed
 
                // assemble the packet
                //assemble frame, process it, reset fragmentation
                uint16_t cur_len = 4;   // This is set to 4 to leave 4 bytes for function processipin
                uint32_t i;
 
-                       LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
-                       // Push to the receive buffer
+               LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
+               // Push to the receive buffer
                                        
                for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
-                {
+               {
                        this_frag = &this_fragmentation->fragment[i];
-                        if(cur_len + this_frag->length > MAXETHER)
-                        {
-                                LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");                            
-                                break;
-                        }
-                        memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
+                       if(cur_len + this_frag->length > MAXETHER)
+                       {
+                               LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");                             
+                               break;
+                       }
+                       memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
                        LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
-                        cur_len += this_frag->length;
+                       cur_len += this_frag->length;
                        if (i == end_index)
                        {
                                this_fragmentation->re_frame_len = cur_len;
                                this_fragmentation->re_frame_begin_index = begin_index;
-                               this_fragmentation->re_frame_end_index = end_index;
-                               // Process the resassembled frame
-                               LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
-                               processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
+                               this_fragmentation->re_frame_end_index = end_index;
+                               // Process the resassembled frame
+                               LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
+                               processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
                                break;
                        }
-                }
-                // Set reassembled frame length to zero after processing it
-                this_fragmentation->re_frame_len = 0;
+               }
+               // Set reassembled frame length to zero after processing it
+               this_fragmentation->re_frame_len = 0;
                for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
                {
                        this_fragmentation->fragment[i].length = 0;      // Indicates that this fragment has been consumed
@@ -1981,17 +1999,58 @@ void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                break;
                }
        }
-       //discard fragments received before the recently assembled frame
-       begin_index = this_fragmentation->start_index;
-       this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
-        this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
-       //clear length and flags of the discarded fragments
-       while (begin_index != this_fragmentation->start_index)
-        {
-                this_fragmentation->fragment[begin_index].flags = 0;
-               this_fragmentation->fragment[begin_index].length = 0;
-                begin_index = (begin_index + 1) & MAXFRAGNUM_MASK;
-        }
+
+discard_lost_frames:
+       //discard fragments numbererd below M and part of an unassembled frame,
+       //but not the one from the frame beginning just before M
+
+       // if we have something to discard
+       if (M_index != this_fragmentation->start_index)
+       {
+               // look for end of previous frame
+               // start at M-1, going backward
+               uint16_t index = M_index;
+               uint8_t end_or_hole_found = 0;
+
+               while (index != this_fragmentation->start_index)
+               {
+                       fragmentt *this_frag;
+
+                       if (!end_or_hole_found)
+                       {
+                               fragmentt *front_frag = &this_fragmentation->frag[index];
+
+                               // before a MP_BEGIN, there must be a MP_END
+                               if (front_frag->length && (front_frag->flags & MP_BEGIN))
+                               {
+                                       end_or_hole_found = 1;
+                                       end_index = index;
+                               }
+                       }
+
+                       index = (index + (MAXFRAGNUM-1)) & MAXFRAGNUM_MASK;
+                       this_frag = &this_fragmentation->frag[index];
+
+                       if (!end_or_hole_found)
+                       {
+                               // we are a hole or a MP_END
+                               if (!this_frag->length || (this_frag->flags & MP_END))
+                               {
+                                       end_or_hole_found = 1;
+                                       end_index = index;
+                               }
+                       }
+
+                       if (end_or_hole_found)
+                       {
+                               this_frag->flags = 0;
+                               this_frag->length = 0;
+                       }
+               }
+
+               this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
+               this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
+       }
 
        LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq);     
        return;
@@ -2141,7 +2200,7 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        if (session[s].ppp.phase < Network)
        {
-               LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
+               LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
                return;
        }
 
@@ -2157,13 +2216,13 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                switch (session[s].ppp.ccp)
                {
                case RequestSent:
-                       initialise_restart_count(s, ccp);
+                       initialise_restart_count(s, ccp);
                        change_state(s, ccp, AckReceived);
                        break;
 
                case AckReceived:
                case Opened:
-                       LOG(2, s, t, "CCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
+                       LOG(2, s, t, "CCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
                        sendccp(s, t);
                        change_state(s, ccp, RequestSent);
                        break;
@@ -2174,7 +2233,7 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
+                       LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
                }
        }
        else if (*p == ConfigReq)
@@ -2197,7 +2256,7 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Stopped:
-                       initialise_restart_count(s, ccp);
+                       initialise_restart_count(s, ccp);
                        sendccp(s, t);
                        if (*q == ConfigAck)
                                change_state(s, ccp, AckSent);
@@ -2219,7 +2278,7 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                case Opened:
-                       initialise_restart_count(s, ccp);
+                       initialise_restart_count(s, ccp);
                        sendccp(s, t);
                        /* fallthrough */
 
@@ -2232,7 +2291,7 @@ void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                        break;
 
                default:
-                       LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
+                       LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
                        return;
                }
 
@@ -2375,7 +2434,7 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
 
        if ((b - start) + l > size)
        {
-               LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, (b - start) + l);
+               LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%td)\n", size, (b - start) + l);
                return NULL;
        }
 
@@ -2418,10 +2477,10 @@ void sendlcp(sessionidt s, tunnelidt t)
        uint8_t b[500], *q, *l;
        int authtype = sess_local[s].lcp_authtype;
 
-        if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP, 0, 0, 0)))
+       if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP, 0, 0, 0)))
                return;
 
-        LOG(3, s, t, "LCP: send ConfigReq%s%s%s including MP options\n",
+       LOG(3, s, t, "LCP: send ConfigReq%s%s%s including MP options\n",
            authtype ? " (" : "",
            authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
            authtype ? ")" : "");
@@ -2448,14 +2507,14 @@ void sendlcp(sessionidt s, tunnelidt t)
                l += 4;
        }
 
-        if (sess_local[s].mp_mrru)
-        {
+       if (sess_local[s].mp_mrru)
+       {
                *l++ = 17; *l++ = 4; // Multilink Max-Receive-Reconstructed-Unit (length 4)
                *(uint16_t *) l = htons(sess_local[s].mp_mrru); l += 2;
        }
 
-        if (sess_local[s].mp_epdis)
-        {
+       if (sess_local[s].mp_epdis)
+       {
                *l++ = 19; *l++ = 7;    // Multilink Endpoint Discriminator (length 7)
                *l++ = IPADDR;  // Endpoint Discriminator class
                *(uint32_t *) l = htonl(sess_local[s].mp_epdis);