projects / l2tpns.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
return on failed lcp
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.93 2006/01/19 21:06:39 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452 if (mru < MINMTU) mru = MINMTU;
453 if (mru > size) mru = size;
454
455 l += 4;
456 if (l > mru) l = mru;
457
458 q = makeppp(buf, size, 0, 0, s, t, proto);
459 if (!q) return;
460
461 *q = CodeRej;
462 *(q + 1) = ++sess_local[s].lcp_ident;
463 *(uint16_t *)(q + 2) = htons(l);
464 memcpy(q + 4, p, l - 4);
465
466 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
467 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
468 if (config->debug > 3) dumplcp(q, l);
469
470 tunnelsend(buf, l + (q - buf), t);
471 }
472
473 // Process LCP messages
474 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
475 {
476 uint8_t b[MAXETHER];
477 uint8_t *q = NULL;
478 uint16_t hl;
479
480 CSTAT(processlcp);
481
482 LOG_HEX(5, "LCP", p, l);
483 if (l < 4)
484 {
485 LOG(1, s, t, "Short LCP %d bytes\n", l);
486 STAT(tunnel_rx_errors);
487 return ;
488 }
489
490 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
491 {
492 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
493 STAT(tunnel_rx_errors);
494 return ;
495 }
496 l = hl;
497
498 if (session[s].die) // going down...
499 return;
500
501 LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
502 "LCP: recv %s\n", ppp_code(*p));
503
504 if (config->debug > 3) dumplcp(p, l);
505
506 if (*p == ConfigAck)
507 {
508 int x = l - 4;
509 uint8_t *o = (p + 4);
510 int authtype = 0;
511
512 while (x > 2)
513 {
514 int type = o[0];
515 int length = o[1];
516
517 if (length == 0 || type == 0 || x < length) break;
518 switch (type)
519 {
520 case 3: // Authentication-Protocol
521 {
522 int proto = ntohs(*(uint16_t *)(o + 2));
523 if (proto == PPPPAP)
524 authtype = AUTHPAP;
525 else if (proto == PPPCHAP && *(o + 4) == 5)
526 authtype = AUTHCHAP;
527 }
528
529 break;
530 }
531 x -= length;
532 o += length;
533 }
534
535 if (!session[s].ip && authtype)
536 sess_local[s].lcp_authtype = authtype;
537
538 switch (session[s].ppp.lcp)
539 {
540 case RequestSent:
541 initialise_restart_count(s, lcp);
542 change_state(s, lcp, AckReceived);
543 break;
544
545 case AckReceived:
546 case Opened:
547 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
548 if (session[s].ppp.lcp == Opened)
549 lcp_restart(s);
550
551 sendlcp(s, t);
552 change_state(s, lcp, RequestSent);
553 break;
554
555 case AckSent:
556 lcp_open(s, t);
557 break;
558
559 default:
560 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
561 }
562 }
563 else if (*p == ConfigReq)
564 {
565 int x = l - 4;
566 uint8_t *o = (p + 4);
567 uint8_t *response = 0;
568 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
569 static uint8_t authproto[5];
570
571 while (x > 2)
572 {
573 int type = o[0];
574 int length = o[1];
575
576 if (length == 0 || type == 0 || x < length) break;
577 switch (type)
578 {
579 case 1: // Maximum-Receive-Unit
580 {
581 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
582 if (mru >= MINMTU)
583 {
584 session[s].mru = mru;
585 break;
586 }
587
588 LOG(3, s, t, " Remote requesting MRU of %u. Rejecting.\n", mru);
589 mru = htons(MRU);
590 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
591 }
592 break;
593
594 case 2: // Async-Control-Character-Map
595 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
596 break;
597
598 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
599 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
600 break;
601
602 case 3: // Authentication-Protocol
603 {
604 int proto = ntohs(*(uint16_t *)(o + 2));
605 char proto_name[] = "0x0000";
606 int alen;
607
608 if (proto == PPPPAP)
609 {
610 if (config->radius_authtypes & AUTHPAP)
611 {
612 sess_local[s].lcp_authtype = AUTHPAP;
613 break;
614 }
615
616 strcpy(proto_name, "PAP");
617 }
618 else if (proto == PPPCHAP)
619 {
620 if (config->radius_authtypes & AUTHCHAP
621 && *(o + 4) == 5) // MD5
622 {
623 sess_local[s].lcp_authtype = AUTHCHAP;
624 break;
625 }
626
627 strcpy(proto_name, "CHAP");
628 }
629 else
630 sprintf(proto_name, "%#4.4x", proto);
631
632 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
633
634 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
635 if (alen < 2) break; // paranoia
636
637 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
638 if (q && *response == ConfigNak &&
639 config->radius_authtypes != config->radius_authprefer)
640 {
641 // alternate type
642 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
643 if (alen < 2) break;
644 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
645 }
646
647 break;
648 }
649 break;
650
651 case 4: // Quality-Protocol
652 case 5: // Magic-Number
653 case 7: // Protocol-Field-Compression
654 case 8: // Address-And-Control-Field-Compression
655 break;
656
657 default: // Reject any unknown options
658 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
659 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
660 }
661 x -= length;
662 o += length;
663 }
664
665 if (response)
666 {
667 l = q - response; // LCP packet length
668 *((uint16_t *) (response + 2)) = htons(l); // update header
669 }
670 else
671 {
672 // Send packet back as ConfigAck
673 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
674 if (!response) return;
675 *response = ConfigAck;
676 }
677
678 switch (session[s].ppp.lcp)
679 {
680 case Closed:
681 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
682 if (!response) return;
683 *response = TerminateAck;
684 *((uint16_t *) (response + 2)) = htons(l = 4);
685 break;
686
687 case Stopped:
688 initialise_restart_count(s, lcp);
689 sendlcp(s, t);
690 if (*response == ConfigAck)
691 change_state(s, lcp, AckSent);
692 else
693 change_state(s, lcp, RequestSent);
694
695 break;
696
697 case RequestSent:
698 if (*response == ConfigAck)
699 change_state(s, lcp, AckSent);
700
701 break;
702
703 case AckReceived:
704 if (*response == ConfigAck)
705 lcp_open(s, t);
706
707 break;
708
709 case Opened:
710 lcp_restart(s);
711 sendlcp(s, t);
712 /* fallthrough */
713
714 case AckSent:
715 if (*response == ConfigAck)
716 change_state(s, lcp, AckSent);
717 else
718 change_state(s, lcp, RequestSent);
719
720 break;
721
722 default:
723 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
724 return;
725 }
726
727 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
728 if (config->debug > 3) dumplcp(response, l);
729
730 tunnelsend(b, l + (response - b), t);
731 }
732 else if (*p == ConfigNak || *p == ConfigRej)
733 {
734 int x = l - 4;
735 uint8_t *o = (p + 4);
736 int authtype = -1;
737
738 while (x > 2)
739 {
740 int type = o[0];
741 int length = o[1];
742
743 if (length == 0 || type == 0 || x < length) break;
744 switch (type)
745 {
746 case 1: // Maximum-Receive-Unit
747 if (*p == ConfigNak)
748 {
749 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
750 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
751 }
752 else
753 {
754 sess_local[s].ppp_mru = 0;
755 LOG(3, s, t, " Remote rejected MRU negotiation\n");
756 }
757
758 break;
759
760 case 3: // Authentication-Protocol
761 if (authtype > 0)
762 break;
763
764 if (*p == ConfigNak)
765 {
766 int proto = ntohs(*(uint16_t *)(o + 2));
767 if (proto == PPPPAP)
768 {
769 authtype = config->radius_authtypes & AUTHPAP;
770 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
771 authtype ? "accept" : "reject");
772 }
773 else if (proto == PPPCHAP && *(o + 4) == 5)
774 {
775 authtype = config->radius_authtypes & AUTHCHAP;
776 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
777 authtype ? "accept" : "reject");
778 }
779 else
780 {
781 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
782 proto);
783 }
784 }
785 else
786 {
787 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
788 authtype = 0; // shutdown
789 }
790
791 break;
792
793 case 5: // Magic-Number
794 if (*p == ConfigNak)
795 {
796 session[s].magic = ntohl(*(uint32_t *)(o + 2));
797 LOG(3, s, t, " Remote requested magic-no %x\n", session[s].magic);
798 if (!session[s].magic) session[s].magic = time_now; // Netgear DG814 sends zero??
799 break;
800 }
801 // ConfigRej: fallthrough
802
803 default:
804 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
805 sessionshutdown(s, "Unable to negotiate LCP.", 3, 0);
806 return;
807 }
808 x -= length;
809 o += length;
810 }
811
812 if (!authtype)
813 {
814 sessionshutdown(s, "Unsupported authentication.", 3, 0);
815 return;
816 }
817
818 if (authtype > 0)
819 sess_local[s].lcp_authtype = authtype;
820
821 switch (session[s].ppp.lcp)
822 {
823 case Closed:
824 case Stopped:
825 {
826 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
827 if (!response) return;
828 *response = TerminateAck;
829 *((uint16_t *) (response + 2)) = htons(l = 4);
830
831 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
832 if (config->debug > 3) dumplcp(response, l);
833
834 tunnelsend(b, l + (response - b), t);
835 }
836 break;
837
838 case RequestSent:
839 case AckSent:
840 initialise_restart_count(s, lcp);
841 sendlcp(s, t);
842 break;
843
844 case AckReceived:
845 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
846 sendlcp(s, t);
847 break;
848
849 case Opened:
850 lcp_restart(s);
851 sendlcp(s, t);
852 break;
853
854 default:
855 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
856 return;
857 }
858 }
859 else if (*p == TerminateReq)
860 {
861 *p = TerminateAck; // close
862 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
863 if (!q) return;
864
865 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
866 if (config->debug > 3) dumplcp(q, l);
867
868 tunnelsend(b, l + (q - b), t); // send it
869 sessionshutdown(s, "Remote end closed connection.", 3, 0);
870 }
871 else if (*p == TerminateAck)
872 {
873 sessionshutdown(s, "Connection closed.", 3, 0);
874 }
875 else if (*p == ProtocolRej)
876 {
877 uint16_t proto = 0;
878
879 if (l > 4)
880 {
881 proto = *(p+4);
882 if (l > 5 && !(proto & 1))
883 {
884 proto <<= 8;
885 proto |= *(p+5);
886 }
887 }
888
889 if (proto == PPPIPV6CP)
890 {
891 LOG(3, s, t, "IPv6 rejected\n");
892 change_state(s, ipv6cp, Closed);
893 }
894 else
895 {
896 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
897 }
898 }
899 else if (*p == EchoReq)
900 {
901 *p = EchoReply; // reply
902 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
903 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
904 if (!q) return;
905
906 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
907 if (config->debug > 3) dumplcp(q, l);
908
909 tunnelsend(b, l + (q - b), t); // send it
910 }
911 else if (*p == EchoReply)
912 {
913 // Ignore it, last_packet time is set earlier than this.
914 }
915 else if (*p != CodeRej)
916 {
917 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
918 }
919 }
920
921 static void ipcp_open(sessionidt s, tunnelidt t)
922 {
923 LOG(3, s, t, "IPCP: Opened, session is now active\n");
924
925 change_state(s, ipcp, Opened);
926
927 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
928 {
929 uint16_t r = radiusnew(s);
930 if (r)
931 {
932 radiussend(r, RADIUSSTART); // send radius start
933
934 // don't send further Start records if IPCP is restarted
935 session[s].flags |= SESSION_STARTED;
936 cluster_send_session(s);
937 }
938 }
939
940 // start IPv6 if configured and still in passive state
941 if (session[s].ppp.ipv6cp == Stopped)
942 {
943 sendipv6cp(s, t);
944 change_state(s, ipv6cp, RequestSent);
945 }
946 }
947
948 // Process IPCP messages
949 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
950 {
951 uint8_t b[MAXETHER];
952 uint8_t *q = 0;
953 uint16_t hl;
954
955 CSTAT(processipcp);
956
957 LOG_HEX(5, "IPCP", p, l);
958 if (l < 5)
959 {
960 LOG(1, s, t, "Short IPCP %d bytes\n", l);
961 STAT(tunnel_rx_errors);
962 return ;
963 }
964
965 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
966 {
967 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
968 STAT(tunnel_rx_errors);
969 return ;
970 }
971 l = hl;
972
973 if (session[s].ppp.phase < Network)
974 {
975 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
976 return;
977 }
978
979 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
980
981 if (*p == ConfigAck)
982 {
983 switch (session[s].ppp.ipcp)
984 {
985 case RequestSent:
986 initialise_restart_count(s, ipcp);
987 change_state(s, ipcp, AckReceived);
988 break;
989
990 case AckReceived:
991 case Opened:
992 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
993 sendipcp(s, t);
994 change_state(s, ipcp, RequestSent);
995 break;
996
997 case AckSent:
998 ipcp_open(s, t);
999 break;
1000
1001 default:
1002 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1003 }
1004 }
1005 else if (*p == ConfigReq)
1006 {
1007 uint8_t *response = 0;
1008 uint8_t *o = p + 4;
1009 int length = l - 4;
1010 int gotip = 0;
1011 in_addr_t addr;
1012
1013 while (length > 2)
1014 {
1015 switch (*o)
1016 {
1017 case 3: // ip address
1018 gotip++; // seen address
1019 if (o[1] != 6 || o[1] > length) return;
1020
1021 addr = htonl(session[s].ip);
1022 if (memcmp(o + 2, &addr, (sizeof addr)))
1023 {
1024 uint8_t *oq = q;
1025 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1026 if (!q || (q != oq && *response == ConfigRej))
1027 {
1028 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1029 return;
1030 }
1031 }
1032
1033 break;
1034
1035 case 129: // primary DNS
1036 if (o[1] != 6 || o[1] > length) return;
1037
1038 addr = htonl(session[s].dns1);
1039 if (memcmp(o + 2, &addr, (sizeof addr)))
1040 {
1041 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1042 if (!q) return;
1043 }
1044
1045 break;
1046
1047 case 131: // secondary DNS
1048 if (o[1] != 6 || o[1] > length) return;
1049
1050 addr = htonl(session[s].dns2);
1051 if (memcmp(o + 2, &addr, sizeof(addr)))
1052 {
1053 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1054 if (!q) return;
1055 }
1056
1057 break;
1058
1059 default:
1060 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1061 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1062 if (!q) return;
1063 }
1064
1065 length -= o[1];
1066 o += o[1];
1067 }
1068
1069 if (response)
1070 {
1071 l = q - response; // IPCP packet length
1072 *((uint16_t *) (response + 2)) = htons(l); // update header
1073 }
1074 else if (gotip)
1075 {
1076 // Send packet back as ConfigAck
1077 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1078 if (!response) return;
1079 *response = ConfigAck;
1080 }
1081 else
1082 {
1083 LOG(1, s, t, "No IP in IPCP request\n");
1084 STAT(tunnel_rx_errors);
1085 return;
1086 }
1087
1088 switch (session[s].ppp.ipcp)
1089 {
1090 case Closed:
1091 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1092 if (!response) return;
1093 *response = TerminateAck;
1094 *((uint16_t *) (response + 2)) = htons(l = 4);
1095 break;
1096
1097 case Stopped:
1098 initialise_restart_count(s, ipcp);
1099 sendipcp(s, t);
1100 if (*response == ConfigAck)
1101 change_state(s, ipcp, AckSent);
1102 else
1103 change_state(s, ipcp, RequestSent);
1104
1105 break;
1106
1107 case RequestSent:
1108 if (*response == ConfigAck)
1109 change_state(s, ipcp, AckSent);
1110
1111 break;
1112
1113 case AckReceived:
1114 if (*response == ConfigAck)
1115 ipcp_open(s, t);
1116
1117 break;
1118
1119 case Opened:
1120 initialise_restart_count(s, ipcp);
1121 sendipcp(s, t);
1122 /* fallthrough */
1123
1124 case AckSent:
1125 if (*response == ConfigAck)
1126 change_state(s, ipcp, AckSent);
1127 else
1128 change_state(s, ipcp, RequestSent);
1129
1130 break;
1131
1132 default:
1133 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1134 return;
1135 }
1136
1137 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1138 tunnelsend(b, l + (response - b), t);
1139 }
1140 else if (*p == TerminateReq)
1141 {
1142 *p = TerminateAck;
1143 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1144 if (!q) return;
1145 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1146 tunnelsend(b, l + (q - b), t);
1147 change_state(s, ipcp, Stopped);
1148 }
1149 else if (*p != CodeRej)
1150 {
1151 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1152 }
1153 }
1154
1155 static void ipv6cp_open(sessionidt s, tunnelidt t)
1156 {
1157 LOG(3, s, t, "IPV6CP: Opened\n");
1158
1159 change_state(s, ipv6cp, Opened);
1160 if (session[s].ipv6prefixlen)
1161 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1162
1163 // Send an initial RA (TODO: Should we send these regularly?)
1164 send_ipv6_ra(s, t, NULL);
1165 }
1166
1167 // Process IPV6CP messages
1168 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1169 {
1170 uint8_t b[MAXETHER];
1171 uint8_t *q = 0;
1172 uint16_t hl;
1173
1174 CSTAT(processipv6cp);
1175
1176 LOG_HEX(5, "IPV6CP", p, l);
1177 if (l < 4)
1178 {
1179 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1180 STAT(tunnel_rx_errors);
1181 return ;
1182 }
1183
1184 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1185 {
1186 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1187 STAT(tunnel_rx_errors);
1188 return ;
1189 }
1190 l = hl;
1191
1192 if (session[s].ppp.phase < Network)
1193 {
1194 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1195 return;
1196 }
1197
1198 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1199
1200 if (!session[s].ip)
1201 {
1202 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1203 return; // need IPCP to complete...
1204 }
1205
1206 if (*p == ConfigAck)
1207 {
1208 switch (session[s].ppp.ipv6cp)
1209 {
1210 case RequestSent:
1211 initialise_restart_count(s, ipv6cp);
1212 change_state(s, ipv6cp, AckReceived);
1213 break;
1214
1215 case AckReceived:
1216 case Opened:
1217 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1218 sendipv6cp(s, t);
1219 change_state(s, ipv6cp, RequestSent);
1220 break;
1221
1222 case AckSent:
1223 ipv6cp_open(s, t);
1224 break;
1225
1226 default:
1227 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1228 }
1229 }
1230 else if (*p == ConfigReq)
1231 {
1232 uint8_t *response = 0;
1233 uint8_t *o = p + 4;
1234 int length = l - 4;
1235 int gotip = 0;
1236 uint8_t ident[8];
1237
1238 while (length > 2)
1239 {
1240 switch (*o)
1241 {
1242 case 1: // interface identifier
1243 gotip++; // seen address
1244 if (o[1] != 10 || o[1] > length) return;
1245
1246 *(uint32_t *) ident = htonl(session[s].ip);
1247 *(uint32_t *) (ident + 4) = 0;
1248
1249 if (memcmp(o + 2, ident, sizeof(ident)))
1250 {
1251 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1252 if (!q) return;
1253 }
1254
1255 break;
1256
1257 default:
1258 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1259 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1260 if (!q) return;
1261 }
1262
1263 length -= o[1];
1264 o += o[1];
1265 }
1266
1267 if (response)
1268 {
1269 l = q - response; // IPV6CP packet length
1270 *((uint16_t *) (response + 2)) = htons(l); // update header
1271 }
1272 else if (gotip)
1273 {
1274 // Send packet back as ConfigAck
1275 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1276 if (!response) return;
1277 *response = ConfigAck;
1278 }
1279 else
1280 {
1281 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1282 STAT(tunnel_rx_errors);
1283 return;
1284 }
1285
1286 switch (session[s].ppp.ipv6cp)
1287 {
1288 case Closed:
1289 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1290 if (!response) return;
1291 *response = TerminateAck;
1292 *((uint16_t *) (response + 2)) = htons(l = 4);
1293 break;
1294
1295 case Stopped:
1296 initialise_restart_count(s, ipv6cp);
1297 sendipv6cp(s, t);
1298 if (*response == ConfigAck)
1299 change_state(s, ipv6cp, AckSent);
1300 else
1301 change_state(s, ipv6cp, RequestSent);
1302
1303 break;
1304
1305 case RequestSent:
1306 if (*response == ConfigAck)
1307 change_state(s, ipv6cp, AckSent);
1308
1309 break;
1310
1311 case AckReceived:
1312 if (*response == ConfigAck)
1313 ipv6cp_open(s, t);
1314
1315 break;
1316
1317 case Opened:
1318 initialise_restart_count(s, ipv6cp);
1319 sendipv6cp(s, t);
1320 /* fallthrough */
1321
1322 case AckSent:
1323 if (*response == ConfigAck)
1324 change_state(s, ipv6cp, AckSent);
1325 else
1326 change_state(s, ipv6cp, RequestSent);
1327
1328 break;
1329
1330 default:
1331 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1332 return;
1333 }
1334
1335 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1336 tunnelsend(b, l + (response - b), t);
1337 }
1338 else if (*p == TerminateReq)
1339 {
1340 *p = TerminateAck;
1341 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1342 if (!q) return;
1343 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1344 tunnelsend(b, l + (q - b), t);
1345 change_state(s, ipv6cp, Stopped);
1346 }
1347 else if (*p != CodeRej)
1348 {
1349 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1350 }
1351 }
1352
1353 // process IP packet received
1354 //
1355 // This MUST be called with at least 4 byte behind 'p'.
1356 // (i.e. this routine writes to p[-4]).
1357 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1358 {
1359 in_addr_t ip;
1360
1361 CSTAT(processipin);
1362
1363 LOG_HEX(5, "IP", p, l);
1364
1365 if (l < 20)
1366 {
1367 LOG(1, s, t, "IP packet too short %d\n", l);
1368 STAT(tunnel_rx_errors);
1369 return ;
1370 }
1371
1372 ip = ntohl(*(uint32_t *)(p + 12));
1373
1374 if (l > MAXETHER)
1375 {
1376 LOG(1, s, t, "IP packet too long %d\n", l);
1377 STAT(tunnel_rx_errors);
1378 return ;
1379 }
1380
1381 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1382 return;
1383
1384 // no spoof (do sessionbyip to handled statically routed subnets)
1385 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1386 {
1387 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1388 return;
1389 }
1390
1391 // run access-list if any
1392 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1393 return;
1394
1395 // adjust MSS on SYN and SYN,ACK packets with options
1396 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1397 {
1398 int ihl = (p[0] & 0xf) * 4; // length of IP header
1399 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1400 adjust_tcp_mss(s, t, p, l, p + ihl);
1401 }
1402
1403 // Add on the tun header
1404 p -= 4;
1405 *(uint32_t *) p = htonl(PKTIP);
1406 l += 4;
1407
1408 // Are we throttled and a slave?
1409 if (session[s].tbf_in && !config->cluster_iam_master) {
1410 // Pass it to the master for handling.
1411 master_throttle_packet(session[s].tbf_in, p, l);
1412 return;
1413 }
1414
1415 // Are we throttled and a master??
1416 if (session[s].tbf_in && config->cluster_iam_master) {
1417 // Actually handle the throttled packets.
1418 tbf_queue_packet(session[s].tbf_in, p, l);
1419 return;
1420 }
1421
1422 // send to ethernet
1423 if (tun_write(p, l) < 0)
1424 {
1425 STAT(tun_tx_errors);
1426 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1427 l, strerror(errno), tunfd, p);
1428
1429 return;
1430 }
1431
1432 p += 4;
1433 l -= 4;
1434
1435 if (session[s].snoop_ip && session[s].snoop_port)
1436 {
1437 // Snooping this session
1438 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1439 }
1440
1441 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1442 session[s].cin_delta += l;
1443 session[s].pin++;
1444
1445 sess_local[s].cin += l;
1446 sess_local[s].pin++;
1447
1448 eth_tx += l;
1449
1450 STAT(tun_tx_packets);
1451 INC_STAT(tun_tx_bytes, l);
1452 }
1453
1454 // process IPv6 packet received
1455 //
1456 // This MUST be called with at least 4 byte behind 'p'.
1457 // (i.e. this routine writes to p[-4]).
1458 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1459 {
1460 struct in6_addr ip;
1461 in_addr_t ipv4;
1462
1463 CSTAT(processipv6in);
1464
1465 LOG_HEX(5, "IPv6", p, l);
1466
1467 ip = *(struct in6_addr *) (p + 8);
1468 ipv4 = ntohl(*(uint32_t *)(p + 16));
1469
1470 if (l > MAXETHER)
1471 {
1472 LOG(1, s, t, "IP packet too long %d\n", l);
1473 STAT(tunnel_rx_errors);
1474 return ;
1475 }
1476
1477 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1478 return;
1479
1480 // no spoof
1481 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1482 {
1483 char str[INET6_ADDRSTRLEN];
1484 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1485 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1486 return;
1487 }
1488
1489 // Check if it's a Router Solicition message.
1490 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1491 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1492 *(uint32_t *)(p + 34) == 0 &&
1493 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1494 LOG(3, s, t, "Got IPv6 RS\n");
1495 send_ipv6_ra(s, t, &ip);
1496 return;
1497 }
1498
1499 // Add on the tun header
1500 p -= 4;
1501 *(uint32_t *) p = htonl(PKTIPV6);
1502 l += 4;
1503
1504 // Are we throttled and a slave?
1505 if (session[s].tbf_in && !config->cluster_iam_master) {
1506 // Pass it to the master for handling.
1507 master_throttle_packet(session[s].tbf_in, p, l);
1508 return;
1509 }
1510
1511 // Are we throttled and a master??
1512 if (session[s].tbf_in && config->cluster_iam_master) {
1513 // Actually handle the throttled packets.
1514 tbf_queue_packet(session[s].tbf_in, p, l);
1515 return;
1516 }
1517
1518 // send to ethernet
1519 if (tun_write(p, l) < 0)
1520 {
1521 STAT(tun_tx_errors);
1522 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1523 l, strerror(errno), tunfd, p);
1524
1525 return;
1526 }
1527
1528 p += 4;
1529 l -= 4;
1530
1531 if (session[s].snoop_ip && session[s].snoop_port)
1532 {
1533 // Snooping this session
1534 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1535 }
1536
1537 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1538 session[s].cin_delta += l;
1539 session[s].pin++;
1540
1541 sess_local[s].cin += l;
1542 sess_local[s].pin++;
1543
1544 eth_tx += l;
1545
1546 STAT(tun_tx_packets);
1547 INC_STAT(tun_tx_bytes, l);
1548 }
1549
1550 //
1551 // Helper routine for the TBF filters.
1552 // Used to send queued data in from the user.
1553 //
1554 void send_ipin(sessionidt s, uint8_t *buf, int len)
1555 {
1556 LOG_HEX(5, "IP in throttled", buf, len);
1557
1558 if (write(tunfd, buf, len) < 0)
1559 {
1560 STAT(tun_tx_errors);
1561 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1562 len, strerror(errno), tunfd, buf);
1563
1564 return;
1565 }
1566
1567 buf += 4;
1568 len -= 4;
1569
1570 if (session[s].snoop_ip && session[s].snoop_port)
1571 {
1572 // Snooping this session
1573 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1574 }
1575
1576 // Increment packet counters
1577 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1578 session[s].cin_delta += len;
1579 session[s].pin++;
1580
1581 sess_local[s].cin += len;
1582 sess_local[s].pin++;
1583
1584 eth_tx += len;
1585
1586 STAT(tun_tx_packets);
1587 INC_STAT(tun_tx_bytes, len - 4);
1588 }
1589
1590
1591 // Process CCP messages
1592 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1593 {
1594 uint8_t b[MAXETHER];
1595 uint8_t *q;
1596
1597 CSTAT(processccp);
1598
1599 LOG_HEX(5, "CCP", p, l);
1600
1601 if (session[s].ppp.phase < Network)
1602 {
1603 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1604 return;
1605 }
1606
1607 if (l < 1)
1608 {
1609 LOG(1, s, t, "Short CCP packet\n");
1610 STAT(tunnel_rx_errors);
1611 }
1612
1613 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1614 if (*p == ConfigAck)
1615 {
1616 switch (session[s].ppp.ccp)
1617 {
1618 case RequestSent:
1619 initialise_restart_count(s, ccp);
1620 change_state(s, ccp, AckReceived);
1621 break;
1622
1623 case AckReceived:
1624 case Opened:
1625 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1626 sendccp(s, t);
1627 change_state(s, ccp, RequestSent);
1628 break;
1629
1630 case AckSent:
1631 LOG(3, s, t, "CCP: Opened\n");
1632 change_state(s, ccp, Opened);
1633 break;
1634
1635 default:
1636 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1637 }
1638 }
1639 else if (*p == ConfigReq)
1640 {
1641 if (l < 6) // accept no compression
1642 *p = ConfigAck;
1643 else // compression requested--reject
1644 *p = ConfigRej;
1645
1646 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1647 if (!q) return;
1648
1649 switch (session[s].ppp.ccp)
1650 {
1651 case Closed:
1652 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1653 if (!q) return;
1654 *q = TerminateAck;
1655 *((uint16_t *) (q + 2)) = htons(l = 4);
1656 break;
1657
1658 case Stopped:
1659 initialise_restart_count(s, ccp);
1660 sendccp(s, t);
1661 if (*q == ConfigAck)
1662 change_state(s, ccp, AckSent);
1663 else
1664 change_state(s, ccp, RequestSent);
1665
1666 break;
1667
1668 case RequestSent:
1669 if (*q == ConfigAck)
1670 change_state(s, ccp, AckSent);
1671
1672 break;
1673
1674 case AckReceived:
1675 if (*q == ConfigAck)
1676 change_state(s, ccp, Opened);
1677
1678 break;
1679
1680 case Opened:
1681 initialise_restart_count(s, ccp);
1682 sendccp(s, t);
1683 /* fallthrough */
1684
1685 case AckSent:
1686 if (*q == ConfigAck)
1687 change_state(s, ccp, AckSent);
1688 else
1689 change_state(s, ccp, RequestSent);
1690
1691 break;
1692
1693 default:
1694 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1695 return;
1696 }
1697
1698 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1699 tunnelsend(b, l + (q - b), t);
1700 }
1701 else if (*p == TerminateReq)
1702 {
1703 *p = TerminateAck;
1704 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1705 if (!q) return;
1706 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1707 tunnelsend(b, l + (q - b), t);
1708 change_state(s, ccp, Stopped);
1709 }
1710 else if (*p != CodeRej)
1711 {
1712 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1713 }
1714 }
1715
1716 // send a CHAP challenge
1717 void sendchap(sessionidt s, tunnelidt t)
1718 {
1719 uint8_t b[MAXETHER];
1720 uint16_t r;
1721 uint8_t *q;
1722
1723 CSTAT(sendchap);
1724
1725 r = radiusnew(s);
1726 if (!r)
1727 {
1728 LOG(1, s, t, "No RADIUS to send challenge\n");
1729 STAT(tunnel_tx_errors);
1730 return;
1731 }
1732
1733 LOG(1, s, t, "Send CHAP challenge\n");
1734
1735 radius[r].chap = 1; // CHAP not PAP
1736 radius[r].id++;
1737 if (radius[r].state != RADIUSCHAP)
1738 radius[r].try = 0;
1739
1740 radius[r].state = RADIUSCHAP;
1741 radius[r].retry = backoff(radius[r].try++);
1742 if (radius[r].try > 5)
1743 {
1744 sessionshutdown(s, "CHAP timeout.", 3, 0);
1745 STAT(tunnel_tx_errors);
1746 return ;
1747 }
1748 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1749 if (!q) return;
1750
1751 *q = 1; // challenge
1752 q[1] = radius[r].id; // ID
1753 q[4] = 16; // value size (size of challenge)
1754 memcpy(q + 5, radius[r].auth, 16); // challenge
1755 strcpy((char *) q + 21, hostname); // our name
1756 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1757 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1758 }
1759
1760 // fill in a L2TP message with a PPP frame,
1761 // copies existing PPP message and changes magic number if seen
1762 // returns start of PPP frame
1763 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1764 {
1765 if (size < 12) // Need more space than this!!
1766 {
1767 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1768 return NULL;
1769 }
1770
1771 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1772 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1773 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1774 b += 6;
1775 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1776 {
1777 *(uint16_t *) b = htons(0xFF03); // HDLC header
1778 b += 2;
1779 }
1780 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1781 *b++ = mtype;
1782 else
1783 {
1784 *(uint16_t *) b = htons(mtype);
1785 b += 2;
1786 }
1787
1788 if (l + 12 > size)
1789 {
1790 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1791 return NULL;
1792 }
1793
1794 if (p && l)
1795 memcpy(b, p, l);
1796
1797 return b;
1798 }
1799
1800 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1801 {
1802 int len = 0;
1803 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1804 return 0;
1805
1806 *b++ = 3; // Authentication-Protocol
1807 if (authtype == AUTHCHAP)
1808 {
1809 len = *b++ = 5; // length
1810 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1811 *b++ = 5; // MD5
1812 }
1813 else if (authtype == AUTHPAP)
1814 {
1815 len = *b++ = 4; // length
1816 *(uint16_t *) b = htons(PPPPAP); b += 2;
1817 }
1818 else
1819 {
1820 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1821 }
1822
1823 return len;
1824 }
1825
1826 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1827 void sendlcp(sessionidt s, tunnelidt t)
1828 {
1829 uint8_t b[500], *q, *l;
1830 int authtype = sess_local[s].lcp_authtype;
1831
1832 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1833 return;
1834
1835 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1836 authtype ? " (" : "",
1837 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1838 authtype ? ")" : "");
1839
1840 l = q;
1841 *l++ = ConfigReq;
1842 *l++ = ++sess_local[s].lcp_ident; // ID
1843
1844 l += 2; //Save space for length
1845
1846 if (sess_local[s].ppp_mru)
1847 {
1848 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1849 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1850 }
1851
1852 if (authtype)
1853 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1854
1855 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1856 *(uint32_t *) l = htonl(session[s].magic);
1857 l += 4;
1858
1859 *(uint16_t *)(q + 2) = htons(l - q); // Length
1860
1861 LOG_HEX(5, "PPPLCP", q, l - q);
1862 if (config->debug > 3) dumplcp(q, l - q);
1863
1864 tunnelsend(b, (l - b), t);
1865 restart_timer(s, lcp);
1866 }
1867
1868 // Send CCP request for no compression
1869 void sendccp(sessionidt s, tunnelidt t)
1870 {
1871 uint8_t b[500], *q;
1872
1873 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1874 return;
1875
1876 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1877
1878 *q = ConfigReq;
1879 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1880 *(uint16_t *)(q + 2) = htons(4); // Length
1881
1882 LOG_HEX(5, "PPPCCP", q, 4);
1883 tunnelsend(b, (q - b) + 4 , t);
1884 restart_timer(s, ccp);
1885 }
1886
1887 // Reject unknown/unconfigured protocols
1888 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1889 {
1890
1891 uint8_t buf[MAXETHER];
1892 uint8_t *q;
1893 int mru = session[s].mru;
1894 if (mru < MINMTU) mru = MINMTU;
1895 if (mru > sizeof(buf)) mru = sizeof(buf);
1896
1897 l += 6;
1898 if (l > mru) l = mru;
1899
1900 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1901 if (!q) return;
1902
1903 *q = ProtocolRej;
1904 *(q + 1) = ++sess_local[s].lcp_ident;
1905 *(uint16_t *)(q + 2) = htons(l);
1906 *(uint16_t *)(q + 4) = htons(proto);
1907 memcpy(q + 6, p, l - 6);
1908
1909 if (proto == PPPIPV6CP)
1910 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1911 else
1912 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1913
1914 tunnelsend(buf, l + (q - buf), t);
1915 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"