ppp.c

   1 // L2TPNS PPP Stuff
   2
   3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.26 2004-11-16 07:54:32 bodea Exp $";
   4
   5 #include <stdio.h>
   6 #include <string.h>
   7 #include <unistd.h>
   8 #include <errno.h>
   9 #include <stdlib.h>
  10 #include "l2tpns.h"
  11 #include "constants.h"
  12 #include "plugin.h"
  13 #include "util.h"
  14 #include "tbf.h"
  15 #include "cluster.h"
  16
  17 extern tunnelt *tunnel;
  18 extern sessiont *session;
  19 extern radiust *radius;
  20 extern int tunfd;
  21 extern char hostname[];
  22 extern u32 eth_tx;
  23 extern time_t time_now;
  24 extern struct configt *config;
  25
  26 static void sendccp(tunnelidt t, sessionidt s);
  27
  28 // Process PAP messages
  29 void processpap(tunnelidt t, sessionidt s, u8 *p, u16 l)
  30 {
  31         char user[129];
  32         char pass[129];
  33         u16 hl;
  34
  35         CSTAT(call_processpap);
  36
  37         LOG_HEX(5, "PAP", p, l);
  38         if (l < 4)
  39         {
  40                 LOG(1, 0, s, t, "Short PAP %u bytes\n", l);
  41                 STAT(tunnel_rx_errors);
  42                 return ;
  43         }
  44
  45         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
  46         {
  47                 LOG(1, 0, s, t, "Length mismatch PAP %u/%u\n", hl, l);
  48                 STAT(tunnel_rx_errors);
  49                 return ;
  50         }
  51         l = hl;
  52
  53         if (*p != 1)
  54         {
  55                 LOG(1, 0, s, t, "Unexpected PAP code %d\n", *p);
  56                 STAT(tunnel_rx_errors);
  57                 return ;
  58         }
  59
  60         {
  61                 u8 *b = p;
  62                 b += 4;
  63                 if (*b && *b < sizeof(user))
  64                         memcpy(user, b + 1, *b);
  65                 user[*b] = 0;
  66                 b += 1 + *b;
  67                 if (*b && *b < sizeof(pass))
  68                         memcpy(pass, b + 1, *b);
  69                 pass[*b] = 0;
  70                 LOG(3, 0, s, t, "PAP login %s/%s\n", user, pass);
  71         }
  72         if (session[s].ip || !session[s].radius)
  73         {
  74                 // respond now, either no RADIUS available or already authenticated
  75                 u8 b[MAXCONTROL];
  76                 u8 id = p[1];
  77                 u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP);
  78                 if (!p) {       // Failed to make ppp header!
  79                         LOG(1,0,0,0, "Failed to make PPP header in process pap!\n");
  80                         return;
  81                 }
  82                 if (session[s].ip)
  83                         *p = 2;                 // ACK
  84                 else
  85                         *p = 3;                 // cant authorise
  86                 p[1] = id;
  87                 *(u16 *) (p + 2) = htons(5);    // length
  88                 p[4] = 0;                       // no message
  89                 if (session[s].ip)
  90                 {
  91                         LOG(3, session[s].ip, s, t, "Already an IP allocated: %s (%d)\n", inet_toa(htonl(session[s].ip)), session[s].ip_pool_index);
  92                         session[s].flags &= ~SF_IPCP_ACKED;
  93                 }
  94                 else
  95                 {
  96                         LOG(1, 0, s, t, "No radius session available to authenticate session...\n");
  97                 }
  98                 LOG(3, 0, s, t, "Fallback response to PAP (%s)\n", (session[s].ip) ? "ACK" : "NAK");
  99                 tunnelsend(b, 5 + (p - b), t); // send it
 100         }
 101         else
 102         {
 103                 // set up RADIUS request
 104                 u16 r = session[s].radius;
 105
 106                 // Run PRE_AUTH plugins
 107                 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
 108                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 109                 if (!packet.continue_auth)
 110                 {
 111                         LOG(3, 0, s, t, "A plugin rejected PRE_AUTH\n");
 112                         if (packet.username) free(packet.username);
 113                         if (packet.password) free(packet.password);
 114                         return;
 115                 }
 116
 117                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 118                 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
 119
 120                 free(packet.username);
 121                 free(packet.password);
 122
 123                 radius[r].id = p[1];
 124                 LOG(3, 0, s, t, "Sending login for %s/%s to radius\n", user, pass);
 125                 radiussend(r, RADIUSAUTH);
 126         }
 127 }
 128
 129 // Process CHAP messages
 130 void processchap(tunnelidt t, sessionidt s, u8 *p, u16 l)
 131 {
 132         u16 r;
 133         u16 hl;
 134
 135         CSTAT(call_processchap);
 136
 137         LOG_HEX(5, "CHAP", p, l);
 138         r = session[s].radius;
 139         if (!r)
 140         {
 141                 LOG(1, 0, s, t, "Unexpected CHAP message\n");
 142
 143 // FIXME: Need to drop the session here.
 144
 145                 STAT(tunnel_rx_errors);
 146                 return;
 147         }
 148
 149         if (l < 4)
 150         {
 151                 LOG(1, 0, s, t, "Short CHAP %u bytes\n", l);
 152                 STAT(tunnel_rx_errors);
 153                 return ;
 154         }
 155
 156         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 157         {
 158                 LOG(1, 0, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
 159                 STAT(tunnel_rx_errors);
 160                 return ;
 161         }
 162         l = hl;
 163
 164         if (*p != 2)
 165         {
 166                 LOG(1, 0, s, t, "Unexpected CHAP response code %d\n", *p);
 167                 STAT(tunnel_rx_errors);
 168                 return;
 169         }
 170         if (p[1] != radius[r].id)
 171         {
 172                 LOG(1, 0, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
 173                 STAT(tunnel_rx_errors);
 174                 return ;
 175         }
 176
 177         if (l < 5 || p[4] != 16)
 178         {
 179                 LOG(1, 0, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
 180                 STAT(tunnel_rx_errors);
 181                 return ;
 182         }
 183
 184         l -= 5;
 185         p += 5;
 186         if (l < 16 || l - 16 >= sizeof(session[s].user))
 187         {
 188                 LOG(1, 0, s, t, "CHAP user too long %d\n", l - 16);
 189                 STAT(tunnel_rx_errors);
 190                 return ;
 191         }
 192
 193         // Run PRE_AUTH plugins
 194         {
 195                 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
 196
 197                 packet.password = calloc(17, 1);
 198                 memcpy(packet.password, p, 16);
 199
 200                 p += 16;
 201                 l -= 16;
 202
 203                 packet.username = calloc(l + 1, 1);
 204                 memcpy(packet.username, p, l);
 205
 206                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 207                 if (!packet.continue_auth)
 208                 {
 209                         LOG(3, 0, s, t, "A plugin rejected PRE_AUTH\n");
 210                         if (packet.username) free(packet.username);
 211                         if (packet.password) free(packet.password);
 212                         return;
 213                 }
 214
 215                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 216                 memcpy(radius[r].pass, packet.password, 16);
 217
 218                 free(packet.username);
 219                 free(packet.password);
 220         }
 221
 222         radius[r].chap = 1;
 223         LOG(3, 0, s, t, "CHAP login %s\n", session[s].user);
 224         radiussend(r, RADIUSAUTH);
 225 }
 226
 227 static char *ppp_lcp_types[] = {
 228         NULL,
 229         "ConfigReq",
 230         "ConfigAck",
 231         "ConfigNak",
 232         "ConfigRej",
 233         "TerminateReq",
 234         "TerminateAck",
 235         "CodeRej",
 236         "ProtocolRej",
 237         "EchoReq",
 238         "EchoReply",
 239         "DiscardRequest",
 240         "IdentRequest",
 241 };
 242
 243 static void dumplcp(u8 *p, int l)
 244 {
 245         int x = l - 4;
 246         u8 *o = (p + 4);
 247
 248         LOG_HEX(5, "PPP LCP Packet", p, l);
 249         LOG(4, 0, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_lcp_types[(int)*p], ntohs( ((u16 *) p)[1]) );
 250         LOG(4, 0, 0, 0, "Length: %d\n", l);
 251         if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
 252                 return;
 253
 254         while (x > 2)
 255         {
 256                 int type = o[0];
 257                 int length = o[1];
 258                 if (length < 2)
 259                 {
 260                         LOG(4, 0, 0, 0, "       Option length is %d...\n", length);
 261                         break;
 262                 }
 263                 if (type == 0)
 264                 {
 265                         LOG(4, 0, 0, 0, "       Option type is 0...\n");
 266                         x -= length;
 267                         o += length;
 268                         continue;
 269                 }
 270                 switch (type)
 271                 {
 272                         case 1: // Maximum-Receive-Unit
 273                                 if (length == 4)
 274                                         LOG(4, 0, 0, 0, "    %s %d\n", lcp_types[type], ntohs(*(u16 *)(o + 2)));
 275                                 else
 276                                         LOG(4, 0, 0, 0, "    %s odd length %d\n", lcp_types[type], length);
 277                                 break;
 278                         case 2: // Async-Control-Character-Map
 279                                 if (length == 6)
 280                                 {
 281                                         u32 asyncmap = ntohl(*(u32 *)(o + 2));
 282                                         LOG(4, 0, 0, 0, "    %s %x\n", lcp_types[type], asyncmap);
 283                                 }
 284                                 else
 285                                         LOG(4, 0, 0, 0, "   %s odd length %d\n", lcp_types[type], length);
 286                                 break;
 287                         case 3: // Authentication-Protocol
 288                                 if (length == 4)
 289                                 {
 290                                         int proto = ntohs(*(u16 *)(o + 2));
 291                                         LOG(4, 0, 0, 0, "   %s 0x%x (%s)\n", lcp_types[type], proto,
 292                                                 proto == PPPCHAP ? "CHAP" :
 293                                                 proto == PPPPAP  ? "PAP"  : "UNKNOWN");
 294                                 }
 295                                 else
 296                                         LOG(4, 0, 0, 0, "   %s odd length %d\n", lcp_types[type], length);
 297                                 break;
 298                         case 4: // Quality-Protocol
 299                                 {
 300                                         u32 qp = ntohl(*(u32 *)(o + 2));
 301                                         LOG(4, 0, 0, 0, "    %s %x\n", lcp_types[type], qp);
 302                                 }
 303                                 break;
 304                         case 5: // Magic-Number
 305                                 if (length == 6)
 306                                 {
 307                                         u32 magicno = ntohl(*(u32 *)(o + 2));
 308                                         LOG(4, 0, 0, 0, "    %s %x\n", lcp_types[type], magicno);
 309                                 }
 310                                 else
 311                                         LOG(4, 0, 0, 0, "   %s odd length %d\n", lcp_types[type], length);
 312                                 break;
 313                         case 7: // Protocol-Field-Compression
 314                         case 8: // Address-And-Control-Field-Compression
 315                                 LOG(4, 0, 0, 0, "    %s\n", lcp_types[type]);
 316                                 break;
 317                         default:
 318                                 LOG(2, 0, 0, 0, "    Unknown PPP LCP Option type %d\n", type);
 319                                 break;
 320                 }
 321                 x -= length;
 322                 o += length;
 323         }
 324 }
 325
 326 // Process LCP messages
 327 void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 328 {
 329         u8 b[MAXCONTROL];
 330         u8 *q = NULL;
 331         u32 magicno = 0;
 332         u16 hl;
 333
 334         CSTAT(call_processlcp);
 335
 336         LOG_HEX(5, "LCP", p, l);
 337         if (l < 4)
 338         {
 339                 LOG(1, session[s].ip, s, t, "Short LCP %d bytes\n", l);
 340                 STAT(tunnel_rx_errors);
 341                 return ;
 342         }
 343
 344         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 345         {
 346                 LOG(1, 0, s, t, "Length mismatch LCP %u/%u\n", hl, l);
 347                 STAT(tunnel_rx_errors);
 348                 return ;
 349         }
 350         l = hl;
 351
 352         if (*p == ConfigAck)
 353         {
 354                 LOG(3, session[s].ip, s, t, "LCP: Discarding ConfigAck\n");
 355                 session[s].flags |= SF_LCP_ACKED;
 356         }
 357         else if (*p == ConfigReq)
 358         {
 359                 int x = l - 4;
 360                 u8 *o = (p + 4);
 361                 u8 response = 0;
 362
 363                 LOG(3, session[s].ip, s, t, "LCP: ConfigReq (%d bytes)...\n", l);
 364                 if (config->debug > 3) dumplcp(p, l);
 365
 366                 while (x > 2)
 367                 {
 368                         int type = o[0];
 369                         int length = o[1];
 370                         if (length == 0 || type == 0 || x < length) break;
 371                         switch (type)
 372                         {
 373                                 case 1: // Maximum-Receive-Unit
 374                                         session[s].mru = ntohs(*(u16 *)(o + 2));
 375                                         break;
 376
 377                                 case 2: // Async-Control-Character-Map
 378                                         if (!ntohl(*(u32 *)(o + 2))) // all bits zero is OK
 379                                                 break;
 380
 381                                         if (response && response != ConfigNak) // rej already queued
 382                                                 break;
 383
 384                                         LOG(2, session[s].ip, s, t, "    Remote requesting asyncmap.  Rejecting.\n");
 385                                         if (!response)
 386                                         {
 387                                                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 388                                                 if (!q)
 389                                                 {
 390                                                         LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
 391                                                         break;
 392                                                 }
 393                                                 response = *q++ = ConfigNak;
 394                                         }
 395                                         *q++ = type;
 396                                         *q++ = 6;
 397                                         memset(q, 0, 4); // asyncmap 0
 398                                         q += 4;
 399                                         break;
 400
 401                                 case 3: // Authentication-Protocol
 402                                         {
 403                                                 int proto = ntohs(*(u16 *)(o + 2));
 404                                                 char proto_name[] = "0x0000";
 405                                                 if (proto == PPPPAP)
 406                                                         break;
 407
 408                                                 if (response && response != ConfigNak) // rej already queued
 409                                                         break;
 410
 411                                                 if (proto == PPPCHAP)
 412                                                         strcpy(proto_name, "CHAP");
 413                                                 else
 414                                                         sprintf(proto_name, "%#4.4x", proto);
 415
 416                                                 LOG(2, session[s].ip, s, t, "    Remote requesting %s authentication.  Rejecting.\n", proto_name);
 417
 418                                                 if (!response)
 419                                                 {
 420                                                         q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 421                                                         if (!q)
 422                                                         {
 423                                                                 LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
 424                                                                 break;
 425                                                         }
 426                                                         response = *q++ = ConfigNak;
 427                                                 }
 428                                                 memcpy(q, o, length);
 429                                                 *(u16 *)(q += 2) = htons(PPPPAP); // NAK -> Use PAP instead
 430                                                 q += length;
 431                                         }
 432                                         break;
 433
 434                                 case 5: // Magic-Number
 435                                         magicno = ntohl(*(u32 *)(o + 2));
 436                                         break;
 437
 438                                 case 4: // Quality-Protocol
 439                                 case 7: // Protocol-Field-Compression
 440                                 case 8: // Address-And-Control-Field-Compression
 441                                         break;
 442
 443                                 default: // Reject any unknown options
 444                                         LOG(2, session[s].ip, s, t, "    Rejecting PPP LCP Option type %d\n", type);
 445                                         if (!response || response != ConfigRej) // drop nak in favour of rej
 446                                         {
 447                                                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 448                                                 if (!q)
 449                                                 {
 450                                                         LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
 451                                                         break;
 452                                                 }
 453                                                 response = *q++ = ConfigRej;
 454                                         }
 455
 456                                         memcpy(q, o, length);
 457                                         q += length;
 458                         }
 459                         x -= length;
 460                         o += length;
 461                 }
 462
 463                 if (!response)
 464                 {
 465                         // Send back a ConfigAck
 466                         q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 467                         if (!q)
 468                         {
 469                                 LOG(3, session[s].ip, s, t, " failed to create packet.\n");
 470                                 return;
 471                         }
 472                         response = *q = ConfigAck;
 473                 }
 474
 475                 LOG(3, session[s].ip, s, t, "Sending %s\n", ppp_lcp_types[response]);
 476                 tunnelsend(b, l + (q - b), t);
 477
 478                 if (!(session[s].flags & SF_LCP_ACKED))
 479                         initlcp(t, s);
 480         }
 481         else if (*p == ConfigNak)
 482         {
 483                 LOG(1, session[s].ip, s, t, "Remote end sent a ConfigNak. Ignoring\n");
 484                 if (config->debug > 3) dumplcp(p, l);
 485                 return ;
 486         }
 487         else if (*p == TerminateReq)
 488         {
 489                 *p = TerminateAck;      // close
 490                 q = makeppp(b, sizeof(b),  p, l, t, s, PPPLCP);
 491                 if (!q)
 492                 {
 493                         LOG(3, session[s].ip, s, t, "Failed to create PPP packet in processlcp.\n");
 494                         return;
 495                 }
 496                 LOG(3, session[s].ip, s, t, "LCP: Received TerminateReq. Sending TerminateAck\n");
 497                 sessionshutdown(s, "Remote end closed connection.");
 498                 tunnelsend(b, l + (q - b), t); // send it
 499         }
 500         else if (*p == TerminateAck)
 501         {
 502                 sessionshutdown(s, "Connection closed.");
 503         }
 504         else if (*p == EchoReq)
 505         {
 506                 *p = EchoReply;         // reply
 507                 *(u32 *) (p + 4) = htonl(session[s].magic); // our magic number
 508                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 509                 if (!q)
 510                 {
 511                         LOG(3, session[s].ip, s, t, " failed to send EchoReply.\n");
 512                         return;
 513                 }
 514                 LOG(5, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
 515                 tunnelsend(b, l + (q - b), t); // send it
 516         }
 517         else if (*p == EchoReply)
 518         {
 519                 // Ignore it, last_packet time is set earlier than this.
 520         }
 521         else if (*p == IdentRequest)
 522         {
 523                 *p = CodeRej;
 524                 if (l > MAXCONTROL)
 525                 {
 526                         LOG(1, 0, s, t, "Truncated Ident Packet (length=%d) to 1400 bytes\n", l);
 527                         l = 1400;
 528                 }
 529                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 530                 if (!q)
 531                 {
 532                         LOG(3, session[s].ip, s, t, "Failed to create IdentRej.\n");
 533                         return;
 534                 }
 535                 LOG_HEX(5, "LCPIdentRej", q, l + 4);
 536                 tunnelsend(b, 12 + 4 + l, t);
 537         }
 538         else
 539         {
 540                 LOG(1, session[s].ip, s, t, "Unexpected LCP code %d\n", *p);
 541                 STAT(tunnel_rx_errors);
 542                 return ;
 543         }
 544 }
 545
 546 // find a PPP option, returns point to option, or 0 if not found
 547 static u8 *findppp(u8 *b, u8 mtype)
 548 {
 549         u16 l = ntohs(*(u16 *) (b + 2));
 550         if (l < 4)
 551                 return 0;
 552         b += 4;
 553         l -= 4;
 554         while (l)
 555         {
 556                 if (l < b[1] || !b[1])
 557                         return 0;               // faulty
 558                 if (*b == mtype)
 559                         return b;
 560                 l -= b[1];
 561                 b += b[1];
 562         }
 563         return 0;
 564 }
 565
 566 // Process IPCP messages
 567 void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 568 {
 569         u16 hl;
 570
 571         CSTAT(call_processipcp);
 572
 573         LOG_HEX(5, "IPCP", p, l);
 574         if (l < 5)
 575         {
 576                 LOG(1, 0, s, t, "Short IPCP %d bytes\n", l);
 577                 STAT(tunnel_rx_errors);
 578                 return ;
 579         }
 580
 581         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 582         {
 583                 LOG(1, 0, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
 584                 STAT(tunnel_rx_errors);
 585                 return ;
 586         }
 587         l = hl;
 588
 589         if (*p == ConfigAck)
 590         {
 591                 // happy with our IPCP
 592                 u16 r = session[s].radius;
 593                 if ((!r || radius[r].state == RADIUSIPCP) && !session[s].walled_garden)
 594                 {
 595                         if (!r)
 596                                 r = radiusnew(s);
 597                         if (r)
 598                                 radiussend(r, RADIUSSTART); // send radius start, having got IPCP at last
 599                 }
 600                 session[s].flags |= SF_IPCP_ACKED;
 601
 602                 LOG(3, session[s].ip, s, t, "IPCP Acked, session is now active\n");
 603                 return;
 604         }
 605         if (*p != ConfigReq)
 606         {
 607                 LOG(1, 0, s, t, "Unexpected IPCP code %d\n", *p);
 608                 STAT(tunnel_rx_errors);
 609                 return ;
 610         }
 611         LOG(4, session[s].ip, s, t, "IPCP ConfigReq received\n");
 612
 613         if (!session[s].ip)
 614         {
 615                 LOG(3, 0, s, t, "Waiting on radius reply\n");
 616                 return;                 // have to wait on RADIUS reply
 617         }
 618         // form a config reply quoting the IP in the session
 619         {
 620                 u8 b[MAXCONTROL];
 621                 u8 *i,
 622                 *q;
 623
 624                 q = p + 4;
 625                 i = p + l;
 626                 while (q < i && q[1])
 627                 {
 628                         if (*q != 0x81 && *q != 0x83 && *q != 3)
 629                                 break;
 630                         q += q[1];
 631                 }
 632                 if (q < i)
 633                 {
 634                         // reject
 635                         u16 n = 4;
 636                         i = p + l;
 637                         if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
 638                         {
 639                                 LOG(2, 0, s, t, "Failed to send IPCP ConfigRej\n");
 640                                 return;
 641                         }
 642                         *q = ConfigRej;
 643                         p += 4;
 644                         while (p < i && p[1])
 645                         {
 646                                 if (*p != 0x81 && *p != 0x83 && *p != 3)
 647                                 {
 648                                         LOG(2, 0, s, t, "IPCP reject %d\n", *p);
 649                                         memcpy(q + n, p, p[1]);
 650                                         n += p[1];
 651                                 }
 652                                 p += p[1];
 653                         }
 654                         *(u16 *) (q + 2) = htons(n);
 655                         LOG(4, session[s].ip, s, t, "Sending ConfigRej\n");
 656                         tunnelsend(b, n + (q - b), t); // send it
 657                 }
 658                 else
 659                 {
 660                         LOG(4, session[s].ip, s, t, "Sending ConfigAck\n");
 661                         *p = ConfigAck;
 662                         if ((i = findppp(p, 0x81))) // Primary DNS address
 663                         {
 664                                 if (*(u32 *) (i + 2) != htonl(session[s].dns1))
 665                                 {
 666                                         *(u32 *) (i + 2) = htonl(session[s].dns1);
 667                                         *p = ConfigNak;
 668                                         LOG(5, session[s].ip, s, t, "   DNS1 = %s\n", inet_toa(session[s].dns1));
 669                                 }
 670                         }
 671                         if ((i = findppp(p, 0x83))) // Secondary DNS address (TBA, is it)
 672                         {
 673                                 if (*(u32 *) (i + 2) != htonl(session[s].dns2))
 674                                 {
 675                                         *(u32 *) (i + 2) = htonl(session[s].dns2);
 676                                         *p = ConfigNak;
 677                                         LOG(5, session[s].ip, s, t, "   DNS2 = %s\n", inet_toa(session[s].dns2));
 678                                 }
 679                         }
 680                         i = findppp(p, 3);              // IP address
 681                         if (!i || i[1] != 6)
 682                         {
 683                                 LOG(1, 0, s, t, "No IP in IPCP request\n");
 684                                 STAT(tunnel_rx_errors);
 685                                 return ;
 686                         }
 687                         if (*(u32 *) (i + 2) != htonl(session[s].ip))
 688                         {
 689                                 *(u32 *) (i + 2) = htonl(session[s].ip);
 690                                 *p = ConfigNak;
 691                                 LOG(4, session[s].ip, s, t, " No, a ConfigNak, client is requesting IP - sending %s\n",
 692                                                 inet_toa(htonl(session[s].ip)));
 693                         }
 694                         if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
 695                         {
 696                                 LOG(2, 0, s, t, " Failed to send IPCP packet.\n");
 697                                 return;
 698                         }
 699                         tunnelsend(b, l + (q - b), t); // send it
 700                 }
 701         }
 702 }
 703
 704 // process IP packet received
 705 //
 706 // This MUST be called with at least 4 byte behind 'p'.
 707 // (i.e. this routine writes to p[-4]).
 708 void processipin(tunnelidt t, sessionidt s, u8 *p, u16 l)
 709 {
 710         ipt ip;
 711
 712         CSTAT(call_processipin);
 713
 714         LOG_HEX(5, "IP", p, l);
 715
 716         ip = ntohl(*(u32 *)(p + 12));
 717
 718         if (l > MAXETHER)
 719         {
 720                 LOG(1, ip, s, t, "IP packet too long %d\n", l);
 721                 STAT(tunnel_rx_errors);
 722                 return ;
 723         }
 724
 725         // no spoof (do sessionbyip to handled statically routed subnets)
 726         if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
 727         {
 728                 LOG(5, ip, s, t, "Dropping packet with spoofed IP %s\n", inet_toa(htonl(ip)));
 729                 return;
 730         }
 731
 732         // Add on the tun header
 733         p -= 4;
 734         *(u32 *)p = htonl(0x00000800);
 735         l += 4;
 736
 737         if (session[s].tbf_in && !config->cluster_iam_master) { // Are we throttled and a slave?
 738                 master_throttle_packet(session[s].tbf_in, p, l); // Pass it to the master for handling.
 739                 return;
 740         }
 741
 742         if (session[s].tbf_in && config->cluster_iam_master) { // Are we throttled and a master?? actually handle the throttled packets.
 743                 tbf_queue_packet(session[s].tbf_in, p, l);
 744                 return;
 745         }
 746
 747         // send to ethernet
 748         if (tun_write(p, l) < 0)
 749         {
 750                 STAT(tun_tx_errors);
 751                 LOG(0, 0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
 752                         l, strerror(errno), tunfd, p);
 753
 754                 return;
 755         }
 756
 757         if (session[s].snoop_ip && session[s].snoop_port)
 758         {
 759                 // Snooping this session
 760                 snoop_send_packet(p + 4, l - 4, session[s].snoop_ip, session[s].snoop_port);
 761         }
 762
 763         session[s].cin += l - 4;
 764         session[s].total_cin += l - 4;
 765         sess_count[s].cin += l - 4;
 766
 767         session[s].pin++;
 768         eth_tx += l - 4;
 769
 770         STAT(tun_tx_packets);
 771         INC_STAT(tun_tx_bytes, l - 4);
 772 }
 773
 774 //
 775 // Helper routine for the TBF filters.
 776 // Used to send queued data in from the user.
 777 //
 778 void send_ipin(sessionidt s, u8 *buf, int len)
 779 {
 780         LOG_HEX(5, "IP in throttled", buf, len);
 781
 782         if (write(tunfd, buf, len) < 0)
 783         {
 784                 STAT(tun_tx_errors);
 785                 LOG(0, 0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
 786                         len, strerror(errno), tunfd, buf);
 787
 788                 return;
 789         }
 790
 791         if (session[s].snoop_ip && session[s].snoop_port)
 792         {
 793                 // Snooping this session
 794                 snoop_send_packet(buf + 4, len - 4, session[s].snoop_ip, session[s].snoop_port);
 795         }
 796
 797         // Increment packet counters
 798         session[s].cin += len - 4;
 799         session[s].total_cin += len - 4;
 800         sess_count[s].cin += len - 4;
 801
 802         session[s].pin++;
 803         eth_tx += len - 4;
 804
 805         STAT(tun_tx_packets);
 806         INC_STAT(tun_tx_bytes, len - 4);
 807 }
 808
 809
 810 // Process CCP messages
 811 void processccp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 812 {
 813
 814         CSTAT(call_processccp);
 815
 816         LOG_HEX(5, "CCP", p, l);
 817         if (l < 2 || (*p != ConfigReq && *p != TerminateReq))
 818         {
 819                 LOG(1, 0, s, t, "Unexpected CCP request code %d\n", *p);
 820                 STAT(tunnel_rx_errors);
 821                 return ;
 822         }
 823         // reject
 824         {
 825                 u8 b[MAXCONTROL];
 826                 u8 *q;
 827                 if (*p == ConfigReq)
 828                 {
 829                         if (l < 6)
 830                         {
 831                                 *p = ConfigAck;         // accept no compression
 832                         }
 833                         else
 834                         {
 835                                 *p = ConfigRej;         // reject
 836                                 sendccp(t, s);
 837                         }
 838                 }
 839                 else
 840                         *p = TerminateAck;              // close
 841                 if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP)))
 842                 {
 843                         LOG(1,0,0,0, "Failed to send CCP packet.\n");
 844                         return;
 845                 }
 846                 tunnelsend(b, l + (q - b), t); // send it
 847         }
 848 }
 849
 850 // send a CHAP PP packet
 851 void sendchap(tunnelidt t, sessionidt s)
 852 {
 853         u8 b[MAXCONTROL];
 854         u16 r = session[s].radius;
 855         u8 *q;
 856
 857         CSTAT(call_sendchap);
 858
 859         if (!r)
 860         {
 861                 LOG(1, 0, s, t, "No RADIUS to send challenge\n");
 862                 STAT(tunnel_tx_errors);
 863                 return ;
 864         }
 865         LOG(1, 0, s, t, "Send CHAP challenge\n");
 866         {
 867                 // new challenge
 868                 int n;
 869                 for (n = 0; n < 15; n++)
 870                         radius[r].auth[n] = rand();
 871         }
 872         radius[r].chap = 1;             // CHAP not PAP
 873         radius[r].id++;
 874         if (radius[r].state != RADIUSCHAP)
 875                 radius[r].try = 0;
 876         radius[r].state = RADIUSCHAP;
 877         radius[r].retry = backoff(radius[r].try++);
 878         if (radius[r].try > 5)
 879         {
 880                 sessionshutdown(s, "Timeout CHAP");
 881                 STAT(tunnel_tx_errors);
 882                 return ;
 883         }
 884         q = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP);
 885         if (!q)
 886         {
 887                 LOG(1, 0, s, t, "failed to send CHAP challenge.\n");
 888                 return;
 889         }
 890         *q = 1;                                 // challenge
 891         q[1] = radius[r].id;                    // ID
 892         q[4] = 16;                              // length
 893         memcpy(q + 5, radius[r].auth, 16);      // challenge
 894         strcpy(q + 21, hostname);               // our name
 895         *(u16 *) (q + 2) = htons(strlen(hostname) + 21); // length
 896         tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
 897 }
 898
 899 // fill in a L2TP message with a PPP frame,
 900 // copies existing PPP message and changes magic number if seen
 901 // returns start of PPP frame
 902 u8 *makeppp(u8 *b, int size, u8 *p, int l, tunnelidt t, sessionidt s, u16 mtype)
 903 {
 904         if (size < 12)
 905                 return NULL;    // Need more space than this!!
 906
 907         *(u16 *) (b + 0) = htons(0x0002); // L2TP with no options
 908         *(u16 *) (b + 2) = htons(tunnel[t].far); // tunnel
 909         *(u16 *) (b + 4) = htons(session[s].far); // session
 910         b += 6;
 911         if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
 912         {
 913                 *(u16 *) b = htons(0xFF03); // HDLC header
 914                 b += 2;
 915         }
 916         if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
 917                 *b++ = mtype;
 918         else
 919         {
 920                 *(u16 *) b = htons(mtype);
 921                 b += 2;
 922         }
 923
 924         if (l + 12 > size) {
 925                 LOG(3,0,0,0, "Would have overflowed the buffer in makeppp: size %d, len %d.\n", size, l);
 926                 return NULL;    // Run out of room to hold the packet!
 927         }
 928         if (p && l)
 929                 memcpy(b, p, l);
 930         return b;
 931 }
 932
 933 // Send initial LCP ConfigReq
 934 void initlcp(tunnelidt t, sessionidt s)
 935 {
 936         char b[500] = {0}, *q;
 937
 938         q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP);
 939         if (!q)
 940         {
 941                 LOG(1, 0, s, t, "Failed to send LCP ConfigReq.\n");
 942                 return;
 943         }
 944         LOG(4, 0, s, t, "Sending LCP ConfigReq for PAP\n");
 945         *q = ConfigReq;
 946         *(u8 *)(q + 1) = (time_now % 255) + 1; // ID
 947         *(u16 *)(q + 2) = htons(14); // Length
 948         *(u8 *)(q + 4) = 5;
 949         *(u8 *)(q + 5) = 6;
 950         *(u32 *)(q + 6) = htonl(session[s].magic);
 951         *(u8 *)(q + 10) = 3;
 952         *(u8 *)(q + 11) = 4;
 953         *(u16 *)(q + 12) = htons(PPPPAP); // PAP
 954         tunnelsend(b, 12 + 14, t);
 955 }
 956
 957 // Send CCP reply
 958 static void sendccp(tunnelidt t, sessionidt s)
 959 {
 960         char *q, b[500] = {0};
 961
 962         q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPCCP);
 963         *q = ConfigReq;
 964         *(u8 *)(q + 1) = (time_now % 255) + 1; // ID
 965         *(u16 *)(q + 2) = htons(4); // Length
 966         LOG_HEX(5, "PPPCCP", q, 4);
 967         tunnelsend(b, (q - b) + 4 , t);
 968 }
 969