projects / l2tpns.git / blob
? search:


244d59a4fe7561b2eadaff7c4432839e779fefe0
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.92 2006/01/19 21:00:24 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452 if (mru < MINMTU) mru = MINMTU;
453 if (mru > size) mru = size;
454
455 l += 4;
456 if (l > mru) l = mru;
457
458 q = makeppp(buf, size, 0, 0, s, t, proto);
459 if (!q) return;
460
461 *q = CodeRej;
462 *(q + 1) = ++sess_local[s].lcp_ident;
463 *(uint16_t *)(q + 2) = htons(l);
464 memcpy(q + 4, p, l - 4);
465
466 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
467 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
468 if (config->debug > 3) dumplcp(q, l);
469
470 tunnelsend(buf, l + (q - buf), t);
471 }
472
473 // Process LCP messages
474 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
475 {
476 uint8_t b[MAXETHER];
477 uint8_t *q = NULL;
478 uint32_t magicno = 0;
479 uint16_t hl;
480
481 CSTAT(processlcp);
482
483 LOG_HEX(5, "LCP", p, l);
484 if (l < 4)
485 {
486 LOG(1, s, t, "Short LCP %d bytes\n", l);
487 STAT(tunnel_rx_errors);
488 return ;
489 }
490
491 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
492 {
493 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
494 STAT(tunnel_rx_errors);
495 return ;
496 }
497 l = hl;
498
499 if (session[s].die) // going down...
500 return;
501
502 LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
503 "LCP: recv %s\n", ppp_code(*p));
504
505 if (config->debug > 3) dumplcp(p, l);
506
507 if (*p == ConfigAck)
508 {
509 int x = l - 4;
510 uint8_t *o = (p + 4);
511 int authtype = 0;
512
513 while (x > 2)
514 {
515 int type = o[0];
516 int length = o[1];
517
518 if (length == 0 || type == 0 || x < length) break;
519 switch (type)
520 {
521 case 3: // Authentication-Protocol
522 {
523 int proto = ntohs(*(uint16_t *)(o + 2));
524 if (proto == PPPPAP)
525 authtype = AUTHPAP;
526 else if (proto == PPPCHAP && *(o + 4) == 5)
527 authtype = AUTHCHAP;
528 }
529
530 break;
531 }
532 x -= length;
533 o += length;
534 }
535
536 if (!session[s].ip && authtype)
537 sess_local[s].lcp_authtype = authtype;
538
539 switch (session[s].ppp.lcp)
540 {
541 case RequestSent:
542 initialise_restart_count(s, lcp);
543 change_state(s, lcp, AckReceived);
544 break;
545
546 case AckReceived:
547 case Opened:
548 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
549 if (session[s].ppp.lcp == Opened)
550 lcp_restart(s);
551
552 sendlcp(s, t);
553 change_state(s, lcp, RequestSent);
554 break;
555
556 case AckSent:
557 lcp_open(s, t);
558 break;
559
560 default:
561 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
562 }
563 }
564 else if (*p == ConfigReq)
565 {
566 int x = l - 4;
567 uint8_t *o = (p + 4);
568 uint8_t *response = 0;
569 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
570 static uint8_t authproto[5];
571
572 while (x > 2)
573 {
574 int type = o[0];
575 int length = o[1];
576
577 if (length == 0 || type == 0 || x < length) break;
578 switch (type)
579 {
580 case 1: // Maximum-Receive-Unit
581 {
582 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
583 if (mru >= MINMTU)
584 {
585 session[s].mru = mru;
586 break;
587 }
588
589 LOG(3, s, t, " Remote requesting MRU of %u. Rejecting.\n", mru);
590 mru = htons(MRU);
591 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
592 }
593 break;
594
595 case 2: // Async-Control-Character-Map
596 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
597 break;
598
599 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
600 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
601 break;
602
603 case 3: // Authentication-Protocol
604 {
605 int proto = ntohs(*(uint16_t *)(o + 2));
606 char proto_name[] = "0x0000";
607 int alen;
608
609 if (proto == PPPPAP)
610 {
611 if (config->radius_authtypes & AUTHPAP)
612 {
613 sess_local[s].lcp_authtype = AUTHPAP;
614 break;
615 }
616
617 strcpy(proto_name, "PAP");
618 }
619 else if (proto == PPPCHAP)
620 {
621 if (config->radius_authtypes & AUTHCHAP
622 && *(o + 4) == 5) // MD5
623 {
624 sess_local[s].lcp_authtype = AUTHCHAP;
625 break;
626 }
627
628 strcpy(proto_name, "CHAP");
629 }
630 else
631 sprintf(proto_name, "%#4.4x", proto);
632
633 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
634
635 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
636 if (alen < 2) break; // paranoia
637
638 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
639 if (q && *response == ConfigNak &&
640 config->radius_authtypes != config->radius_authprefer)
641 {
642 // alternate type
643 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
644 if (alen < 2) break;
645 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
646 }
647
648 break;
649 }
650 break;
651
652 case 5: // Magic-Number
653 magicno = ntohl(*(uint32_t *)(o + 2));
654 break;
655
656 case 4: // Quality-Protocol
657 case 7: // Protocol-Field-Compression
658 case 8: // Address-And-Control-Field-Compression
659 break;
660
661 default: // Reject any unknown options
662 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
663 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
664 }
665 x -= length;
666 o += length;
667 }
668
669 if (response)
670 {
671 l = q - response; // LCP packet length
672 *((uint16_t *) (response + 2)) = htons(l); // update header
673 }
674 else
675 {
676 // Send packet back as ConfigAck
677 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
678 if (!response) return;
679 *response = ConfigAck;
680 }
681
682 switch (session[s].ppp.lcp)
683 {
684 case Closed:
685 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
686 if (!response) return;
687 *response = TerminateAck;
688 *((uint16_t *) (response + 2)) = htons(l = 4);
689 break;
690
691 case Stopped:
692 initialise_restart_count(s, lcp);
693 sendlcp(s, t);
694 if (*response == ConfigAck)
695 change_state(s, lcp, AckSent);
696 else
697 change_state(s, lcp, RequestSent);
698
699 break;
700
701 case RequestSent:
702 if (*response == ConfigAck)
703 change_state(s, lcp, AckSent);
704
705 break;
706
707 case AckReceived:
708 if (*response == ConfigAck)
709 lcp_open(s, t);
710
711 break;
712
713 case Opened:
714 lcp_restart(s);
715 sendlcp(s, t);
716 /* fallthrough */
717
718 case AckSent:
719 if (*response == ConfigAck)
720 change_state(s, lcp, AckSent);
721 else
722 change_state(s, lcp, RequestSent);
723
724 break;
725
726 default:
727 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
728 return;
729 }
730
731 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
732 if (config->debug > 3) dumplcp(response, l);
733
734 tunnelsend(b, l + (response - b), t);
735 }
736 else if (*p == ConfigNak || *p == ConfigRej)
737 {
738 int x = l - 4;
739 uint8_t *o = (p + 4);
740 int authtype = -1;
741
742 while (x > 2)
743 {
744 int type = o[0];
745 int length = o[1];
746
747 if (length == 0 || type == 0 || x < length) break;
748 switch (type)
749 {
750 case 1: // Maximum-Receive-Unit
751 if (*p == ConfigNak)
752 {
753 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
754 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
755 }
756 else
757 {
758 sess_local[s].ppp_mru = 0;
759 LOG(3, s, t, " Remote rejected MRU negotiation\n");
760 }
761
762 break;
763
764 case 3: // Authentication-Protocol
765 if (authtype > 0)
766 break;
767
768 if (*p == ConfigNak)
769 {
770 int proto = ntohs(*(uint16_t *)(o + 2));
771 if (proto == PPPPAP)
772 {
773 authtype = config->radius_authtypes & AUTHPAP;
774 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
775 authtype ? "accept" : "reject");
776 }
777 else if (proto == PPPCHAP && *(o + 4) == 5)
778 {
779 authtype = config->radius_authtypes & AUTHCHAP;
780 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
781 authtype ? "accept" : "reject");
782 }
783 else
784 {
785 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
786 proto);
787 }
788 }
789 else
790 {
791 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
792 authtype = 0; // shutdown
793 }
794
795 break;
796
797 case 5: // Magic-Number
798 if (*p == ConfigNak)
799 {
800 session[s].magic = ntohl(*(uint32_t *)(o + 2));
801 LOG(3, s, t, " Remote requested magic-no %x\n", session[s].magic);
802 if (!session[s].magic) session[s].magic = time_now; // Netgear DG814 sends zero??
803 break;
804 }
805 // ConfigRej: fallthrough
806
807 default:
808 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
809 sessionshutdown(s, "Unable to negotiate LCP.", 3, 0);
810 break;
811 }
812 x -= length;
813 o += length;
814 }
815
816 if (!authtype)
817 {
818 sessionshutdown(s, "Unsupported authentication.", 3, 0);
819 return;
820 }
821
822 if (authtype > 0)
823 sess_local[s].lcp_authtype = authtype;
824
825 switch (session[s].ppp.lcp)
826 {
827 case Closed:
828 case Stopped:
829 {
830 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
831 if (!response) return;
832 *response = TerminateAck;
833 *((uint16_t *) (response + 2)) = htons(l = 4);
834
835 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
836 if (config->debug > 3) dumplcp(response, l);
837
838 tunnelsend(b, l + (response - b), t);
839 }
840 break;
841
842 case RequestSent:
843 case AckSent:
844 initialise_restart_count(s, lcp);
845 sendlcp(s, t);
846 break;
847
848 case AckReceived:
849 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
850 sendlcp(s, t);
851 break;
852
853 case Opened:
854 lcp_restart(s);
855 sendlcp(s, t);
856 break;
857
858 default:
859 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
860 return;
861 }
862 }
863 else if (*p == TerminateReq)
864 {
865 *p = TerminateAck; // close
866 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
867 if (!q) return;
868
869 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
870 if (config->debug > 3) dumplcp(q, l);
871
872 tunnelsend(b, l + (q - b), t); // send it
873 sessionshutdown(s, "Remote end closed connection.", 3, 0);
874 }
875 else if (*p == TerminateAck)
876 {
877 sessionshutdown(s, "Connection closed.", 3, 0);
878 }
879 else if (*p == ProtocolRej)
880 {
881 uint16_t proto = 0;
882
883 if (l > 4)
884 {
885 proto = *(p+4);
886 if (l > 5 && !(proto & 1))
887 {
888 proto <<= 8;
889 proto |= *(p+5);
890 }
891 }
892
893 if (proto == PPPIPV6CP)
894 {
895 LOG(3, s, t, "IPv6 rejected\n");
896 change_state(s, ipv6cp, Closed);
897 }
898 else
899 {
900 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
901 }
902 }
903 else if (*p == EchoReq)
904 {
905 *p = EchoReply; // reply
906 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
907 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
908 if (!q) return;
909
910 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
911 if (config->debug > 3) dumplcp(q, l);
912
913 tunnelsend(b, l + (q - b), t); // send it
914 }
915 else if (*p == EchoReply)
916 {
917 // Ignore it, last_packet time is set earlier than this.
918 }
919 else if (*p != CodeRej)
920 {
921 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
922 }
923 }
924
925 static void ipcp_open(sessionidt s, tunnelidt t)
926 {
927 LOG(3, s, t, "IPCP: Opened, session is now active\n");
928
929 change_state(s, ipcp, Opened);
930
931 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
932 {
933 uint16_t r = radiusnew(s);
934 if (r)
935 {
936 radiussend(r, RADIUSSTART); // send radius start
937
938 // don't send further Start records if IPCP is restarted
939 session[s].flags |= SESSION_STARTED;
940 cluster_send_session(s);
941 }
942 }
943
944 // start IPv6 if configured and still in passive state
945 if (session[s].ppp.ipv6cp == Stopped)
946 {
947 sendipv6cp(s, t);
948 change_state(s, ipv6cp, RequestSent);
949 }
950 }
951
952 // Process IPCP messages
953 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
954 {
955 uint8_t b[MAXETHER];
956 uint8_t *q = 0;
957 uint16_t hl;
958
959 CSTAT(processipcp);
960
961 LOG_HEX(5, "IPCP", p, l);
962 if (l < 5)
963 {
964 LOG(1, s, t, "Short IPCP %d bytes\n", l);
965 STAT(tunnel_rx_errors);
966 return ;
967 }
968
969 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
970 {
971 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
972 STAT(tunnel_rx_errors);
973 return ;
974 }
975 l = hl;
976
977 if (session[s].ppp.phase < Network)
978 {
979 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
980 return;
981 }
982
983 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
984
985 if (*p == ConfigAck)
986 {
987 switch (session[s].ppp.ipcp)
988 {
989 case RequestSent:
990 initialise_restart_count(s, ipcp);
991 change_state(s, ipcp, AckReceived);
992 break;
993
994 case AckReceived:
995 case Opened:
996 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
997 sendipcp(s, t);
998 change_state(s, ipcp, RequestSent);
999 break;
1000
1001 case AckSent:
1002 ipcp_open(s, t);
1003 break;
1004
1005 default:
1006 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1007 }
1008 }
1009 else if (*p == ConfigReq)
1010 {
1011 uint8_t *response = 0;
1012 uint8_t *o = p + 4;
1013 int length = l - 4;
1014 int gotip = 0;
1015 in_addr_t addr;
1016
1017 while (length > 2)
1018 {
1019 switch (*o)
1020 {
1021 case 3: // ip address
1022 gotip++; // seen address
1023 if (o[1] != 6 || o[1] > length) return;
1024
1025 addr = htonl(session[s].ip);
1026 if (memcmp(o + 2, &addr, (sizeof addr)))
1027 {
1028 uint8_t *oq = q;
1029 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1030 if (!q || (q != oq && *response == ConfigRej))
1031 {
1032 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1033 return;
1034 }
1035 }
1036
1037 break;
1038
1039 case 129: // primary DNS
1040 if (o[1] != 6 || o[1] > length) return;
1041
1042 addr = htonl(session[s].dns1);
1043 if (memcmp(o + 2, &addr, (sizeof addr)))
1044 {
1045 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1046 if (!q) return;
1047 }
1048
1049 break;
1050
1051 case 131: // secondary DNS
1052 if (o[1] != 6 || o[1] > length) return;
1053
1054 addr = htonl(session[s].dns2);
1055 if (memcmp(o + 2, &addr, sizeof(addr)))
1056 {
1057 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1058 if (!q) return;
1059 }
1060
1061 break;
1062
1063 default:
1064 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1065 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1066 if (!q) return;
1067 }
1068
1069 length -= o[1];
1070 o += o[1];
1071 }
1072
1073 if (response)
1074 {
1075 l = q - response; // IPCP packet length
1076 *((uint16_t *) (response + 2)) = htons(l); // update header
1077 }
1078 else if (gotip)
1079 {
1080 // Send packet back as ConfigAck
1081 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1082 if (!response) return;
1083 *response = ConfigAck;
1084 }
1085 else
1086 {
1087 LOG(1, s, t, "No IP in IPCP request\n");
1088 STAT(tunnel_rx_errors);
1089 return;
1090 }
1091
1092 switch (session[s].ppp.ipcp)
1093 {
1094 case Closed:
1095 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1096 if (!response) return;
1097 *response = TerminateAck;
1098 *((uint16_t *) (response + 2)) = htons(l = 4);
1099 break;
1100
1101 case Stopped:
1102 initialise_restart_count(s, ipcp);
1103 sendipcp(s, t);
1104 if (*response == ConfigAck)
1105 change_state(s, ipcp, AckSent);
1106 else
1107 change_state(s, ipcp, RequestSent);
1108
1109 break;
1110
1111 case RequestSent:
1112 if (*response == ConfigAck)
1113 change_state(s, ipcp, AckSent);
1114
1115 break;
1116
1117 case AckReceived:
1118 if (*response == ConfigAck)
1119 ipcp_open(s, t);
1120
1121 break;
1122
1123 case Opened:
1124 initialise_restart_count(s, ipcp);
1125 sendipcp(s, t);
1126 /* fallthrough */
1127
1128 case AckSent:
1129 if (*response == ConfigAck)
1130 change_state(s, ipcp, AckSent);
1131 else
1132 change_state(s, ipcp, RequestSent);
1133
1134 break;
1135
1136 default:
1137 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1138 return;
1139 }
1140
1141 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1142 tunnelsend(b, l + (response - b), t);
1143 }
1144 else if (*p == TerminateReq)
1145 {
1146 *p = TerminateAck;
1147 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1148 if (!q) return;
1149 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1150 tunnelsend(b, l + (q - b), t);
1151 change_state(s, ipcp, Stopped);
1152 }
1153 else if (*p != CodeRej)
1154 {
1155 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1156 }
1157 }
1158
1159 static void ipv6cp_open(sessionidt s, tunnelidt t)
1160 {
1161 LOG(3, s, t, "IPV6CP: Opened\n");
1162
1163 change_state(s, ipv6cp, Opened);
1164 if (session[s].ipv6prefixlen)
1165 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1166
1167 // Send an initial RA (TODO: Should we send these regularly?)
1168 send_ipv6_ra(s, t, NULL);
1169 }
1170
1171 // Process IPV6CP messages
1172 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1173 {
1174 uint8_t b[MAXETHER];
1175 uint8_t *q = 0;
1176 uint16_t hl;
1177
1178 CSTAT(processipv6cp);
1179
1180 LOG_HEX(5, "IPV6CP", p, l);
1181 if (l < 4)
1182 {
1183 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1184 STAT(tunnel_rx_errors);
1185 return ;
1186 }
1187
1188 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1189 {
1190 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1191 STAT(tunnel_rx_errors);
1192 return ;
1193 }
1194 l = hl;
1195
1196 if (session[s].ppp.phase < Network)
1197 {
1198 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1199 return;
1200 }
1201
1202 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1203
1204 if (!session[s].ip)
1205 {
1206 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1207 return; // need IPCP to complete...
1208 }
1209
1210 if (*p == ConfigAck)
1211 {
1212 switch (session[s].ppp.ipv6cp)
1213 {
1214 case RequestSent:
1215 initialise_restart_count(s, ipv6cp);
1216 change_state(s, ipv6cp, AckReceived);
1217 break;
1218
1219 case AckReceived:
1220 case Opened:
1221 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1222 sendipv6cp(s, t);
1223 change_state(s, ipv6cp, RequestSent);
1224 break;
1225
1226 case AckSent:
1227 ipv6cp_open(s, t);
1228 break;
1229
1230 default:
1231 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1232 }
1233 }
1234 else if (*p == ConfigReq)
1235 {
1236 uint8_t *response = 0;
1237 uint8_t *o = p + 4;
1238 int length = l - 4;
1239 int gotip = 0;
1240 uint8_t ident[8];
1241
1242 while (length > 2)
1243 {
1244 switch (*o)
1245 {
1246 case 1: // interface identifier
1247 gotip++; // seen address
1248 if (o[1] != 10 || o[1] > length) return;
1249
1250 *(uint32_t *) ident = htonl(session[s].ip);
1251 *(uint32_t *) (ident + 4) = 0;
1252
1253 if (memcmp(o + 2, ident, sizeof(ident)))
1254 {
1255 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1256 if (!q) return;
1257 }
1258
1259 break;
1260
1261 default:
1262 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1263 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1264 if (!q) return;
1265 }
1266
1267 length -= o[1];
1268 o += o[1];
1269 }
1270
1271 if (response)
1272 {
1273 l = q - response; // IPV6CP packet length
1274 *((uint16_t *) (response + 2)) = htons(l); // update header
1275 }
1276 else if (gotip)
1277 {
1278 // Send packet back as ConfigAck
1279 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1280 if (!response) return;
1281 *response = ConfigAck;
1282 }
1283 else
1284 {
1285 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1286 STAT(tunnel_rx_errors);
1287 return;
1288 }
1289
1290 switch (session[s].ppp.ipv6cp)
1291 {
1292 case Closed:
1293 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1294 if (!response) return;
1295 *response = TerminateAck;
1296 *((uint16_t *) (response + 2)) = htons(l = 4);
1297 break;
1298
1299 case Stopped:
1300 initialise_restart_count(s, ipv6cp);
1301 sendipv6cp(s, t);
1302 if (*response == ConfigAck)
1303 change_state(s, ipv6cp, AckSent);
1304 else
1305 change_state(s, ipv6cp, RequestSent);
1306
1307 break;
1308
1309 case RequestSent:
1310 if (*response == ConfigAck)
1311 change_state(s, ipv6cp, AckSent);
1312
1313 break;
1314
1315 case AckReceived:
1316 if (*response == ConfigAck)
1317 ipv6cp_open(s, t);
1318
1319 break;
1320
1321 case Opened:
1322 initialise_restart_count(s, ipv6cp);
1323 sendipv6cp(s, t);
1324 /* fallthrough */
1325
1326 case AckSent:
1327 if (*response == ConfigAck)
1328 change_state(s, ipv6cp, AckSent);
1329 else
1330 change_state(s, ipv6cp, RequestSent);
1331
1332 break;
1333
1334 default:
1335 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1336 return;
1337 }
1338
1339 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1340 tunnelsend(b, l + (response - b), t);
1341 }
1342 else if (*p == TerminateReq)
1343 {
1344 *p = TerminateAck;
1345 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1346 if (!q) return;
1347 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1348 tunnelsend(b, l + (q - b), t);
1349 change_state(s, ipv6cp, Stopped);
1350 }
1351 else if (*p != CodeRej)
1352 {
1353 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1354 }
1355 }
1356
1357 // process IP packet received
1358 //
1359 // This MUST be called with at least 4 byte behind 'p'.
1360 // (i.e. this routine writes to p[-4]).
1361 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1362 {
1363 in_addr_t ip;
1364
1365 CSTAT(processipin);
1366
1367 LOG_HEX(5, "IP", p, l);
1368
1369 if (l < 20)
1370 {
1371 LOG(1, s, t, "IP packet too short %d\n", l);
1372 STAT(tunnel_rx_errors);
1373 return ;
1374 }
1375
1376 ip = ntohl(*(uint32_t *)(p + 12));
1377
1378 if (l > MAXETHER)
1379 {
1380 LOG(1, s, t, "IP packet too long %d\n", l);
1381 STAT(tunnel_rx_errors);
1382 return ;
1383 }
1384
1385 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1386 return;
1387
1388 // no spoof (do sessionbyip to handled statically routed subnets)
1389 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1390 {
1391 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1392 return;
1393 }
1394
1395 // run access-list if any
1396 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1397 return;
1398
1399 // adjust MSS on SYN and SYN,ACK packets with options
1400 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1401 {
1402 int ihl = (p[0] & 0xf) * 4; // length of IP header
1403 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1404 adjust_tcp_mss(s, t, p, l, p + ihl);
1405 }
1406
1407 // Add on the tun header
1408 p -= 4;
1409 *(uint32_t *) p = htonl(PKTIP);
1410 l += 4;
1411
1412 // Are we throttled and a slave?
1413 if (session[s].tbf_in && !config->cluster_iam_master) {
1414 // Pass it to the master for handling.
1415 master_throttle_packet(session[s].tbf_in, p, l);
1416 return;
1417 }
1418
1419 // Are we throttled and a master??
1420 if (session[s].tbf_in && config->cluster_iam_master) {
1421 // Actually handle the throttled packets.
1422 tbf_queue_packet(session[s].tbf_in, p, l);
1423 return;
1424 }
1425
1426 // send to ethernet
1427 if (tun_write(p, l) < 0)
1428 {
1429 STAT(tun_tx_errors);
1430 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1431 l, strerror(errno), tunfd, p);
1432
1433 return;
1434 }
1435
1436 p += 4;
1437 l -= 4;
1438
1439 if (session[s].snoop_ip && session[s].snoop_port)
1440 {
1441 // Snooping this session
1442 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1443 }
1444
1445 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1446 session[s].cin_delta += l;
1447 session[s].pin++;
1448
1449 sess_local[s].cin += l;
1450 sess_local[s].pin++;
1451
1452 eth_tx += l;
1453
1454 STAT(tun_tx_packets);
1455 INC_STAT(tun_tx_bytes, l);
1456 }
1457
1458 // process IPv6 packet received
1459 //
1460 // This MUST be called with at least 4 byte behind 'p'.
1461 // (i.e. this routine writes to p[-4]).
1462 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1463 {
1464 struct in6_addr ip;
1465 in_addr_t ipv4;
1466
1467 CSTAT(processipv6in);
1468
1469 LOG_HEX(5, "IPv6", p, l);
1470
1471 ip = *(struct in6_addr *) (p + 8);
1472 ipv4 = ntohl(*(uint32_t *)(p + 16));
1473
1474 if (l > MAXETHER)
1475 {
1476 LOG(1, s, t, "IP packet too long %d\n", l);
1477 STAT(tunnel_rx_errors);
1478 return ;
1479 }
1480
1481 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1482 return;
1483
1484 // no spoof
1485 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1486 {
1487 char str[INET6_ADDRSTRLEN];
1488 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1489 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1490 return;
1491 }
1492
1493 // Check if it's a Router Solicition message.
1494 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1495 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1496 *(uint32_t *)(p + 34) == 0 &&
1497 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1498 LOG(3, s, t, "Got IPv6 RS\n");
1499 send_ipv6_ra(s, t, &ip);
1500 return;
1501 }
1502
1503 // Add on the tun header
1504 p -= 4;
1505 *(uint32_t *) p = htonl(PKTIPV6);
1506 l += 4;
1507
1508 // Are we throttled and a slave?
1509 if (session[s].tbf_in && !config->cluster_iam_master) {
1510 // Pass it to the master for handling.
1511 master_throttle_packet(session[s].tbf_in, p, l);
1512 return;
1513 }
1514
1515 // Are we throttled and a master??
1516 if (session[s].tbf_in && config->cluster_iam_master) {
1517 // Actually handle the throttled packets.
1518 tbf_queue_packet(session[s].tbf_in, p, l);
1519 return;
1520 }
1521
1522 // send to ethernet
1523 if (tun_write(p, l) < 0)
1524 {
1525 STAT(tun_tx_errors);
1526 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1527 l, strerror(errno), tunfd, p);
1528
1529 return;
1530 }
1531
1532 p += 4;
1533 l -= 4;
1534
1535 if (session[s].snoop_ip && session[s].snoop_port)
1536 {
1537 // Snooping this session
1538 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1539 }
1540
1541 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1542 session[s].cin_delta += l;
1543 session[s].pin++;
1544
1545 sess_local[s].cin += l;
1546 sess_local[s].pin++;
1547
1548 eth_tx += l;
1549
1550 STAT(tun_tx_packets);
1551 INC_STAT(tun_tx_bytes, l);
1552 }
1553
1554 //
1555 // Helper routine for the TBF filters.
1556 // Used to send queued data in from the user.
1557 //
1558 void send_ipin(sessionidt s, uint8_t *buf, int len)
1559 {
1560 LOG_HEX(5, "IP in throttled", buf, len);
1561
1562 if (write(tunfd, buf, len) < 0)
1563 {
1564 STAT(tun_tx_errors);
1565 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1566 len, strerror(errno), tunfd, buf);
1567
1568 return;
1569 }
1570
1571 buf += 4;
1572 len -= 4;
1573
1574 if (session[s].snoop_ip && session[s].snoop_port)
1575 {
1576 // Snooping this session
1577 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1578 }
1579
1580 // Increment packet counters
1581 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1582 session[s].cin_delta += len;
1583 session[s].pin++;
1584
1585 sess_local[s].cin += len;
1586 sess_local[s].pin++;
1587
1588 eth_tx += len;
1589
1590 STAT(tun_tx_packets);
1591 INC_STAT(tun_tx_bytes, len - 4);
1592 }
1593
1594
1595 // Process CCP messages
1596 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1597 {
1598 uint8_t b[MAXETHER];
1599 uint8_t *q;
1600
1601 CSTAT(processccp);
1602
1603 LOG_HEX(5, "CCP", p, l);
1604
1605 if (session[s].ppp.phase < Network)
1606 {
1607 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1608 return;
1609 }
1610
1611 if (l < 1)
1612 {
1613 LOG(1, s, t, "Short CCP packet\n");
1614 STAT(tunnel_rx_errors);
1615 }
1616
1617 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1618 if (*p == ConfigAck)
1619 {
1620 switch (session[s].ppp.ccp)
1621 {
1622 case RequestSent:
1623 initialise_restart_count(s, ccp);
1624 change_state(s, ccp, AckReceived);
1625 break;
1626
1627 case AckReceived:
1628 case Opened:
1629 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1630 sendccp(s, t);
1631 change_state(s, ccp, RequestSent);
1632 break;
1633
1634 case AckSent:
1635 LOG(3, s, t, "CCP: Opened\n");
1636 change_state(s, ccp, Opened);
1637 break;
1638
1639 default:
1640 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1641 }
1642 }
1643 else if (*p == ConfigReq)
1644 {
1645 if (l < 6) // accept no compression
1646 *p = ConfigAck;
1647 else // compression requested--reject
1648 *p = ConfigRej;
1649
1650 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1651 if (!q) return;
1652
1653 switch (session[s].ppp.ccp)
1654 {
1655 case Closed:
1656 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1657 if (!q) return;
1658 *q = TerminateAck;
1659 *((uint16_t *) (q + 2)) = htons(l = 4);
1660 break;
1661
1662 case Stopped:
1663 initialise_restart_count(s, ccp);
1664 sendccp(s, t);
1665 if (*q == ConfigAck)
1666 change_state(s, ccp, AckSent);
1667 else
1668 change_state(s, ccp, RequestSent);
1669
1670 break;
1671
1672 case RequestSent:
1673 if (*q == ConfigAck)
1674 change_state(s, ccp, AckSent);
1675
1676 break;
1677
1678 case AckReceived:
1679 if (*q == ConfigAck)
1680 change_state(s, ccp, Opened);
1681
1682 break;
1683
1684 case Opened:
1685 initialise_restart_count(s, ccp);
1686 sendccp(s, t);
1687 /* fallthrough */
1688
1689 case AckSent:
1690 if (*q == ConfigAck)
1691 change_state(s, ccp, AckSent);
1692 else
1693 change_state(s, ccp, RequestSent);
1694
1695 break;
1696
1697 default:
1698 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1699 return;
1700 }
1701
1702 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1703 tunnelsend(b, l + (q - b), t);
1704 }
1705 else if (*p == TerminateReq)
1706 {
1707 *p = TerminateAck;
1708 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1709 if (!q) return;
1710 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1711 tunnelsend(b, l + (q - b), t);
1712 change_state(s, ccp, Stopped);
1713 }
1714 else if (*p != CodeRej)
1715 {
1716 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1717 }
1718 }
1719
1720 // send a CHAP challenge
1721 void sendchap(sessionidt s, tunnelidt t)
1722 {
1723 uint8_t b[MAXETHER];
1724 uint16_t r;
1725 uint8_t *q;
1726
1727 CSTAT(sendchap);
1728
1729 r = radiusnew(s);
1730 if (!r)
1731 {
1732 LOG(1, s, t, "No RADIUS to send challenge\n");
1733 STAT(tunnel_tx_errors);
1734 return;
1735 }
1736
1737 LOG(1, s, t, "Send CHAP challenge\n");
1738
1739 radius[r].chap = 1; // CHAP not PAP
1740 radius[r].id++;
1741 if (radius[r].state != RADIUSCHAP)
1742 radius[r].try = 0;
1743
1744 radius[r].state = RADIUSCHAP;
1745 radius[r].retry = backoff(radius[r].try++);
1746 if (radius[r].try > 5)
1747 {
1748 sessionshutdown(s, "CHAP timeout.", 3, 0);
1749 STAT(tunnel_tx_errors);
1750 return ;
1751 }
1752 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1753 if (!q) return;
1754
1755 *q = 1; // challenge
1756 q[1] = radius[r].id; // ID
1757 q[4] = 16; // value size (size of challenge)
1758 memcpy(q + 5, radius[r].auth, 16); // challenge
1759 strcpy((char *) q + 21, hostname); // our name
1760 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1761 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1762 }
1763
1764 // fill in a L2TP message with a PPP frame,
1765 // copies existing PPP message and changes magic number if seen
1766 // returns start of PPP frame
1767 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1768 {
1769 if (size < 12) // Need more space than this!!
1770 {
1771 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1772 return NULL;
1773 }
1774
1775 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1776 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1777 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1778 b += 6;
1779 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1780 {
1781 *(uint16_t *) b = htons(0xFF03); // HDLC header
1782 b += 2;
1783 }
1784 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1785 *b++ = mtype;
1786 else
1787 {
1788 *(uint16_t *) b = htons(mtype);
1789 b += 2;
1790 }
1791
1792 if (l + 12 > size)
1793 {
1794 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1795 return NULL;
1796 }
1797
1798 if (p && l)
1799 memcpy(b, p, l);
1800
1801 return b;
1802 }
1803
1804 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1805 {
1806 int len = 0;
1807 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1808 return 0;
1809
1810 *b++ = 3; // Authentication-Protocol
1811 if (authtype == AUTHCHAP)
1812 {
1813 len = *b++ = 5; // length
1814 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1815 *b++ = 5; // MD5
1816 }
1817 else if (authtype == AUTHPAP)
1818 {
1819 len = *b++ = 4; // length
1820 *(uint16_t *) b = htons(PPPPAP); b += 2;
1821 }
1822 else
1823 {
1824 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1825 }
1826
1827 return len;
1828 }
1829
1830 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1831 void sendlcp(sessionidt s, tunnelidt t)
1832 {
1833 uint8_t b[500], *q, *l;
1834 int authtype = sess_local[s].lcp_authtype;
1835
1836 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1837 return;
1838
1839 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1840 authtype ? " (" : "",
1841 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1842 authtype ? ")" : "");
1843
1844 l = q;
1845 *l++ = ConfigReq;
1846 *l++ = ++sess_local[s].lcp_ident; // ID
1847
1848 l += 2; //Save space for length
1849
1850 if (sess_local[s].ppp_mru)
1851 {
1852 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1853 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1854 }
1855
1856 if (authtype)
1857 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1858
1859 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1860 *(uint32_t *) l = htonl(session[s].magic);
1861 l += 4;
1862
1863 *(uint16_t *)(q + 2) = htons(l - q); // Length
1864
1865 LOG_HEX(5, "PPPLCP", q, l - q);
1866 if (config->debug > 3) dumplcp(q, l - q);
1867
1868 tunnelsend(b, (l - b), t);
1869 restart_timer(s, lcp);
1870 }
1871
1872 // Send CCP request for no compression
1873 void sendccp(sessionidt s, tunnelidt t)
1874 {
1875 uint8_t b[500], *q;
1876
1877 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1878 return;
1879
1880 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1881
1882 *q = ConfigReq;
1883 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1884 *(uint16_t *)(q + 2) = htons(4); // Length
1885
1886 LOG_HEX(5, "PPPCCP", q, 4);
1887 tunnelsend(b, (q - b) + 4 , t);
1888 restart_timer(s, ccp);
1889 }
1890
1891 // Reject unknown/unconfigured protocols
1892 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1893 {
1894
1895 uint8_t buf[MAXETHER];
1896 uint8_t *q;
1897 int mru = session[s].mru;
1898 if (mru < MINMTU) mru = MINMTU;
1899 if (mru > sizeof(buf)) mru = sizeof(buf);
1900
1901 l += 6;
1902 if (l > mru) l = mru;
1903
1904 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1905 if (!q) return;
1906
1907 *q = ProtocolRej;
1908 *(q + 1) = ++sess_local[s].lcp_ident;
1909 *(uint16_t *)(q + 2) = htons(l);
1910 *(uint16_t *)(q + 4) = htons(proto);
1911 memcpy(q + 6, p, l - 6);
1912
1913 if (proto == PPPIPV6CP)
1914 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1915 else
1916 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1917
1918 tunnelsend(buf, l + (q - buf), t);
1919 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"