projects / l2tpns.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
*** empty log message ***
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.71 2005/08/11 06:22:11 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 r = radiusnew(s);
89 if (session[s].ip || !r)
90 {
91 // respond now, either no RADIUS available or already authenticated
92 uint8_t b[MAXCONTROL];
93 uint8_t id = p[1];
94 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
95 if (!p) return;
96
97 if (session[s].ip)
98 *p = 2; // ACK
99 else
100 *p = 3; // cant authorise
101 p[1] = id;
102 *(uint16_t *) (p + 2) = htons(5); // length
103 p[4] = 0; // no message
104 tunnelsend(b, 5 + (p - b), t); // send it
105
106 if (session[s].ip)
107 {
108 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
109 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
110 }
111 else
112 {
113 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
114 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
115 }
116 }
117 else
118 {
119 // Run PRE_AUTH plugins
120 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
121 run_plugins(PLUGIN_PRE_AUTH, &packet);
122 if (!packet.continue_auth)
123 {
124 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
125 if (packet.username) free(packet.username);
126 if (packet.password) free(packet.password);
127 return;
128 }
129
130 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
131 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
132
133 free(packet.username);
134 free(packet.password);
135
136 radius[r].id = p[1];
137 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
138 radiussend(r, RADIUSAUTH);
139 }
140 }
141
142 // Process CHAP messages
143 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
144 {
145 uint16_t r;
146 uint16_t hl;
147
148 CSTAT(processchap);
149
150 LOG_HEX(5, "CHAP", p, l);
151 r = sess_local[s].radius;
152 if (!r)
153 {
154 LOG(1, s, t, "Unexpected CHAP message\n");
155 STAT(tunnel_rx_errors);
156 return;
157 }
158
159 if (l < 4)
160 {
161 LOG(1, s, t, "Short CHAP %u bytes\n", l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "Short CHAP packet.", 3, 0);
164 return;
165 }
166
167 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
168 {
169 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
170 STAT(tunnel_rx_errors);
171 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
172 return;
173 }
174 l = hl;
175
176 if (*p != 2)
177 {
178 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
179 STAT(tunnel_rx_errors);
180 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
181 return;
182 }
183
184 if (session[s].ppp.phase != Authenticate)
185 {
186 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
187 return;
188 }
189
190 if (p[1] != radius[r].id)
191 {
192 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
193 STAT(tunnel_rx_errors);
194 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
195 return;
196 }
197
198 if (l < 5 || p[4] != 16)
199 {
200 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
201 STAT(tunnel_rx_errors);
202 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
203 return;
204 }
205
206 l -= 5;
207 p += 5;
208 if (l < 16 || l - 16 >= sizeof(session[s].user))
209 {
210 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
211 STAT(tunnel_rx_errors);
212 sessionshutdown(s, "CHAP username too long.", 3, 0);
213 return;
214 }
215
216 // Run PRE_AUTH plugins
217 {
218 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
219
220 packet.password = calloc(17, 1);
221 memcpy(packet.password, p, 16);
222
223 p += 16;
224 l -= 16;
225
226 packet.username = calloc(l + 1, 1);
227 memcpy(packet.username, p, l);
228
229 run_plugins(PLUGIN_PRE_AUTH, &packet);
230 if (!packet.continue_auth)
231 {
232 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
233 if (packet.username) free(packet.username);
234 if (packet.password) free(packet.password);
235 return;
236 }
237
238 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
239 memcpy(radius[r].pass, packet.password, 16);
240
241 free(packet.username);
242 free(packet.password);
243 }
244
245 radius[r].chap = 1;
246 LOG(3, s, t, "CHAP login %s\n", session[s].user);
247 radiussend(r, RADIUSAUTH);
248 }
249
250 static void dumplcp(uint8_t *p, int l)
251 {
252 int x = l - 4;
253 uint8_t *o = (p + 4);
254
255 LOG_HEX(5, "PPP LCP Packet", p, l);
256 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
257 LOG(4, 0, 0, "Length: %d\n", l);
258 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
259 return;
260
261 while (x > 2)
262 {
263 int type = o[0];
264 int length = o[1];
265 if (length < 2)
266 {
267 LOG(4, 0, 0, " Option length is %d...\n", length);
268 break;
269 }
270 if (type == 0)
271 {
272 LOG(4, 0, 0, " Option type is 0...\n");
273 x -= length;
274 o += length;
275 continue;
276 }
277 switch (type)
278 {
279 case 1: // Maximum-Receive-Unit
280 if (length == 4)
281 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
282 else
283 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
284 break;
285 case 2: // Async-Control-Character-Map
286 if (length == 6)
287 {
288 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
289 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
290 }
291 else
292 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
293 break;
294 case 3: // Authentication-Protocol
295 if (length == 4)
296 {
297 int proto = ntohs(*(uint16_t *)(o + 2));
298 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
299 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
300 }
301 else if (length == 5)
302 {
303 int proto = ntohs(*(uint16_t *)(o + 2));
304 int algo = *(uint8_t *)(o + 4);
305 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
306 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
307 }
308 else
309 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
310 break;
311 case 4: // Quality-Protocol
312 {
313 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
314 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
315 }
316 break;
317 case 5: // Magic-Number
318 if (length == 6)
319 {
320 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
321 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
322 }
323 else
324 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
325 break;
326 case 7: // Protocol-Field-Compression
327 case 8: // Address-And-Control-Field-Compression
328 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
329 break;
330 default:
331 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
332 break;
333 }
334 x -= length;
335 o += length;
336 }
337 }
338
339 void lcp_open(sessionidt s, tunnelidt t)
340 {
341 // transition to Authentication or Network phase:
342 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
343
344 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
345
346 // LCP now Opened
347 change_state(s, lcp, Opened);
348
349 if (session[s].ppp.phase == Authenticate)
350 {
351 if (sess_local[s].lcp_authtype == AUTHCHAP)
352 sendchap(s, t);
353 }
354 else
355 {
356 // This-Layer-Up
357 sendipcp(s, t);
358 change_state(s, ipcp, RequestSent);
359 // move to passive state for IPv6 (if configured), CCP
360 if (config->ipv6_prefix.s6_addr[0])
361 change_state(s, ipv6cp, Stopped);
362 else
363 change_state(s, ipv6cp, Closed);
364
365 change_state(s, ccp, Stopped);
366 }
367 }
368
369 static void lcp_restart(sessionidt s)
370 {
371 session[s].ppp.phase = Establish;
372 // This-Layer-Down
373 change_state(s, ipcp, Dead);
374 change_state(s, ipv6cp, Dead);
375 change_state(s, ccp, Dead);
376 }
377
378 static uint8_t *ppp_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
379 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
380 {
381 if (!*response || **response != ConfigRej)
382 {
383 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
384 if (!queued)
385 return 0;
386
387 *queued = ConfigRej;
388 queued += 4;
389 }
390
391 if ((queued - buf + option[1]) > blen)
392 {
393 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
394 return 0;
395 }
396
397 memcpy(queued, option, option[1]);
398 return queued + option[1];
399 }
400
401 static uint8_t *ppp_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
402 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
403 uint8_t *value, size_t vlen)
404 {
405 int *nak_sent;
406 switch (mtype)
407 {
408 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
409 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
410 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
411 default: return 0; // ?
412 }
413
414 if (*response && **response != ConfigNak)
415 {
416 if (*nak_sent < config->ppp_max_failure) // reject queued
417 return queued;
418
419 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
420 }
421
422 if (!*response)
423 {
424 if (*nak_sent >= config->ppp_max_failure)
425 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
426
427 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
428 if (!queued)
429 return 0;
430
431 *nak_sent++;
432 *queued = ConfigNak;
433 queued += 4;
434 }
435
436 if ((queued - buf + vlen + 2) > blen)
437 {
438 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
439 return 0;
440 }
441
442 *queued++ = *option;
443 *queued++ = vlen + 2;
444 memcpy(queued, value, vlen);
445 return queued + vlen;
446 }
447
448 // Process LCP messages
449 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
450 {
451 uint8_t b[MAXCONTROL];
452 uint8_t *q = NULL;
453 uint32_t magicno = 0;
454 uint16_t hl;
455
456 CSTAT(processlcp);
457
458 LOG_HEX(5, "LCP", p, l);
459 if (l < 4)
460 {
461 LOG(1, s, t, "Short LCP %d bytes\n", l);
462 STAT(tunnel_rx_errors);
463 return ;
464 }
465
466 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
467 {
468 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
469 STAT(tunnel_rx_errors);
470 return ;
471 }
472 l = hl;
473
474 if (session[s].die) // going down...
475 return;
476
477 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
478 if (config->debug > 3) dumplcp(p, l);
479
480 if (*p == ConfigAck)
481 {
482 int x = l - 4;
483 uint8_t *o = (p + 4);
484 int authtype = 0;
485
486 while (x > 2)
487 {
488 int type = o[0];
489 int length = o[1];
490
491 if (length == 0 || type == 0 || x < length) break;
492 switch (type)
493 {
494 case 3: // Authentication-Protocol
495 {
496 int proto = ntohs(*(uint16_t *)(o + 2));
497 if (proto == PPPPAP)
498 authtype = AUTHPAP;
499 else if (proto == PPPCHAP && *(o + 4) == 5)
500 authtype = AUTHCHAP;
501 }
502
503 break;
504 }
505 x -= length;
506 o += length;
507 }
508
509 if (!session[s].ip && authtype)
510 sess_local[s].lcp_authtype = authtype;
511
512 switch (session[s].ppp.lcp)
513 {
514 case RequestSent:
515 initialise_restart_count(s, lcp);
516 change_state(s, lcp, AckReceived);
517 break;
518
519 case AckReceived:
520 case Opened:
521 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
522 if (session[s].ppp.lcp == Opened)
523 lcp_restart(s);
524
525 sendlcp(s, t, sess_local[s].lcp_authtype);
526 change_state(s, lcp, RequestSent);
527 break;
528
529 case AckSent:
530 lcp_open(s, t);
531 break;
532
533 default:
534 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
535 }
536 }
537 else if (*p == ConfigReq)
538 {
539 int x = l - 4;
540 uint8_t *o = (p + 4);
541 uint8_t *response = 0;
542 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
543 static uint8_t authproto[5];
544
545 while (x > 2)
546 {
547 int type = o[0];
548 int length = o[1];
549
550 if (length == 0 || type == 0 || x < length) break;
551 switch (type)
552 {
553 case 1: // Maximum-Receive-Unit
554 session[s].mru = ntohs(*(uint16_t *)(o + 2));
555 break;
556
557 case 2: // Async-Control-Character-Map
558 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
559 break;
560
561 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
562 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
563 break;
564
565 case 3: // Authentication-Protocol
566 {
567 int proto = ntohs(*(uint16_t *)(o + 2));
568 char proto_name[] = "0x0000";
569 int alen;
570
571 if (proto == PPPPAP)
572 {
573 if (config->radius_authtypes & AUTHPAP)
574 {
575 sess_local[s].lcp_authtype = AUTHPAP;
576 break;
577 }
578
579 strcpy(proto_name, "PAP");
580 }
581 else if (proto == PPPCHAP)
582 {
583 if (config->radius_authtypes & AUTHCHAP
584 && *(o + 4) == 5) // MD5
585 {
586 sess_local[s].lcp_authtype = AUTHCHAP;
587 break;
588 }
589
590 strcpy(proto_name, "CHAP");
591 }
592 else
593 sprintf(proto_name, "%#4.4x", proto);
594
595 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
596
597 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
598 if (alen < 2) break; // paranoia
599
600 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
601 if (q && *response == ConfigNak &&
602 config->radius_authtypes != config->radius_authprefer)
603 {
604 // alternate type
605 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
606 if (alen < 2) break;
607 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
608 }
609
610 break;
611 }
612 break;
613
614 case 5: // Magic-Number
615 magicno = ntohl(*(uint32_t *)(o + 2));
616 break;
617
618 case 4: // Quality-Protocol
619 case 7: // Protocol-Field-Compression
620 case 8: // Address-And-Control-Field-Compression
621 break;
622
623 default: // Reject any unknown options
624 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
625 q = ppp_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
626 }
627 x -= length;
628 o += length;
629 }
630
631 if (response)
632 {
633 l = q - response; // LCP packet length
634 *((uint16_t *) (response + 2)) = htons(l); // update header
635 }
636 else
637 {
638 // Send packet back as ConfigAck
639 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
640 if (!response) return;
641 *response = ConfigAck;
642 }
643
644 switch (session[s].ppp.lcp)
645 {
646 case Closed:
647 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
648 if (!response) return;
649 *response = TerminateAck;
650 *((uint16_t *) (response + 2)) = htons(l = 4);
651 break;
652
653 case Stopped:
654 initialise_restart_count(s, lcp);
655 sendlcp(s, t, sess_local[s].lcp_authtype);
656 if (*response == ConfigAck)
657 change_state(s, lcp, AckSent);
658 else
659 change_state(s, lcp, RequestSent);
660
661 break;
662
663 case RequestSent:
664 if (*response == ConfigAck)
665 change_state(s, lcp, AckSent);
666
667 break;
668
669 case AckReceived:
670 if (*response == ConfigAck)
671 lcp_open(s, t);
672
673 break;
674
675 case Opened:
676 lcp_restart(s);
677 sendlcp(s, t, sess_local[s].lcp_authtype);
678 /* fallthrough */
679
680 case AckSent:
681 if (*response == ConfigAck)
682 change_state(s, lcp, AckSent);
683 else
684 change_state(s, lcp, RequestSent);
685
686 break;
687
688 default:
689 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
690 return;
691 }
692
693 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
694 if (config->debug > 3) dumplcp(response, l);
695
696 tunnelsend(b, l + (response - b), t);
697 }
698 else if (*p == ConfigNak)
699 {
700 int x = l - 4;
701 uint8_t *o = (p + 4);
702 int authtype = -1;
703
704 while (x > 2)
705 {
706 int type = o[0];
707 int length = o[1];
708
709 if (length == 0 || type == 0 || x < length) break;
710 switch (type)
711 {
712 case 1: // Maximum-Receive-Unit
713 session[s].mru = ntohs(*(uint16_t *)(o + 2));
714 LOG(3, s, t, " Remote requested MRU of %u\n", session[s].mru);
715 break;
716
717 case 3: // Authentication-Protocol
718 if (authtype > 0)
719 break;
720
721 {
722 int proto = ntohs(*(uint16_t *)(o + 2));
723 if (proto == PPPPAP)
724 {
725 authtype = config->radius_authtypes & AUTHPAP;
726 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
727 authtype ? "accept" : "reject");
728 }
729 else if (proto == PPPCHAP && *(o + 4) == 5)
730 {
731 authtype = config->radius_authtypes & AUTHCHAP;
732 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
733 authtype ? "accept" : "reject");
734 }
735 else
736 {
737 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
738 proto);
739 }
740 }
741
742 break;
743
744 default:
745 LOG(2, s, t, " Remote NAKed LCP type %u?\n", type);
746 break;
747 }
748 x -= length;
749 o += length;
750 }
751
752 if (!authtype)
753 {
754 sessionshutdown(s, "Unsupported authentication.", 3, 0);
755 return;
756 }
757
758 if (authtype > 0)
759 sess_local[s].lcp_authtype = authtype;
760
761 switch (session[s].ppp.lcp)
762 {
763 case Closed:
764 case Stopped:
765 {
766 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
767 if (!response) return;
768 *response = TerminateAck;
769 *((uint16_t *) (response + 2)) = htons(l = 4);
770
771 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
772 if (config->debug > 3) dumplcp(response, l);
773
774 tunnelsend(b, l + (response - b), t);
775 }
776 break;
777
778 case RequestSent:
779 case AckSent:
780 initialise_restart_count(s, lcp);
781 sendlcp(s, t, sess_local[s].lcp_authtype);
782 break;
783
784 case AckReceived:
785 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
786 sendlcp(s, t, sess_local[s].lcp_authtype);
787 break;
788
789 case Opened:
790 lcp_restart(s);
791 sendlcp(s, t, sess_local[s].lcp_authtype);
792 break;
793
794 default:
795 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
796 return;
797 }
798 }
799 else if (*p == TerminateReq)
800 {
801 *p = TerminateAck; // close
802 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
803 if (!q) return;
804
805 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
806 if (config->debug > 3) dumplcp(q, l);
807
808 tunnelsend(b, l + (q - b), t); // send it
809 sessionshutdown(s, "Remote end closed connection.", 3, 0);
810 }
811 else if (*p == TerminateAck)
812 {
813 sessionshutdown(s, "Connection closed.", 3, 0);
814 }
815 else if (*p == ProtocolRej)
816 {
817 if (*(uint16_t *) (p+4) == htons(PPPIPV6CP))
818 {
819 LOG(3, s, t, "IPv6 rejected\n");
820 change_state(s, ipv6cp, Closed);
821 }
822 else
823 {
824 LOG(1, s, t, "Unexpected LCP protocol reject 0x%X\n",
825 ntohs(*(uint16_t *) (p+4)));
826 STAT(tunnel_rx_errors);
827 }
828 }
829 else if (*p == EchoReq)
830 {
831 *p = EchoReply; // reply
832 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
833 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
834 if (!q) return;
835
836 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
837 if (config->debug > 3) dumplcp(q, l);
838
839 tunnelsend(b, l + (q - b), t); // send it
840 }
841 else if (*p == EchoReply)
842 {
843 // Ignore it, last_packet time is set earlier than this.
844 }
845 else
846 {
847 int code = *p;
848 int mru = session[s].mru;
849 if (!mru)
850 mru = DEFAULT_MRU;
851
852 if (l > mru) l = mru;
853
854 *p = CodeRej;
855 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
856 if (!q) return;
857
858 LOG(2, s, t, "Unexpected LCP code %s\n", ppp_code(code));
859 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
860 if (config->debug > 3) dumplcp(q, l);
861
862 tunnelsend(b, l + (q - b), t);
863 }
864 }
865
866 static void ipcp_open(sessionidt s, tunnelidt t)
867 {
868 LOG(3, s, t, "IPCP: Opened, session is now active\n");
869
870 change_state(s, ipcp, Opened);
871
872 if (!session[s].walled_garden)
873 {
874 uint16_t r = radiusnew(s);
875 if (r)
876 radiussend(r, RADIUSSTART); // send radius start
877 }
878
879 // start IPv6 if configured and still in passive state
880 if (session[s].ppp.ipv6cp == Stopped)
881 {
882 sendipv6cp(s, t);
883 change_state(s, ipv6cp, RequestSent);
884 }
885 }
886
887 // Process IPCP messages
888 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
889 {
890 uint8_t b[MAXCONTROL];
891 uint8_t *q = 0;
892 uint16_t hl;
893
894 CSTAT(processipcp);
895
896 LOG_HEX(5, "IPCP", p, l);
897 if (l < 5)
898 {
899 LOG(1, s, t, "Short IPCP %d bytes\n", l);
900 STAT(tunnel_rx_errors);
901 return ;
902 }
903
904 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
905 {
906 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
907 STAT(tunnel_rx_errors);
908 return ;
909 }
910 l = hl;
911
912 if (session[s].ppp.phase < Network)
913 {
914 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
915 return;
916 }
917
918 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
919
920 if (*p == ConfigAck)
921 {
922 switch (session[s].ppp.ipcp)
923 {
924 case RequestSent:
925 initialise_restart_count(s, ipcp);
926 change_state(s, ipcp, AckReceived);
927 break;
928
929 case AckReceived:
930 case Opened:
931 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
932 sendipcp(s, t);
933 change_state(s, ipcp, RequestSent);
934 break;
935
936 case AckSent:
937 ipcp_open(s, t);
938 break;
939
940 default:
941 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
942 }
943 }
944 else if (*p == ConfigReq)
945 {
946 uint8_t *response = 0;
947 uint8_t *o = p + 4;
948 int length = l - 4;
949 int gotip = 0;
950 in_addr_t addr;
951
952 while (length > 2)
953 {
954 switch (*o)
955 {
956 case 3: // ip address
957 gotip++; // seen address
958 if (o[1] != 6 || o[1] > length) return;
959
960 addr = htonl(session[s].ip);
961 if (memcmp(o + 2, &addr, (sizeof addr)))
962 {
963 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
964 if (!q || *response == ConfigRej)
965 {
966 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
967 return;
968 }
969 }
970
971 break;
972
973 case 129: // primary DNS
974 if (o[1] != 6 || o[1] > length) return;
975
976 addr = htonl(session[s].dns1);
977 if (memcmp(o + 2, &addr, (sizeof addr)))
978 {
979 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
980 if (!q) return;
981 }
982
983 break;
984
985 case 131: // secondary DNS
986 if (o[1] != 6 || o[1] > length) return;
987
988 addr = htonl(session[s].dns1);
989 if (memcmp(o + 2, &addr, sizeof(addr)))
990 {
991 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
992 if (!q) return;
993 }
994
995 break;
996
997 default:
998 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
999 q = ppp_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1000 if (!q) return;
1001 }
1002
1003 length -= o[1];
1004 o += o[1];
1005 }
1006
1007 if (response)
1008 {
1009 l = q - response; // IPCP packet length
1010 *((uint16_t *) (response + 2)) = htons(l); // update header
1011 }
1012 else if (gotip)
1013 {
1014 // Send packet back as ConfigAck
1015 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1016 if (!response) return;
1017 *response = ConfigAck;
1018 }
1019 else
1020 {
1021 LOG(1, s, t, "No IP in IPCP request\n");
1022 STAT(tunnel_rx_errors);
1023 return;
1024 }
1025
1026 switch (session[s].ppp.ipcp)
1027 {
1028 case Closed:
1029 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1030 if (!response) return;
1031 *response = TerminateAck;
1032 *((uint16_t *) (response + 2)) = htons(l = 4);
1033 break;
1034
1035 case Stopped:
1036 initialise_restart_count(s, ipcp);
1037 sendipcp(s, t);
1038 if (*response == ConfigAck)
1039 change_state(s, ipcp, AckSent);
1040 else
1041 change_state(s, ipcp, RequestSent);
1042
1043 break;
1044
1045 case RequestSent:
1046 if (*response == ConfigAck)
1047 change_state(s, ipcp, AckSent);
1048
1049 break;
1050
1051 case AckReceived:
1052 if (*response == ConfigAck)
1053 ipcp_open(s, t);
1054
1055 break;
1056
1057 case Opened:
1058 initialise_restart_count(s, ipcp);
1059 sendipcp(s, t);
1060 /* fallthrough */
1061
1062 case AckSent:
1063 if (*response == ConfigAck)
1064 change_state(s, ipcp, AckSent);
1065 else
1066 change_state(s, ipcp, RequestSent);
1067
1068 break;
1069
1070 default:
1071 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1072 return;
1073 }
1074
1075 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1076 tunnelsend(b, l + (response - b), t);
1077 }
1078 else if (*p == TerminateReq)
1079 {
1080 *p = TerminateAck;
1081 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1082 if (!q) return;
1083 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1084 tunnelsend(b, l + (q - b), t);
1085 change_state(s, ipcp, Stopped);
1086 }
1087 else
1088 {
1089 int code = *p;
1090 int mru = session[s].mru;
1091 if (!mru)
1092 mru = DEFAULT_MRU;
1093
1094 if (l > mru) l = mru;
1095
1096 *p = CodeRej;
1097 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1098 if (!q) return;
1099
1100 LOG(2, s, t, "Unexpected IPCP code %s\n", ppp_code(code));
1101 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1102 tunnelsend(b, l + (q - b), t);
1103 }
1104 }
1105
1106 static void ipv6cp_open(sessionidt s, tunnelidt t)
1107 {
1108 LOG(3, s, t, "IPV6CP: Opened\n");
1109
1110 change_state(s, ipv6cp, Opened);
1111 if (session[s].ipv6prefixlen)
1112 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1113
1114 // Send an initial RA (TODO: Should we send these regularly?)
1115 send_ipv6_ra(s, t, NULL);
1116 }
1117
1118 // Process IPV6CP messages
1119 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1120 {
1121 uint8_t b[MAXCONTROL];
1122 uint8_t *q = 0;
1123 uint16_t hl;
1124
1125 CSTAT(processipv6cp);
1126
1127 LOG_HEX(5, "IPV6CP", p, l);
1128 if (l < 4)
1129 {
1130 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1131 STAT(tunnel_rx_errors);
1132 return ;
1133 }
1134
1135 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1136 {
1137 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1138 STAT(tunnel_rx_errors);
1139 return ;
1140 }
1141 l = hl;
1142
1143 if (session[s].ppp.phase < Network)
1144 {
1145 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1146 return;
1147 }
1148
1149 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1150
1151 if (!config->ipv6_prefix.s6_addr[0])
1152 {
1153 LOG(2, s, t, "IPV6CP: %s rejected (not configured)\n", ppp_code(*p));
1154 *p = ProtocolRej;
1155 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1156 if (!q) return;
1157 tunnelsend(b, l + (q - b), t);
1158 return;
1159 }
1160
1161 if (!session[s].ip)
1162 {
1163 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1164 return; // need IPCP to complete...
1165 }
1166
1167 if (*p == ConfigAck)
1168 {
1169 switch (session[s].ppp.ipv6cp)
1170 {
1171 case RequestSent:
1172 initialise_restart_count(s, ipv6cp);
1173 change_state(s, ipv6cp, AckReceived);
1174 break;
1175
1176 case AckReceived:
1177 case Opened:
1178 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1179 sendipv6cp(s, t);
1180 change_state(s, ipv6cp, RequestSent);
1181 break;
1182
1183 case AckSent:
1184 ipv6cp_open(s, t);
1185 break;
1186
1187 default:
1188 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1189 }
1190 }
1191 else if (*p == ConfigReq)
1192 {
1193 uint8_t *response = 0;
1194 uint8_t *o = p + 4;
1195 int length = l - 4;
1196 int gotip = 0;
1197 uint8_t ident[8];
1198
1199 while (length > 2)
1200 {
1201 switch (*o)
1202 {
1203 case 1: // interface identifier
1204 gotip++; // seen address
1205 if (o[1] != 10 || o[1] > length) return;
1206
1207 *(uint32_t *) ident = htonl(session[s].ip);
1208 *(uint32_t *) (ident + 4) = 0;
1209
1210 if (memcmp(o + 2, ident, sizeof(ident)))
1211 {
1212 q = ppp_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1213 if (!q) return;
1214 }
1215
1216 break;
1217
1218 default:
1219 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1220 q = ppp_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1221 if (!q) return;
1222 }
1223
1224 length -= o[1];
1225 o += o[1];
1226 }
1227
1228 if (response)
1229 {
1230 l = q - response; // IPV6CP packet length
1231 *((uint16_t *) (response + 2)) = htons(l); // update header
1232 }
1233 else if (gotip)
1234 {
1235 // Send packet back as ConfigAck
1236 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1237 if (!response) return;
1238 *response = ConfigAck;
1239 }
1240 else
1241 {
1242 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1243 STAT(tunnel_rx_errors);
1244 return;
1245 }
1246
1247 switch (session[s].ppp.ipv6cp)
1248 {
1249 case Closed:
1250 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1251 if (!response) return;
1252 *response = TerminateAck;
1253 *((uint16_t *) (response + 2)) = htons(l = 4);
1254 break;
1255
1256 case Stopped:
1257 initialise_restart_count(s, ipv6cp);
1258 sendipv6cp(s, t);
1259 if (*response == ConfigAck)
1260 change_state(s, ipv6cp, AckSent);
1261 else
1262 change_state(s, ipv6cp, RequestSent);
1263
1264 break;
1265
1266 case RequestSent:
1267 if (*response == ConfigAck)
1268 change_state(s, ipv6cp, AckSent);
1269
1270 break;
1271
1272 case AckReceived:
1273 if (*response == ConfigAck)
1274 ipv6cp_open(s, t);
1275
1276 break;
1277
1278 case Opened:
1279 initialise_restart_count(s, ipv6cp);
1280 sendipv6cp(s, t);
1281 /* fallthrough */
1282
1283 case AckSent:
1284 if (*response == ConfigAck)
1285 change_state(s, ipv6cp, AckSent);
1286 else
1287 change_state(s, ipv6cp, RequestSent);
1288
1289 break;
1290
1291 default:
1292 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1293 return;
1294 }
1295
1296 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1297 tunnelsend(b, l + (response - b), t);
1298 }
1299 else if (*p == TerminateReq)
1300 {
1301 *p = TerminateAck;
1302 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1303 if (!q) return;
1304 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1305 tunnelsend(b, l + (q - b), t);
1306 change_state(s, ipv6cp, Stopped);
1307 }
1308 else
1309 {
1310 int code = *p;
1311 int mru = session[s].mru;
1312 if (!mru)
1313 mru = DEFAULT_MRU;
1314
1315 if (l > mru) l = mru;
1316
1317 *p = CodeRej;
1318 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1319 if (!q) return;
1320
1321 LOG(2, s, t, "Unexpected IPV6CP code %s\n", ppp_code(code));
1322 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1323 tunnelsend(b, l + (q - b), t);
1324 }
1325 }
1326
1327 // process IP packet received
1328 //
1329 // This MUST be called with at least 4 byte behind 'p'.
1330 // (i.e. this routine writes to p[-4]).
1331 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1332 {
1333 in_addr_t ip;
1334
1335 CSTAT(processipin);
1336
1337 LOG_HEX(5, "IP", p, l);
1338
1339 ip = ntohl(*(uint32_t *)(p + 12));
1340
1341 if (l > MAXETHER)
1342 {
1343 LOG(1, s, t, "IP packet too long %d\n", l);
1344 STAT(tunnel_rx_errors);
1345 return ;
1346 }
1347
1348 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1349 return;
1350
1351 // no spoof (do sessionbyip to handled statically routed subnets)
1352 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1353 {
1354 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1355 return;
1356 }
1357
1358 // run access-list if any
1359 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1360 return;
1361
1362 // Add on the tun header
1363 p -= 4;
1364 *(uint32_t *) p = htonl(PKTIP);
1365 l += 4;
1366
1367 // Are we throttled and a slave?
1368 if (session[s].tbf_in && !config->cluster_iam_master) {
1369 // Pass it to the master for handling.
1370 master_throttle_packet(session[s].tbf_in, p, l);
1371 return;
1372 }
1373
1374 // Are we throttled and a master??
1375 if (session[s].tbf_in && config->cluster_iam_master) {
1376 // Actually handle the throttled packets.
1377 tbf_queue_packet(session[s].tbf_in, p, l);
1378 return;
1379 }
1380
1381 // send to ethernet
1382 if (tun_write(p, l) < 0)
1383 {
1384 STAT(tun_tx_errors);
1385 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1386 l, strerror(errno), tunfd, p);
1387
1388 return;
1389 }
1390
1391 p += 4;
1392 l -= 4;
1393
1394 if (session[s].snoop_ip && session[s].snoop_port)
1395 {
1396 // Snooping this session
1397 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1398 }
1399
1400 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1401 session[s].cin_delta += l;
1402 session[s].pin++;
1403
1404 sess_local[s].cin += l;
1405 sess_local[s].pin++;
1406
1407 eth_tx += l;
1408
1409 STAT(tun_tx_packets);
1410 INC_STAT(tun_tx_bytes, l);
1411 }
1412
1413 // process IPv6 packet received
1414 //
1415 // This MUST be called with at least 4 byte behind 'p'.
1416 // (i.e. this routine writes to p[-4]).
1417 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1418 {
1419 struct in6_addr ip;
1420 in_addr_t ipv4;
1421
1422 CSTAT(processipv6in);
1423
1424 LOG_HEX(5, "IPv6", p, l);
1425
1426 ip = *(struct in6_addr *) (p + 8);
1427 ipv4 = ntohl(*(uint32_t *)(p + 16));
1428
1429 if (l > MAXETHER)
1430 {
1431 LOG(1, s, t, "IP packet too long %d\n", l);
1432 STAT(tunnel_rx_errors);
1433 return ;
1434 }
1435
1436 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1437 return;
1438
1439 // no spoof
1440 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1441 {
1442 char str[INET6_ADDRSTRLEN];
1443 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1444 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1445 return;
1446 }
1447
1448 // Check if it's a Router Solicition message.
1449 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1450 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1451 *(uint32_t *)(p + 34) == 0 &&
1452 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1453 LOG(3, s, t, "Got IPv6 RS\n");
1454 send_ipv6_ra(s, t, &ip);
1455 return;
1456 }
1457
1458 // Add on the tun header
1459 p -= 4;
1460 *(uint32_t *) p = htonl(PKTIPV6);
1461 l += 4;
1462
1463 // Are we throttled and a slave?
1464 if (session[s].tbf_in && !config->cluster_iam_master) {
1465 // Pass it to the master for handling.
1466 master_throttle_packet(session[s].tbf_in, p, l);
1467 return;
1468 }
1469
1470 // Are we throttled and a master??
1471 if (session[s].tbf_in && config->cluster_iam_master) {
1472 // Actually handle the throttled packets.
1473 tbf_queue_packet(session[s].tbf_in, p, l);
1474 return;
1475 }
1476
1477 // send to ethernet
1478 if (tun_write(p, l) < 0)
1479 {
1480 STAT(tun_tx_errors);
1481 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1482 l, strerror(errno), tunfd, p);
1483
1484 return;
1485 }
1486
1487 p += 4;
1488 l -= 4;
1489
1490 if (session[s].snoop_ip && session[s].snoop_port)
1491 {
1492 // Snooping this session
1493 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1494 }
1495
1496 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1497 session[s].cin_delta += l;
1498 session[s].pin++;
1499
1500 sess_local[s].cin += l;
1501 sess_local[s].pin++;
1502
1503 eth_tx += l;
1504
1505 STAT(tun_tx_packets);
1506 INC_STAT(tun_tx_bytes, l);
1507 }
1508
1509 //
1510 // Helper routine for the TBF filters.
1511 // Used to send queued data in from the user.
1512 //
1513 void send_ipin(sessionidt s, uint8_t *buf, int len)
1514 {
1515 LOG_HEX(5, "IP in throttled", buf, len);
1516
1517 if (write(tunfd, buf, len) < 0)
1518 {
1519 STAT(tun_tx_errors);
1520 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1521 len, strerror(errno), tunfd, buf);
1522
1523 return;
1524 }
1525
1526 buf += 4;
1527 len -= 4;
1528
1529 if (session[s].snoop_ip && session[s].snoop_port)
1530 {
1531 // Snooping this session
1532 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1533 }
1534
1535 // Increment packet counters
1536 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1537 session[s].cin_delta += len;
1538 session[s].pin++;
1539
1540 sess_local[s].cin += len;
1541 sess_local[s].pin++;
1542
1543 eth_tx += len;
1544
1545 STAT(tun_tx_packets);
1546 INC_STAT(tun_tx_bytes, len - 4);
1547 }
1548
1549
1550 // Process CCP messages
1551 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1552 {
1553 uint8_t b[MAXCONTROL];
1554 uint8_t *q;
1555
1556 CSTAT(processccp);
1557
1558 LOG_HEX(5, "CCP", p, l);
1559
1560 if (session[s].ppp.phase < Network)
1561 {
1562 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1563 return;
1564 }
1565
1566 if (l < 1)
1567 {
1568 LOG(1, s, t, "Short CCP packet\n");
1569 STAT(tunnel_rx_errors);
1570 }
1571
1572 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1573 if (*p == ConfigAck)
1574 {
1575 switch (session[s].ppp.ccp)
1576 {
1577 case RequestSent:
1578 initialise_restart_count(s, ccp);
1579 change_state(s, ccp, AckReceived);
1580 break;
1581
1582 case AckReceived:
1583 case Opened:
1584 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1585 sendccp(s, t);
1586 change_state(s, ccp, RequestSent);
1587 break;
1588
1589 case AckSent:
1590 LOG(3, s, t, "CCP: Opened\n");
1591 change_state(s, ccp, Opened);
1592 break;
1593
1594 default:
1595 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1596 }
1597 }
1598 else if (*p == ConfigReq)
1599 {
1600 if (l < 6) // accept no compression
1601 *p = ConfigAck;
1602 else // compression requested--reject
1603 *p = ConfigRej;
1604
1605 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1606 if (!q) return;
1607
1608 switch (session[s].ppp.ccp)
1609 {
1610 case Closed:
1611 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1612 if (!q) return;
1613 *q = TerminateAck;
1614 *((uint16_t *) (q + 2)) = htons(l = 4);
1615 break;
1616
1617 case Stopped:
1618 initialise_restart_count(s, ccp);
1619 sendccp(s, t);
1620 if (*q == ConfigAck)
1621 change_state(s, ccp, AckSent);
1622 else
1623 change_state(s, ccp, RequestSent);
1624
1625 break;
1626
1627 case RequestSent:
1628 if (*q == ConfigAck)
1629 change_state(s, ccp, AckSent);
1630
1631 break;
1632
1633 case AckReceived:
1634 if (*q == ConfigAck)
1635 change_state(s, ccp, Opened);
1636
1637 break;
1638
1639 case Opened:
1640 initialise_restart_count(s, ccp);
1641 sendccp(s, t);
1642 /* fallthrough */
1643
1644 case AckSent:
1645 if (*q == ConfigAck)
1646 change_state(s, ccp, AckSent);
1647 else
1648 change_state(s, ccp, RequestSent);
1649
1650 break;
1651
1652 default:
1653 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1654 return;
1655 }
1656
1657 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1658 tunnelsend(b, l + (q - b), t);
1659 }
1660 else if (*p == TerminateReq)
1661 {
1662 *p = TerminateAck;
1663 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1664 if (!q) return;
1665 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1666 tunnelsend(b, l + (q - b), t);
1667 change_state(s, ccp, Stopped);
1668 }
1669 else
1670 {
1671 int code = *p;
1672 int mru = session[s].mru;
1673 if (!mru)
1674 mru = DEFAULT_MRU;
1675
1676 if (l > mru) l = mru;
1677
1678 *p = CodeRej;
1679 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1680 if (!q) return;
1681
1682 LOG(2, s, t, "Unexpected CCP code %s\n", ppp_code(code));
1683 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1684 tunnelsend(b, l + (q - b), t);
1685 }
1686 }
1687
1688 // send a CHAP challenge
1689 void sendchap(sessionidt s, tunnelidt t)
1690 {
1691 uint8_t b[MAXCONTROL];
1692 uint16_t r;
1693 uint8_t *q;
1694
1695 CSTAT(sendchap);
1696
1697 r = radiusnew(s);
1698 if (!r)
1699 {
1700 LOG(1, s, t, "No RADIUS to send challenge\n");
1701 STAT(tunnel_tx_errors);
1702 return;
1703 }
1704
1705 LOG(1, s, t, "Send CHAP challenge\n");
1706
1707 radius[r].chap = 1; // CHAP not PAP
1708 radius[r].id++;
1709 if (radius[r].state != RADIUSCHAP)
1710 radius[r].try = 0;
1711
1712 radius[r].state = RADIUSCHAP;
1713 radius[r].retry = backoff(radius[r].try++);
1714 if (radius[r].try > 5)
1715 {
1716 sessionshutdown(s, "CHAP timeout.", 3, 0);
1717 STAT(tunnel_tx_errors);
1718 return ;
1719 }
1720 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1721 if (!q) return;
1722
1723 *q = 1; // challenge
1724 q[1] = radius[r].id; // ID
1725 q[4] = 16; // value size (size of challenge)
1726 memcpy(q + 5, radius[r].auth, 16); // challenge
1727 strcpy((char *) q + 21, hostname); // our name
1728 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1729 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1730 }
1731
1732 // fill in a L2TP message with a PPP frame,
1733 // copies existing PPP message and changes magic number if seen
1734 // returns start of PPP frame
1735 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1736 {
1737 if (size < 12) // Need more space than this!!
1738 {
1739 static int backtrace_count = 0;
1740 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1741 log_backtrace(backtrace_count, 5)
1742 return NULL;
1743 }
1744
1745 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1746 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1747 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1748 b += 6;
1749 if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1750 {
1751 *(uint16_t *) b = htons(0xFF03); // HDLC header
1752 b += 2;
1753 }
1754 if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1755 *b++ = mtype;
1756 else
1757 {
1758 *(uint16_t *) b = htons(mtype);
1759 b += 2;
1760 }
1761
1762 if (l + 12 > size)
1763 {
1764 static int backtrace_count = 0;
1765 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1766 log_backtrace(backtrace_count, 5)
1767 return NULL;
1768 }
1769
1770 if (p && l)
1771 memcpy(b, p, l);
1772
1773 return b;
1774 }
1775
1776 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1777 {
1778 int len = 0;
1779 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1780 return 0;
1781
1782 *b++ = 3; // Authentication-Protocol
1783 if (authtype == AUTHCHAP)
1784 {
1785 len = *b++ = 5; // length
1786 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1787 *b++ = 5; // MD5
1788 }
1789 else if (authtype == AUTHPAP)
1790 {
1791 len = *b++ = 4; // length
1792 *(uint16_t *) b = htons(PPPPAP); b += 2;
1793 }
1794 else
1795 {
1796 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1797 }
1798
1799 return len;
1800 }
1801
1802 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1803 void sendlcp(sessionidt s, tunnelidt t, int authtype)
1804 {
1805 uint8_t b[500], *q, *l;
1806
1807 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1808 return;
1809
1810 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1811 authtype ? " (" : "",
1812 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1813 authtype ? ")" : "");
1814
1815 if (!session[s].mru)
1816 session[s].mru = DEFAULT_MRU;
1817
1818 l = q;
1819 *l++ = ConfigReq;
1820 *l++ = (time_now % 255) + 1; // ID
1821
1822 l += 2; //Save space for length
1823
1824 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1825 *(uint16_t *) l = htons(session[s].mru); l += 2;
1826
1827 if (authtype)
1828 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1829
1830 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1831 *(uint32_t *) l = htonl(session[s].magic);
1832 l += 4;
1833
1834 *(uint16_t *)(q + 2) = htons(l - q); // Length
1835
1836 LOG_HEX(5, "PPPLCP", q, l - q);
1837 if (config->debug > 3) dumplcp(q, l - q);
1838
1839 tunnelsend(b, (l - b), t);
1840 }
1841
1842 // Send CCP request for no compression
1843 void sendccp(sessionidt s, tunnelidt t)
1844 {
1845 uint8_t b[500], *q;
1846
1847 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1848 return;
1849
1850 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1851
1852 *q = ConfigReq;
1853 *(uint8_t *)(q + 1) = (time_now % 255) + 1; // ID
1854 *(uint16_t *)(q + 2) = htons(4); // Length
1855
1856 LOG_HEX(5, "PPPCCP", q, 4);
1857 tunnelsend(b, (q - b) + 4 , t);
1858 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"