ppp.c

   1 // L2TPNS PPP Stuff
   2
   3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.91 2005/12/15 14:23:03 bodea Exp $";
   4
   5 #include <stdio.h>
   6 #include <string.h>
   7 #include <unistd.h>
   8 #include <errno.h>
   9 #include <stdlib.h>
  10 #include "l2tpns.h"
  11 #include "constants.h"
  12 #include "plugin.h"
  13 #include "util.h"
  14 #include "tbf.h"
  15 #include "cluster.h"
  16
  17 extern tunnelt *tunnel;
  18 extern sessiont *session;
  19 extern radiust *radius;
  20 extern int tunfd;
  21 extern char hostname[];
  22 extern uint32_t eth_tx;
  23 extern time_t time_now;
  24 extern configt *config;
  25
  26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
  27
  28 // Process PAP messages
  29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
  30 {
  31         char user[MAXUSER];
  32         char pass[MAXPASS];
  33         uint16_t hl;
  34         uint16_t r;
  35
  36         CSTAT(processpap);
  37
  38         LOG_HEX(5, "PAP", p, l);
  39         if (l < 4)
  40         {
  41                 LOG(1, s, t, "Short PAP %u bytes\n", l);
  42                 STAT(tunnel_rx_errors);
  43                 sessionshutdown(s, "Short PAP packet.", 3, 0);
  44                 return;
  45         }
  46
  47         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
  48         {
  49                 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
  50                 STAT(tunnel_rx_errors);
  51                 sessionshutdown(s, "PAP length mismatch.", 3, 0);
  52                 return;
  53         }
  54         l = hl;
  55
  56         if (*p != 1)
  57         {
  58                 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
  59                 STAT(tunnel_rx_errors);
  60                 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
  61                 return;
  62         }
  63
  64         if (session[s].ppp.phase != Authenticate)
  65         {
  66                 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
  67                 return;
  68         }
  69
  70         {
  71                 uint8_t *b = p;
  72                 b += 4;
  73                 user[0] = pass[0] = 0;
  74                 if (*b && *b < sizeof(user))
  75                 {
  76                         memcpy(user, b + 1, *b);
  77                         user[*b] = 0;
  78                         b += 1 + *b;
  79                         if (*b && *b < sizeof(pass))
  80                         {
  81                                 memcpy(pass, b + 1, *b);
  82                                 pass[*b] = 0;
  83                         }
  84                 }
  85                 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
  86         }
  87
  88         if (session[s].ip || !(r = radiusnew(s)))
  89         {
  90                 // respond now, either no RADIUS available or already authenticated
  91                 uint8_t b[MAXETHER];
  92                 uint8_t id = p[1];
  93                 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
  94                 if (!p) return;
  95
  96                 if (session[s].ip)
  97                         *p = 2;                         // ACK
  98                 else
  99                         *p = 3;                         // cant authorise
 100                 p[1] = id;
 101                 *(uint16_t *) (p + 2) = htons(5);       // length
 102                 p[4] = 0;                               // no message
 103                 tunnelsend(b, 5 + (p - b), t);          // send it
 104
 105                 if (session[s].ip)
 106                 {
 107                         LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
 108                                 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
 109                 }
 110                 else
 111                 {
 112                         LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
 113                         sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
 114                 }
 115         }
 116         else
 117         {
 118                 // Run PRE_AUTH plugins
 119                 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
 120                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 121                 if (!packet.continue_auth)
 122                 {
 123                         LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
 124                         if (packet.username) free(packet.username);
 125                         if (packet.password) free(packet.password);
 126                         return;
 127                 }
 128
 129                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 130                 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
 131
 132                 free(packet.username);
 133                 free(packet.password);
 134
 135                 radius[r].id = p[1];
 136                 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
 137                 radiussend(r, RADIUSAUTH);
 138         }
 139 }
 140
 141 // Process CHAP messages
 142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 143 {
 144         uint16_t r;
 145         uint16_t hl;
 146
 147         CSTAT(processchap);
 148
 149         LOG_HEX(5, "CHAP", p, l);
 150
 151         if (l < 4)
 152         {
 153                 LOG(1, s, t, "Short CHAP %u bytes\n", l);
 154                 STAT(tunnel_rx_errors);
 155                 sessionshutdown(s, "Short CHAP packet.", 3, 0);
 156                 return;
 157         }
 158
 159         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 160         {
 161                 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
 162                 STAT(tunnel_rx_errors);
 163                 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
 164                 return;
 165         }
 166         l = hl;
 167
 168         if (*p != 2)
 169         {
 170                 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
 171                 STAT(tunnel_rx_errors);
 172                 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
 173                 return;
 174         }
 175
 176         r = sess_local[s].radius;
 177         if (!r)
 178         {
 179                 LOG(3, s, t, "Unexpected CHAP message\n");
 180                 return;
 181         }
 182
 183         if (session[s].ppp.phase != Authenticate)
 184         {
 185                 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
 186                 return;
 187         }
 188
 189         if (p[1] != radius[r].id)
 190         {
 191                 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
 192                 STAT(tunnel_rx_errors);
 193                 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
 194                 return;
 195         }
 196
 197         if (l < 5 || p[4] != 16)
 198         {
 199                 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
 200                 STAT(tunnel_rx_errors);
 201                 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
 202                 return;
 203         }
 204
 205         l -= 5;
 206         p += 5;
 207         if (l < 16 || l - 16 >= sizeof(session[s].user))
 208         {
 209                 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
 210                 STAT(tunnel_rx_errors);
 211                 sessionshutdown(s, "CHAP username too long.", 3, 0);
 212                 return;
 213         }
 214
 215         // Run PRE_AUTH plugins
 216         {
 217                 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
 218
 219                 packet.password = calloc(17, 1);
 220                 memcpy(packet.password, p, 16);
 221
 222                 p += 16;
 223                 l -= 16;
 224
 225                 packet.username = calloc(l + 1, 1);
 226                 memcpy(packet.username, p, l);
 227
 228                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 229                 if (!packet.continue_auth)
 230                 {
 231                         LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
 232                         if (packet.username) free(packet.username);
 233                         if (packet.password) free(packet.password);
 234                         return;
 235                 }
 236
 237                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 238                 memcpy(radius[r].pass, packet.password, 16);
 239
 240                 free(packet.username);
 241                 free(packet.password);
 242         }
 243
 244         radius[r].chap = 1;
 245         LOG(3, s, t, "CHAP login %s\n", session[s].user);
 246         radiussend(r, RADIUSAUTH);
 247 }
 248
 249 static void dumplcp(uint8_t *p, int l)
 250 {
 251         int x = l - 4;
 252         uint8_t *o = (p + 4);
 253
 254         LOG_HEX(5, "PPP LCP Packet", p, l);
 255         LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
 256         LOG(4, 0, 0, "Length: %d\n", l);
 257         if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
 258                 return;
 259
 260         while (x > 2)
 261         {
 262                 int type = o[0];
 263                 int length = o[1];
 264                 if (length < 2)
 265                 {
 266                         LOG(4, 0, 0, "  Option length is %d...\n", length);
 267                         break;
 268                 }
 269                 if (type == 0)
 270                 {
 271                         LOG(4, 0, 0, "  Option type is 0...\n");
 272                         x -= length;
 273                         o += length;
 274                         continue;
 275                 }
 276                 switch (type)
 277                 {
 278                         case 1: // Maximum-Receive-Unit
 279                                 if (length == 4)
 280                                         LOG(4, 0, 0, "    %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
 281                                 else
 282                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 283                                 break;
 284                         case 2: // Async-Control-Character-Map
 285                                 if (length == 6)
 286                                 {
 287                                         uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
 288                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), asyncmap);
 289                                 }
 290                                 else
 291                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 292                                 break;
 293                         case 3: // Authentication-Protocol
 294                                 if (length == 4)
 295                                 {
 296                                         int proto = ntohs(*(uint16_t *)(o + 2));
 297                                         LOG(4, 0, 0, "    %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
 298                                                 proto == PPPPAP  ? "PAP"  : "UNSUPPORTED");
 299                                 }
 300                                 else if (length == 5)
 301                                 {
 302                                         int proto = ntohs(*(uint16_t *)(o + 2));
 303                                         int algo = *(o + 4);
 304                                         LOG(4, 0, 0, "    %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
 305                                                 (proto == PPPCHAP && algo == 5) ? "CHAP MD5"  : "UNSUPPORTED");
 306                                 }
 307                                 else
 308                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 309                                 break;
 310                         case 4: // Quality-Protocol
 311                                 {
 312                                         uint32_t qp = ntohl(*(uint32_t *)(o + 2));
 313                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), qp);
 314                                 }
 315                                 break;
 316                         case 5: // Magic-Number
 317                                 if (length == 6)
 318                                 {
 319                                         uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
 320                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), magicno);
 321                                 }
 322                                 else
 323                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 324                                 break;
 325                         case 7: // Protocol-Field-Compression
 326                         case 8: // Address-And-Control-Field-Compression
 327                                 LOG(4, 0, 0, "    %s\n", ppp_lcp_option(type));
 328                                 break;
 329                         default:
 330                                 LOG(2, 0, 0, "    Unknown PPP LCP Option type %d\n", type);
 331                                 break;
 332                 }
 333                 x -= length;
 334                 o += length;
 335         }
 336 }
 337
 338 void lcp_open(sessionidt s, tunnelidt t)
 339 {
 340         // transition to Authentication or Network phase:
 341         session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
 342
 343         LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
 344
 345         // LCP now Opened
 346         change_state(s, lcp, Opened);
 347
 348         if (session[s].ppp.phase == Authenticate)
 349         {
 350                 if (sess_local[s].lcp_authtype == AUTHCHAP)
 351                         sendchap(s, t);
 352         }
 353         else
 354         {
 355                 // This-Layer-Up
 356                 sendipcp(s, t);
 357                 change_state(s, ipcp, RequestSent);
 358                 // move to passive state for IPv6 (if configured), CCP
 359                 if (config->ipv6_prefix.s6_addr[0])
 360                         change_state(s, ipv6cp, Stopped);
 361                 else
 362                         change_state(s, ipv6cp, Closed);
 363
 364                 change_state(s, ccp, Stopped);
 365         }
 366 }
 367
 368 static void lcp_restart(sessionidt s)
 369 {
 370         session[s].ppp.phase = Establish;
 371         // This-Layer-Down
 372         change_state(s, ipcp, Dead);
 373         change_state(s, ipv6cp, Dead);
 374         change_state(s, ccp, Dead);
 375 }
 376
 377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
 378         uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
 379 {
 380         if (!*response || **response != ConfigRej)
 381         {
 382                 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
 383                 if (!queued)
 384                         return 0;
 385
 386                 *queued = ConfigRej;
 387                 queued += 4;
 388         }
 389
 390         if ((queued - buf + option[1]) > blen)
 391         {
 392                 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
 393                 return 0;
 394         }
 395
 396         memcpy(queued, option, option[1]);
 397         return queued + option[1];
 398 }
 399
 400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
 401         uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
 402         uint8_t *value, size_t vlen)
 403 {
 404         int *nak_sent;
 405         switch (mtype)
 406         {
 407         case PPPLCP:    nak_sent = &sess_local[s].lcp.nak_sent;    break;
 408         case PPPIPCP:   nak_sent = &sess_local[s].ipcp.nak_sent;   break;
 409         case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
 410         default:        return 0; // ?
 411         }
 412
 413         if (*response && **response != ConfigNak)
 414         {
 415                 if (*nak_sent < config->ppp_max_failure) // reject queued
 416                         return queued;
 417
 418                 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
 419         }
 420
 421         if (!*response)
 422         {
 423                 if (*nak_sent >= config->ppp_max_failure)
 424                         return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
 425
 426                 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
 427                 if (!queued)
 428                         return 0;
 429
 430                 (*nak_sent)++;
 431                 *queued = ConfigNak;
 432                 queued += 4;
 433         }
 434
 435         if ((queued - buf + vlen + 2) > blen)
 436         {
 437                 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
 438                 return 0;
 439         }
 440
 441         *queued++ = *option;
 442         *queued++ = vlen + 2;
 443         memcpy(queued, value, vlen);
 444         return queued + vlen;
 445 }
 446
 447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
 448         char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
 449 {
 450         uint8_t *q;
 451         int mru = session[s].mru;
 452         if (mru < MINMTU) mru = MINMTU;
 453         if (mru > size) mru = size;
 454
 455         l += 4;
 456         if (l > mru) l = mru;
 457
 458         q = makeppp(buf, size, 0, 0, s, t, proto);
 459         if (!q) return;
 460
 461         *q = CodeRej;
 462         *(q + 1) = ++sess_local[s].lcp_ident;
 463         *(uint16_t *)(q + 2) = htons(l);
 464         memcpy(q + 4, p, l - 4);
 465
 466         LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
 467         LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
 468         if (config->debug > 3) dumplcp(q, l);
 469
 470         tunnelsend(buf, l + (q - buf), t);
 471 }
 472
 473 // Process LCP messages
 474 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 475 {
 476         uint8_t b[MAXETHER];
 477         uint8_t *q = NULL;
 478         uint32_t magicno = 0;
 479         uint16_t hl;
 480
 481         CSTAT(processlcp);
 482
 483         LOG_HEX(5, "LCP", p, l);
 484         if (l < 4)
 485         {
 486                 LOG(1, s, t, "Short LCP %d bytes\n", l);
 487                 STAT(tunnel_rx_errors);
 488                 return ;
 489         }
 490
 491         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 492         {
 493                 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
 494                 STAT(tunnel_rx_errors);
 495                 return ;
 496         }
 497         l = hl;
 498
 499         if (session[s].die) // going down...
 500                 return;
 501
 502         LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
 503                 "LCP: recv %s\n", ppp_code(*p));
 504
 505         if (config->debug > 3) dumplcp(p, l);
 506
 507         if (*p == ConfigAck)
 508         {
 509                 int x = l - 4;
 510                 uint8_t *o = (p + 4);
 511                 int authtype = 0;
 512
 513                 while (x > 2)
 514                 {
 515                         int type = o[0];
 516                         int length = o[1];
 517
 518                         if (length == 0 || type == 0 || x < length) break;
 519                         switch (type)
 520                         {
 521                                 case 3: // Authentication-Protocol
 522                                         {
 523                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 524                                                 if (proto == PPPPAP)
 525                                                         authtype = AUTHPAP;
 526                                                 else if (proto == PPPCHAP && *(o + 4) == 5)
 527                                                         authtype = AUTHCHAP;
 528                                         }
 529
 530                                         break;
 531                         }
 532                         x -= length;
 533                         o += length;
 534                 }
 535
 536                 if (!session[s].ip && authtype)
 537                         sess_local[s].lcp_authtype = authtype;
 538
 539                 switch (session[s].ppp.lcp)
 540                 {
 541                 case RequestSent:
 542                         initialise_restart_count(s, lcp);
 543                         change_state(s, lcp, AckReceived);
 544                         break;
 545
 546                 case AckReceived:
 547                 case Opened:
 548                         LOG(2, s, t, "LCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
 549                         if (session[s].ppp.lcp == Opened)
 550                                 lcp_restart(s);
 551
 552                         sendlcp(s, t);
 553                         change_state(s, lcp, RequestSent);
 554                         break;
 555
 556                 case AckSent:
 557                         lcp_open(s, t);
 558                         break;
 559
 560                 default:
 561                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 562                 }
 563         }
 564         else if (*p == ConfigReq)
 565         {
 566                 int x = l - 4;
 567                 uint8_t *o = (p + 4);
 568                 uint8_t *response = 0;
 569                 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
 570                 static uint8_t authproto[5];
 571
 572                 while (x > 2)
 573                 {
 574                         int type = o[0];
 575                         int length = o[1];
 576
 577                         if (length == 0 || type == 0 || x < length) break;
 578                         switch (type)
 579                         {
 580                                 case 1: // Maximum-Receive-Unit
 581                                         {
 582                                                 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
 583                                                 if (mru >= MINMTU)
 584                                                 {
 585                                                         session[s].mru = mru;
 586                                                         break;
 587                                                 }
 588
 589                                                 LOG(3, s, t, "    Remote requesting MRU of %u.  Rejecting.\n", mru);
 590                                                 mru = htons(MRU);
 591                                                 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
 592                                         }
 593                                         break;
 594
 595                                 case 2: // Async-Control-Character-Map
 596                                         if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
 597                                                 break;
 598
 599                                         LOG(3, s, t, "    Remote requesting asyncmap.  Rejecting.\n");
 600                                         q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
 601                                         break;
 602
 603                                 case 3: // Authentication-Protocol
 604                                         {
 605                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 606                                                 char proto_name[] = "0x0000";
 607                                                 int alen;
 608
 609                                                 if (proto == PPPPAP)
 610                                                 {
 611                                                         if (config->radius_authtypes & AUTHPAP)
 612                                                         {
 613                                                                 sess_local[s].lcp_authtype = AUTHPAP;
 614                                                                 break;
 615                                                         }
 616
 617                                                         strcpy(proto_name, "PAP");
 618                                                 }
 619                                                 else if (proto == PPPCHAP)
 620                                                 {
 621                                                         if (config->radius_authtypes & AUTHCHAP
 622                                                             && *(o + 4) == 5) // MD5
 623                                                         {
 624                                                                 sess_local[s].lcp_authtype = AUTHCHAP;
 625                                                                 break;
 626                                                         }
 627
 628                                                         strcpy(proto_name, "CHAP");
 629                                                 }
 630                                                 else
 631                                                         sprintf(proto_name, "%#4.4x", proto);
 632
 633                                                 LOG(3, s, t, "    Remote requesting %s authentication.  Rejecting.\n", proto_name);
 634
 635                                                 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
 636                                                 if (alen < 2) break; // paranoia
 637
 638                                                 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
 639                                                 if (q && *response == ConfigNak &&
 640                                                         config->radius_authtypes != config->radius_authprefer)
 641                                                 {
 642                                                         // alternate type
 643                                                         alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
 644                                                         if (alen < 2) break;
 645                                                         q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
 646                                                 }
 647
 648                                                 break;
 649                                         }
 650                                         break;
 651
 652                                 case 5: // Magic-Number
 653                                         magicno = ntohl(*(uint32_t *)(o + 2));
 654                                         break;
 655
 656                                 case 4: // Quality-Protocol
 657                                 case 7: // Protocol-Field-Compression
 658                                 case 8: // Address-And-Control-Field-Compression
 659                                         break;
 660
 661                                 default: // Reject any unknown options
 662                                         LOG(3, s, t, "    Rejecting unknown PPP LCP option %d\n", type);
 663                                         q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
 664                         }
 665                         x -= length;
 666                         o += length;
 667                 }
 668
 669                 if (response)
 670                 {
 671                         l = q - response; // LCP packet length
 672                         *((uint16_t *) (response + 2)) = htons(l); // update header
 673                 }
 674                 else
 675                 {
 676                         // Send packet back as ConfigAck
 677                         response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
 678                         if (!response) return;
 679                         *response = ConfigAck;
 680                 }
 681
 682                 switch (session[s].ppp.lcp)
 683                 {
 684                 case Closed:
 685                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
 686                         if (!response) return;
 687                         *response = TerminateAck;
 688                         *((uint16_t *) (response + 2)) = htons(l = 4);
 689                         break;
 690
 691                 case Stopped:
 692                         initialise_restart_count(s, lcp);
 693                         sendlcp(s, t);
 694                         if (*response == ConfigAck)
 695                                 change_state(s, lcp, AckSent);
 696                         else
 697                                 change_state(s, lcp, RequestSent);
 698
 699                         break;
 700
 701                 case RequestSent:
 702                         if (*response == ConfigAck)
 703                                 change_state(s, lcp, AckSent);
 704
 705                         break;
 706
 707                 case AckReceived:
 708                         if (*response == ConfigAck)
 709                                 lcp_open(s, t);
 710
 711                         break;
 712
 713                 case Opened:
 714                         lcp_restart(s);
 715                         sendlcp(s, t);
 716                         /* fallthrough */
 717
 718                 case AckSent:
 719                         if (*response == ConfigAck)
 720                                 change_state(s, lcp, AckSent);
 721                         else
 722                                 change_state(s, lcp, RequestSent);
 723
 724                         break;
 725
 726                 default:
 727                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 728                         return;
 729                 }
 730
 731                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
 732                 if (config->debug > 3) dumplcp(response, l);
 733
 734                 tunnelsend(b, l + (response - b), t);
 735         }
 736         else if (*p == ConfigNak || *p == ConfigRej)
 737         {
 738                 int x = l - 4;
 739                 uint8_t *o = (p + 4);
 740                 int authtype = -1;
 741
 742                 while (x > 2)
 743                 {
 744                         int type = o[0];
 745                         int length = o[1];
 746
 747                         if (length == 0 || type == 0 || x < length) break;
 748                         switch (type)
 749                         {
 750                                 case 1: // Maximum-Receive-Unit
 751                                         if (*p == ConfigNak)
 752                                         {
 753                                                 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
 754                                                 LOG(3, s, t, "    Remote requested MRU of %u\n", sess_local[s].ppp_mru);
 755                                         }
 756                                         else
 757                                         {
 758                                                 sess_local[s].ppp_mru = 0;
 759                                                 LOG(3, s, t, "    Remote rejected MRU negotiation\n");
 760                                         }
 761
 762                                         break;
 763
 764                                 case 3: // Authentication-Protocol
 765                                         if (authtype > 0)
 766                                                 break;
 767
 768                                         if (*p == ConfigNak)
 769                                         {
 770                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 771                                                 if (proto == PPPPAP)
 772                                                 {
 773                                                         authtype = config->radius_authtypes & AUTHPAP;
 774                                                         LOG(3, s, t, "    Remote requested PAP authentication...%sing\n",
 775                                                                 authtype ? "accept" : "reject");
 776                                                 }
 777                                                 else if (proto == PPPCHAP && *(o + 4) == 5)
 778                                                 {
 779                                                         authtype = config->radius_authtypes & AUTHCHAP;
 780                                                         LOG(3, s, t, "    Remote requested CHAP authentication...%sing\n",
 781                                                                 authtype ? "accept" : "reject");
 782                                                 }
 783                                                 else
 784                                                 {
 785                                                         LOG(3, s, t, "    Rejecting unsupported authentication %#4x\n",
 786                                                                 proto);
 787                                                 }
 788                                         }
 789                                         else
 790                                         {
 791                                                 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
 792                                                 authtype = 0; // shutdown
 793                                         }
 794
 795                                         break;
 796
 797                                 default:
 798                                         LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
 799                                         sessionshutdown(s, "Unable to negotiate LCP.", 3, 0);
 800                                         break;
 801                         }
 802                         x -= length;
 803                         o += length;
 804                 }
 805
 806                 if (!authtype)
 807                 {
 808                         sessionshutdown(s, "Unsupported authentication.", 3, 0);
 809                         return;
 810                 }
 811
 812                 if (authtype > 0)
 813                         sess_local[s].lcp_authtype = authtype;
 814
 815                 switch (session[s].ppp.lcp)
 816                 {
 817                 case Closed:
 818                 case Stopped:
 819                         {
 820                                 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
 821                                 if (!response) return;
 822                                 *response = TerminateAck;
 823                                 *((uint16_t *) (response + 2)) = htons(l = 4);
 824
 825                                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
 826                                 if (config->debug > 3) dumplcp(response, l);
 827
 828                                 tunnelsend(b, l + (response - b), t);
 829                         }
 830                         break;
 831
 832                 case RequestSent:
 833                 case AckSent:
 834                         initialise_restart_count(s, lcp);
 835                         sendlcp(s, t);
 836                         break;
 837
 838                 case AckReceived:
 839                         LOG(2, s, t, "LCP: ConfigNak in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
 840                         sendlcp(s, t);
 841                         break;
 842
 843                 case Opened:
 844                         lcp_restart(s);
 845                         sendlcp(s, t);
 846                         break;
 847
 848                 default:
 849                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 850                         return;
 851                 }
 852         }
 853         else if (*p == TerminateReq)
 854         {
 855                 *p = TerminateAck;      // close
 856                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPLCP);
 857                 if (!q) return;
 858
 859                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
 860                 if (config->debug > 3) dumplcp(q, l);
 861
 862                 tunnelsend(b, l + (q - b), t); // send it
 863                 sessionshutdown(s, "Remote end closed connection.", 3, 0);
 864         }
 865         else if (*p == TerminateAck)
 866         {
 867                 sessionshutdown(s, "Connection closed.", 3, 0);
 868         }
 869         else if (*p == ProtocolRej)
 870         {
 871                 uint16_t proto = 0;
 872
 873                 if (l > 4)
 874                 {
 875                         proto = *(p+4);
 876                         if (l > 5 && !(proto & 1))
 877                         {
 878                                 proto <<= 8;
 879                                 proto |= *(p+5);
 880                         }
 881                 }
 882
 883                 if (proto == PPPIPV6CP)
 884                 {
 885                         LOG(3, s, t, "IPv6 rejected\n");
 886                         change_state(s, ipv6cp, Closed);
 887                 }
 888                 else
 889                 {
 890                         LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
 891                 }
 892         }
 893         else if (*p == EchoReq)
 894         {
 895                 *p = EchoReply;         // reply
 896                 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
 897                 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
 898                 if (!q) return;
 899
 900                 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
 901                 if (config->debug > 3) dumplcp(q, l);
 902
 903                 tunnelsend(b, l + (q - b), t); // send it
 904         }
 905         else if (*p == EchoReply)
 906         {
 907                 // Ignore it, last_packet time is set earlier than this.
 908         }
 909         else if (*p != CodeRej)
 910         {
 911                 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
 912         }
 913 }
 914
 915 static void ipcp_open(sessionidt s, tunnelidt t)
 916 {
 917         LOG(3, s, t, "IPCP: Opened, session is now active\n");
 918
 919         change_state(s, ipcp, Opened);
 920
 921         if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
 922         {
 923                 uint16_t r = radiusnew(s);
 924                 if (r)
 925                 {
 926                         radiussend(r, RADIUSSTART); // send radius start
 927
 928                         // don't send further Start records if IPCP is restarted
 929                         session[s].flags |= SESSION_STARTED;
 930                         cluster_send_session(s);
 931                 }
 932         }
 933
 934         // start IPv6 if configured and still in passive state
 935         if (session[s].ppp.ipv6cp == Stopped)
 936         {
 937                 sendipv6cp(s, t);
 938                 change_state(s, ipv6cp, RequestSent);
 939         }
 940 }
 941
 942 // Process IPCP messages
 943 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 944 {
 945         uint8_t b[MAXETHER];
 946         uint8_t *q = 0;
 947         uint16_t hl;
 948
 949         CSTAT(processipcp);
 950
 951         LOG_HEX(5, "IPCP", p, l);
 952         if (l < 5)
 953         {
 954                 LOG(1, s, t, "Short IPCP %d bytes\n", l);
 955                 STAT(tunnel_rx_errors);
 956                 return ;
 957         }
 958
 959         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 960         {
 961                 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
 962                 STAT(tunnel_rx_errors);
 963                 return ;
 964         }
 965         l = hl;
 966
 967         if (session[s].ppp.phase < Network)
 968         {
 969                 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
 970                 return;
 971         }
 972
 973         LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
 974
 975         if (*p == ConfigAck)
 976         {
 977                 switch (session[s].ppp.ipcp)
 978                 {
 979                 case RequestSent:
 980                         initialise_restart_count(s, ipcp);
 981                         change_state(s, ipcp, AckReceived);
 982                         break;
 983
 984                 case AckReceived:
 985                 case Opened:
 986                         LOG(2, s, t, "IPCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
 987                         sendipcp(s, t);
 988                         change_state(s, ipcp, RequestSent);
 989                         break;
 990
 991                 case AckSent:
 992                         ipcp_open(s, t);
 993                         break;
 994
 995                 default:
 996                         LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
 997                 }
 998         }
 999         else if (*p == ConfigReq)
1000         {
1001                 uint8_t *response = 0;
1002                 uint8_t *o = p + 4;
1003                 int length = l - 4;
1004                 int gotip = 0;
1005                 in_addr_t addr;
1006
1007                 while (length > 2)
1008                 {
1009                         switch (*o)
1010                         {
1011                         case 3: // ip address
1012                                 gotip++; // seen address
1013                                 if (o[1] != 6 || o[1] > length) return;
1014
1015                                 addr = htonl(session[s].ip);
1016                                 if (memcmp(o + 2, &addr, (sizeof addr)))
1017                                 {
1018                                         uint8_t *oq = q;
1019                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1020                                         if (!q || (q != oq && *response == ConfigRej))
1021                                         {
1022                                                 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1023                                                 return;
1024                                         }
1025                                 }
1026
1027                                 break;
1028
1029                         case 129: // primary DNS
1030                                 if (o[1] != 6 || o[1] > length) return;
1031
1032                                 addr = htonl(session[s].dns1);
1033                                 if (memcmp(o + 2, &addr, (sizeof addr)))
1034                                 {
1035                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1036                                         if (!q) return;
1037                                 }
1038
1039                                 break;
1040
1041                         case 131: // secondary DNS
1042                                 if (o[1] != 6 || o[1] > length) return;
1043
1044                                 addr = htonl(session[s].dns2);
1045                                 if (memcmp(o + 2, &addr, sizeof(addr)))
1046                                 {
1047                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1048                                         if (!q) return;
1049                                 }
1050
1051                                 break;
1052
1053                         default:
1054                                 LOG(2, s, t, "    Rejecting PPP IPCP Option type %d\n", *o);
1055                                 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1056                                 if (!q) return;
1057                         }
1058
1059                         length -= o[1];
1060                         o += o[1];
1061                 }
1062
1063                 if (response)
1064                 {
1065                         l = q - response; // IPCP packet length
1066                         *((uint16_t *) (response + 2)) = htons(l); // update header
1067                 }
1068                 else if (gotip)
1069                 {
1070                         // Send packet back as ConfigAck
1071                         response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1072                         if (!response) return;
1073                         *response = ConfigAck;
1074                 }
1075                 else
1076                 {
1077                         LOG(1, s, t, "No IP in IPCP request\n");
1078                         STAT(tunnel_rx_errors);
1079                         return;
1080                 }
1081
1082                 switch (session[s].ppp.ipcp)
1083                 {
1084                 case Closed:
1085                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1086                         if (!response) return;
1087                         *response = TerminateAck;
1088                         *((uint16_t *) (response + 2)) = htons(l = 4);
1089                         break;
1090
1091                 case Stopped:
1092                         initialise_restart_count(s, ipcp);
1093                         sendipcp(s, t);
1094                         if (*response == ConfigAck)
1095                                 change_state(s, ipcp, AckSent);
1096                         else
1097                                 change_state(s, ipcp, RequestSent);
1098
1099                         break;
1100
1101                 case RequestSent:
1102                         if (*response == ConfigAck)
1103                                 change_state(s, ipcp, AckSent);
1104
1105                         break;
1106
1107                 case AckReceived:
1108                         if (*response == ConfigAck)
1109                                 ipcp_open(s, t);
1110
1111                         break;
1112
1113                 case Opened:
1114                         initialise_restart_count(s, ipcp);
1115                         sendipcp(s, t);
1116                         /* fallthrough */
1117
1118                 case AckSent:
1119                         if (*response == ConfigAck)
1120                                 change_state(s, ipcp, AckSent);
1121                         else
1122                                 change_state(s, ipcp, RequestSent);
1123
1124                         break;
1125
1126                 default:
1127                         LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1128                         return;
1129                 }
1130
1131                 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1132                 tunnelsend(b, l + (response - b), t);
1133         }
1134         else if (*p == TerminateReq)
1135         {
1136                 *p = TerminateAck;
1137                 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1138                 if (!q) return;
1139                 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1140                 tunnelsend(b, l + (q - b), t);
1141                 change_state(s, ipcp, Stopped);
1142         }
1143         else if (*p != CodeRej)
1144         {
1145                 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1146         }
1147 }
1148
1149 static void ipv6cp_open(sessionidt s, tunnelidt t)
1150 {
1151         LOG(3, s, t, "IPV6CP: Opened\n");
1152
1153         change_state(s, ipv6cp, Opened);
1154         if (session[s].ipv6prefixlen)
1155                 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1156
1157         // Send an initial RA (TODO: Should we send these regularly?)
1158         send_ipv6_ra(s, t, NULL);
1159 }
1160
1161 // Process IPV6CP messages
1162 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1163 {
1164         uint8_t b[MAXETHER];
1165         uint8_t *q = 0;
1166         uint16_t hl;
1167
1168         CSTAT(processipv6cp);
1169
1170         LOG_HEX(5, "IPV6CP", p, l);
1171         if (l < 4)
1172         {
1173                 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1174                 STAT(tunnel_rx_errors);
1175                 return ;
1176         }
1177
1178         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1179         {
1180                 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1181                 STAT(tunnel_rx_errors);
1182                 return ;
1183         }
1184         l = hl;
1185
1186         if (session[s].ppp.phase < Network)
1187         {
1188                 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1189                 return;
1190         }
1191
1192         LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1193
1194         if (!session[s].ip)
1195         {
1196                 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1197                 return; // need IPCP to complete...
1198         }
1199
1200         if (*p == ConfigAck)
1201         {
1202                 switch (session[s].ppp.ipv6cp)
1203                 {
1204                 case RequestSent:
1205                         initialise_restart_count(s, ipv6cp);
1206                         change_state(s, ipv6cp, AckReceived);
1207                         break;
1208
1209                 case AckReceived:
1210                 case Opened:
1211                         LOG(2, s, t, "IPV6CP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1212                         sendipv6cp(s, t);
1213                         change_state(s, ipv6cp, RequestSent);
1214                         break;
1215
1216                 case AckSent:
1217                         ipv6cp_open(s, t);
1218                         break;
1219
1220                 default:
1221                         LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1222                 }
1223         }
1224         else if (*p == ConfigReq)
1225         {
1226                 uint8_t *response = 0;
1227                 uint8_t *o = p + 4;
1228                 int length = l - 4;
1229                 int gotip = 0;
1230                 uint8_t ident[8];
1231
1232                 while (length > 2)
1233                 {
1234                         switch (*o)
1235                         {
1236                         case 1: // interface identifier
1237                                 gotip++; // seen address
1238                                 if (o[1] != 10 || o[1] > length) return;
1239
1240                                 *(uint32_t *) ident = htonl(session[s].ip);
1241                                 *(uint32_t *) (ident + 4) = 0;
1242
1243                                 if (memcmp(o + 2, ident, sizeof(ident)))
1244                                 {
1245                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1246                                         if (!q) return;
1247                                 }
1248
1249                                 break;
1250
1251                         default:
1252                                 LOG(2, s, t, "    Rejecting PPP IPV6CP Option type %d\n", *o);
1253                                 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1254                                 if (!q) return;
1255                         }
1256
1257                         length -= o[1];
1258                         o += o[1];
1259                 }
1260
1261                 if (response)
1262                 {
1263                         l = q - response; // IPV6CP packet length
1264                         *((uint16_t *) (response + 2)) = htons(l); // update header
1265                 }
1266                 else if (gotip)
1267                 {
1268                         // Send packet back as ConfigAck
1269                         response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1270                         if (!response) return;
1271                         *response = ConfigAck;
1272                 }
1273                 else
1274                 {
1275                         LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1276                         STAT(tunnel_rx_errors);
1277                         return;
1278                 }
1279
1280                 switch (session[s].ppp.ipv6cp)
1281                 {
1282                 case Closed:
1283                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1284                         if (!response) return;
1285                         *response = TerminateAck;
1286                         *((uint16_t *) (response + 2)) = htons(l = 4);
1287                         break;
1288
1289                 case Stopped:
1290                         initialise_restart_count(s, ipv6cp);
1291                         sendipv6cp(s, t);
1292                         if (*response == ConfigAck)
1293                                 change_state(s, ipv6cp, AckSent);
1294                         else
1295                                 change_state(s, ipv6cp, RequestSent);
1296
1297                         break;
1298
1299                 case RequestSent:
1300                         if (*response == ConfigAck)
1301                                 change_state(s, ipv6cp, AckSent);
1302
1303                         break;
1304
1305                 case AckReceived:
1306                         if (*response == ConfigAck)
1307                                 ipv6cp_open(s, t);
1308
1309                         break;
1310
1311                 case Opened:
1312                         initialise_restart_count(s, ipv6cp);
1313                         sendipv6cp(s, t);
1314                         /* fallthrough */
1315
1316                 case AckSent:
1317                         if (*response == ConfigAck)
1318                                 change_state(s, ipv6cp, AckSent);
1319                         else
1320                                 change_state(s, ipv6cp, RequestSent);
1321
1322                         break;
1323
1324                 default:
1325                         LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1326                         return;
1327                 }
1328
1329                 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1330                 tunnelsend(b, l + (response - b), t);
1331         }
1332         else if (*p == TerminateReq)
1333         {
1334                 *p = TerminateAck;
1335                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPIPV6CP);
1336                 if (!q) return;
1337                 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1338                 tunnelsend(b, l + (q - b), t);
1339                 change_state(s, ipv6cp, Stopped);
1340         }
1341         else if (*p != CodeRej)
1342         {
1343                 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1344         }
1345 }
1346
1347 // process IP packet received
1348 //
1349 // This MUST be called with at least 4 byte behind 'p'.
1350 // (i.e. this routine writes to p[-4]).
1351 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1352 {
1353         in_addr_t ip;
1354
1355         CSTAT(processipin);
1356
1357         LOG_HEX(5, "IP", p, l);
1358
1359         if (l < 20)
1360         {
1361                 LOG(1, s, t, "IP packet too short %d\n", l);
1362                 STAT(tunnel_rx_errors);
1363                 return ;
1364         }
1365
1366         ip = ntohl(*(uint32_t *)(p + 12));
1367
1368         if (l > MAXETHER)
1369         {
1370                 LOG(1, s, t, "IP packet too long %d\n", l);
1371                 STAT(tunnel_rx_errors);
1372                 return ;
1373         }
1374
1375         if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1376                 return;
1377
1378         // no spoof (do sessionbyip to handled statically routed subnets)
1379         if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1380         {
1381                 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1382                 return;
1383         }
1384
1385         // run access-list if any
1386         if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1387                 return;
1388
1389         // adjust MSS on SYN and SYN,ACK packets with options
1390         if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1391         {
1392                 int ihl = (p[0] & 0xf) * 4; // length of IP header
1393                 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1394                         adjust_tcp_mss(s, t, p, l, p + ihl);
1395         }
1396
1397         // Add on the tun header
1398         p -= 4;
1399         *(uint32_t *) p = htonl(PKTIP);
1400         l += 4;
1401
1402         // Are we throttled and a slave?
1403         if (session[s].tbf_in && !config->cluster_iam_master) {
1404                 // Pass it to the master for handling.
1405                 master_throttle_packet(session[s].tbf_in, p, l);
1406                 return;
1407         }
1408
1409         // Are we throttled and a master??
1410         if (session[s].tbf_in && config->cluster_iam_master) {
1411                 // Actually handle the throttled packets.
1412                 tbf_queue_packet(session[s].tbf_in, p, l);
1413                 return;
1414         }
1415
1416         // send to ethernet
1417         if (tun_write(p, l) < 0)
1418         {
1419                 STAT(tun_tx_errors);
1420                 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1421                         l, strerror(errno), tunfd, p);
1422
1423                 return;
1424         }
1425
1426         p += 4;
1427         l -= 4;
1428
1429         if (session[s].snoop_ip && session[s].snoop_port)
1430         {
1431                 // Snooping this session
1432                 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1433         }
1434
1435         increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1436         session[s].cin_delta += l;
1437         session[s].pin++;
1438
1439         sess_local[s].cin += l;
1440         sess_local[s].pin++;
1441
1442         eth_tx += l;
1443
1444         STAT(tun_tx_packets);
1445         INC_STAT(tun_tx_bytes, l);
1446 }
1447
1448 // process IPv6 packet received
1449 //
1450 // This MUST be called with at least 4 byte behind 'p'.
1451 // (i.e. this routine writes to p[-4]).
1452 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1453 {
1454         struct in6_addr ip;
1455         in_addr_t ipv4;
1456
1457         CSTAT(processipv6in);
1458
1459         LOG_HEX(5, "IPv6", p, l);
1460
1461         ip = *(struct in6_addr *) (p + 8);
1462         ipv4 = ntohl(*(uint32_t *)(p + 16));
1463
1464         if (l > MAXETHER)
1465         {
1466                 LOG(1, s, t, "IP packet too long %d\n", l);
1467                 STAT(tunnel_rx_errors);
1468                 return ;
1469         }
1470
1471         if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1472                 return;
1473
1474         // no spoof
1475         if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1476         {
1477                 char str[INET6_ADDRSTRLEN];
1478                 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1479                                 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1480                 return;
1481         }
1482
1483         // Check if it's a Router Solicition message.
1484         if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1485                         *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1486                         *(uint32_t *)(p + 34) == 0 &&
1487                         *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1488                 LOG(3, s, t, "Got IPv6 RS\n");
1489                 send_ipv6_ra(s, t, &ip);
1490                 return;
1491         }
1492
1493         // Add on the tun header
1494         p -= 4;
1495         *(uint32_t *) p = htonl(PKTIPV6);
1496         l += 4;
1497
1498         // Are we throttled and a slave?
1499         if (session[s].tbf_in && !config->cluster_iam_master) {
1500                 // Pass it to the master for handling.
1501                 master_throttle_packet(session[s].tbf_in, p, l);
1502                 return;
1503         }
1504
1505         // Are we throttled and a master??
1506         if (session[s].tbf_in && config->cluster_iam_master) {
1507                 // Actually handle the throttled packets.
1508                 tbf_queue_packet(session[s].tbf_in, p, l);
1509                 return;
1510         }
1511
1512         // send to ethernet
1513         if (tun_write(p, l) < 0)
1514         {
1515                 STAT(tun_tx_errors);
1516                 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1517                         l, strerror(errno), tunfd, p);
1518
1519                 return;
1520         }
1521
1522         p += 4;
1523         l -= 4;
1524
1525         if (session[s].snoop_ip && session[s].snoop_port)
1526         {
1527                 // Snooping this session
1528                 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1529         }
1530
1531         increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1532         session[s].cin_delta += l;
1533         session[s].pin++;
1534
1535         sess_local[s].cin += l;
1536         sess_local[s].pin++;
1537
1538         eth_tx += l;
1539
1540         STAT(tun_tx_packets);
1541         INC_STAT(tun_tx_bytes, l);
1542 }
1543
1544 //
1545 // Helper routine for the TBF filters.
1546 // Used to send queued data in from the user.
1547 //
1548 void send_ipin(sessionidt s, uint8_t *buf, int len)
1549 {
1550         LOG_HEX(5, "IP in throttled", buf, len);
1551
1552         if (write(tunfd, buf, len) < 0)
1553         {
1554                 STAT(tun_tx_errors);
1555                 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1556                         len, strerror(errno), tunfd, buf);
1557
1558                 return;
1559         }
1560
1561         buf += 4;
1562         len -= 4;
1563
1564         if (session[s].snoop_ip && session[s].snoop_port)
1565         {
1566                 // Snooping this session
1567                 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1568         }
1569
1570         // Increment packet counters
1571         increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1572         session[s].cin_delta += len;
1573         session[s].pin++;
1574
1575         sess_local[s].cin += len;
1576         sess_local[s].pin++;
1577
1578         eth_tx += len;
1579
1580         STAT(tun_tx_packets);
1581         INC_STAT(tun_tx_bytes, len - 4);
1582 }
1583
1584
1585 // Process CCP messages
1586 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1587 {
1588         uint8_t b[MAXETHER];
1589         uint8_t *q;
1590
1591         CSTAT(processccp);
1592
1593         LOG_HEX(5, "CCP", p, l);
1594
1595         if (session[s].ppp.phase < Network)
1596         {
1597                 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1598                 return;
1599         }
1600
1601         if (l < 1)
1602         {
1603                 LOG(1, s, t, "Short CCP packet\n");
1604                 STAT(tunnel_rx_errors);
1605         }
1606
1607         LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1608         if (*p == ConfigAck)
1609         {
1610                 switch (session[s].ppp.ccp)
1611                 {
1612                 case RequestSent:
1613                         initialise_restart_count(s, ccp);
1614                         change_state(s, ccp, AckReceived);
1615                         break;
1616
1617                 case AckReceived:
1618                 case Opened:
1619                         LOG(2, s, t, "CCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1620                         sendccp(s, t);
1621                         change_state(s, ccp, RequestSent);
1622                         break;
1623
1624                 case AckSent:
1625                         LOG(3, s, t, "CCP: Opened\n");
1626                         change_state(s, ccp, Opened);
1627                         break;
1628
1629                 default:
1630                         LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1631                 }
1632         }
1633         else if (*p == ConfigReq)
1634         {
1635                 if (l < 6) // accept no compression
1636                         *p = ConfigAck;
1637                 else // compression requested--reject
1638                         *p = ConfigRej;
1639
1640                 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1641                 if (!q) return;
1642
1643                 switch (session[s].ppp.ccp)
1644                 {
1645                 case Closed:
1646                         q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1647                         if (!q) return;
1648                         *q = TerminateAck;
1649                         *((uint16_t *) (q + 2)) = htons(l = 4);
1650                         break;
1651
1652                 case Stopped:
1653                         initialise_restart_count(s, ccp);
1654                         sendccp(s, t);
1655                         if (*q == ConfigAck)
1656                                 change_state(s, ccp, AckSent);
1657                         else
1658                                 change_state(s, ccp, RequestSent);
1659
1660                         break;
1661
1662                 case RequestSent:
1663                         if (*q == ConfigAck)
1664                                 change_state(s, ccp, AckSent);
1665
1666                         break;
1667
1668                 case AckReceived:
1669                         if (*q == ConfigAck)
1670                                 change_state(s, ccp, Opened);
1671
1672                         break;
1673
1674                 case Opened:
1675                         initialise_restart_count(s, ccp);
1676                         sendccp(s, t);
1677                         /* fallthrough */
1678
1679                 case AckSent:
1680                         if (*q == ConfigAck)
1681                                 change_state(s, ccp, AckSent);
1682                         else
1683                                 change_state(s, ccp, RequestSent);
1684
1685                         break;
1686
1687                 default:
1688                         LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1689                         return;
1690                 }
1691
1692                 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1693                 tunnelsend(b, l + (q - b), t);
1694         }
1695         else if (*p == TerminateReq)
1696         {
1697                 *p = TerminateAck;
1698                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPCCP);
1699                 if (!q) return;
1700                 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1701                 tunnelsend(b, l + (q - b), t);
1702                 change_state(s, ccp, Stopped);
1703         }
1704         else if (*p != CodeRej)
1705         {
1706                 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1707         }
1708 }
1709
1710 // send a CHAP challenge
1711 void sendchap(sessionidt s, tunnelidt t)
1712 {
1713         uint8_t b[MAXETHER];
1714         uint16_t r;
1715         uint8_t *q;
1716
1717         CSTAT(sendchap);
1718
1719         r = radiusnew(s);
1720         if (!r)
1721         {
1722                 LOG(1, s, t, "No RADIUS to send challenge\n");
1723                 STAT(tunnel_tx_errors);
1724                 return;
1725         }
1726
1727         LOG(1, s, t, "Send CHAP challenge\n");
1728
1729         radius[r].chap = 1;             // CHAP not PAP
1730         radius[r].id++;
1731         if (radius[r].state != RADIUSCHAP)
1732                 radius[r].try = 0;
1733
1734         radius[r].state = RADIUSCHAP;
1735         radius[r].retry = backoff(radius[r].try++);
1736         if (radius[r].try > 5)
1737         {
1738                 sessionshutdown(s, "CHAP timeout.", 3, 0);
1739                 STAT(tunnel_tx_errors);
1740                 return ;
1741         }
1742         q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1743         if (!q) return;
1744
1745         *q = 1;                                 // challenge
1746         q[1] = radius[r].id;                    // ID
1747         q[4] = 16;                              // value size (size of challenge)
1748         memcpy(q + 5, radius[r].auth, 16);      // challenge
1749         strcpy((char *) q + 21, hostname);      // our name
1750         *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1751         tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1752 }
1753
1754 // fill in a L2TP message with a PPP frame,
1755 // copies existing PPP message and changes magic number if seen
1756 // returns start of PPP frame
1757 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1758 {
1759         if (size < 12) // Need more space than this!!
1760         {
1761                 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1762                 return NULL;
1763         }
1764
1765         *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1766         *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1767         *(uint16_t *) (b + 4) = htons(session[s].far); // session
1768         b += 6;
1769         if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1770         {
1771                 *(uint16_t *) b = htons(0xFF03); // HDLC header
1772                 b += 2;
1773         }
1774         if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1775                 *b++ = mtype;
1776         else
1777         {
1778                 *(uint16_t *) b = htons(mtype);
1779                 b += 2;
1780         }
1781
1782         if (l + 12 > size)
1783         {
1784                 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1785                 return NULL;
1786         }
1787
1788         if (p && l)
1789                 memcpy(b, p, l);
1790
1791         return b;
1792 }
1793
1794 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1795 {
1796         int len = 0;
1797         if ((authtype == AUTHCHAP && size < 5) || size < 4)
1798                 return 0;
1799
1800         *b++ = 3; // Authentication-Protocol
1801         if (authtype == AUTHCHAP)
1802         {
1803                 len = *b++ = 5; // length
1804                 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1805                 *b++ = 5; // MD5
1806         }
1807         else if (authtype == AUTHPAP)
1808         {
1809                 len = *b++ = 4; // length
1810                 *(uint16_t *) b = htons(PPPPAP); b += 2;
1811         }
1812         else
1813         {
1814                 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1815         }
1816
1817         return len;
1818 }
1819
1820 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1821 void sendlcp(sessionidt s, tunnelidt t)
1822 {
1823         uint8_t b[500], *q, *l;
1824         int authtype = sess_local[s].lcp_authtype;
1825
1826         if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1827                 return;
1828
1829         LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1830             authtype ? " (" : "",
1831             authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1832             authtype ? ")" : "");
1833
1834         l = q;
1835         *l++ = ConfigReq;
1836         *l++ = ++sess_local[s].lcp_ident; // ID
1837
1838         l += 2; //Save space for length
1839
1840         if (sess_local[s].ppp_mru)
1841         {
1842                 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1843                 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1844         }
1845
1846         if (authtype)
1847                 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1848
1849         *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1850         *(uint32_t *) l = htonl(session[s].magic);
1851         l += 4;
1852
1853         *(uint16_t *)(q + 2) = htons(l - q); // Length
1854
1855         LOG_HEX(5, "PPPLCP", q, l - q);
1856         if (config->debug > 3) dumplcp(q, l - q);
1857
1858         tunnelsend(b, (l - b), t);
1859         restart_timer(s, lcp);
1860 }
1861
1862 // Send CCP request for no compression
1863 void sendccp(sessionidt s, tunnelidt t)
1864 {
1865         uint8_t b[500], *q;
1866
1867         if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1868                 return;
1869
1870         LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1871
1872         *q = ConfigReq;
1873         *(q + 1) = ++sess_local[s].lcp_ident; // ID
1874         *(uint16_t *)(q + 2) = htons(4); // Length
1875
1876         LOG_HEX(5, "PPPCCP", q, 4);
1877         tunnelsend(b, (q - b) + 4 , t);
1878         restart_timer(s, ccp);
1879 }
1880
1881 // Reject unknown/unconfigured protocols
1882 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1883 {
1884
1885         uint8_t buf[MAXETHER];
1886         uint8_t *q;
1887         int mru = session[s].mru;
1888         if (mru < MINMTU) mru = MINMTU;
1889         if (mru > sizeof(buf)) mru = sizeof(buf);
1890
1891         l += 6;
1892         if (l > mru) l = mru;
1893
1894         q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1895         if (!q) return;
1896
1897         *q = ProtocolRej;
1898         *(q + 1) = ++sess_local[s].lcp_ident;
1899         *(uint16_t *)(q + 2) = htons(l);
1900         *(uint16_t *)(q + 4) = htons(proto);
1901         memcpy(q + 6, p, l - 6);
1902
1903         if (proto == PPPIPV6CP)
1904                 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1905         else
1906                 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1907
1908         tunnelsend(buf, l + (q - buf), t);
1909 }