3cd27c91c9ec9a60a77d7e6d63ae7cb8e379a94e
[l2tpns.git] / l2tpns.c
1 // L2TP Network Server
2 // Adrian Kennard 2002
3 // Copyright (c) 2003, 2004 Optus Internet Engineering
4 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
5 // vim: sw=8 ts=8
6
7 char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.40 2004/11/04 05:08:36 bodea Exp $";
8
9 #include <arpa/inet.h>
10 #include <assert.h>
11 #include <errno.h>
12 #include <fcntl.h>
13 #include <linux/if_tun.h>
14 #define SYSLOG_NAMES
15 #include <syslog.h>
16 #include <malloc.h>
17 #include <math.h>
18 #include <net/route.h>
19 #include <sys/mman.h>
20 #include <netdb.h>
21 #include <netinet/in.h>
22 #include <stdarg.h>
23 #include <stdlib.h>
24 #include <stdio.h>
25 #include <string.h>
26 #include <ctype.h>
27 #include <sys/ioctl.h>
28 #include <sys/socket.h>
29 #include <sys/stat.h>
30 #include <sys/time.h>
31 #include <sys/resource.h>
32 #include <sys/wait.h>
33 #include <linux/if.h>
34 #include <stddef.h>
35 #include <time.h>
36 #include <dlfcn.h>
37 #include <unistd.h>
38 #include <sched.h>
39 #include <sys/sysinfo.h>
40 #include <libcli.h>
41
42 #include "md5.h"
43 #include "l2tpns.h"
44 #include "cluster.h"
45 #include "plugin.h"
46 #include "ll.h"
47 #include "constants.h"
48 #include "control.h"
49 #include "util.h"
50 #include "tbf.h"
51
52 // Globals
53 struct configt *config = NULL; // all configuration
54 int tunfd = -1; // tun interface file handle. (network device)
55 int udpfd = -1; // UDP file handle
56 int controlfd = -1; // Control signal handle
57 int snoopfd = -1; // UDP file handle for sending out intercept data
58 int *radfds = NULL; // RADIUS requests file handles
59 int ifrfd = -1; // File descriptor for routing, etc
60 time_t basetime = 0; // base clock
61 char hostname[1000] = ""; // us.
62 int tunidx; // ifr_ifindex of tun device
63 u32 sessionid = 0; // session id for radius accounting
64 int syslog_log = 0; // are we logging to syslog
65 FILE *log_stream = NULL; // file handle for direct logging (i.e. direct into file, not via syslog).
66 extern int cluster_sockfd; // Intra-cluster communications socket.
67 u32 last_id = 0; // Last used PPP SID. Can I kill this?? -- mo
68 int clifd = 0; // Socket listening for CLI connections.
69
70 struct cli_session_actions *cli_session_actions = NULL; // Pending session changes requested by CLI
71 struct cli_tunnel_actions *cli_tunnel_actions = NULL; // Pending tunnel changes required by CLI
72
73 static void *ip_hash[256]; // Mapping from IP address to session structures.
74
75 u32 udp_tx = 0, udp_rx = 0, udp_rx_pkt = 0; // Global traffic counters.
76 u32 eth_tx = 0, eth_rx = 0, eth_rx_pkt = 0;
77 u32 ip_pool_size = 1; // Size of the pool of addresses used for dynamic address allocation.
78 time_t time_now = 0; // Current time in seconds since epoch.
79 char time_now_string[64] = {0}; // Current time as a string.
80 char main_quit = 0; // True if we're in the process of exiting.
81 char *_program_name = NULL;
82 linked_list *loaded_plugins;
83 linked_list *plugins[MAX_PLUGIN_TYPES];
84
85 #ifdef BGP
86 #include "bgp.h"
87 struct bgp_peer *bgp_peers = 0;
88 struct bgp_route_list *bgp_routes = 0;
89 int bgp_configured = 0;
90 #endif /* BGP */
91
92 #define membersize(STRUCT, MEMBER) sizeof(((STRUCT *)0)->MEMBER)
93 #define CONFIG(NAME, MEMBER, TYPE) { NAME, offsetof(struct configt, MEMBER), membersize(struct configt, MEMBER), TYPE }
94
95 struct config_descriptt config_values[] = {
96 CONFIG("debug", debug, INT),
97 CONFIG("log_file", log_filename, STRING),
98 CONFIG("pid_file", pid_file, STRING),
99 CONFIG("l2tp_secret", l2tpsecret, STRING),
100 CONFIG("primary_dns", default_dns1, IP),
101 CONFIG("secondary_dns", default_dns2, IP),
102 CONFIG("save_state", save_state, BOOL),
103 CONFIG("primary_radius", radiusserver[0], IP),
104 CONFIG("secondary_radius", radiusserver[1], IP),
105 CONFIG("primary_radius_port", radiusport[0], SHORT),
106 CONFIG("secondary_radius_port", radiusport[1], SHORT),
107 CONFIG("radius_accounting", radius_accounting, BOOL),
108 CONFIG("radius_secret", radiussecret, STRING),
109 CONFIG("bind_address", bind_address, IP),
110 CONFIG("send_garp", send_garp, BOOL),
111 CONFIG("throttle_speed", rl_rate, UNSIGNED_LONG),
112 CONFIG("throttle_buckets", num_tbfs, INT),
113 CONFIG("accounting_dir", accounting_dir, STRING),
114 CONFIG("setuid", target_uid, INT),
115 CONFIG("dump_speed", dump_speed, BOOL),
116 CONFIG("cleanup_interval", cleanup_interval, INT),
117 CONFIG("multi_read_count", multi_read_count, INT),
118 CONFIG("scheduler_fifo", scheduler_fifo, BOOL),
119 CONFIG("lock_pages", lock_pages, BOOL),
120 CONFIG("icmp_rate", icmp_rate, INT),
121 CONFIG("cluster_address", cluster_address, IP),
122 CONFIG("cluster_interface", cluster_interface, STRING),
123 CONFIG("cluster_hb_interval", cluster_hb_interval, INT),
124 CONFIG("cluster_hb_timeout", cluster_hb_timeout, INT),
125 #ifdef BGP
126 CONFIG("as_number", as_number, SHORT),
127 CONFIG("bgp_peer1", bgp_peer[0], STRING),
128 CONFIG("bgp_peer1_as", bgp_peer_as[0], SHORT),
129 CONFIG("bgp_peer2", bgp_peer[1], STRING),
130 CONFIG("bgp_peer2_as", bgp_peer_as[1], SHORT),
131 #endif /* BGP */
132 { NULL, 0, 0, 0 },
133 };
134
135 char *plugin_functions[] = {
136 NULL,
137 "plugin_pre_auth",
138 "plugin_post_auth",
139 "plugin_packet_rx",
140 "plugin_packet_tx",
141 "plugin_timer",
142 "plugin_new_session",
143 "plugin_kill_session",
144 "plugin_control",
145 "plugin_radius_response",
146 "plugin_become_master",
147 "plugin_new_session_master",
148 };
149
150 #define max_plugin_functions (sizeof(plugin_functions) / sizeof(char *))
151
152 tunnelt *tunnel = NULL; // Array of tunnel structures.
153 sessiont *session = NULL; // Array of session structures.
154 sessioncountt *sess_count = NULL; // Array of partial per-session traffic counters.
155 radiust *radius = NULL; // Array of radius structures.
156 ippoolt *ip_address_pool = NULL; // Array of dynamic IP addresses.
157 controlt *controlfree = 0;
158 struct Tstats *_statistics = NULL;
159 #ifdef RINGBUFFER
160 struct Tringbuffer *ringbuffer = NULL;
161 #endif
162
163 void sigalrm_handler(int);
164 void sighup_handler(int);
165 void sigterm_handler(int);
166 void sigquit_handler(int);
167 void sigchild_handler(int);
168 void read_config_file();
169 void read_state();
170 void dump_state();
171 void tunnel_clean();
172 tunnelidt new_tunnel();
173 void update_config();
174 int unhide_avp(u8 *avp, tunnelidt t, sessionidt s, u16 length);
175
176 static void cache_ipmap(ipt ip, int s);
177 static void uncache_ipmap(ipt ip);
178
179 // return internal time (10ths since process startup)
180 clockt now(void)
181 {
182 struct timeval t;
183 gettimeofday(&t, 0);
184 return (t.tv_sec - basetime) * 10 + t.tv_usec / 100000 + 1;
185 }
186
187 // work out a retry time based on try number
188 // This is a straight bounded exponential backoff.
189 // Maximum re-try time is 32 seconds. (2^5).
190 clockt backoff(u8 try)
191 {
192 if (try > 5) try = 5; // max backoff
193 return now() + 10 * (1 << try);
194 }
195
196
197 //
198 // Log a debug message.
199 //
200 void _log(int level, ipt address, sessionidt s, tunnelidt t, const char *format, ...)
201 {
202 static char message[65536] = {0};
203 static char message2[65536] = {0};
204 va_list ap;
205
206 #ifdef RINGBUFFER
207 if (ringbuffer)
208 {
209 if (++ringbuffer->tail >= RINGBUFFER_SIZE)
210 ringbuffer->tail = 0;
211 if (ringbuffer->tail == ringbuffer->head)
212 if (++ringbuffer->head >= RINGBUFFER_SIZE)
213 ringbuffer->head = 0;
214
215 ringbuffer->buffer[ringbuffer->tail].level = level;
216 ringbuffer->buffer[ringbuffer->tail].address = address;
217 ringbuffer->buffer[ringbuffer->tail].session = s;
218 ringbuffer->buffer[ringbuffer->tail].tunnel = t;
219 va_start(ap, format);
220 vsnprintf(ringbuffer->buffer[ringbuffer->tail].message, 4095, format, ap);
221 va_end(ap);
222 }
223 #endif
224
225 if (config->debug < level) return;
226
227 va_start(ap, format);
228 if (log_stream)
229 {
230 vsnprintf(message2, 65535, format, ap);
231 snprintf(message, 65535, "%s %02d/%02d %s", time_now_string, t, s, message2);
232 fprintf(log_stream, "%s", message);
233 }
234 else if (syslog_log)
235 {
236 vsnprintf(message2, 65535, format, ap);
237 snprintf(message, 65535, "%02d/%02d %s", t, s, message2);
238 syslog(level + 2, message); // We don't need LOG_EMERG or LOG_ALERT
239 }
240 va_end(ap);
241 }
242
243 void _log_hex(int level, const char *title, const char *data, int maxsize)
244 {
245 int i, j;
246 const u8 *d = (const u8 *)data;
247
248 if (config->debug < level) return;
249
250 // No support for log_hex to syslog
251 if (log_stream)
252 {
253 _log(level, 0, 0, 0, "%s (%d bytes):\n", title, maxsize);
254 setvbuf(log_stream, NULL, _IOFBF, 16384);
255
256 for (i = 0; i < maxsize; )
257 {
258 fprintf(log_stream, "%4X: ", i);
259 for (j = i; j < maxsize && j < (i + 16); j++)
260 {
261 fprintf(log_stream, "%02X ", d[j]);
262 if (j == i + 7)
263 fputs(": ", log_stream);
264 }
265
266 for (; j < i + 16; j++)
267 {
268 fputs(" ", log_stream);
269 if (j == i + 7)
270 fputs(": ", log_stream);
271 }
272
273 fputs(" ", log_stream);
274 for (j = i; j < maxsize && j < (i + 16); j++)
275 {
276 if (d[j] >= 0x20 && d[j] < 0x7f && d[j] != 0x20)
277 fputc(d[j], log_stream);
278 else
279 fputc('.', log_stream);
280
281 if (j == i + 7)
282 fputs(" ", log_stream);
283 }
284
285 i = j;
286 fputs("\n", log_stream);
287 }
288
289 fflush(log_stream);
290 setbuf(log_stream, NULL);
291 }
292 }
293
294
295 // Add a route
296 //
297 // This adds it to the routing table, advertises it
298 // via iBGP if enabled, and stuffs it into the
299 // 'sessionbyip' cache.
300 //
301 // 'ip' and 'mask' must be in _host_ order.
302 //
303 void routeset(sessionidt s, ipt ip, ipt mask, ipt gw, u8 add)
304 {
305 struct rtentry r;
306 int i;
307
308 if (!mask) mask = 0xffffffff;
309
310 ip &= mask; // Force the ip to be the first one in the route.
311
312 memset(&r, 0, sizeof(r));
313 r.rt_dev = config->tundevice;
314 r.rt_dst.sa_family = AF_INET;
315 *(u32 *) & (((struct sockaddr_in *) &r.rt_dst)->sin_addr.s_addr) = htonl(ip);
316 r.rt_gateway.sa_family = AF_INET;
317 *(u32 *) & (((struct sockaddr_in *) &r.rt_gateway)->sin_addr.s_addr) = htonl(gw);
318 r.rt_genmask.sa_family = AF_INET;
319 *(u32 *) & (((struct sockaddr_in *) &r.rt_genmask)->sin_addr.s_addr) = htonl(mask);
320 r.rt_flags = (RTF_UP | RTF_STATIC);
321 if (gw)
322 r.rt_flags |= RTF_GATEWAY;
323 else if (mask == 0xffffffff)
324 r.rt_flags |= RTF_HOST;
325
326 log(1, ip, 0, 0, "Route %s %u.%u.%u.%u/%u.%u.%u.%u %u.%u.%u.%u\n",
327 add ? "add" : "del",
328 ip >> 24, ip >> 16 & 0xff, ip >> 8 & 0xff, ip & 0xff,
329 mask >> 24, mask >> 16 & 0xff, mask >> 8 & 0xff, mask & 0xff,
330 gw >> 24, gw >> 16 & 0xff, gw >> 8 & 0xff, gw & 0xff);
331
332 if (ioctl(ifrfd, add ? SIOCADDRT : SIOCDELRT, (void *) &r) < 0)
333 log(0, 0, 0, 0, "routeset() error in ioctl: %s\n", strerror(errno));
334
335 #ifdef BGP
336 if (add)
337 bgp_add_route(htonl(ip), htonl(mask));
338 else
339 bgp_del_route(htonl(ip), htonl(mask));
340 #endif /* BGP */
341
342 // Add/Remove the IPs to the 'sessionbyip' cache.
343 // Note that we add the zero address in the case of
344 // a network route. Roll on CIDR.
345
346 // Note that 's == 0' implies this is the address pool.
347 // We still cache it here, because it will pre-fill
348 // the malloc'ed tree.
349
350 if (s)
351 {
352 if (!add) // Are we deleting a route?
353 s = 0; // Caching the session as '0' is the same as uncaching.
354
355 for (i = ip; (i&mask) == (ip&mask) ; ++i)
356 cache_ipmap(i, s);
357 }
358 }
359
360 //
361 // Set up TUN interface
362 void inittun(void)
363 {
364 struct ifreq ifr;
365 struct sockaddr_in sin = {0};
366 memset(&ifr, 0, sizeof(ifr));
367 ifr.ifr_flags = IFF_TUN;
368
369 tunfd = open(TUNDEVICE, O_RDWR);
370 if (tunfd < 0)
371 { // fatal
372 log(0, 0, 0, 0, "Can't open %s: %s\n", TUNDEVICE, strerror(errno));
373 exit(1);
374 }
375 {
376 int flags = fcntl(tunfd, F_GETFL, 0);
377 fcntl(tunfd, F_SETFL, flags | O_NONBLOCK);
378 }
379 if (ioctl(tunfd, TUNSETIFF, (void *) &ifr) < 0)
380 {
381 log(0, 0, 0, 0, "Can't set tun interface: %s\n", strerror(errno));
382 exit(1);
383 }
384 assert(strlen(ifr.ifr_name) < sizeof(config->tundevice));
385 strncpy(config->tundevice, ifr.ifr_name, sizeof(config->tundevice) - 1);
386 ifrfd = socket(PF_INET, SOCK_DGRAM, IPPROTO_IP);
387
388 sin.sin_family = AF_INET;
389 sin.sin_addr.s_addr = config->bind_address ? config->bind_address : 0x01010101; // 1.1.1.1
390 memcpy(&ifr.ifr_addr, &sin, sizeof(struct sockaddr));
391
392 if (ioctl(ifrfd, SIOCSIFADDR, (void *) &ifr) < 0)
393 {
394 log(0, 0, 0, 0, "Error setting tun address: %s\n", strerror(errno));
395 exit(1);
396 }
397 /* Bump up the qlen to deal with bursts from the network */
398 ifr.ifr_qlen = 1000;
399 if (ioctl(ifrfd, SIOCSIFTXQLEN, (void *) &ifr) < 0)
400 {
401 log(0, 0, 0, 0, "Error setting tun queue length: %s\n", strerror(errno));
402 exit(1);
403 }
404 ifr.ifr_flags = IFF_UP;
405 if (ioctl(ifrfd, SIOCSIFFLAGS, (void *) &ifr) < 0)
406 {
407 log(0, 0, 0, 0, "Error setting tun flags: %s\n", strerror(errno));
408 exit(1);
409 }
410 if (ioctl(ifrfd, SIOCGIFINDEX, (void *) &ifr) < 0)
411 {
412 log(0, 0, 0, 0, "Error setting tun ifindex: %s\n", strerror(errno));
413 exit(1);
414 }
415 tunidx = ifr.ifr_ifindex;
416 }
417
418 // set up UDP port
419 void initudp(void)
420 {
421 int on = 1;
422 struct sockaddr_in addr;
423
424 // Tunnel
425 memset(&addr, 0, sizeof(addr));
426 addr.sin_family = AF_INET;
427 addr.sin_port = htons(L2TPPORT);
428 addr.sin_addr.s_addr = config->bind_address;
429 udpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
430 setsockopt(udpfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
431 {
432 int flags = fcntl(udpfd, F_GETFL, 0);
433 fcntl(udpfd, F_SETFL, flags | O_NONBLOCK);
434 }
435 if (bind(udpfd, (void *) &addr, sizeof(addr)) < 0)
436 {
437 log(0, 0, 0, 0, "Error in UDP bind: %s\n", strerror(errno));
438 exit(1);
439 }
440 snoopfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
441
442 // Control
443 memset(&addr, 0, sizeof(addr));
444 addr.sin_family = AF_INET;
445 addr.sin_port = htons(1702);
446 controlfd = socket(AF_INET, SOCK_DGRAM, 17);
447 setsockopt(controlfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
448 if (bind(controlfd, (void *) &addr, sizeof(addr)) < 0)
449 {
450 log(0, 0, 0, 0, "Error in control bind: %s\n", strerror(errno));
451 exit(1);
452 }
453 }
454
455 //
456 // Find session by IP, < 1 for not found
457 //
458 // Confusingly enough, this 'ip' must be
459 // in _network_ order. This being the common
460 // case when looking it up from IP packet headers.
461 //
462 // We actually use this cache for two things.
463 // #1. For used IP addresses, this maps to the
464 // session ID that it's used by.
465 // #2. For un-used IP addresses, this maps to the
466 // index into the pool table that contains that
467 // IP address.
468 //
469
470 int lookup_ipmap(ipt ip)
471 {
472 u8 *a = (u8 *)&ip;
473 char **d = (char **) ip_hash;
474 int s;
475
476 if (!(d = (char **) d[(size_t) *a++])) return 0;
477 if (!(d = (char **) d[(size_t) *a++])) return 0;
478 if (!(d = (char **) d[(size_t) *a++])) return 0;
479
480 s = (ipt) d[(size_t) *a];
481 return s;
482 }
483
484 sessionidt sessionbyip(ipt ip)
485 {
486 int s = lookup_ipmap(ip);
487 CSTAT(call_sessionbyip);
488
489 if (s > 0 && s < MAXSESSION && session[s].tunnel)
490 return s;
491 return 0;
492 }
493
494 //
495 // Take an IP address in HOST byte order and
496 // add it to the sessionid by IP cache.
497 //
498 // (It's actually cached in network order)
499 //
500 static void cache_ipmap(ipt ip, int s)
501 {
502 ipt nip = htonl(ip); // MUST be in network order. I.e. MSB must in be ((char*)(&ip))[0]
503 u8 *a = (u8 *) &nip;
504 char **d = (char **) ip_hash;
505 int i;
506
507 for (i = 0; i < 3; i++)
508 {
509 if (!d[(size_t) a[i]])
510 {
511 if (!(d[(size_t) a[i]] = calloc(256, sizeof (void *))))
512 return;
513 }
514
515 d = (char **) d[(size_t) a[i]];
516 }
517
518 d[(size_t) a[3]] = (char *)((int)s);
519
520 if (s > 0)
521 log(4, ip, s, session[s].tunnel, "Caching ip address %s\n", inet_toa(nip));
522 else if (s == 0)
523 log(4, ip, 0, 0, "Un-caching ip address %s\n", inet_toa(nip));
524 // else a map to an ip pool index.
525 }
526
527 static void uncache_ipmap(ipt ip)
528 {
529 cache_ipmap(ip, 0); // Assign it to the NULL session.
530 }
531
532 //
533 // CLI list to dump current ipcache.
534 //
535 int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc)
536 {
537 char **d = (char **) ip_hash, **e, **f, **g;
538 int i, j, k, l;
539 int count = 0;
540
541 if (CLI_HELP_REQUESTED)
542 return CLI_HELP_NO_ARGS;
543
544 cli_print(cli, "%7s %s", "Sess#", "IP Address");
545
546 for (i = 0; i < 256; ++i)
547 {
548 if (!d[i])
549 continue;
550 e = (char**) d[i];
551 for (j = 0; j < 256; ++j)
552 {
553 if (!e[j])
554 continue;
555 f = (char**) e[j];
556 for (k = 0; k < 256; ++k)
557 {
558 if (!f[k])
559 continue;
560 g = (char**)f[k];
561 for (l = 0; l < 256; ++l)
562 {
563 if (!g[l])
564 continue;
565 cli_print(cli, "%7d %d.%d.%d.%d", (int) g[l], i, j, k, l);
566 ++count;
567 }
568 }
569 }
570 }
571 cli_print(cli, "%d entries in cache", count);
572 return CLI_OK;
573 }
574
575
576 // Find session by username, 0 for not found
577 // walled garden users aren't authenticated, so the username is
578 // reasonably useless. Ignore them to avoid incorrect actions
579 //
580 // This is VERY inefficent. Don't call it often. :)
581 //
582 sessionidt sessionbyuser(char *username)
583 {
584 int s;
585 CSTAT(call_sessionbyuser);
586
587 for (s = 1; s < MAXSESSION ; ++s)
588 {
589 if (session[s].walled_garden)
590 continue; // Skip walled garden users.
591
592 if (!strncmp(session[s].user, username, 128))
593 return s;
594
595 }
596 return 0; // Not found.
597 }
598
599 void send_garp(ipt ip)
600 {
601 int s;
602 struct ifreq ifr;
603 u8 mac[6];
604
605 s = socket(PF_INET, SOCK_DGRAM, 0);
606 if (s < 0)
607 {
608 log(0, 0, 0, 0, "Error creating socket for GARP: %s\n", strerror(errno));
609 return;
610 }
611 memset(&ifr, 0, sizeof(ifr));
612 strncpy(ifr.ifr_name, "eth0", sizeof(ifr.ifr_name) - 1);
613 if (ioctl(s, SIOCGIFHWADDR, &ifr) < 0)
614 {
615 log(0, 0, 0, 0, "Error getting eth0 hardware address for GARP: %s\n", strerror(errno));
616 close(s);
617 return;
618 }
619 memcpy(mac, &ifr.ifr_hwaddr.sa_data, 6*sizeof(char));
620 if (ioctl(s, SIOCGIFINDEX, &ifr) < 0)
621 {
622 log(0, 0, 0, 0, "Error getting eth0 interface index for GARP: %s\n", strerror(errno));
623 close(s);
624 return;
625 }
626 close(s);
627 sendarp(ifr.ifr_ifindex, mac, ip);
628 }
629
630 // Find session by username, 0 for not found
631 sessiont *sessiontbysessionidt(sessionidt s)
632 {
633 if (!s || s > MAXSESSION) return NULL;
634 return &session[s];
635 }
636
637 sessionidt sessionidtbysessiont(sessiont *s)
638 {
639 sessionidt val = s-session;
640 if (s < session || val > MAXSESSION) return 0;
641 return val;
642 }
643
644 // actually send a control message for a specific tunnel
645 void tunnelsend(u8 * buf, u16 l, tunnelidt t)
646 {
647 struct sockaddr_in addr;
648
649 CSTAT(call_tunnelsend);
650
651 if (!t)
652 {
653 static int backtrace_count = 0;
654 log(0, 0, 0, t, "tunnelsend called with 0 as tunnel id\n");
655 STAT(tunnel_tx_errors);
656 log_backtrace(backtrace_count, 5)
657 return;
658 }
659
660 if (!tunnel[t].ip)
661 {
662 static int backtrace_count = 0;
663 log(1, 0, 0, t, "Error sending data out tunnel: no remote endpoint (tunnel not set up)\n");
664 log_backtrace(backtrace_count, 5)
665 STAT(tunnel_tx_errors);
666 return;
667 }
668 memset(&addr, 0, sizeof(addr));
669 addr.sin_family = AF_INET;
670 *(u32 *) & addr.sin_addr = htonl(tunnel[t].ip);
671 addr.sin_port = htons(tunnel[t].port);
672
673 // sequence expected, if sequence in message
674 if (*buf & 0x08) *(u16 *) (buf + ((*buf & 0x40) ? 10 : 8)) = htons(tunnel[t].nr);
675
676 // If this is a control message, deal with retries
677 if (*buf & 0x80)
678 {
679 tunnel[t].last = time_now; // control message sent
680 tunnel[t].retry = backoff(tunnel[t].try); // when to resend
681 if (tunnel[t].try > 1)
682 {
683 STAT(tunnel_retries);
684 log(3, tunnel[t].ip, 0, t, "Control message resend try %d\n", tunnel[t].try);
685 }
686 }
687
688 if (sendto(udpfd, buf, l, 0, (void *) &addr, sizeof(addr)) < 0)
689 {
690 log(0, tunnel[t].ip, ntohs((*(u16 *) (buf + 6))), t, "Error sending data out tunnel: %s (udpfd=%d, buf=%p, len=%d, dest=%s)\n",
691 strerror(errno), udpfd, buf, l, inet_ntoa(addr.sin_addr));
692 STAT(tunnel_tx_errors);
693 return;
694 }
695
696 log_hex(5, "Send Tunnel Data", buf, l);
697 STAT(tunnel_tx_packets);
698 INC_STAT(tunnel_tx_bytes, l);
699 }
700
701 //
702 // Tiny helper function to write data to
703 // the 'tun' device.
704 //
705 int tun_write(u8 * data, int size)
706 {
707 return write(tunfd, data, size);
708 }
709
710 // process outgoing (to tunnel) IP
711 //
712 void processipout(u8 * buf, int len)
713 {
714 sessionidt s;
715 sessiont *sp;
716 tunnelidt t;
717 ipt ip;
718
719 char * data = buf; // Keep a copy of the originals.
720 int size = len;
721
722 u8 b[MAXETHER + 20];
723
724 CSTAT(call_processipout);
725
726 if (len < MIN_IP_SIZE)
727 {
728 log(1, 0, 0, 0, "Short IP, %d bytes\n", len);
729 STAT(tunnel_tx_errors);
730 return;
731 }
732 if (len >= MAXETHER)
733 {
734 log(1, 0, 0, 0, "Oversize IP packet %d bytes\n", len);
735 STAT(tunnel_tx_errors);
736 return;
737 }
738
739 // Skip the tun header
740 buf += 4;
741 len -= 4;
742
743 // Got an IP header now
744 if (*(u8 *)(buf) >> 4 != 4)
745 {
746 log(1, 0, 0, 0, "IP: Don't understand anything except IPv4\n");
747 return;
748 }
749
750 ip = *(u32 *)(buf + 16);
751 if (!(s = sessionbyip(ip)))
752 {
753 // Is this a packet for a session that doesn't exist?
754 static int rate = 0; // Number of ICMP packets we've sent this second.
755 static int last = 0; // Last time we reset the ICMP packet counter 'rate'.
756
757 if (last != time_now)
758 {
759 last = time_now;
760 rate = 0;
761 }
762
763 if (rate++ < config->icmp_rate) // Only send a max of icmp_rate per second.
764 {
765 log(4, 0, 0, 0, "IP: Sending ICMP host unreachable to %s\n", inet_toa(*(u32 *)(buf + 12)));
766 host_unreachable(*(u32 *)(buf + 12), *(u16 *)(buf + 4), ip, buf, (len < 64) ? 64 : len);
767 }
768 return;
769 }
770 t = session[s].tunnel;
771 sp = &session[s];
772
773 if (sp->tbf_out)
774 {
775 // Are we throttling this session?
776 if (config->cluster_iam_master)
777 tbf_queue_packet(sp->tbf_out, data, size);
778 else
779 master_throttle_packet(sp->tbf_out, data, size);
780 return;
781 }
782 else if (sp->walled_garden && !config->cluster_iam_master)
783 {
784 // We are walled-gardening this
785 master_garden_packet(s, data, size);
786 return;
787 }
788
789 // Snooping this session, send it to intercept box
790 if (sp->snoop_ip && sp->snoop_port)
791 snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
792
793 log(5, session[s].ip, s, t, "Ethernet -> Tunnel (%d bytes)\n", len);
794
795 // Add on L2TP header
796 {
797 u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP);
798 if (!p)
799 {
800 log(3, session[s].ip, s, t, "failed to send packet in processipout.\n");
801 return;
802 }
803 tunnelsend(b, len + (p-b), t); // send it...
804 }
805
806 sp->cout += len; // byte count
807 sp->total_cout += len; // byte count
808 sp->pout++;
809 udp_tx += len;
810 sess_count[s].cout += len; // To send to master..
811 }
812
813 //
814 // Helper routine for the TBF filters.
815 // Used to send queued data in to the user!
816 //
817 void send_ipout(sessionidt s, u8 *buf, int len)
818 {
819 sessiont *sp;
820 tunnelidt t;
821 ipt ip;
822
823 u8 b[MAXETHER + 20];
824
825 if (len < 0 || len > MAXETHER)
826 {
827 log(1,0,0,0, "Odd size IP packet: %d bytes\n", len);
828 return;
829 }
830
831 // Skip the tun header
832 buf += 4;
833 len -= 4;
834
835 ip = *(u32 *)(buf + 16);
836
837 if (!session[s].ip)
838 return;
839 t = session[s].tunnel;
840 sp = &session[s];
841
842 log(5, session[s].ip, s, t, "Ethernet -> Tunnel (%d bytes)\n", len);
843
844 // Snooping this session.
845 if (sp->snoop_ip && sp->snoop_port)
846 snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
847
848 // Add on L2TP header
849 {
850 u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP);
851 if (!p)
852 {
853 log(3, session[s].ip, s, t, "failed to send packet in send_ipout.\n");
854 return;
855 }
856 tunnelsend(b, len + (p-b), t); // send it...
857 }
858 sp->cout += len; // byte count
859 sp->total_cout += len; // byte count
860 sp->pout++;
861 udp_tx += len;
862 sess_count[s].cout += len; // To send to master..
863 }
864
865 // add an AVP (16 bit)
866 void control16(controlt * c, u16 avp, u16 val, u8 m)
867 {
868 u16 l = (m ? 0x8008 : 0x0008);
869 *(u16 *) (c->buf + c->length + 0) = htons(l);
870 *(u16 *) (c->buf + c->length + 2) = htons(0);
871 *(u16 *) (c->buf + c->length + 4) = htons(avp);
872 *(u16 *) (c->buf + c->length + 6) = htons(val);
873 c->length += 8;
874 }
875
876 // add an AVP (32 bit)
877 void control32(controlt * c, u16 avp, u32 val, u8 m)
878 {
879 u16 l = (m ? 0x800A : 0x000A);
880 *(u16 *) (c->buf + c->length + 0) = htons(l);
881 *(u16 *) (c->buf + c->length + 2) = htons(0);
882 *(u16 *) (c->buf + c->length + 4) = htons(avp);
883 *(u32 *) (c->buf + c->length + 6) = htonl(val);
884 c->length += 10;
885 }
886
887 // add an AVP (32 bit)
888 void controls(controlt * c, u16 avp, char *val, u8 m)
889 {
890 u16 l = ((m ? 0x8000 : 0) + strlen(val) + 6);
891 *(u16 *) (c->buf + c->length + 0) = htons(l);
892 *(u16 *) (c->buf + c->length + 2) = htons(0);
893 *(u16 *) (c->buf + c->length + 4) = htons(avp);
894 memcpy(c->buf + c->length + 6, val, strlen(val));
895 c->length += 6 + strlen(val);
896 }
897
898 // add a binary AVP
899 void controlb(controlt * c, u16 avp, char *val, unsigned int len, u8 m)
900 {
901 u16 l = ((m ? 0x8000 : 0) + len + 6);
902 *(u16 *) (c->buf + c->length + 0) = htons(l);
903 *(u16 *) (c->buf + c->length + 2) = htons(0);
904 *(u16 *) (c->buf + c->length + 4) = htons(avp);
905 memcpy(c->buf + c->length + 6, val, len);
906 c->length += 6 + len;
907 }
908
909 // new control connection
910 controlt *controlnew(u16 mtype)
911 {
912 controlt *c;
913 if (!controlfree)
914 c = malloc(sizeof(controlt));
915 else
916 {
917 c = controlfree;
918 controlfree = c->next;
919 }
920 assert(c);
921 c->next = 0;
922 *(u16 *) (c->buf + 0) = htons(0xC802); // flags/ver
923 c->length = 12;
924 control16(c, 0, mtype, 1);
925 return c;
926 }
927
928 // send zero block if nothing is waiting
929 // (ZLB send).
930 void controlnull(tunnelidt t)
931 {
932 u8 buf[12];
933 if (tunnel[t].controlc) // Messages queued; They will carry the ack.
934 return;
935
936 *(u16 *) (buf + 0) = htons(0xC802); // flags/ver
937 *(u16 *) (buf + 2) = htons(12); // length
938 *(u16 *) (buf + 4) = htons(tunnel[t].far); // tunnel
939 *(u16 *) (buf + 6) = htons(0); // session
940 *(u16 *) (buf + 8) = htons(tunnel[t].ns); // sequence
941 *(u16 *) (buf + 10) = htons(tunnel[t].nr); // sequence
942 tunnelsend(buf, 12, t);
943 }
944
945 // add a control message to a tunnel, and send if within window
946 void controladd(controlt * c, tunnelidt t, sessionidt s)
947 {
948 *(u16 *) (c->buf + 2) = htons(c->length); // length
949 *(u16 *) (c->buf + 4) = htons(tunnel[t].far); // tunnel
950 *(u16 *) (c->buf + 6) = htons(s ? session[s].far : 0); // session
951 *(u16 *) (c->buf + 8) = htons(tunnel[t].ns); // sequence
952 tunnel[t].ns++; // advance sequence
953 // link in message in to queue
954 if (tunnel[t].controlc)
955 tunnel[t].controle->next = c;
956 else
957 tunnel[t].controls = c;
958 tunnel[t].controle = c;
959 tunnel[t].controlc++;
960 // send now if space in window
961 if (tunnel[t].controlc <= tunnel[t].window)
962 {
963 tunnel[t].try = 0; // first send
964 tunnelsend(c->buf, c->length, t);
965 }
966 }
967
968 //
969 // Throttle or Unthrottle a session
970 //
971 // Throttle the data from/to through a session to no more than
972 // 'rate_in' kbit/sec in (from user) or 'rate_out' kbit/sec out (to
973 // user).
974 //
975 // If either value is -1, the current value is retained for that
976 // direction.
977 //
978 void throttle_session(sessionidt s, int rate_in, int rate_out)
979 {
980 if (!session[s].tunnel)
981 return; // No-one home.
982
983 if (!*session[s].user)
984 return; // User not logged in
985
986 if (rate_in >= 0)
987 {
988 int bytes = rate_in * 1024 / 8; // kbits to bytes
989 if (session[s].tbf_in)
990 free_tbf(session[s].tbf_in);
991
992 if (rate_in > 0)
993 session[s].tbf_in = new_tbf(s, bytes * 2, bytes, send_ipin);
994 else
995 session[s].tbf_in = 0;
996
997 session[s].throttle_in = rate_in;
998 }
999
1000 if (rate_out >= 0)
1001 {
1002 int bytes = rate_out * 1024 / 8;
1003 if (session[s].tbf_out)
1004 free_tbf(session[s].tbf_out);
1005
1006 if (rate_out > 0)
1007 session[s].tbf_out = new_tbf(s, bytes * 2, bytes, send_ipout);
1008 else
1009 session[s].tbf_out = 0;
1010
1011 session[s].throttle_out = rate_out;
1012 }
1013 }
1014
1015 // start tidy shutdown of session
1016 void sessionshutdown(sessionidt s, char *reason)
1017 {
1018 int dead = session[s].die;
1019 int walled_garden = session[s].walled_garden;
1020
1021
1022 CSTAT(call_sessionshutdown);
1023
1024 if (!session[s].tunnel)
1025 {
1026 log(3, session[s].ip, s, session[s].tunnel, "Called sessionshutdown on a session with no tunnel.\n");
1027 return; // not a live session
1028 }
1029
1030 if (!dead)
1031 log(2, 0, s, session[s].tunnel, "Shutting down session %d: %s\n", s, reason);
1032
1033 session[s].die = now() + 150; // Clean up in 15 seconds
1034
1035 {
1036 struct param_kill_session data = { &tunnel[session[s].tunnel], &session[s] };
1037 run_plugins(PLUGIN_KILL_SESSION, &data);
1038 }
1039
1040 // RADIUS Stop message
1041 if (session[s].opened && !walled_garden && !dead)
1042 {
1043 u16 r = session[s].radius;
1044 if (!r)
1045 {
1046 if (!(r = radiusnew(s)))
1047 {
1048 log(1, 0, s, session[s].tunnel, "No free RADIUS sessions for Stop message\n");
1049 STAT(radius_overflow);
1050 }
1051 else
1052 {
1053 int n;
1054 for (n = 0; n < 15; n++)
1055 radius[r].auth[n] = rand();
1056 }
1057 }
1058 if (r && radius[r].state != RADIUSSTOP)
1059 radiussend(r, RADIUSSTOP); // stop, if not already trying
1060 }
1061
1062 if (session[s].ip)
1063 { // IP allocated, clear and unroute
1064 int r;
1065 for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++)
1066 {
1067 routeset(s, session[s].route[r].ip, session[s].route[r].mask, session[s].ip, 0);
1068 session[s].route[r].ip = 0;
1069 }
1070
1071 if (session[s].ip_pool_index == -1) // static ip
1072 {
1073 routeset(s, session[s].ip, 0, 0, 0); // Delete route.
1074 session[s].ip = 0;
1075 }
1076 else
1077 free_ip_address(s);
1078 }
1079
1080 if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
1081 throttle_session(s, 0, 0);
1082
1083 { // Send CDN
1084 controlt *c = controlnew(14); // sending CDN
1085 control16(c, 1, 3, 1); // result code (admin reasons - TBA make error, general error, add message
1086 control16(c, 14, s, 1); // assigned session (our end)
1087 controladd(c, session[s].tunnel, s); // send the message
1088 }
1089
1090 cluster_send_session(s);
1091 }
1092
1093 void sendipcp(tunnelidt t, sessionidt s)
1094 {
1095 u8 buf[MAXCONTROL];
1096 u16 r = session[s].radius;
1097 u8 *q;
1098
1099 CSTAT(call_sendipcp);
1100
1101 if (!r)
1102 r = radiusnew(s);
1103
1104 if (radius[r].state != RADIUSIPCP)
1105 {
1106 radius[r].state = RADIUSIPCP;
1107 radius[r].try = 0;
1108 }
1109
1110 radius[r].retry = backoff(radius[r].try++);
1111 if (radius[r].try > 10)
1112 {
1113 radiusclear(r, s); // Clear radius session.
1114 sessionshutdown(s, "No reply on IPCP");
1115 return;
1116 }
1117
1118 q = makeppp(buf,sizeof(buf), 0, 0, t, s, PPPIPCP);
1119 if (!q)
1120 {
1121 log(3, session[s].ip, s, t, "failed to send packet in sendipcp.\n");
1122 return;
1123 }
1124
1125 *q = ConfigReq;
1126 q[1] = r << RADIUS_SHIFT; // ID, dont care, we only send one type of request
1127 *(u16 *) (q + 2) = htons(10);
1128 q[4] = 3;
1129 q[5] = 6;
1130 *(u32 *) (q + 6) = config->bind_address ? config->bind_address : my_address; // send my IP
1131 tunnelsend(buf, 10 + (q - buf), t); // send it
1132 session[s].flags &= ~SF_IPCP_ACKED; // Clear flag.
1133 }
1134
1135 // kill a session now
1136 void sessionkill(sessionidt s, char *reason)
1137 {
1138
1139 CSTAT(call_sessionkill);
1140
1141 session[s].die = now();
1142 sessionshutdown(s, reason); // close radius/routes, etc.
1143 if (session[s].radius)
1144 radiusclear(session[s].radius, s); // cant send clean accounting data, session is killed
1145
1146 log(2, 0, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
1147
1148 memset(&session[s], 0, sizeof(session[s]));
1149 session[s].tunnel = T_FREE; // Mark it as free.
1150 session[s].next = sessionfree;
1151 sessionfree = s;
1152 cli_session_actions[s].action = 0;
1153 cluster_send_session(s);
1154 }
1155
1156 // kill a tunnel now
1157 void tunnelkill(tunnelidt t, char *reason)
1158 {
1159 sessionidt s;
1160 controlt *c;
1161
1162 CSTAT(call_tunnelkill);
1163
1164 tunnel[t].state = TUNNELDIE;
1165
1166 // free control messages
1167 while ((c = tunnel[t].controls))
1168 {
1169 controlt * n = c->next;
1170 tunnel[t].controls = n;
1171 tunnel[t].controlc--;
1172 c->next = controlfree;
1173 controlfree = c;
1174 }
1175 // kill sessions
1176 for (s = 1; s < MAXSESSION; s++)
1177 if (session[s].tunnel == t)
1178 sessionkill(s, reason);
1179
1180 // free tunnel
1181 tunnelclear(t);
1182 log(1, 0, 0, t, "Kill tunnel %d: %s\n", t, reason);
1183 cli_tunnel_actions[s].action = 0;
1184 cluster_send_tunnel(t);
1185 }
1186
1187 // shut down a tunnel cleanly
1188 void tunnelshutdown(tunnelidt t, char *reason)
1189 {
1190 sessionidt s;
1191
1192 CSTAT(call_tunnelshutdown);
1193
1194 if (!tunnel[t].last || !tunnel[t].far || tunnel[t].state == TUNNELFREE)
1195 {
1196 // never set up, can immediately kill
1197 tunnelkill(t, reason);
1198 return;
1199 }
1200 log(1, 0, 0, t, "Shutting down tunnel %d (%s)\n", t, reason);
1201
1202 // close session
1203 for (s = 1; s < MAXSESSION; s++)
1204 if (session[s].tunnel == t)
1205 sessionkill(s, reason);
1206
1207 tunnel[t].state = TUNNELDIE;
1208 tunnel[t].die = now() + 700; // Clean up in 70 seconds
1209 cluster_send_tunnel(t);
1210 // TBA - should we wait for sessions to stop?
1211 { // Send StopCCN
1212 controlt *c = controlnew(4); // sending StopCCN
1213 control16(c, 1, 1, 1); // result code (admin reasons - TBA make error, general error, add message
1214 control16(c, 9, t, 1); // assigned tunnel (our end)
1215 controladd(c, t, 0); // send the message
1216 }
1217 }
1218
1219 // read and process packet on tunnel (UDP)
1220 void processudp(u8 * buf, int len, struct sockaddr_in *addr)
1221 {
1222 char *chapresponse = NULL;
1223 u16 l = len, t = 0, s = 0, ns = 0, nr = 0;
1224 u8 *p = buf + 2;
1225
1226
1227 CSTAT(call_processudp);
1228
1229 udp_rx += len;
1230 udp_rx_pkt++;
1231 log_hex(5, "UDP Data", buf, len);
1232 STAT(tunnel_rx_packets);
1233 INC_STAT(tunnel_rx_bytes, len);
1234 if (len < 6)
1235 {
1236 log(1, ntohl(addr->sin_addr.s_addr), 0, 0, "Short UDP, %d bytes\n", len);
1237 STAT(tunnel_rx_errors);
1238 return;
1239 }
1240 if ((buf[1] & 0x0F) != 2)
1241 {
1242 log(1, ntohl(addr->sin_addr.s_addr), 0, 0, "Bad L2TP ver %d\n", (buf[1] & 0x0F) != 2);
1243 STAT(tunnel_rx_errors);
1244 return;
1245 }
1246 if (*buf & 0x40)
1247 { // length
1248 l = ntohs(*(u16 *) p);
1249 p += 2;
1250 }
1251 t = ntohs(*(u16 *) p);
1252 p += 2;
1253 s = ntohs(*(u16 *) p);
1254 p += 2;
1255 if (s >= MAXSESSION)
1256 {
1257 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Received UDP packet with invalid session ID\n");
1258 STAT(tunnel_rx_errors);
1259 return;
1260 }
1261 if (t >= MAXTUNNEL)
1262 {
1263 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Received UDP packet with invalid tunnel ID\n");
1264 STAT(tunnel_rx_errors);
1265 return;
1266 }
1267 if (*buf & 0x08)
1268 { // ns/nr
1269 ns = ntohs(*(u16 *) p);
1270 p += 2;
1271 nr = ntohs(*(u16 *) p);
1272 p += 2;
1273 }
1274 if (*buf & 0x02)
1275 { // offset
1276 u16 o = ntohs(*(u16 *) p);
1277 p += o + 2;
1278 }
1279 if ((p - buf) > l)
1280 {
1281 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Bad length %d>%d\n", (p - buf), l);
1282 STAT(tunnel_rx_errors);
1283 return;
1284 }
1285 l -= (p - buf);
1286 if (*buf & 0x80)
1287 { // control
1288 u16 message = 0xFFFF; // message type
1289 u8 fatal = 0;
1290 u8 mandatorymessage = 0;
1291 u8 chap = 0; // if CHAP being used
1292 u16 asession = 0; // assigned session
1293 u32 amagic = 0; // magic number
1294 u8 aflags = 0; // flags from last LCF
1295 u16 version = 0x0100; // protocol version (we handle 0.0 as well and send that back just in case)
1296 int requestchap = 0; // do we request PAP instead of original CHAP request?
1297 char called[MAXTEL] = ""; // called number
1298 char calling[MAXTEL] = ""; // calling number
1299
1300 if (!config->cluster_iam_master)
1301 {
1302 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
1303 return;
1304 }
1305
1306 if ((*buf & 0xCA) != 0xC8)
1307 {
1308 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Bad control header %02X\n", *buf);
1309 STAT(tunnel_rx_errors);
1310 return;
1311 }
1312 log(3, ntohl(addr->sin_addr.s_addr), s, t, "Control message (%d bytes): (unacked %d) l-ns %d l-nr %d r-ns %d r-nr %d\n",
1313 l, tunnel[t].controlc, tunnel[t].ns, tunnel[t].nr, ns, nr);
1314 // if no tunnel specified, assign one
1315 if (!t)
1316 {
1317 int i;
1318
1319 //
1320 // Is this a duplicate of the first packet? (SCCRQ)
1321 //
1322 for (i = 1; i <= config->cluster_highest_tunnelid ; ++i)
1323 {
1324 if (tunnel[i].state != TUNNELOPENING ||
1325 tunnel[i].ip != ntohl(*(ipt *) & addr->sin_addr) ||
1326 tunnel[i].port != ntohs(addr->sin_port) )
1327 continue;
1328 t = i;
1329 break;
1330 }
1331 }
1332
1333 if (!t)
1334 {
1335 if (!(t = new_tunnel()))
1336 {
1337 log(1, ntohl(addr->sin_addr.s_addr), 0, 0, "No more tunnels\n");
1338 STAT(tunnel_overflow);
1339 return;
1340 }
1341 tunnelclear(t);
1342 tunnel[t].ip = ntohl(*(ipt *) & addr->sin_addr);
1343 tunnel[t].port = ntohs(addr->sin_port);
1344 tunnel[t].window = 4; // default window
1345 log(1, ntohl(addr->sin_addr.s_addr), 0, t, " New tunnel from %u.%u.%u.%u/%u ID %d\n", tunnel[t].ip >> 24, tunnel[t].ip >> 16 & 255, tunnel[t].ip >> 8 & 255, tunnel[t].ip & 255, tunnel[t].port, t);
1346 STAT(tunnel_created);
1347 }
1348
1349 // This is used to time out old tunnels
1350 tunnel[t].lastrec = time_now;
1351
1352 // check sequence of this message
1353 {
1354 int skip = tunnel[t].window; // track how many in-window packets are still in queue
1355 // some to clear maybe?
1356 while (tunnel[t].controlc && (((tunnel[t].ns - tunnel[t].controlc) - nr) & 0x8000))
1357 {
1358 controlt *c = tunnel[t].controls;
1359 tunnel[t].controls = c->next;
1360 tunnel[t].controlc--;
1361 c->next = controlfree;
1362 controlfree = c;
1363 skip--;
1364 tunnel[t].try = 0; // we have progress
1365 }
1366
1367 // If the 'ns' just received is not the 'nr' we're
1368 // expecting, just send an ack and drop it.
1369 //
1370 // if 'ns' is less, then we got a retransmitted packet.
1371 // if 'ns' is greater than missed a packet. Either way
1372 // we should ignore it.
1373 if (ns != tunnel[t].nr)
1374 {
1375 // is this the sequence we were expecting?
1376 log(1, ntohl(addr->sin_addr.s_addr), 0, t, " Out of sequence tunnel %d, (%d is not the expected %d)\n", t, ns, tunnel[t].nr);
1377 STAT(tunnel_rx_errors);
1378
1379 if (l) // Is this not a ZLB?
1380 controlnull(t);
1381 return;
1382 }
1383 // receiver advance (do here so quoted correctly in any sends below)
1384 if (l) tunnel[t].nr = (ns + 1);
1385 if (skip < 0) skip = 0;
1386 if (skip < tunnel[t].controlc)
1387 {
1388 // some control packets can now be sent that were previous stuck out of window
1389 int tosend = tunnel[t].window - skip;
1390 controlt *c = tunnel[t].controls;
1391 while (c && skip)
1392 {
1393 c = c->next;
1394 skip--;
1395 }
1396 while (c && tosend)
1397 {
1398 tunnel[t].try = 0; // first send
1399 tunnelsend(c->buf, c->length, t);
1400 c = c->next;
1401 tosend--;
1402 }
1403 }
1404 if (!tunnel[t].controlc)
1405 tunnel[t].retry = 0; // caught up
1406 }
1407 if (l)
1408 { // if not a null message
1409 // process AVPs
1410 while (l && !(fatal & 0x80))
1411 {
1412 u16 n = (ntohs(*(u16 *) p) & 0x3FF);
1413 u8 *b = p;
1414 u8 flags = *p;
1415 u16 mtype;
1416 p += n; // next
1417 if (l < n)
1418 {
1419 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Invalid length in AVP\n");
1420 STAT(tunnel_rx_errors);
1421 fatal = flags;
1422 return;
1423 }
1424 l -= n;
1425 if (flags & 0x40)
1426 {
1427 // handle hidden AVPs
1428 if (!*config->l2tpsecret)
1429 {
1430 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Hidden AVP requested, but no L2TP secret.\n");
1431 fatal = flags;
1432 continue;
1433 }
1434 if (!session[s].random_vector_length)
1435 {
1436 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Hidden AVP requested, but no random vector.\n");
1437 fatal = flags;
1438 continue;
1439 }
1440 log(4, ntohl(addr->sin_addr.s_addr), s, t, "Hidden AVP\n");
1441 // Unhide the AVP
1442 n = unhide_avp(b, t, s, n);
1443 if (n == 0)
1444 {
1445 fatal = flags;
1446 continue;
1447 }
1448 }
1449 if (*b & 0x3C)
1450 {
1451 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Unrecognised AVP flags %02X\n", *b);
1452 fatal = flags;
1453 continue; // next
1454 }
1455 b += 2;
1456 if (*(u16 *) (b))
1457 {
1458 log(2, ntohl(addr->sin_addr.s_addr), s, t, "Unknown AVP vendor %d\n", ntohs(*(u16 *) (b)));
1459 fatal = flags;
1460 continue; // next
1461 }
1462 b += 2;
1463 mtype = ntohs(*(u16 *) (b));
1464 b += 2;
1465 n -= 6;
1466
1467 log(4, ntohl(addr->sin_addr.s_addr), s, t, " AVP %d (%s) len %d\n", mtype, avpnames[mtype], n);
1468 switch (mtype)
1469 {
1470 case 0: // message type
1471 message = ntohs(*(u16 *) b);
1472 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Message type = %d (%s)\n", *b,
1473 l2tp_message_types[message]);
1474 mandatorymessage = flags;
1475 break;
1476 case 1: // result code
1477 {
1478 u16 rescode = ntohs(*(u16 *)(b));
1479 const char* resdesc = "(unknown)";
1480 if (message == 4)
1481 { /* StopCCN */
1482 if (rescode <= MAX_STOPCCN_RESULT_CODE)
1483 resdesc = stopccn_result_codes[rescode];
1484 }
1485 else if (message == 14)
1486 { /* CDN */
1487 if (rescode <= MAX_CDN_RESULT_CODE)
1488 resdesc = cdn_result_codes[rescode];
1489 }
1490
1491 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Result Code %d: %s\n",
1492 rescode, resdesc);
1493 if (n >= 4)
1494 {
1495 u16 errcode = ntohs(*(u16 *)(b + 2));
1496 const char* errdesc = "(unknown)";
1497 if (errcode <= MAX_ERROR_CODE)
1498 errdesc = error_codes[errcode];
1499 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Error Code %d: %s\n",
1500 errcode, errdesc);
1501 }
1502 if (n > 4)
1503 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Error String: %.*s\n",
1504 n-4, b+4);
1505
1506 break;
1507 }
1508 break;
1509 case 2: // protocol version
1510 {
1511 version = ntohs(*(u16 *) (b));
1512 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Protocol version = %d\n", version);
1513 if (version && version != 0x0100)
1514 { // allow 0.0 and 1.0
1515 log(1, ntohl(addr->sin_addr.s_addr), s, t, " Bad protocol version %04X\n",
1516 version);
1517 fatal = flags;
1518 continue; // next
1519 }
1520 }
1521 break;
1522 case 3: // framing capabilities
1523 // log(4, ntohl(addr->sin_addr.s_addr), s, t, "Framing capabilities\n");
1524 break;
1525 case 4: // bearer capabilities
1526 // log(4, ntohl(addr->sin_addr.s_addr), s, t, "Bearer capabilities\n");
1527 break;
1528 case 5: // tie breaker
1529 // We never open tunnels, so we don't care about tie breakers
1530 // log(4, ntohl(addr->sin_addr.s_addr), s, t, "Tie breaker\n");
1531 continue;
1532 case 6: // firmware revision
1533 // log(4, ntohl(addr->sin_addr.s_addr), s, t, "Firmware revision\n");
1534 break;
1535 case 7: // host name
1536 memset(tunnel[t].hostname, 0, 128);
1537 memcpy(tunnel[t].hostname, b, (n >= 127) ? 127 : n);
1538 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Tunnel hostname = \"%s\"\n", tunnel[t].hostname);
1539 // TBA - to send to RADIUS
1540 break;
1541 case 8: // vendor name
1542 memset(tunnel[t].vendor, 0, sizeof(tunnel[t].vendor));
1543 memcpy(tunnel[t].vendor, b, (n >= sizeof(tunnel[t].vendor) - 1) ? sizeof(tunnel[t].vendor) - 1 : n);
1544 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Vendor name = \"%s\"\n", tunnel[t].vendor);
1545 break;
1546 case 9: // assigned tunnel
1547 tunnel[t].far = ntohs(*(u16 *) (b));
1548 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Remote tunnel id = %d\n", tunnel[t].far);
1549 break;
1550 case 10: // rx window
1551 tunnel[t].window = ntohs(*(u16 *) (b));
1552 if (!tunnel[t].window)
1553 tunnel[t].window = 1; // window of 0 is silly
1554 log(4, ntohl(addr->sin_addr.s_addr), s, t, " rx window = %d\n", tunnel[t].window);
1555 break;
1556 case 11: // Challenge
1557 {
1558 log(4, ntohl(addr->sin_addr.s_addr), s, t, " LAC requested CHAP authentication for tunnel\n");
1559 build_chap_response(b, 2, n, &chapresponse);
1560 }
1561 break;
1562 case 13: // Response
1563 // Why did they send a response? We never challenge.
1564 log(2, ntohl(addr->sin_addr.s_addr), s, t, " received unexpected challenge response\n");
1565 break;
1566
1567 case 14: // assigned session
1568 asession = session[s].far = ntohs(*(u16 *) (b));
1569 log(4, ntohl(addr->sin_addr.s_addr), s, t, " assigned session = %d\n", asession);
1570 break;
1571 case 15: // call serial number
1572 log(4, ntohl(addr->sin_addr.s_addr), s, t, " call serial number = %d\n", ntohl(*(u32 *)b));
1573 break;
1574 case 18: // bearer type
1575 log(4, ntohl(addr->sin_addr.s_addr), s, t, " bearer type = %d\n", ntohl(*(u32 *)b));
1576 // TBA - for RADIUS
1577 break;
1578 case 19: // framing type
1579 log(4, ntohl(addr->sin_addr.s_addr), s, t, " framing type = %d\n", ntohl(*(u32 *)b));
1580 // TBA
1581 break;
1582 case 21: // called number
1583 memset(called, 0, MAXTEL);
1584 memcpy(called, b, (n >= MAXTEL) ? (MAXTEL-1) : n);
1585 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Called <%s>\n", called);
1586 break;
1587 case 22: // calling number
1588 memset(calling, 0, MAXTEL);
1589 memcpy(calling, b, (n >= MAXTEL) ? (MAXTEL-1) : n);
1590 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Calling <%s>\n", calling);
1591 break;
1592 case 23: // subtype
1593 break;
1594 case 24: // tx connect speed
1595 if (n == 4)
1596 {
1597 session[s].tx_connect_speed = ntohl(*(u32 *)b);
1598 }
1599 else
1600 {
1601 // AS5300s send connect speed as a string
1602 char tmp[30] = {0};
1603 memcpy(tmp, b, (n >= 30) ? 30 : n);
1604 session[s].tx_connect_speed = atol(tmp);
1605 }
1606 log(4, ntohl(addr->sin_addr.s_addr), s, t, " TX connect speed <%u>\n",
1607 session[s].tx_connect_speed);
1608 break;
1609 case 38: // rx connect speed
1610 if (n == 4)
1611 {
1612 session[s].rx_connect_speed = ntohl(*(u32 *)b);
1613 }
1614 else
1615 {
1616 // AS5300s send connect speed as a string
1617 char tmp[30] = {0};
1618 memcpy(tmp, b, (n >= 30) ? 30 : n);
1619 session[s].rx_connect_speed = atol(tmp);
1620 }
1621 log(4, ntohl(addr->sin_addr.s_addr), s, t, " RX connect speed <%u>\n",
1622 session[s].rx_connect_speed);
1623 break;
1624 case 25: // Physical Channel ID
1625 {
1626 u32 tmp = ntohl(*(u32 *)b);
1627 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Physical Channel ID <%X>\n", tmp);
1628 break;
1629 }
1630 case 29: // Proxy Authentication Type
1631 {
1632 u16 authtype = ntohs(*(u16 *)b);
1633 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Proxy Auth Type %d (%s)\n",
1634 authtype, authtypes[authtype]);
1635 requestchap = (authtype == 2);
1636 break;
1637 }
1638 case 30: // Proxy Authentication Name
1639 {
1640 char authname[64] = {0};
1641 memcpy(authname, b, (n > 63) ? 63 : n);
1642 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Proxy Auth Name (%s)\n",
1643 authname);
1644 break;
1645 }
1646 case 31: // Proxy Authentication Challenge
1647 {
1648 memcpy(radius[session[s].radius].auth, b, 16);
1649 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Proxy Auth Challenge\n");
1650 break;
1651 }
1652 case 32: // Proxy Authentication ID
1653 {
1654 u16 authid = ntohs(*(u16 *)(b));
1655 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Proxy Auth ID (%d)\n",
1656 authid);
1657 if (session[s].radius)
1658 radius[session[s].radius].id = authid;
1659 break;
1660 }
1661 case 33: // Proxy Authentication Response
1662 {
1663 char authresp[64] = {0};
1664 memcpy(authresp, b, (n > 63) ? 63 : n);
1665 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Proxy Auth Response\n");
1666 break;
1667 }
1668 case 27: // last send lcp
1669 { // find magic number
1670 u8 *p = b, *e = p + n;
1671 while (p < e && p[1])
1672 {
1673 if (*p == 5 && p[1] == 6)
1674 amagic = ntohl(*(u32 *) (p + 2));
1675 else if (*p == 3 && p[1] == 5 && *(u16 *) (p + 2) == htons(PPPCHAP) && p[4] == 5)
1676 chap = 1;
1677 else if (*p == 7)
1678 aflags |= SESSIONPFC;
1679 else if (*p == 8)
1680 aflags |= SESSIONACFC;
1681 p += p[1];
1682 }
1683
1684 {
1685 char tmp[500] = {0};
1686 tmp[0] = ConfigReq;
1687 memcpy((tmp + 1), b, n);
1688 }
1689 }
1690 break;
1691 case 28: // last recv lcp confreq
1692 {
1693 char tmp[500] = {0};
1694 tmp[0] = ConfigReq;
1695 memcpy((tmp + 1), b, n);
1696 break;
1697 }
1698 case 26: // Initial Received LCP CONFREQ
1699 {
1700 char tmp[500] = {0};
1701 tmp[0] = ConfigReq;
1702 memcpy((tmp + 1), b, n);
1703 }
1704 break;
1705 case 39: // seq required - we control it as an LNS anyway...
1706 break;
1707 case 36: // Random Vector
1708 log(4, ntohl(addr->sin_addr.s_addr), s, t, " Random Vector received. Enabled AVP Hiding.\n");
1709 memset(session[s].random_vector, 0, sizeof(session[s].random_vector));
1710 memcpy(session[s].random_vector, b, n);
1711 session[s].random_vector_length = n;
1712 break;
1713 default:
1714 log(2, ntohl(addr->sin_addr.s_addr), s, t, " Unknown AVP type %d\n", mtype);
1715 fatal = flags;
1716 continue; // next
1717 }
1718 }
1719 // process message
1720 if (fatal & 0x80)
1721 tunnelshutdown(t, "Unknown Mandatory AVP");
1722 else
1723 switch (message)
1724 {
1725 case 1: // SCCRQ - Start Control Connection Request
1726 {
1727 controlt *c = controlnew(2); // sending SCCRP
1728 control16(c, 2, version, 1); // protocol version
1729 control32(c, 3, 3, 1); // framing
1730 controls(c, 7, tunnel[t].hostname, 1); // host name (TBA)
1731 if (chapresponse) controlb(c, 13, chapresponse, 16, 1); // Challenge response
1732 control16(c, 9, t, 1); // assigned tunnel
1733 controladd(c, t, s); // send the resply
1734 }
1735 tunnel[t].state = TUNNELOPENING;
1736 break;
1737 case 2: // SCCRP
1738 tunnel[t].state = TUNNELOPEN;
1739 break;
1740 case 3: // SCCN
1741 tunnel[t].state = TUNNELOPEN;
1742 controlnull(t); // ack
1743 break;
1744 case 4: // StopCCN
1745 controlnull(t); // ack
1746 tunnelshutdown(t, "Stopped"); // Shut down cleanly
1747 tunnelkill(t, "Stopped"); // Immediately force everything dead
1748 break;
1749 case 6: // HELLO
1750 controlnull(t); // simply ACK
1751 break;
1752 case 7: // OCRQ
1753 // TBA
1754 break;
1755 case 8: // OCRO
1756 // TBA
1757 break;
1758 case 9: // OCCN
1759 // TBA
1760 break;
1761 case 10: // ICRQ
1762 if (!sessionfree)
1763 {
1764 STAT(session_overflow);
1765 tunnelshutdown(t, "No free sessions");
1766 }
1767 else
1768 {
1769 u16 r;
1770 controlt *c;
1771
1772 s = sessionfree;
1773 sessionfree = session[s].next;
1774 memset(&session[s], 0, sizeof(session[s]));
1775
1776 if (s > config->cluster_highest_sessionid)
1777 config->cluster_highest_sessionid = s;
1778
1779 // make a RADIUS session
1780 if (!(r = radiusnew(s)))
1781 {
1782 log(1, ntohl(addr->sin_addr.s_addr), s, t, "No free RADIUS sessions for ICRQ\n");
1783 sessionkill(s, "no free RADIUS sesions");
1784 return;
1785 }
1786
1787 c = controlnew(11); // sending ICRP
1788 session[s].id = sessionid++;
1789 session[s].opened = time(NULL);
1790 session[s].tunnel = t;
1791 session[s].far = asession;
1792 session[s].last_packet = time_now;
1793 log(3, ntohl(addr->sin_addr.s_addr), s, t, "New session (%d/%d)\n", tunnel[t].far, session[s].far);
1794 control16(c, 14, s, 1); // assigned session
1795 controladd(c, t, s); // send the reply
1796 {
1797 // Generate a random challenge
1798 int n;
1799 for (n = 0; n < 15; n++)
1800 radius[r].auth[n] = rand();
1801 }
1802 strncpy(radius[r].calling, calling, sizeof(radius[r].calling) - 1);
1803 strncpy(session[s].called, called, sizeof(session[s].called) - 1);
1804 strncpy(session[s].calling, calling, sizeof(session[s].calling) - 1);
1805 STAT(session_created);
1806 }
1807 break;
1808 case 11: // ICRP
1809 // TBA
1810 break;
1811 case 12: // ICCN
1812 if (amagic == 0) amagic = time_now;
1813 session[s].magic = amagic; // set magic number
1814 session[s].l2tp_flags = aflags; // set flags received
1815 log(3, ntohl(addr->sin_addr.s_addr), s, t, "Magic %X Flags %X\n", amagic, aflags);
1816 controlnull(t); // ack
1817 // In CHAP state, request PAP instead
1818 if (requestchap)
1819 initlcp(t, s);
1820 break;
1821 case 14: // CDN
1822 controlnull(t); // ack
1823 sessionshutdown(s, "Closed (Received CDN)");
1824 break;
1825 case 0xFFFF:
1826 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Missing message type\n");
1827 break;
1828 default:
1829 STAT(tunnel_rx_errors);
1830 if (mandatorymessage & 0x80)
1831 tunnelshutdown(t, "Unknown message");
1832 else
1833 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Unknown message type %d\n", message);
1834 break;
1835 }
1836 if (chapresponse) free(chapresponse);
1837 cluster_send_tunnel(t);
1838 }
1839 else
1840 {
1841 log(4, 0, s, t, " Got a ZLB ack\n");
1842 }
1843 }
1844 else
1845 { // data
1846 u16 prot;
1847
1848 log_hex(5, "Receive Tunnel Data", p, l);
1849 if (l > 2 && p[0] == 0xFF && p[1] == 0x03)
1850 { // HDLC address header, discard
1851 p += 2;
1852 l -= 2;
1853 }
1854 if (l < 2)
1855 {
1856 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Short ppp length %d\n", l);
1857 STAT(tunnel_rx_errors);
1858 return;
1859 }
1860 if (*p & 1)
1861 {
1862 prot = *p++;
1863 l--;
1864 }
1865 else
1866 {
1867 prot = ntohs(*(u16 *) p);
1868 p += 2;
1869 l -= 2;
1870 }
1871
1872 if (s && !session[s].tunnel) // Is something wrong??
1873 {
1874 if (!config->cluster_iam_master)
1875 {
1876 // Pass it off to the master to deal with..
1877 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
1878 return;
1879 }
1880
1881
1882 log(1, ntohl(addr->sin_addr.s_addr), s, t, "UDP packet contains session %d "
1883 "but no session[%d].tunnel exists (LAC said"
1884 " tunnel = %d). Dropping packet.\n", s, s, t);
1885 STAT(tunnel_rx_errors);
1886 return;
1887 }
1888
1889 if (session[s].die)
1890 {
1891 log(3, ntohl(addr->sin_addr.s_addr), s, t, "Session %d is closing. Don't process PPP packets\n", s);
1892 // I'm pretty sure this isn't right -- mo.
1893 // return; // closing session, PPP not processed
1894 }
1895 if (prot == PPPPAP)
1896 {
1897 session[s].last_packet = time_now;
1898 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
1899 processpap(t, s, p, l);
1900 }
1901 else if (prot == PPPCHAP)
1902 {
1903 session[s].last_packet = time_now;
1904 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
1905 processchap(t, s, p, l);
1906 }
1907 else if (prot == PPPLCP)
1908 {
1909 session[s].last_packet = time_now;
1910 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
1911 processlcp(t, s, p, l);
1912 }
1913 else if (prot == PPPIPCP)
1914 {
1915 session[s].last_packet = time_now;
1916 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
1917 processipcp(t, s, p, l);
1918 }
1919 else if (prot == PPPCCP)
1920 {
1921 session[s].last_packet = time_now;
1922 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
1923 processccp(t, s, p, l);
1924 }
1925 else if (prot == PPPIP)
1926 {
1927 if (!config->cluster_iam_master)
1928 {
1929 // We're a slave. Should we forward this packet to the master?
1930
1931 // Is this a walled garden session, or something that needs it's
1932 // idle time updated??
1933
1934 // Maintain the idle timeouts on the master. If this would
1935 // significantly reset the idletimeout, run it via the master
1936 // to refresh the master's idle timer.
1937 // Not sure this is ideal: It may re-order packets.
1938
1939 if (session[s].walled_garden || (session[s].last_packet + (ECHO_TIMEOUT/2)) < time_now)
1940 {
1941 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
1942 session[s].last_packet = time_now;
1943 return;
1944 }
1945 // fall through to processipin.
1946 } else
1947 session[s].last_packet = time_now;
1948 processipin(t, s, p, l);
1949 }
1950 else
1951 {
1952 STAT(tunnel_rx_errors);
1953 log(1, ntohl(addr->sin_addr.s_addr), s, t, "Unknown PPP protocol %04X\n", prot);
1954 }
1955 }
1956 }
1957
1958 // read and process packet on tun
1959 void processtun(u8 * buf, int len)
1960 {
1961 log_hex(5, "Receive TUN Data", buf, len);
1962 STAT(tun_rx_packets);
1963 INC_STAT(tun_rx_bytes, len);
1964
1965 CSTAT(call_processtun);
1966
1967 eth_rx_pkt++;
1968 eth_rx += len;
1969 if (len < 22)
1970 {
1971 log(1, 0, 0, 0, "Short tun packet %d bytes\n", len);
1972 STAT(tun_rx_errors);
1973 return;
1974 }
1975
1976 if (*(u16 *) (buf + 2) == htons(PKTIP)) // IP
1977 processipout(buf, len);
1978 // Else discard.
1979 }
1980
1981 //
1982 // Maximum number of actions to complete.
1983 // This is to avoid sending out too many packets
1984 // at once.
1985 #define MAX_ACTIONS 500
1986
1987 int regular_cleanups(void)
1988 {
1989 static sessionidt s = 0; // Next session to check for actions on.
1990 tunnelidt t;
1991 int count=0,i;
1992 u16 r;
1993 static clockt next_acct = 0;
1994 int a;
1995
1996 log(3, 0, 0, 0, "Begin regular cleanup\n");
1997
1998 for (r = 1; r < MAXRADIUS; r++)
1999 {
2000 if (!radius[r].state)
2001 continue;
2002 if (radius[r].retry)
2003 {
2004 if (radius[r].retry <= TIME)
2005 radiusretry(r);
2006 } else
2007 radius[r].retry = backoff(radius[r].try+1); // Is this really needed? --mo
2008 }
2009 for (t = 1; t <= config->cluster_highest_tunnelid; t++)
2010 {
2011 // check for expired tunnels
2012 if (tunnel[t].die && tunnel[t].die <= TIME)
2013 {
2014 STAT(tunnel_timeout);
2015 tunnelkill(t, "Expired");
2016 continue;
2017 }
2018 // check for message resend
2019 if (tunnel[t].retry && tunnel[t].controlc)
2020 {
2021 // resend pending messages as timeout on reply
2022 if (tunnel[t].retry <= TIME)
2023 {
2024 controlt *c = tunnel[t].controls;
2025 u8 w = tunnel[t].window;
2026 tunnel[t].try++; // another try
2027 if (tunnel[t].try > 5)
2028 tunnelkill(t, "Timeout on control message"); // game over
2029 else
2030 while (c && w--)
2031 {
2032 tunnelsend(c->buf, c->length, t);
2033 c = c->next;
2034 }
2035 }
2036 }
2037 // Send hello
2038 if (tunnel[t].state == TUNNELOPEN && tunnel[t].lastrec < TIME + 600)
2039 {
2040 controlt *c = controlnew(6); // sending HELLO
2041 controladd(c, t, 0); // send the message
2042 log(3, tunnel[t].ip, 0, t, "Sending HELLO message\n");
2043 }
2044
2045 // Check for tunnel changes requested from the CLI
2046 if ((a = cli_tunnel_actions[t].action))
2047 {
2048 cli_tunnel_actions[t].action = 0;
2049 if (a & CLI_TUN_KILL)
2050 {
2051 log(2, tunnel[t].ip, 0, t, "Dropping tunnel by CLI\n");
2052 tunnelshutdown(t, "Requested by administrator");
2053 }
2054 }
2055
2056 }
2057
2058 count = 0;
2059 for (i = 1; i <= config->cluster_highest_sessionid; i++)
2060 {
2061 s++;
2062 if (s > config->cluster_highest_sessionid)
2063 s = 1;
2064
2065 if (!session[s].tunnel) // Session isn't in use
2066 continue;
2067
2068 if (!session[s].die && session[s].ip && !(session[s].flags & SF_IPCP_ACKED))
2069 {
2070 // IPCP has not completed yet. Resend
2071 log(3, session[s].ip, s, session[s].tunnel, "No ACK for initial IPCP ConfigReq... resending\n");
2072 sendipcp(session[s].tunnel, s);
2073 }
2074
2075 // check for expired sessions
2076 if (session[s].die && session[s].die <= TIME)
2077 {
2078 sessionkill(s, "Expired");
2079 if (++count >= MAX_ACTIONS) break;
2080 continue;
2081 }
2082
2083 // Drop sessions who have not responded within IDLE_TIMEOUT seconds
2084 if (session[s].last_packet && (time_now - session[s].last_packet >= IDLE_TIMEOUT))
2085 {
2086 sessionkill(s, "No response to LCP ECHO requests");
2087 STAT(session_timeout);
2088 if (++count >= MAX_ACTIONS) break;
2089 continue;
2090 }
2091
2092 // No data in IDLE_TIMEOUT seconds, send LCP ECHO
2093 if (session[s].user[0] && (time_now - session[s].last_packet >= ECHO_TIMEOUT))
2094 {
2095 u8 b[MAXCONTROL] = {0};
2096
2097 u8 *q = makeppp(b, sizeof(b), 0, 0, session[s].tunnel, s, PPPLCP);
2098 if (!q)
2099 {
2100 log(3, session[s].ip, s, t, "failed to send ECHO packet.\n");
2101 continue;
2102 }
2103
2104 *q = EchoReq;
2105 *(u8 *)(q + 1) = (time_now % 255); // ID
2106 *(u16 *)(q + 2) = htons(8); // Length
2107 *(u32 *)(q + 4) = 0; // Magic Number (not supported)
2108
2109 log(4, session[s].ip, s, session[s].tunnel, "No data in %d seconds, sending LCP ECHO\n",
2110 (int)(time_now - session[s].last_packet));
2111 tunnelsend(b, 24, session[s].tunnel); // send it
2112 if (++count >= MAX_ACTIONS) break;
2113 }
2114
2115 // Check for actions requested from the CLI
2116 if ((a = cli_session_actions[s].action))
2117 {
2118 int send = 0;
2119
2120 cli_session_actions[s].action = 0;
2121 if (a & CLI_SESS_KILL)
2122 {
2123 log(2, 0, s, session[s].tunnel, "Dropping session by CLI\n");
2124 sessionshutdown(s, "Requested by administrator");
2125 a = 0; // dead, no need to check for other actions
2126 }
2127
2128 if (a & CLI_SESS_NOSNOOP)
2129 {
2130 log(2, 0, s, session[s].tunnel, "Unsnooping session by CLI\n");
2131 session[s].snoop_ip = 0;
2132 session[s].snoop_port = 0;
2133 send++;
2134 }
2135 else if (a & CLI_SESS_SNOOP)
2136 {
2137 log(2, 0, s, session[s].tunnel, "Snooping session by CLI (to %s:%d)\n",
2138 inet_toa(cli_session_actions[s].snoop_ip), cli_session_actions[s].snoop_port);
2139
2140 session[s].snoop_ip = cli_session_actions[s].snoop_ip;
2141 session[s].snoop_port = cli_session_actions[s].snoop_port;
2142 send++;
2143 }
2144
2145 if (a & CLI_SESS_NOTHROTTLE)
2146 {
2147 log(2, 0, s, session[s].tunnel, "Un-throttling session by CLI\n");
2148 throttle_session(s, 0, 0);
2149 send++;
2150 }
2151 else if (a & CLI_SESS_THROTTLE)
2152 {
2153 log(2, 0, s, session[s].tunnel, "Throttling session by CLI (to %dkb/s up and %dkb/s down)\n",
2154 cli_session_actions[s].throttle_in,
2155 cli_session_actions[s].throttle_out);
2156
2157 throttle_session(s, cli_session_actions[s].throttle_in, cli_session_actions[s].throttle_out);
2158 send++;
2159 }
2160
2161 if (send)
2162 cluster_send_session(s);
2163
2164 if (++count >= MAX_ACTIONS) break;
2165 }
2166 }
2167
2168 if (*config->accounting_dir && next_acct <= TIME)
2169 {
2170 // Dump accounting data
2171 next_acct = TIME + ACCT_TIME;
2172 dump_acct_info();
2173 }
2174
2175 if (count >= MAX_ACTIONS)
2176 return 1; // Didn't finish!
2177
2178 log(3, 0, 0, 0, "End regular cleanup (%d actions), next in %d seconds\n", count, config->cleanup_interval);
2179 return 0;
2180 }
2181
2182
2183 //
2184 // Are we in the middle of a tunnel update, or radius
2185 // requests??
2186 //
2187 int still_busy(void)
2188 {
2189 int i;
2190 static clockt last_talked = 0;
2191 static clockt start_busy_wait = 0;
2192 if (start_busy_wait == 0)
2193 start_busy_wait = TIME;
2194
2195 for (i = config->cluster_highest_tunnelid ; i > 0 ; --i)
2196 {
2197 if (!tunnel[i].controlc)
2198 continue;
2199
2200 if (last_talked != TIME)
2201 {
2202 log(2,0,0,0, "Tunnel %d still has un-acked control messages.\n", i);
2203 last_talked = TIME;
2204 }
2205 return 1;
2206 }
2207
2208 // We stop waiting for radius after BUSY_WAIT_TIME 1/10th seconds
2209 if (abs(TIME - start_busy_wait) > BUSY_WAIT_TIME)
2210 {
2211 log(1, 0, 0, 0, "Giving up waiting for RADIUS to be empty. Shutting down anyway.\n");
2212 return 0;
2213 }
2214
2215 for (i = 1; i < MAXRADIUS; i++)
2216 {
2217 if (radius[i].state == RADIUSNULL)
2218 continue;
2219 if (radius[i].state == RADIUSWAIT)
2220 continue;
2221
2222 if (last_talked != TIME)
2223 {
2224 log(2,0,0,0, "Radius session %d is still busy (sid %d)\n", i, radius[i].session);
2225 last_talked = TIME;
2226 }
2227 return 1;
2228 }
2229
2230 return 0;
2231 }
2232
2233 static fd_set readset;
2234 static int readset_n = 0;
2235
2236 // main loop - gets packets on tun or udp and processes them
2237 void mainloop(void)
2238 {
2239 int i;
2240 u8 buf[65536];
2241 struct timeval to;
2242 clockt next_cluster_ping = 0; // send initial ping immediately
2243 time_t next_clean = time_now + config->cleanup_interval;
2244
2245 log(4, 0, 0, 0, "Beginning of main loop. udpfd=%d, tunfd=%d, cluster_sockfd=%d, controlfd=%d\n",
2246 udpfd, tunfd, cluster_sockfd, controlfd);
2247
2248 FD_ZERO(&readset);
2249 FD_SET(udpfd, &readset);
2250 FD_SET(tunfd, &readset);
2251 FD_SET(controlfd, &readset);
2252 FD_SET(clifd, &readset);
2253 if (cluster_sockfd) FD_SET(cluster_sockfd, &readset);
2254 readset_n = udpfd;
2255 if (tunfd > readset_n) readset_n = tunfd;
2256 if (controlfd > readset_n) readset_n = controlfd;
2257 if (clifd > readset_n) readset_n = clifd;
2258 if (cluster_sockfd > readset_n) readset_n = cluster_sockfd;
2259
2260 while (!main_quit || still_busy())
2261 {
2262 fd_set r;
2263 int n = readset_n;
2264 #ifdef BGP
2265 fd_set w;
2266 int bgp_set[BGP_NUM_PEERS];
2267 #endif /* BGP */
2268
2269 if (config->reload_config)
2270 {
2271 // Update the config state based on config settings
2272 update_config();
2273 }
2274
2275 memcpy(&r, &readset, sizeof(fd_set));
2276 to.tv_sec = 0;
2277 to.tv_usec = 100000; // 1/10th of a second.
2278
2279 #ifdef BGP
2280 FD_ZERO(&w);
2281 for (i = 0; i < BGP_NUM_PEERS; i++)
2282 {
2283 bgp_set[i] = bgp_select_state(&bgp_peers[i]);
2284 if (bgp_set[i] & 1)
2285 {
2286 FD_SET(bgp_peers[i].sock, &r);
2287 if (bgp_peers[i].sock > n)
2288 n = bgp_peers[i].sock;
2289 }
2290
2291 if (bgp_set[i] & 2)
2292 {
2293 FD_SET(bgp_peers[i].sock, &w);
2294 if (bgp_peers[i].sock > n)
2295 n = bgp_peers[i].sock;
2296 }
2297 }
2298
2299 n = select(n + 1, &r, &w, 0, &to);
2300 #else /* BGP */
2301 n = select(n + 1, &r, 0, 0, &to);
2302 #endif /* BGP */
2303
2304 TIME = now();
2305 if (n < 0)
2306 {
2307 if (errno == EINTR ||
2308 errno == ECHILD) // EINTR was clobbered by sigchild_handler()
2309 continue;
2310
2311 log(0, 0, 0, 0, "Error returned from select(): %s\n", strerror(errno));
2312 main_quit++;
2313 break;
2314 }
2315 else if (n)
2316 {
2317 struct sockaddr_in addr;
2318 int alen = sizeof(addr);
2319 if (FD_ISSET(udpfd, &r))
2320 {
2321 int c, n;
2322 for (c = 0; c < config->multi_read_count; c++)
2323 {
2324 if ((n = recvfrom(udpfd, buf, sizeof(buf), 0, (void *) &addr, &alen)) > 0)
2325 processudp(buf, n, &addr);
2326 else
2327 break;
2328 }
2329 }
2330 if (FD_ISSET(tunfd, &r))
2331 {
2332 int c, n;
2333 for (c = 0; c < config->multi_read_count; c++)
2334 {
2335 if ((n = read(tunfd, buf, sizeof(buf))) > 0)
2336 processtun(buf, n);
2337 else
2338 break;
2339 }
2340 }
2341
2342 if (config->cluster_iam_master)
2343 for (i = 0; i < config->num_radfds; i++)
2344 if (FD_ISSET(radfds[i], &r))
2345 processrad(buf, recv(radfds[i], buf, sizeof(buf), 0), i);
2346
2347 if (FD_ISSET(cluster_sockfd, &r))
2348 {
2349 int size;
2350 size = recvfrom(cluster_sockfd, buf, sizeof(buf), MSG_WAITALL, (void *) &addr, &alen);
2351 processcluster(buf, size, addr.sin_addr.s_addr);
2352 }
2353
2354 if (FD_ISSET(controlfd, &r))
2355 processcontrol(buf, recvfrom(controlfd, buf, sizeof(buf), MSG_WAITALL, (void *) &addr, &alen), &addr);
2356
2357 if (FD_ISSET(clifd, &r))
2358 {
2359 struct sockaddr_in addr;
2360 int sockfd;
2361 int len = sizeof(addr);
2362
2363 if ((sockfd = accept(clifd, (struct sockaddr *)&addr, &len)) <= 0)
2364 {
2365 log(0, 0, 0, 0, "accept error: %s\n", strerror(errno));
2366 continue;
2367 }
2368 else
2369 {
2370 cli_do(sockfd);
2371 close(sockfd);
2372 }
2373 }
2374 }
2375
2376 // Runs on every machine (master and slaves).
2377 if (cluster_sockfd && next_cluster_ping <= TIME)
2378 {
2379 // Check to see which of the cluster is still alive..
2380
2381 cluster_send_ping(basetime); // Only does anything if we're a slave
2382 cluster_check_master(); // ditto.
2383
2384 cluster_heartbeat(); // Only does anything if we're a master.
2385 cluster_check_slaves(); // ditto.
2386
2387 master_update_counts(); // If we're a slave, send our byte counters to our master.
2388
2389 if (config->cluster_iam_master && !config->cluster_iam_uptodate)
2390 next_cluster_ping = TIME + 1; // out-of-date slaves, do fast updates
2391 else
2392 next_cluster_ping = TIME + config->cluster_hb_interval;
2393 }
2394
2395 // Run token bucket filtering queue..
2396 // Only run it every 1/10th of a second.
2397 // Runs on all machines both master and slave.
2398 {
2399 static clockt last_run = 0;
2400 if (last_run != TIME)
2401 {
2402 last_run = TIME;
2403 tbf_run_timer();
2404 }
2405 }
2406
2407 /* Handle timeouts. Make sure that this gets run anyway, even if there was
2408 * something to read, else under load this will never actually run....
2409 *
2410 */
2411 if (config->cluster_iam_master && next_clean <= time_now)
2412 {
2413 if (regular_cleanups())
2414 {
2415 // Did it finish?
2416 next_clean = time_now + 1 ; // Didn't finish. Check quickly.
2417 }
2418 else
2419 {
2420 next_clean = time_now + config->cleanup_interval; // Did. Move to next interval.
2421 }
2422 }
2423
2424 #ifdef BGP
2425 for (i = 0; i < BGP_NUM_PEERS; i++)
2426 {
2427 bgp_process(&bgp_peers[i],
2428 bgp_set[i] ? FD_ISSET(bgp_peers[i].sock, &r) : 0,
2429 bgp_set[i] ? FD_ISSET(bgp_peers[i].sock, &w) : 0);
2430 }
2431 #endif /* BGP */
2432 }
2433
2434 // Are we the master and shutting down??
2435 if (config->cluster_iam_master)
2436 cluster_heartbeat(); // Flush any queued changes..
2437
2438 // Ok. Notify everyone we're shutting down. If we're
2439 // the master, this will force an election.
2440 cluster_send_ping(0);
2441
2442 //
2443 // Important!!! We MUST not process any packets past this point!
2444 }
2445
2446 static void stripdomain(char *host)
2447 {
2448 char *p;
2449
2450 if ((p = strchr(host, '.')))
2451 {
2452 char *domain = 0;
2453 char _domain[1024];
2454
2455 // strip off domain
2456 FILE *resolv = fopen("/etc/resolv.conf", "r");
2457 if (resolv)
2458 {
2459 char buf[1024];
2460 char *b;
2461
2462 while (fgets(buf, sizeof(buf), resolv))
2463 {
2464 if (strncmp(buf, "domain", 6) && strncmp(buf, "search", 6))
2465 continue;
2466
2467 if (!isspace(buf[6]))
2468 continue;
2469
2470 b = buf + 7;
2471 while (isspace(*b)) b++;
2472
2473 if (*b)
2474 {
2475 char *d = b;
2476 while (*b && !isspace(*b)) b++;
2477 *b = 0;
2478 if (buf[0] == 'd') // domain is canonical
2479 {
2480 domain = d;
2481 break;
2482 }
2483
2484 // first search line
2485 if (!domain)
2486 {
2487 // hold, may be subsequent domain line
2488 strncpy(_domain, d, sizeof(_domain))[sizeof(_domain)-1] = 0;
2489 domain = _domain;
2490 }
2491 }
2492 }
2493
2494 fclose(resolv);
2495 }
2496
2497 if (domain)
2498 {
2499 int hl = strlen(host);
2500 int dl = strlen(domain);
2501 if (dl < hl && host[hl - dl - 1] == '.' && !strcmp(host + hl - dl, domain))
2502 host[hl -dl - 1] = 0;
2503 }
2504 else
2505 {
2506 *p = 0; // everything after first dot
2507 }
2508 }
2509 }
2510
2511 // Init data structures
2512 void initdata(int optdebug, char *optconfig)
2513 {
2514 int i;
2515
2516 if (!(_statistics = shared_malloc(sizeof(struct Tstats))))
2517 {
2518 log(0, 0, 0, 0, "Error doing malloc for _statistics: %s\n", strerror(errno));
2519 exit(1);
2520 }
2521 if (!(config = shared_malloc(sizeof(struct configt))))
2522 {
2523 log(0, 0, 0, 0, "Error doing malloc for configuration: %s\n", strerror(errno));
2524 exit(1);
2525 }
2526 memset(config, 0, sizeof(struct configt));
2527 time(&config->start_time);
2528 strncpy(config->config_file, optconfig, strlen(optconfig));
2529 config->debug = optdebug;
2530 config->num_tbfs = MAXTBFS;
2531 config->rl_rate = 28; // 28kbps
2532
2533 if (!(tunnel = shared_malloc(sizeof(tunnelt) * MAXTUNNEL)))
2534 {
2535 log(0, 0, 0, 0, "Error doing malloc for tunnels: %s\n", strerror(errno));
2536 exit(1);
2537 }
2538 if (!(session = shared_malloc(sizeof(sessiont) * MAXSESSION)))
2539 {
2540 log(0, 0, 0, 0, "Error doing malloc for sessions: %s\n", strerror(errno));
2541 exit(1);
2542 }
2543
2544 if (!(sess_count = shared_malloc(sizeof(sessioncountt) * MAXSESSION)))
2545 {
2546 log(0, 0, 0, 0, "Error doing malloc for sessions_count: %s\n", strerror(errno));
2547 exit(1);
2548 }
2549
2550 if (!(radius = shared_malloc(sizeof(radiust) * MAXRADIUS)))
2551 {
2552 log(0, 0, 0, 0, "Error doing malloc for radius: %s\n", strerror(errno));
2553 exit(1);
2554 }
2555
2556 if (!(ip_address_pool = shared_malloc(sizeof(ippoolt) * MAXIPPOOL)))
2557 {
2558 log(0, 0, 0, 0, "Error doing malloc for ip_address_pool: %s\n", strerror(errno));
2559 exit(1);
2560 }
2561
2562 #ifdef RINGBUFFER
2563 if (!(ringbuffer = shared_malloc(sizeof(struct Tringbuffer))))
2564 {
2565 log(0, 0, 0, 0, "Error doing malloc for ringbuffer: %s\n", strerror(errno));
2566 exit(1);
2567 }
2568 memset(ringbuffer, 0, sizeof(struct Tringbuffer));
2569 #endif
2570
2571 if (!(cli_session_actions = shared_malloc(sizeof(struct cli_session_actions) * MAXSESSION)))
2572 {
2573 log(0, 0, 0, 0, "Error doing malloc for cli session actions: %s\n", strerror(errno));
2574 exit(1);
2575 }
2576 memset(cli_session_actions, 0, sizeof(struct cli_session_actions) * MAXSESSION);
2577
2578 if (!(cli_tunnel_actions = shared_malloc(sizeof(struct cli_tunnel_actions) * MAXSESSION)))
2579 {
2580 log(0, 0, 0, 0, "Error doing malloc for cli tunnel actions: %s\n", strerror(errno));
2581 exit(1);
2582 }
2583 memset(cli_tunnel_actions, 0, sizeof(struct cli_tunnel_actions) * MAXSESSION);
2584
2585 memset(tunnel, 0, sizeof(tunnelt) * MAXTUNNEL);
2586 memset(session, 0, sizeof(sessiont) * MAXSESSION);
2587 memset(radius, 0, sizeof(radiust) * MAXRADIUS);
2588 memset(ip_address_pool, 0, sizeof(ippoolt) * MAXIPPOOL);
2589
2590 // Put all the sessions on the free list marked as undefined.
2591 for (i = 1; i < MAXSESSION - 1; i++)
2592 {
2593 session[i].next = i + 1;
2594 session[i].tunnel = T_UNDEF; // mark it as not filled in.
2595 }
2596 session[MAXSESSION - 1].next = 0;
2597 sessionfree = 1;
2598
2599 // Mark all the tunnels as undefined (waiting to be filled in by a download).
2600 for (i = 1; i < MAXTUNNEL- 1; i++)
2601 tunnel[i].state = TUNNELUNDEF; // mark it as not filled in.
2602
2603 if (!*hostname)
2604 {
2605 // Grab my hostname unless it's been specified
2606 gethostname(hostname, sizeof(hostname));
2607 stripdomain(hostname);
2608 }
2609
2610 _statistics->start_time = _statistics->last_reset = time(NULL);
2611
2612 #ifdef BGP
2613 if (!(bgp_peers = shared_malloc(sizeof(struct bgp_peer) * BGP_NUM_PEERS)))
2614 {
2615 log(0, 0, 0, 0, "Error doing malloc for bgp: %s\n", strerror(errno));
2616 exit(1);
2617 }
2618 #endif /* BGP */
2619 }
2620
2621 void initiptables(void)
2622 {
2623 /* Flush the tables here so that we have a clean slate */
2624
2625 // Not needed. 'nat' is setup by garden.c
2626 // mangle isn't used (as throttling is done by tbf inhouse).
2627 }
2628
2629 int assign_ip_address(sessionidt s)
2630 {
2631 u32 i;
2632 int best = -1;
2633 time_t best_time = time_now;
2634 char *u = session[s].user;
2635 char reuse = 0;
2636
2637
2638 CSTAT(call_assign_ip_address);
2639
2640 for (i = 1; i < ip_pool_size; i++)
2641 {
2642 if (!ip_address_pool[i].address || ip_address_pool[i].assigned)
2643 continue;
2644
2645 if (!session[s].walled_garden && ip_address_pool[i].user[0] && !strcmp(u, ip_address_pool[i].user))
2646 {
2647 best = i;
2648 reuse = 1;
2649 break;
2650 }
2651
2652 if (ip_address_pool[i].last < best_time)
2653 {
2654 best = i;
2655 if (!(best_time = ip_address_pool[i].last))
2656 break; // never used, grab this one
2657 }
2658 }
2659
2660 if (best < 0)
2661 {
2662 log(0, 0, s, session[s].tunnel, "assign_ip_address(): out of addresses\n");
2663 return 0;
2664 }
2665
2666 session[s].ip = ip_address_pool[best].address;
2667 session[s].ip_pool_index = best;
2668 ip_address_pool[best].assigned = 1;
2669 ip_address_pool[best].last = time_now;
2670 ip_address_pool[best].session = s;
2671 if (session[s].walled_garden)
2672 /* Don't track addresses of users in walled garden (note: this
2673 means that their address isn't "sticky" even if they get
2674 un-gardened). */
2675 ip_address_pool[best].user[0] = 0;
2676 else
2677 strncpy(ip_address_pool[best].user, u, sizeof(ip_address_pool[best].user) - 1);
2678
2679 STAT(ip_allocated);
2680 log(4, ip_address_pool[best].address, s, session[s].tunnel,
2681 "assign_ip_address(): %s ip address %d from pool\n", reuse ? "Reusing" : "Allocating", best);
2682
2683 return 1;
2684 }
2685
2686 void free_ip_address(sessionidt s)
2687 {
2688 int i = session[s].ip_pool_index;
2689
2690 if (!session[s].ip)
2691 return; // what the?
2692
2693 if (i < 0) // Is this actually part of the ip pool?
2694 i = 0;
2695
2696 STAT(ip_freed);
2697 cache_ipmap(session[s].ip, -i); // Change the mapping to point back to the ip pool index.
2698 session[s].ip = 0;
2699 ip_address_pool[i].assigned = 0;
2700 ip_address_pool[i].session = 0;
2701 ip_address_pool[i].last = time_now;
2702
2703
2704 CSTAT(call_free_ip_address);
2705
2706 }
2707
2708 //
2709 // Fsck the address pool against the session table.
2710 // Normally only called when we become a master.
2711 //
2712 // This isn't perfect: We aren't keep tracking of which
2713 // users used to have an IP address.
2714 //
2715 void rebuild_address_pool(void)
2716 {
2717 int i;
2718
2719 //
2720 // Zero the IP pool allocation, and build
2721 // a map from IP address to pool index.
2722 for (i = 1; i < MAXIPPOOL; ++i)
2723 {
2724 ip_address_pool[i].assigned = 0;
2725 ip_address_pool[i].session = 0;
2726 if (!ip_address_pool[i].address)
2727 continue;
2728
2729 cache_ipmap(ip_address_pool[i].address, -i); // Map pool IP to pool index.
2730 }
2731
2732 for (i = 0; i < MAXSESSION; ++i)
2733 {
2734 int ipid;
2735 if (!session[i].ip || !session[i].tunnel)
2736 continue;
2737 ipid = - lookup_ipmap(htonl(session[i].ip));
2738
2739 if (session[i].ip_pool_index < 0)
2740 {
2741 // Not allocated out of the pool.
2742 if (ipid < 1) // Not found in the pool either? good.
2743 continue;
2744
2745 log(0, 0, i, 0, "Session %d has an IP address (%s) that was marked static, but is in the pool (%d)!\n",
2746 i, inet_toa(session[i].ip), ipid);
2747
2748 // Fall through and process it as part of the pool.
2749 }
2750
2751
2752 if (ipid > MAXIPPOOL || ipid < 0)
2753 {
2754 log(0, 0, i, 0, "Session %d has a pool IP that's not found in the pool! (%d)\n", i, ipid);
2755 ipid = -1;
2756 session[i].ip_pool_index = ipid;
2757 continue;
2758 }
2759
2760 ip_address_pool[ipid].assigned = 1;
2761 ip_address_pool[ipid].session = i;
2762 ip_address_pool[ipid].last = time_now;
2763 strncpy(ip_address_pool[ipid].user, session[i].user, sizeof(ip_address_pool[ipid].user) - 1);
2764 session[i].ip_pool_index = ipid;
2765 cache_ipmap(session[i].ip, i); // Fix the ip map.
2766 }
2767 }
2768
2769 //
2770 // Fix the address pool to match a changed session.
2771 // (usually when the master sends us an update).
2772 void fix_address_pool(int sid)
2773 {
2774 int ipid;
2775
2776 ipid = session[sid].ip_pool_index;
2777
2778 if (ipid > ip_pool_size)
2779 return; // Ignore it. rebuild_address_pool will fix it up.
2780
2781 if (ip_address_pool[ipid].address != session[sid].ip)
2782 return; // Just ignore it. rebuild_address_pool will take care of it.
2783
2784 ip_address_pool[ipid].assigned = 1;
2785 ip_address_pool[ipid].session = sid;
2786 ip_address_pool[ipid].last = time_now;
2787 strncpy(ip_address_pool[ipid].user, session[sid].user, sizeof(ip_address_pool[ipid].user) - 1);
2788 }
2789
2790 //
2791 // Add a block of addresses to the IP pool to hand out.
2792 //
2793 void add_to_ip_pool(u32 addr, u32 mask)
2794 {
2795 int i;
2796 if (mask == 0)
2797 mask = 0xffffffff; // Host route only.
2798
2799 addr &= mask;
2800
2801 if (ip_pool_size >= MAXIPPOOL) // Pool is full!
2802 return ;
2803
2804 for (i = addr ;(i & mask) == addr; ++i)
2805 {
2806 if ((i & 0xff) == 0 || (i&0xff) == 255)
2807 continue; // Skip 0 and broadcast addresses.
2808
2809 ip_address_pool[ip_pool_size].address = i;
2810 ip_address_pool[ip_pool_size].assigned = 0;
2811 ++ip_pool_size;
2812 if (ip_pool_size >= MAXIPPOOL)
2813 {
2814 log(0,0,0,0, "Overflowed IP pool adding %s\n", inet_toa(htonl(addr)) );
2815 return;
2816 }
2817 }
2818 }
2819
2820 // Initialize the IP address pool
2821 void initippool()
2822 {
2823 FILE *f;
2824 char *p;
2825 char buf[4096];
2826 memset(ip_address_pool, 0, sizeof(ip_address_pool));
2827
2828 if (!(f = fopen(IPPOOLFILE, "r")))
2829 {
2830 log(0, 0, 0, 0, "Can't load pool file " IPPOOLFILE ": %s\n", strerror(errno));
2831 exit(1);
2832 }
2833
2834 while (ip_pool_size < MAXIPPOOL && fgets(buf, 4096, f))
2835 {
2836 char *pool = buf;
2837 buf[4095] = 0; // Force it to be zero terminated/
2838
2839 if (*buf == '#' || *buf == '\n')
2840 continue; // Skip comments / blank lines
2841 if ((p = (char *)strrchr(buf, '\n'))) *p = 0;
2842 if ((p = (char *)strchr(buf, ':')))
2843 {
2844 ipt src;
2845 *p = '\0';
2846 src = inet_addr(buf);
2847 if (src == INADDR_NONE)
2848 {
2849 log(0, 0, 0, 0, "Invalid address pool IP %s\n", buf);
2850 exit(1);
2851 }
2852 // This entry is for a specific IP only
2853 if (src != config->bind_address)
2854 continue;
2855 *p = ':';
2856 pool = p+1;
2857 }
2858 if ((p = (char *)strchr(pool, '/')))
2859 {
2860 // It's a range
2861 int numbits = 0;
2862 u32 start = 0, mask = 0;
2863
2864 log(2, 0, 0, 0, "Adding IP address range %s\n", buf);
2865 *p++ = 0;
2866 if (!*p || !(numbits = atoi(p)))
2867 {
2868 log(0, 0, 0, 0, "Invalid pool range %s\n", buf);
2869 continue;
2870 }
2871 start = ntohl(inet_addr(pool));
2872 mask = (u32)(pow(2, numbits) - 1) << (32 - numbits);
2873
2874 // Add a static route for this pool
2875 log(5, 0, 0, 0, "Adding route for address pool %s/%u\n", inet_toa(htonl(start)), 32 + mask);
2876 routeset(0, start, mask, 0, 1);
2877
2878 add_to_ip_pool(start, mask);
2879 }
2880 else
2881 {
2882 // It's a single ip address
2883 add_to_ip_pool(inet_addr(pool), 0);
2884 }
2885 }
2886 fclose(f);
2887 log(1, 0, 0, 0, "IP address pool is %d addresses\n", ip_pool_size - 1);
2888 }
2889
2890 void snoop_send_packet(char *packet, u16 size, ipt destination, u16 port)
2891 {
2892 struct sockaddr_in snoop_addr = {0};
2893 if (!destination || !port || snoopfd <= 0 || size <= 0 || !packet)
2894 return;
2895
2896 snoop_addr.sin_family = AF_INET;
2897 snoop_addr.sin_addr.s_addr = destination;
2898 snoop_addr.sin_port = ntohs(port);
2899
2900 log(5, 0, 0, 0, "Snooping packet at %p (%d bytes) to %s:%d\n",
2901 packet, size, inet_toa(snoop_addr.sin_addr.s_addr), htons(snoop_addr.sin_port));
2902 if (sendto(snoopfd, packet, size, MSG_DONTWAIT | MSG_NOSIGNAL, (void *) &snoop_addr, sizeof(snoop_addr)) < 0)
2903 log(0, 0, 0, 0, "Error sending intercept packet: %s\n", strerror(errno));
2904 STAT(packets_snooped);
2905 }
2906
2907 void dump_acct_info()
2908 {
2909 char filename[1024];
2910 char timestr[64];
2911 time_t t = time(NULL);
2912 int i;
2913 FILE *f = NULL;
2914
2915
2916 CSTAT(call_dump_acct_info);
2917
2918 strftime(timestr, 64, "%Y%m%d%H%M%S", localtime(&t));
2919 snprintf(filename, 1024, "%s/%s", config->accounting_dir, timestr);
2920
2921 for (i = 0; i < MAXSESSION; i++)
2922 {
2923 if (!session[i].opened || !session[i].ip || !(session[i].cin || session[i].cout) || !*session[i].user || session[i].walled_garden)
2924 continue;
2925 if (!f)
2926 {
2927 time_t now = time(NULL);
2928 if (!(f = fopen(filename, "w")))
2929 {
2930 log(0, 0, 0, 0, "Can't write accounting info to %s: %s\n", filename, strerror(errno));
2931 return ;
2932 }
2933 log(3, 0, 0, 0, "Dumping accounting information to %s\n", filename);
2934 fprintf(f, "# dslwatch.pl dump file V1.01\n"
2935 "# host: %s\n"
2936 "# time: %ld\n"
2937 "# uptime: %ld\n"
2938 "# format: username ip qos uptxoctets downrxoctets\n",
2939 hostname,
2940 now,
2941 now - basetime);
2942 }
2943
2944 log(4, 0, 0, 0, "Dumping accounting information for %s\n", session[i].user);
2945 fprintf(f, "%s %s %d %u %u\n",
2946 session[i].user, // username
2947 inet_toa(htonl(session[i].ip)), // ip
2948 (session[i].throttle_in || session[i].throttle_out) ? 2 : 1, // qos
2949 (u32)session[i].cin, // uptxoctets
2950 (u32)session[i].cout); // downrxoctets
2951
2952 session[i].pin = session[i].cin = 0;
2953 session[i].pout = session[i].cout = 0;
2954 }
2955
2956 if (f)
2957 fclose(f);
2958 }
2959
2960 // Main program
2961 int main(int argc, char *argv[])
2962 {
2963 int o;
2964 int optdebug = 0;
2965 char *optconfig = CONFIGFILE;
2966
2967 _program_name = strdup(argv[0]);
2968
2969 time(&basetime); // start clock
2970
2971 // scan args
2972 while ((o = getopt(argc, argv, "dvc:h:")) >= 0)
2973 {
2974 switch (o)
2975 {
2976 case 'd':
2977 // Double fork to detach from terminal
2978 if (fork()) exit(0);
2979 if (fork()) exit(0);
2980 break;
2981 case 'v':
2982 optdebug++;
2983 break;
2984 case 'c':
2985 optconfig = optarg;
2986 break;
2987 case 'h':
2988 snprintf(hostname, sizeof(hostname), "%s", optarg);
2989 break;
2990 default:
2991 printf("Args are:\n"
2992 "\t-d\tDetach from terminal\n"
2993 "\t-c <file>\tConfig file\n"
2994 "\t-h <hostname>\tForce hostname\n"
2995 "\t-a <address>\tUse specific address\n"
2996 "\t-v\t\tDebug\n");
2997
2998 return (0);
2999 break;
3000 }
3001 }
3002
3003 // Start the timer routine off
3004 time(&time_now);
3005 strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now));
3006 signal(SIGALRM, sigalrm_handler);
3007 siginterrupt(SIGALRM, 0);
3008
3009 initiptables();
3010 initplugins();
3011 initdata(optdebug, optconfig);
3012
3013 init_cli(hostname);
3014 read_config_file();
3015 init_tbf(config->num_tbfs);
3016
3017 log(0, 0, 0, 0, "L2TPNS version " VERSION "\n");
3018 log(0, 0, 0, 0, "Copyright (c) 2003, 2004 Optus Internet Engineering\n");
3019 log(0, 0, 0, 0, "Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n");
3020 {
3021 struct rlimit rlim;
3022 rlim.rlim_cur = RLIM_INFINITY;
3023 rlim.rlim_max = RLIM_INFINITY;
3024 // Remove the maximum core size
3025 if (setrlimit(RLIMIT_CORE, &rlim) < 0)
3026 log(0, 0, 0, 0, "Can't set ulimit: %s\n", strerror(errno));
3027 // Make core dumps go to /tmp
3028 chdir("/tmp");
3029 }
3030
3031 if (config->scheduler_fifo)
3032 {
3033 int ret;
3034 struct sched_param params = {0};
3035 params.sched_priority = 1;
3036
3037 if (get_nprocs() < 2)
3038 {
3039 log(0, 0, 0, 0, "Not using FIFO scheduler, there is only 1 processor in the system.\n");
3040 config->scheduler_fifo = 0;
3041 }
3042 else
3043 {
3044 if ((ret = sched_setscheduler(0, SCHED_FIFO, &params)) == 0)
3045 {
3046 log(1, 0, 0, 0, "Using FIFO scheduler. Say goodbye to any other processes running\n");
3047 }
3048 else
3049 {
3050 log(0, 0, 0, 0, "Error setting scheduler to FIFO: %s\n", strerror(errno));
3051 config->scheduler_fifo = 0;
3052 }
3053 }
3054 }
3055
3056 /* Set up the cluster communications port. */
3057 if (cluster_init(config->bind_address) < 0)
3058 exit(1);
3059
3060 #ifdef BGP
3061 signal(SIGPIPE, SIG_IGN);
3062 bgp_setup(config->as_number);
3063 bgp_add_route(config->bind_address, 0xffffffff);
3064 if (*config->bgp_peer[0])
3065 bgp_start(&bgp_peers[0], config->bgp_peer[0],
3066 config->bgp_peer_as[0], 0); /* 0 = routing disabled */
3067
3068 if (*config->bgp_peer[1])
3069 bgp_start(&bgp_peers[1], config->bgp_peer[1],
3070 config->bgp_peer_as[1], 0);
3071 #endif /* BGP */
3072
3073 inittun();
3074 log(1, 0, 0, 0, "Set up on interface %s\n", config->tundevice);
3075
3076 initudp();
3077 initrad();
3078 initippool();
3079
3080 read_state();
3081
3082 signal(SIGHUP, sighup_handler);
3083 signal(SIGTERM, sigterm_handler);
3084 signal(SIGINT, sigterm_handler);
3085 signal(SIGQUIT, sigquit_handler);
3086 signal(SIGCHLD, sigchild_handler);
3087
3088 // Prevent us from getting paged out
3089 if (config->lock_pages)
3090 {
3091 if (!mlockall(MCL_CURRENT))
3092 log(1, 0, 0, 0, "Locking pages into memory\n");
3093 else
3094 log(0, 0, 0, 0, "Can't lock pages: %s\n", strerror(errno));
3095 }
3096
3097 alarm(1);
3098
3099 // Drop privileges here
3100 if (config->target_uid > 0 && geteuid() == 0)
3101 setuid(config->target_uid);
3102
3103 mainloop();
3104
3105 #ifdef BGP
3106 /* try to shut BGP down cleanly; with luck the sockets will be
3107 writable since we're out of the select */
3108 {
3109 int i;
3110 for (i = 0; i < BGP_NUM_PEERS; i++)
3111 if (bgp_peers[i].state == Established)
3112 bgp_stop(&bgp_peers[i]);
3113 }
3114 #endif /* BGP */
3115
3116 /* remove plugins (so cleanup code gets run) */
3117 plugins_done();
3118
3119 // Remove the PID file if we wrote it
3120 if (config->wrote_pid && *config->pid_file == '/')
3121 unlink(config->pid_file);
3122
3123 /* kill CLI children */
3124 signal(SIGTERM, SIG_IGN);
3125 kill(0, SIGTERM);
3126 return 0;
3127 }
3128
3129 void sighup_handler(int junk)
3130 {
3131 if (log_stream && log_stream != stderr)
3132 {
3133 fclose(log_stream);
3134 log_stream = NULL;
3135 }
3136
3137 read_config_file();
3138 }
3139
3140 void sigalrm_handler(int junk)
3141 {
3142 // Log current traffic stats
3143
3144 snprintf(config->bandwidth, sizeof(config->bandwidth),
3145 "UDP-ETH:%1.0f/%1.0f ETH-UDP:%1.0f/%1.0f TOTAL:%0.1f IN:%u OUT:%u",
3146 (udp_rx / 1024.0 / 1024.0 * 8),
3147 (eth_tx / 1024.0 / 1024.0 * 8),
3148 (eth_rx / 1024.0 / 1024.0 * 8),
3149 (udp_tx / 1024.0 / 1024.0 * 8),
3150 ((udp_tx + udp_rx + eth_tx + eth_rx) / 1024.0 / 1024.0 * 8),
3151 udp_rx_pkt, eth_rx_pkt);
3152
3153 udp_tx = udp_rx = 0;
3154 udp_rx_pkt = eth_rx_pkt = 0;
3155 eth_tx = eth_rx = 0;
3156
3157 if (config->dump_speed)
3158 printf("%s\n", config->bandwidth);
3159
3160 // Update the internal time counter
3161 time(&time_now);
3162 strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now));
3163 alarm(1);
3164
3165 {
3166 // Run timer hooks
3167 struct param_timer p = { time_now };
3168 run_plugins(PLUGIN_TIMER, &p);
3169 }
3170
3171 }
3172
3173 void sigterm_handler(int junk)
3174 {
3175 log(1, 0, 0, 0, "Shutting down cleanly\n");
3176 if (config->save_state)
3177 dump_state();
3178
3179 main_quit++;
3180 }
3181
3182 void sigquit_handler(int junk)
3183 {
3184 int i;
3185
3186 log(1, 0, 0, 0, "Shutting down without saving sessions\n");
3187 for (i = 1; i < MAXSESSION; i++)
3188 {
3189 if (session[i].opened)
3190 sessionkill(i, "L2TPNS Closing");
3191 }
3192 for (i = 1; i < MAXTUNNEL; i++)
3193 {
3194 if (tunnel[i].ip || tunnel[i].state)
3195 tunnelshutdown(i, "L2TPNS Closing");
3196 }
3197
3198 main_quit++;
3199 }
3200
3201 void sigchild_handler(int signal)
3202 {
3203 while (waitpid(-1, NULL, WNOHANG) > 0)
3204 ;
3205 }
3206
3207 void read_state()
3208 {
3209 struct stat sb;
3210 int i;
3211 ippoolt itmp;
3212 FILE *f;
3213 char magic[sizeof(DUMP_MAGIC) - 1];
3214 u32 buf[2];
3215
3216 if (!config->save_state)
3217 {
3218 unlink(STATEFILE);
3219 return ;
3220 }
3221
3222 if (stat(STATEFILE, &sb) < 0)
3223 {
3224 unlink(STATEFILE);
3225 return ;
3226 }
3227
3228 if (sb.st_mtime < (time(NULL) - 60))
3229 {
3230 log(0, 0, 0, 0, "State file is too old to read, ignoring\n");
3231 unlink(STATEFILE);
3232 return ;
3233 }
3234
3235 f = fopen(STATEFILE, "r");
3236 unlink(STATEFILE);
3237
3238 if (!f)
3239 {
3240 log(0, 0, 0, 0, "Can't read state file: %s\n", strerror(errno));
3241 exit(1);
3242 }
3243
3244 if (fread(magic, sizeof(magic), 1, f) != 1 || strncmp(magic, DUMP_MAGIC, sizeof(magic)))
3245 {
3246 log(0, 0, 0, 0, "Bad state file magic\n");
3247 exit(1);
3248 }
3249
3250 log(1, 0, 0, 0, "Reading state information\n");
3251 if (fread(buf, sizeof(buf), 1, f) != 1 || buf[0] > MAXIPPOOL || buf[1] != sizeof(ippoolt))
3252 {
3253 log(0, 0, 0, 0, "Error/mismatch reading ip pool header from state file\n");
3254 exit(1);
3255 }
3256
3257 if (buf[0] > ip_pool_size)
3258 {
3259 log(0, 0, 0, 0, "ip pool has shrunk! state = %d, current = %d\n", buf[0], ip_pool_size);
3260 exit(1);
3261 }
3262
3263 log(2, 0, 0, 0, "Loading %u ip addresses\n", buf[0]);
3264 for (i = 0; i < buf[0]; i++)
3265 {
3266 if (fread(&itmp, sizeof(itmp), 1, f) != 1)
3267 {
3268 log(0, 0, 0, 0, "Error reading ip %d from state file: %s\n", i, strerror(errno));
3269 exit(1);
3270 }
3271
3272 if (itmp.address != ip_address_pool[i].address)
3273 {
3274 log(0, 0, 0, 0, "Mismatched ip %d from state file: pool may only be extended\n", i);
3275 exit(1);
3276 }
3277
3278 memcpy(&ip_address_pool[i], &itmp, sizeof(itmp));
3279 }
3280
3281 if (fread(buf, sizeof(buf), 1, f) != 1 || buf[0] != MAXTUNNEL || buf[1] != sizeof(tunnelt))
3282 {
3283 log(0, 0, 0, 0, "Error/mismatch reading tunnel header from state file\n");
3284 exit(1);
3285 }
3286
3287 log(2, 0, 0, 0, "Loading %u tunnels\n", MAXTUNNEL);
3288 if (fread(tunnel, sizeof(tunnelt), MAXTUNNEL, f) != MAXTUNNEL)
3289 {
3290 log(0, 0, 0, 0, "Error reading tunnel data from state file\n");
3291 exit(1);
3292 }
3293
3294 for (i = 0; i < MAXTUNNEL; i++)
3295 {
3296 tunnel[i].controlc = 0;
3297 tunnel[i].controls = NULL;
3298 tunnel[i].controle = NULL;
3299 if (*tunnel[i].hostname)
3300 log(3, 0, 0, 0, "Created tunnel for %s\n", tunnel[i].hostname);
3301 }
3302
3303 if (fread(buf, sizeof(buf), 1, f) != 1 || buf[0] != MAXSESSION || buf[1] != sizeof(sessiont))
3304 {
3305 log(0, 0, 0, 0, "Error/mismatch reading session header from state file\n");
3306 exit(1);
3307 }
3308
3309 log(2, 0, 0, 0, "Loading %u sessions\n", MAXSESSION);
3310 if (fread(session, sizeof(sessiont), MAXSESSION, f) != MAXSESSION)
3311 {
3312 log(0, 0, 0, 0, "Error reading session data from state file\n");
3313 exit(1);
3314 }
3315
3316 for (i = 0; i < MAXSESSION; i++)
3317 {
3318 session[i].tbf_in = 0;
3319 session[i].tbf_out = 0;
3320 if (session[i].opened)
3321 {
3322 log(2, 0, i, 0, "Loaded active session for user %s\n", session[i].user);
3323 if (session[i].ip)
3324 sessionsetup(session[i].tunnel, i);
3325 }
3326 }
3327
3328 fclose(f);
3329 log(0, 0, 0, 0, "Loaded saved state information\n");
3330 }
3331
3332 void dump_state()
3333 {
3334 FILE *f;
3335 u32 buf[2];
3336
3337 if (!config->save_state)
3338 return;
3339
3340 do
3341 {
3342 if (!(f = fopen(STATEFILE, "w")))
3343 break;
3344
3345 log(1, 0, 0, 0, "Dumping state information\n");
3346
3347 if (fwrite(DUMP_MAGIC, sizeof(DUMP_MAGIC) - 1, 1, f) != 1)
3348 break;
3349
3350 log(2, 0, 0, 0, "Dumping %u ip addresses\n", ip_pool_size);
3351 buf[0] = ip_pool_size;
3352 buf[1] = sizeof(ippoolt);
3353 if (fwrite(buf, sizeof(buf), 1, f) != 1)
3354 break;
3355 if (fwrite(ip_address_pool, sizeof(ippoolt), ip_pool_size, f) != ip_pool_size)
3356 break;
3357
3358 log(2, 0, 0, 0, "Dumping %u tunnels\n", MAXTUNNEL);
3359 buf[0] = MAXTUNNEL;
3360 buf[1] = sizeof(tunnelt);
3361 if (fwrite(buf, sizeof(buf), 1, f) != 1)
3362 break;
3363 if (fwrite(tunnel, sizeof(tunnelt), MAXTUNNEL, f) != MAXTUNNEL)
3364 break;
3365
3366 log(2, 0, 0, 0, "Dumping %u sessions\n", MAXSESSION);
3367 buf[0] = MAXSESSION;
3368 buf[1] = sizeof(sessiont);
3369 if (fwrite(buf, sizeof(buf), 1, f) != 1)
3370 break;
3371 if (fwrite(session, sizeof(sessiont), MAXSESSION, f) != MAXSESSION)
3372 break;
3373
3374 if (fclose(f) == 0)
3375 return ; // OK
3376 }
3377 while (0);
3378
3379 log(0, 0, 0, 0, "Can't write state information: %s\n", strerror(errno));
3380 unlink(STATEFILE);
3381 }
3382
3383 void build_chap_response(char *challenge, u8 id, u16 challenge_length, char **challenge_response)
3384 {
3385 MD5_CTX ctx;
3386 *challenge_response = NULL;
3387
3388 if (!*config->l2tpsecret)
3389 {
3390 log(0, 0, 0, 0, "LNS requested CHAP authentication, but no l2tp secret is defined\n");
3391 return;
3392 }
3393
3394 log(4, 0, 0, 0, " Building challenge response for CHAP request\n");
3395
3396 *challenge_response = (char *)calloc(17, 1);
3397
3398 MD5Init(&ctx);
3399 MD5Update(&ctx, &id, 1);
3400 MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
3401 MD5Update(&ctx, challenge, challenge_length);
3402 MD5Final(*challenge_response, &ctx);
3403
3404 return;
3405 }
3406
3407 static int facility_value(char *name)
3408 {
3409 int i;
3410 for (i = 0; facilitynames[i].c_name; i++)
3411 {
3412 if (strcmp(facilitynames[i].c_name, name) == 0)
3413 return facilitynames[i].c_val;
3414 }
3415 return 0;
3416 }
3417
3418 void update_config()
3419 {
3420 int i;
3421 static int timeout = 0;
3422 static int interval = 0;
3423
3424 // Update logging
3425 closelog();
3426 syslog_log = 0;
3427 if (log_stream)
3428 {
3429 fclose(log_stream);
3430 log_stream = NULL;
3431 }
3432 if (*config->log_filename)
3433 {
3434 if (strstr(config->log_filename, "syslog:") == config->log_filename)
3435 {
3436 char *p = config->log_filename + 7;
3437 if (*p)
3438 {
3439 openlog("l2tpns", LOG_PID, facility_value(p));
3440 syslog_log = 1;
3441 }
3442 }
3443 else if (strchr(config->log_filename, '/') == config->log_filename)
3444 {
3445 if ((log_stream = fopen((char *)(config->log_filename), "a")))
3446 {
3447 fseek(log_stream, 0, SEEK_END);
3448 setbuf(log_stream, NULL);
3449 }
3450 else
3451 {
3452 log_stream = stderr;
3453 setbuf(log_stream, NULL);
3454 }
3455 }
3456 }
3457 else
3458 {
3459 log_stream = stderr;
3460 setbuf(log_stream, NULL);
3461 }
3462
3463
3464 // Update radius
3465 config->numradiusservers = 0;
3466 for (i = 0; i < MAXRADSERVER; i++)
3467 if (config->radiusserver[i])
3468 {
3469 config->numradiusservers++;
3470 // Set radius port: if not set, take the port from the
3471 // first radius server. For the first radius server,
3472 // take the #defined default value from l2tpns.h
3473
3474 // test twice, In case someone works with
3475 // a secondary radius server without defining
3476 // a primary one, this will work even then.
3477 if (i>0 && !config->radiusport[i])
3478 config->radiusport[i] = config->radiusport[i-1];
3479 if (!config->radiusport[i])
3480 config->radiusport[i] = RADPORT;
3481 }
3482
3483 if (!config->numradiusservers)
3484 {
3485 log(0, 0, 0, 0, "No RADIUS servers defined!\n");
3486 }
3487
3488 config->num_radfds = 2 << RADIUS_SHIFT;
3489
3490 // Update plugins
3491 for (i = 0; i < MAXPLUGINS; i++)
3492 {
3493 if (strcmp(config->plugins[i], config->old_plugins[i]) == 0)
3494 continue;
3495 if (*config->plugins[i])
3496 {
3497 // Plugin added
3498 add_plugin(config->plugins[i]);
3499 }
3500 else if (*config->old_plugins[i])
3501 {
3502 // Plugin removed
3503 remove_plugin(config->old_plugins[i]);
3504 }
3505 }
3506 memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
3507 if (!config->cleanup_interval) config->cleanup_interval = 10;
3508 if (!config->multi_read_count) config->multi_read_count = 10;
3509 if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);
3510 if (!*config->cluster_interface)
3511 strncpy(config->cluster_interface, DEFAULT_MCAST_INTERFACE, sizeof(config->cluster_interface) - 1);
3512
3513 if (!config->cluster_hb_interval)
3514 config->cluster_hb_interval = PING_INTERVAL; // Heartbeat every 0.5 seconds.
3515
3516 if (!config->cluster_hb_timeout)
3517 config->cluster_hb_timeout = HB_TIMEOUT; // 10 missed heartbeat triggers an election.
3518
3519 if (interval != config->cluster_hb_interval || timeout != config->cluster_hb_timeout)
3520 {
3521 // Paranoia: cluster_check_master() treats 2 x interval + 1 sec as
3522 // late, ensure we're sufficiently larger than that
3523 int t = 4 * config->cluster_hb_interval + 11;
3524
3525 if (config->cluster_hb_timeout < t)
3526 {
3527 log(0,0,0,0, "Heartbeat timeout %d too low, adjusting to %d\n", config->cluster_hb_timeout, t);
3528 config->cluster_hb_timeout = t;
3529 }
3530
3531 // Push timing changes to the slaves immediately if we're the master
3532 if (config->cluster_iam_master)
3533 cluster_heartbeat();
3534
3535 interval = config->cluster_hb_interval;
3536 timeout = config->cluster_hb_timeout;
3537 }
3538
3539 // Write PID file
3540 if (*config->pid_file == '/' && !config->wrote_pid)
3541 {
3542 FILE *f;
3543 if ((f = fopen(config->pid_file, "w")))
3544 {
3545 fprintf(f, "%d\n", getpid());
3546 fclose(f);
3547 config->wrote_pid = 1;
3548 }
3549 else
3550 {
3551 log(0, 0, 0, 0, "Can't write to PID file %s: %s\n", config->pid_file, strerror(errno));
3552 }
3553 }
3554
3555 config->reload_config = 0;
3556 }
3557
3558 void read_config_file()
3559 {
3560 FILE *f;
3561
3562 if (!config->config_file) return;
3563 if (!(f = fopen(config->config_file, "r")))
3564 {
3565 fprintf(stderr, "Can't open config file %s: %s\n", config->config_file, strerror(errno));
3566 return;
3567 }
3568
3569 log(3, 0, 0, 0, "Reading config file %s\n", config->config_file);
3570 cli_do_file(f);
3571 log(3, 0, 0, 0, "Done reading config file\n");
3572 fclose(f);
3573 update_config();
3574 }
3575
3576 int sessionsetup(tunnelidt t, sessionidt s)
3577 {
3578 // A session now exists, set it up
3579 ipt ip;
3580 char *user;
3581 sessionidt i;
3582 int r;
3583
3584 CSTAT(call_sessionsetup);
3585
3586 log(3, session[s].ip, s, t, "Doing session setup for session\n");
3587
3588 if (!session[s].ip || session[s].ip == 0xFFFFFFFE)
3589 {
3590 assign_ip_address(s);
3591 if (session[s].ip)
3592 log(3, 0, s, t, " No IP allocated. Assigned %s from pool\n",
3593 inet_toa(htonl(session[s].ip)));
3594 else
3595 {
3596 log(0, 0, s, t, " No IP allocated. The IP address pool is FULL!\n");
3597 sessionshutdown(s, "No IP addresses available");
3598 return 0;
3599 }
3600 }
3601
3602
3603 // Make sure this is right
3604 session[s].tunnel = t;
3605
3606 // zap old sessions with same IP and/or username
3607 // Don't kill gardened sessions - doing so leads to a DoS
3608 // from someone who doesn't need to know the password
3609 {
3610 ip = session[s].ip;
3611 user = session[s].user;
3612 for (i = 1; i <= config->cluster_highest_sessionid; i++)
3613 {
3614 if (i == s) continue;
3615 if (ip == session[i].ip) sessionkill(i, "Duplicate IP address");
3616 if (!session[s].walled_garden && !session[i].walled_garden && strcasecmp(user, session[i].user) == 0)
3617 sessionkill(i, "Duplicate session for users");
3618 }
3619 }
3620
3621 // Add the route for this session.
3622 //
3623 // Static IPs need to be routed. Anything else
3624 // is part of the IP address pool and is already routed,
3625 // it just needs to be added to the IP cache.
3626 if (session[s].ip_pool_index == -1) // static ip
3627 routeset(s, session[s].ip, 0, 0, 1);
3628 else
3629 cache_ipmap(session[s].ip, s);
3630
3631 for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++)
3632 routeset(s, session[s].route[r].ip, session[s].route[r].mask, session[s].ip, 1);
3633
3634 if (!session[s].unique_id)
3635 {
3636 // did this session just finish radius?
3637 log(3, session[s].ip, s, t, "Sending initial IPCP to client\n");
3638 sendipcp(t, s);
3639 session[s].unique_id = ++last_id;
3640 }
3641
3642 // Run the plugin's against this new session.
3643 {
3644 struct param_new_session data = { &tunnel[t], &session[s] };
3645 run_plugins(PLUGIN_NEW_SESSION, &data);
3646 }
3647
3648 // Allocate TBFs if throttled
3649 if (session[s].throttle_in || session[s].throttle_out)
3650 throttle_session(s, session[s].throttle_in, session[s].throttle_out);
3651
3652 session[s].last_packet = time_now;
3653
3654 {
3655 char *sessionip, *tunnelip;
3656 sessionip = strdup(inet_toa(htonl(session[s].ip)));
3657 tunnelip = strdup(inet_toa(htonl(tunnel[t].ip)));
3658 log(2, session[s].ip, s, t, "Login by %s at %s from %s (%s)\n",
3659 session[s].user, sessionip, tunnelip, tunnel[t].hostname);
3660 if (sessionip) free(sessionip);
3661 if (tunnelip) free(tunnelip);
3662 }
3663
3664 cluster_send_session(s); // Mark it as dirty, and needing to the flooded to the cluster.
3665
3666 return 1; // RADIUS OK and IP allocated, done...
3667 }
3668
3669 //
3670 // This session just got dropped on us by the master or something.
3671 // Make sure our tables up up to date...
3672 //
3673 int load_session(sessionidt s, sessiont *new)
3674 {
3675 int i;
3676
3677 // Sanity checks.
3678 if (new->ip_pool_index >= MAXIPPOOL ||
3679 new->tunnel >= MAXTUNNEL)
3680 {
3681 log(0,0,s,0, "Strange session update received!\n");
3682 // FIXME! What to do here?
3683 return 0;
3684 }
3685
3686 //
3687 // Ok. All sanity checks passed. Now we're committed to
3688 // loading the new session.
3689 //
3690
3691 session[s].tunnel = new->tunnel; // For logging in cache_ipmap
3692
3693
3694 if (new->ip != session[s].ip) // Changed ip. fix up hash tables.
3695 {
3696 if (session[s].ip) // If there's an old one, remove it.
3697 {
3698 // Remove any routes if the IP has changed
3699 for (i = 0; i < MAXROUTE && session[s].route[i].ip; i++)
3700 {
3701 routeset(s, session[s].route[i].ip, session[s].route[i].mask, session[s].ip, 0);
3702 session[s].route[i].ip = 0;
3703 }
3704
3705 if (session[s].ip_pool_index == -1) // static IP
3706 routeset(s, session[s].ip, 0, 0, 0);
3707 else // It's part of the IP pool, remove it manually.
3708 uncache_ipmap(session[s].ip);
3709 }
3710
3711 if (new->ip)
3712 {
3713 // If there's a new one, add it.
3714 if (new->ip_pool_index == -1)
3715 routeset(s, new->ip, 0, 0, 1);
3716 else
3717 cache_ipmap(new->ip, s);
3718 }
3719 }
3720
3721 // Update routed networks
3722 for (i = 0; i < MAXROUTE && (session[s].route[i].ip || new->route[i].ip); i++)
3723 {
3724 if (new->route[i].ip == session[s].route[i].ip &&
3725 new->route[i].mask == session[s].route[i].mask)
3726 continue;
3727
3728 if (session[s].route[i].ip) // Remove the old one if it exists.
3729 routeset(s, session[s].route[i].ip, session[s].route[i].mask, session[s].ip, 0);
3730
3731 if (new->route[i].ip) // Add the new one if it exists.
3732 routeset(s, new->route[i].ip, new->route[i].mask, new->ip, 1);
3733 }
3734
3735 if (new->tunnel && s > config->cluster_highest_sessionid) // Maintain this in the slave. It's used
3736 // for walking the sessions to forward byte counts to the master.
3737 config->cluster_highest_sessionid = s;
3738
3739 // TEMP: old session struct used a u32 to define the throttle
3740 // speed for both up/down, new uses a u16 for each. Deal with
3741 // sessions from an old master for migration.
3742 if (new->throttle_out == 0 && new->tbf_out)
3743 new->throttle_out = new->throttle_in;
3744
3745 memcpy(&session[s], new, sizeof(session[s])); // Copy over..
3746
3747 // Do fixups into address pool.
3748 if (new->ip_pool_index != -1)
3749 fix_address_pool(s);
3750
3751 return 1;
3752 }
3753
3754 #ifdef RINGBUFFER
3755 void ringbuffer_dump(FILE *stream)
3756 {
3757 int i = ringbuffer->head;
3758
3759 while (i != ringbuffer->tail)
3760 {
3761 if (*ringbuffer->buffer[i].message)
3762 fprintf(stream, "%d-%s", ringbuffer->buffer[i].level, ringbuffer->buffer[i].message);
3763 if (++i == ringbuffer->tail) break;
3764 if (i == RINGBUFFER_SIZE) i = 0;
3765 }
3766 }
3767 #endif
3768
3769 void initplugins()
3770 {
3771 int i;
3772
3773 loaded_plugins = ll_init();
3774 // Initialize the plugins to nothing
3775 for (i = 0; i < MAX_PLUGIN_TYPES; i++)
3776 plugins[i] = ll_init();
3777 }
3778
3779 static void *open_plugin(char *plugin_name, int load)
3780 {
3781 char path[256] = "";
3782
3783 snprintf(path, 256, PLUGINDIR "/%s.so", plugin_name);
3784 log(2, 0, 0, 0, "%soading plugin from %s\n", load ? "L" : "Un-l", path);
3785 return dlopen(path, RTLD_NOW);
3786 }
3787
3788 void add_plugin(char *plugin_name)
3789 {
3790 static struct pluginfuncs funcs = {
3791 _log,
3792 _log_hex,
3793 inet_toa,
3794 sessionbyuser,
3795 sessiontbysessionidt,
3796 sessionidtbysessiont,
3797 sessionkill,
3798 radiusnew,
3799 radiussend,
3800 };
3801
3802 void *p = open_plugin(plugin_name, 1);
3803 int (*initfunc)(struct pluginfuncs *);
3804 int i;
3805
3806 if (!p)
3807 {
3808 log(1, 0, 0, 0, " Plugin load failed: %s\n", dlerror());
3809 return;
3810 }
3811
3812 if (ll_contains(loaded_plugins, p))
3813 {
3814 dlclose(p);
3815 return;
3816 }
3817
3818 {
3819 int *v = dlsym(p, "__plugin_api_version");
3820 if (!v || *v != PLUGIN_API_VERSION)
3821 {
3822 log(1, 0, 0, 0, " Plugin load failed: API version mismatch: %s\n", dlerror());
3823 dlclose(p);
3824 return;
3825 }
3826 }
3827
3828 if ((initfunc = dlsym(p, "plugin_init")))
3829 {
3830 if (!initfunc(&funcs))
3831 {
3832 log(1, 0, 0, 0, " Plugin load failed: plugin_init() returned FALSE: %s\n", dlerror());
3833 dlclose(p);
3834 return;
3835 }
3836 }
3837
3838 ll_push(loaded_plugins, p);
3839
3840 for (i = 0; i < max_plugin_functions; i++)
3841 {
3842 void *x;
3843 if (plugin_functions[i] && (x = dlsym(p, plugin_functions[i])))
3844 {
3845 log(3, 0, 0, 0, " Supports function \"%s\"\n", plugin_functions[i]);
3846 ll_push(plugins[i], x);
3847 }
3848 }
3849
3850 log(2, 0, 0, 0, " Loaded plugin %s\n", plugin_name);
3851 }
3852
3853 static void run_plugin_done(void *plugin)
3854 {
3855 int (*donefunc)(void) = dlsym(plugin, "plugin_done");
3856
3857 if (donefunc)
3858 donefunc();
3859 }
3860
3861 void remove_plugin(char *plugin_name)
3862 {
3863 void *p = open_plugin(plugin_name, 0);
3864 int i;
3865
3866 if (!p)
3867 return;
3868
3869 for (i = 0; i < max_plugin_functions; i++)
3870 {
3871 void *x;
3872 if (plugin_functions[i] && (x = dlsym(p, plugin_functions[i])))
3873 ll_delete(plugins[i], x);
3874 }
3875
3876 if (ll_contains(loaded_plugins, p))
3877 {
3878 ll_delete(loaded_plugins, p);
3879 run_plugin_done(p);
3880 }
3881
3882 dlclose(p);
3883 log(2, 0, 0, 0, "Removed plugin %s\n", plugin_name);
3884 }
3885
3886 int run_plugins(int plugin_type, void *data)
3887 {
3888 int (*func)(void *data);
3889 if (!plugins[plugin_type] || plugin_type > max_plugin_functions) return 1;
3890
3891 ll_reset(plugins[plugin_type]);
3892 while ((func = ll_next(plugins[plugin_type])))
3893 {
3894 int rc;
3895 rc = func(data);
3896 if (rc == PLUGIN_RET_STOP) return 1;
3897 if (rc == PLUGIN_RET_ERROR) return 0;
3898 }
3899 return 1;
3900 }
3901
3902 void plugins_done()
3903 {
3904 void *p;
3905
3906 ll_reset(loaded_plugins);
3907 while ((p = ll_next(loaded_plugins)))
3908 run_plugin_done(p);
3909 }
3910
3911 void processcontrol(u8 * buf, int len, struct sockaddr_in *addr)
3912 {
3913 char *resp;
3914 int l;
3915 struct param_control param = { buf, len, ntohl(addr->sin_addr.s_addr), ntohs(addr->sin_port), NULL, 0, 0 };
3916
3917
3918 if (log_stream && config->debug >= 4)
3919 {
3920 log(4, ntohl(addr->sin_addr.s_addr), 0, 0, "Received ");
3921 dump_packet(buf, log_stream);
3922 }
3923
3924 resp = calloc(1400, 1);
3925 l = new_packet(PKT_RESP_ERROR, resp);
3926 *(int *)(resp + 6) = *(int *)(buf + 6);
3927
3928 param.type = ntohs(*(short *)(buf + 2));
3929 param.id = ntohl(*(int *)(buf + 6));
3930 param.data_length = ntohs(*(short *)(buf + 4)) - 10;
3931 param.data = (param.data_length > 0) ? (char *)(buf + 10) : NULL;
3932 param.response = resp;
3933 param.response_length = l;
3934
3935 run_plugins(PLUGIN_CONTROL, &param);
3936
3937 if (param.send_response)
3938 {
3939 send_packet(controlfd, ntohl(addr->sin_addr.s_addr), ntohs(addr->sin_port), param.response, param.response_length);
3940 log(4, ntohl(addr->sin_addr.s_addr), 0, 0, "Sent Control packet response\n");
3941 }
3942
3943 free(resp);
3944 }
3945
3946 /*
3947 * HACK
3948 * Go through all of the tunnels and do some cleanups
3949 */
3950 void tunnel_clean()
3951 {
3952 int i;
3953
3954 log(1, 0, 0, 0, "Cleaning tunnels array\n");
3955
3956 for (i = 1; i < MAXTUNNEL; i++)
3957 {
3958 if (!tunnel[i].ip
3959 || !*tunnel[i].hostname
3960 || (tunnel[i].state == TUNNELDIE && tunnel[i].die >= time_now))
3961 {
3962 tunnelclear(i);
3963 }
3964 }
3965 }
3966
3967 void tunnelclear(tunnelidt t)
3968 {
3969 if (!t) return;
3970 memset(&tunnel[t], 0, sizeof(tunnel[t]));
3971 tunnel[t].state = TUNNELFREE;
3972 }
3973
3974 tunnelidt new_tunnel()
3975 {
3976 tunnelidt i;
3977 for (i = 1; i < MAXTUNNEL; i++)
3978 {
3979 if (tunnel[i].state == TUNNELFREE)
3980 {
3981 log(4, 0, 0, i, "Assigning tunnel ID %d\n", i);
3982 if (i > config->cluster_highest_tunnelid)
3983 config->cluster_highest_tunnelid = i;
3984 return i;
3985 }
3986 }
3987 log(0, 0, 0, 0, "Can't find a free tunnel! There shouldn't be this many in use!\n");
3988 return 0;
3989 }
3990
3991 //
3992 // We're becoming the master. Do any required setup..
3993 //
3994 // This is principally telling all the plugins that we're
3995 // now a master, and telling them about all the sessions
3996 // that are active too..
3997 //
3998 void become_master(void)
3999 {
4000 int s, i;
4001 run_plugins(PLUGIN_BECOME_MASTER, NULL);
4002
4003 // running a bunch of iptables commands is slow and can cause
4004 // the master to drop tunnels on takeover--kludge around the
4005 // problem by forking for the moment (note: race)
4006 if (!fork_and_close())
4007 {
4008 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
4009 {
4010 if (!session[s].tunnel) // Not an in-use session.
4011 continue;
4012
4013 run_plugins(PLUGIN_NEW_SESSION_MASTER, &session[s]);
4014 }
4015 exit(0);
4016 }
4017
4018 // add radius fds
4019 for (i = 0; i < config->num_radfds; i++)
4020 {
4021 if (!radfds[i]) continue;
4022 FD_SET(radfds[i], &readset);
4023 if (radfds[i] > readset_n)
4024 readset_n = radfds[i];
4025 }
4026 }
4027
4028 int cmd_show_hist_idle(struct cli_def *cli, char *command, char **argv, int argc)
4029 {
4030 int s, i;
4031 int count = 0;
4032 int buckets[64];
4033
4034 if (CLI_HELP_REQUESTED)
4035 return CLI_HELP_NO_ARGS;
4036
4037 time(&time_now);
4038 for (i = 0; i < 64;++i) buckets[i] = 0;
4039
4040 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
4041 {
4042 int idle;
4043 if (!session[s].tunnel)
4044 continue;
4045
4046 idle = time_now - session[s].last_packet;
4047 idle /= 5 ; // In multiples of 5 seconds.
4048 if (idle < 0)
4049 idle = 0;
4050 if (idle > 63)
4051 idle = 63;
4052
4053 ++count;
4054 ++buckets[idle];
4055 }
4056
4057 for (i = 0; i < 63; ++i)
4058 {
4059 cli_print(cli, "%3d seconds : %7.2f%% (%6d)", i * 5, (double) buckets[i] * 100.0 / count , buckets[i]);
4060 }
4061 cli_print(cli, "lots of secs : %7.2f%% (%6d)", (double) buckets[63] * 100.0 / count , buckets[i]);
4062 cli_print(cli, "%d total sessions open.", count);
4063 return CLI_OK;
4064 }
4065
4066 int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc)
4067 {
4068 int s, i;
4069 int count = 0;
4070 int buckets[64];
4071
4072 if (CLI_HELP_REQUESTED)
4073 return CLI_HELP_NO_ARGS;
4074
4075 time(&time_now);
4076 for (i = 0; i < 64;++i) buckets[i] = 0;
4077
4078 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
4079 {
4080 int open = 0, d;
4081 if (!session[s].tunnel)
4082 continue;
4083
4084 d = time_now - session[s].opened;
4085 if (d < 0)
4086 d = 0;
4087 while (d > 1 && open < 32)
4088 {
4089 ++open;
4090 d >>= 1; // half.
4091 }
4092 ++count;
4093 ++buckets[open];
4094 }
4095
4096 s = 1;
4097 for (i = 0; i < 30; ++i)
4098 {
4099 cli_print(cli, " < %8d seconds : %7.2f%% (%6d)", s, (double) buckets[i] * 100.0 / count , buckets[i]);
4100 s <<= 1;
4101 }
4102 cli_print(cli, "%d total sessions open.", count);
4103 return CLI_OK;
4104 }
4105
4106 /* Unhide an avp.
4107 *
4108 * This unencodes the AVP using the L2TP CHAP secret and the
4109 * previously stored random vector. It replaces the hidden data with
4110 * the cleartext data and returns the length of the cleartext data
4111 * (including the AVP "header" of 6 bytes).
4112 *
4113 * Based on code from rp-l2tpd by Roaring Penguin Software Inc.
4114 */
4115 int unhide_avp(u8 *avp, tunnelidt t, sessionidt s, u16 length)
4116 {
4117 MD5_CTX ctx;
4118 u8 *cursor;
4119 u8 digest[16];
4120 u8 working_vector[16];
4121 uint16_t hidden_length;
4122 u8 type[2];
4123 size_t done, todo;
4124 u8 *output;
4125
4126 // Find the AVP type.
4127 type[0] = *(avp + 4);
4128 type[1] = *(avp + 5);
4129
4130 // Line up with the hidden data
4131 cursor = output = avp + 6;
4132
4133 // Compute initial pad
4134 MD5Init(&ctx);
4135 MD5Update(&ctx, type, 2);
4136 MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
4137 MD5Update(&ctx, session[s].random_vector, session[s].random_vector_length);
4138 MD5Final(digest, &ctx);
4139
4140 // Get hidden length
4141 hidden_length = ((uint16_t) (digest[0] ^ cursor[0])) * 256 + (uint16_t) (digest[1] ^ cursor[1]);
4142
4143 // Keep these for later use
4144 working_vector[0] = *cursor;
4145 working_vector[1] = *(cursor + 1);
4146 cursor += 2;
4147
4148 if (hidden_length > length - 8)
4149 {
4150 log(1, 0, s, t, "Hidden length %d too long in AVP of length %d\n", (int) hidden_length, (int) length);
4151 return 0;
4152 }
4153
4154 /* Decrypt remainder */
4155 done = 2;
4156 todo = hidden_length;
4157 while (todo)
4158 {
4159 working_vector[done] = *cursor;
4160 *output = digest[done] ^ *cursor;
4161 ++output;
4162 ++cursor;
4163 --todo;
4164 ++done;
4165 if (done == 16 && todo)
4166 {
4167 // Compute new digest
4168 done = 0;
4169 MD5Init(&ctx);
4170 MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
4171 MD5Update(&ctx, &working_vector, 16);
4172 MD5Final(digest, &ctx);
4173 }
4174 }
4175
4176 return hidden_length + 6;
4177 }
4178