ppp.c

   1 // L2TPNS PPP Stuff
   2
   3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.21 2004-11-05 04:55:27 bodea Exp $";
   4
   5 #include <stdio.h>
   6 #include <string.h>
   7 #include <unistd.h>
   8 #include <errno.h>
   9 #include <stdlib.h>
  10 #include "l2tpns.h"
  11 #include "constants.h"
  12 #include "plugin.h"
  13 #include "util.h"
  14 #include "tbf.h"
  15 #include "cluster.h"
  16
  17 extern tunnelt *tunnel;
  18 extern sessiont *session;
  19 extern radiust *radius;
  20 extern int tunfd;
  21 extern char hostname[];
  22 extern u32 eth_tx;
  23 extern time_t time_now;
  24 extern struct configt *config;
  25
  26 void sendccp(tunnelidt t, sessionidt s);
  27
  28 // Process PAP messages
  29 void processpap(tunnelidt t, sessionidt s, u8 *p, u16 l)
  30 {
  31         char user[129];
  32         char pass[129];
  33         u16 hl;
  34
  35         CSTAT(call_processpap);
  36
  37         LOG_HEX(5, "PAP", p, l);
  38         if (l < 4)
  39         {
  40                 LOG(1, 0, s, t, "Short PAP %u bytes\n", l);
  41                 STAT(tunnel_rx_errors);
  42                 return ;
  43         }
  44
  45         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
  46         {
  47                 LOG(1, 0, s, t, "Length mismatch PAP %u/%u\n", hl, l);
  48                 STAT(tunnel_rx_errors);
  49                 return ;
  50         }
  51         l = hl;
  52
  53         if (*p != 1)
  54         {
  55                 LOG(1, 0, s, t, "Unexpected PAP code %d\n", *p);
  56                 STAT(tunnel_rx_errors);
  57                 return ;
  58         }
  59
  60         {
  61                 u8 *b = p;
  62                 b += 4;
  63                 if (*b && *b < sizeof(user))
  64                         memcpy(user, b + 1, *b);
  65                 user[*b] = 0;
  66                 b += 1 + *b;
  67                 if (*b && *b < sizeof(pass))
  68                         memcpy(pass, b + 1, *b);
  69                 pass[*b] = 0;
  70                 LOG(3, 0, s, t, "PAP login %s/%s\n", user, pass);
  71         }
  72         if (session[s].ip || !session[s].radius)
  73         {
  74                 // respond now, either no RADIUS available or already authenticated
  75                 u8 b[MAXCONTROL];
  76                 u8 id = p[1];
  77                 u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP);
  78                 if (!p) {       // Failed to make ppp header!
  79                         LOG(1,0,0,0, "Failed to make PPP header in process pap!\n");
  80                         return;
  81                 }
  82                 if (session[s].ip)
  83                         *p = 2;                 // ACK
  84                 else
  85                         *p = 3;                 // cant authorise
  86                 p[1] = id;
  87                 *(u16 *) (p + 2) = htons(5);    // length
  88                 p[4] = 0;                       // no message
  89                 if (session[s].ip)
  90                 {
  91                         LOG(3, session[s].ip, s, t, "Already an IP allocated: %s (%d)\n", inet_toa(htonl(session[s].ip)), session[s].ip_pool_index);
  92                         session[s].flags &= ~SF_IPCP_ACKED;
  93                 }
  94                 else
  95                 {
  96                         LOG(1, 0, s, t, "No radius session available to authenticate session...\n");
  97                 }
  98                 LOG(3, 0, s, t, "Fallback response to PAP (%s)\n", (session[s].ip) ? "ACK" : "NAK");
  99                 tunnelsend(b, 5 + (p - b), t); // send it
 100         }
 101         else
 102         {
 103                 // set up RADIUS request
 104                 u16 r = session[s].radius;
 105
 106                 // Run PRE_AUTH plugins
 107                 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
 108                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 109                 if (!packet.continue_auth)
 110                 {
 111                         LOG(3, 0, s, t, "A plugin rejected PRE_AUTH\n");
 112                         if (packet.username) free(packet.username);
 113                         if (packet.password) free(packet.password);
 114                         return;
 115                 }
 116
 117                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 118                 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
 119
 120                 free(packet.username);
 121                 free(packet.password);
 122
 123                 radius[r].id = p[1];
 124                 LOG(3, 0, s, t, "Sending login for %s/%s to radius\n", user, pass);
 125                 radiussend(r, RADIUSAUTH);
 126         }
 127 }
 128
 129 // Process CHAP messages
 130 void processchap(tunnelidt t, sessionidt s, u8 *p, u16 l)
 131 {
 132         u16 r;
 133         u16 hl;
 134
 135         CSTAT(call_processchap);
 136
 137         LOG_HEX(5, "CHAP", p, l);
 138         r = session[s].radius;
 139         if (!r)
 140         {
 141                 LOG(1, 0, s, t, "Unexpected CHAP message\n");
 142
 143 // FIXME: Need to drop the session here.
 144
 145                 STAT(tunnel_rx_errors);
 146                 return;
 147         }
 148
 149         if (l < 4)
 150         {
 151                 LOG(1, 0, s, t, "Short CHAP %u bytes\n", l);
 152                 STAT(tunnel_rx_errors);
 153                 return ;
 154         }
 155
 156         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 157         {
 158                 LOG(1, 0, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
 159                 STAT(tunnel_rx_errors);
 160                 return ;
 161         }
 162         l = hl;
 163
 164         if (*p != 2)
 165         {
 166                 LOG(1, 0, s, t, "Unexpected CHAP response code %d\n", *p);
 167                 STAT(tunnel_rx_errors);
 168                 return;
 169         }
 170         if (p[1] != radius[r].id)
 171         {
 172                 LOG(1, 0, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
 173                 STAT(tunnel_rx_errors);
 174                 return ;
 175         }
 176
 177         if (l < 5 || p[4] != 16)
 178         {
 179                 LOG(1, 0, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
 180                 STAT(tunnel_rx_errors);
 181                 return ;
 182         }
 183
 184         l -= 5;
 185         p += 5;
 186         if (l < 16 || l - 16 >= sizeof(session[s].user))
 187         {
 188                 LOG(1, 0, s, t, "CHAP user too long %d\n", l - 16);
 189                 STAT(tunnel_rx_errors);
 190                 return ;
 191         }
 192
 193         // Run PRE_AUTH plugins
 194         {
 195                 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
 196
 197                 packet.password = calloc(17, 1);
 198                 memcpy(packet.password, p, 16);
 199
 200                 p += 16;
 201                 l -= 16;
 202
 203                 packet.username = calloc(l + 1, 1);
 204                 memcpy(packet.username, p, l);
 205
 206                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 207                 if (!packet.continue_auth)
 208                 {
 209                         LOG(3, 0, s, t, "A plugin rejected PRE_AUTH\n");
 210                         if (packet.username) free(packet.username);
 211                         if (packet.password) free(packet.password);
 212                         return;
 213                 }
 214
 215                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 216                 memcpy(radius[r].pass, packet.password, 16);
 217
 218                 free(packet.username);
 219                 free(packet.password);
 220         }
 221
 222         radius[r].chap = 1;
 223         LOG(3, 0, s, t, "CHAP login %s\n", session[s].user);
 224         radiussend(r, RADIUSAUTH);
 225 }
 226
 227 char *ppp_lcp_types[] = {
 228         NULL,
 229         "ConfigReq",
 230         "ConfigAck",
 231         "ConfigNak",
 232         "ConfigRej",
 233         "TerminateReq",
 234         "TerminateAck",
 235         "CodeRej",
 236         "ProtocolRej",
 237         "EchoReq",
 238         "EchoReply",
 239         "DiscardRequest",
 240         "IdentRequest",
 241 };
 242
 243 void dumplcp(u8 *p, int l)
 244 {
 245         int x = l - 4;
 246         u8 *o = (p + 4);
 247
 248         LOG_HEX(5, "PPP LCP Packet", p, l);
 249         LOG(4, 0, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_lcp_types[(int)*p], ntohs( ((u16 *) p)[1]) );
 250         LOG(4, 0, 0, 0, "Length: %d\n", l);
 251         if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
 252                 return;
 253
 254         while (x > 2)
 255         {
 256                 int type = o[0];
 257                 int length = o[1];
 258                 if (length < 2)
 259                 {
 260                         LOG(4, 0, 0, 0, "       Option length is %d...\n", length);
 261                         break;
 262                 }
 263                 if (type == 0)
 264                 {
 265                         LOG(4, 0, 0, 0, "       Option type is 0...\n");
 266                         x -= length;
 267                         o += length;
 268                         continue;
 269                 }
 270                 switch (type)
 271                 {
 272                         case 1: // Maximum-Receive-Unit
 273                                 if (length == 4)
 274                                         LOG(4, 0, 0, 0, "    %s %d\n", lcp_types[type], ntohs(*(u16 *)(o + 2)));
 275                                 else
 276                                         LOG(4, 0, 0, 0, "    %s odd length %d\n", lcp_types[type], length);
 277                                 break;
 278                         case 3: // Authentication-Protocol
 279                                 {
 280                                         if (length == 4)
 281                                         {
 282                                                 int proto = ntohs(*(u16 *)(o + 2));
 283                                                 LOG(4, 0, 0, 0, "   %s 0x%x (%s)\n", lcp_types[type], proto,
 284                                                         proto == PPPCHAP ? "CHAP" :
 285                                                         proto == PPPPAP  ? "PAP"  : "UNKNOWN");
 286                                         }
 287                                         else
 288                                                 LOG(4, 0, 0, 0, "   %s odd length %d\n", lcp_types[type], length);
 289                                         break;
 290                                 }
 291                         case 4: // Quality-Protocol
 292                                 {
 293                                         u32 qp = ntohl(*(u32 *)(o + 2));
 294                                         LOG(4, 0, 0, 0, "    %s %x\n", lcp_types[type], qp);
 295                                         break;
 296                                 }
 297                         case 5: // Magic-Number
 298                                 {
 299                                         if (length == 6)
 300                                         {
 301                                                 u32 magicno = ntohl(*(u32 *)(o + 2));
 302                                                 LOG(4, 0, 0, 0, "    %s %x\n", lcp_types[type], magicno);
 303                                         }
 304                                         else
 305                                                 LOG(4, 0, 0, 0, "   %s odd length %d\n", lcp_types[type], length);
 306                                         break;
 307                                 }
 308                         case 7: // Protocol-Field-Compression
 309                                 {
 310                                         LOG(4, 0, 0, 0, "    %s\n", lcp_types[type]);
 311                                         break;
 312                                 }
 313                         case 8: // Address-And-Control-Field-Compression
 314                                 {
 315                                         LOG(4, 0, 0, 0, "    %s\n", lcp_types[type]);
 316                                         break;
 317                                 }
 318                         default:
 319                                 LOG(2, 0, 0, 0, "    Unknown PPP LCP Option type %d\n", type);
 320                                 break;
 321                 }
 322                 x -= length;
 323                 o += length;
 324         }
 325 }
 326
 327 // Process LCP messages
 328 void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 329 {
 330         u8 b[MAXCONTROL];
 331         u8 *q = NULL;
 332         u32 magicno = 0;
 333         u16 hl;
 334
 335         CSTAT(call_processlcp);
 336
 337         LOG_HEX(5, "LCP", p, l);
 338         if (l < 4)
 339         {
 340                 LOG(1, session[s].ip, s, t, "Short LCP %d bytes\n", l);
 341                 STAT(tunnel_rx_errors);
 342                 return ;
 343         }
 344
 345         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 346         {
 347                 LOG(1, 0, s, t, "Length mismatch LCP %u/%u\n", hl, l);
 348                 STAT(tunnel_rx_errors);
 349                 return ;
 350         }
 351         l = hl;
 352
 353         if (*p == ConfigAck)
 354         {
 355                 LOG(3, session[s].ip, s, t, "LCP: Discarding ConfigAck\n");
 356                 session[s].flags |= SF_LCP_ACKED;
 357         }
 358         else if (*p == ConfigReq)
 359         {
 360                 int x = l - 4;
 361                 u8 *o = (p + 4);
 362
 363                 LOG(3, session[s].ip, s, t, "LCP: ConfigReq (%d bytes)...\n", l);
 364                 if (config->debug > 3) dumplcp(p, l);
 365
 366                 while (x > 2)
 367                 {
 368                         int type = o[0];
 369                         int length = o[1];
 370                         if (length == 0 || type == 0) break;
 371                         switch (type)
 372                         {
 373                                 case 1: // Maximum-Receive-Unit
 374                                         session[s].mru = ntohs(*(u16 *)(o + 2));
 375                                         break;
 376                                 case 2: // asyncmap
 377                                         LOG_HEX(2, "PPP LCP Packet", p, l);
 378                                         LOG(2, 0, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_lcp_types[(int)*p], ntohs( ((u16 *) p)[1]) );
 379                                         break;
 380                                 case 3: // Authentication-Protocol
 381                                         {
 382                                                 int proto = ntohs(*(u16 *)(o + 2));
 383                                                 if (proto == PPPCHAP)
 384                                                 {
 385                                                         LOG(2, session[s].ip, s, t, "    Remote end is trying to do CHAP. Rejecting it.\n");
 386
 387                                                         if (!q)
 388                                                         {
 389                                                                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 390                                                                 if (!q) {
 391                                                                         LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
 392                                                                         break;
 393                                                                 }
 394                                                                 *q++ = ConfigNak;
 395                                                         }
 396                                                         memcpy(q, o, length);
 397                                                         *(u16 *)(q += 2) = htons(PPPPAP); // NAK -> Use PAP instead
 398                                                         q += length;
 399                                                 }
 400                                                 break;
 401                                         }
 402                                 case 5: // Magic-Number
 403                                         {
 404                                                 magicno = ntohl(*(u32 *)(o + 2));
 405                                                 break;
 406                                         }
 407                                 case 4: // Quality-Protocol
 408                                 case 7: // Protocol-Field-Compression
 409                                 case 8: // Address-And-Control-Field-Compression
 410                                                 break;
 411                                 case 13: // CallBack option for LCP extention of win2000/routers L2TP client
 412                                 case 17:
 413                                 case 18:
 414                                 {
 415                                         // Reject LCP CallBack
 416                                         LOG(2, session[s].ip, s, t, "    PPP LCP Option type %d, len=%d\n", type, length);
 417                                         memcpy(p + 4, o, length);
 418                                         *(u16 *)(p + 2) = htons(length + 4);
 419                                         *p = ConfigRej;
 420                                         q = makeppp(b,sizeof(b), p, length + 4, t, s, PPPLCP);
 421                                         tunnelsend(b, 12 + length + 4, t);
 422                                         return;
 423                                         }
 424
 425                                 default:
 426                                         // Reject Unknown LCP Option to stop to send it again
 427                                         LOG(2, session[s].ip, s, t, "    Unknown PPP LCP Option type %d\n", type);
 428                                         memcpy(p + 4, o, length);
 429                                         *(u16 *)(p + 2) = htons(length + 4);
 430                                         *p = ConfigRej;
 431                                         q = makeppp(b,sizeof(b), p, length + 4, t, s, PPPLCP);
 432                                         tunnelsend(b, 12 + length + 4, t);
 433                                         return;
 434                         }
 435                         x -= length;
 436                         o += length;
 437                 }
 438
 439                 if (!(session[s].flags & SF_LCP_ACKED))
 440                         initlcp(t, s);
 441
 442                 if (!q)
 443                 {
 444                         // Send back a ConfigAck
 445                         LOG(3, session[s].ip, s, t, "ConfigReq accepted, sending as Ack\n");
 446                         q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 447                         if (!q)
 448                         {
 449                                 LOG(3, session[s].ip, s, t, " failed to create packet.\n");
 450                                 return;
 451                         }
 452                         *q = ConfigAck;
 453                         tunnelsend(b, l + (q - b), t);
 454                 }
 455                 else
 456                 {
 457                         // Already built a ConfigNak... send it
 458                         LOG(3, session[s].ip, s, t, "Sending ConfigNak\n");
 459                         tunnelsend(b, l + (q - b), t);
 460                 }
 461         }
 462         else if (*p == ConfigNak)
 463         {
 464                 LOG(1, session[s].ip, s, t, "Remote end sent a ConfigNak. Ignoring\n");
 465                 if (config->debug > 3) dumplcp(p, l);
 466                 return ;
 467         }
 468         else if (*p == TerminateReq)
 469         {
 470                 *p = TerminateAck;      // close
 471                 q = makeppp(b, sizeof(b),  p, l, t, s, PPPLCP);
 472                 if (!q) {
 473                         LOG(3, session[s].ip, s, t, "Failed to create PPP packet in processlcp.\n");
 474                         return;
 475                 }
 476                 LOG(3, session[s].ip, s, t, "LCP: Received TerminateReq. Sending TerminateAck\n");
 477                 sessionshutdown(s, "Remote end closed connection.");
 478                 tunnelsend(b, l + (q - b), t); // send it
 479         }
 480         else if (*p == TerminateAck)
 481         {
 482                 sessionshutdown(s, "Connection closed.");
 483         }
 484         else if (*p == EchoReq)
 485         {
 486                 *p = EchoReply;         // reply
 487                 *(u32 *) (p + 4) = htonl(session[s].magic); // our magic number
 488                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 489                 if (!q) {
 490                         LOG(3, session[s].ip, s, t, " failed to send EchoReply.\n");
 491                         return;
 492                 }
 493                 LOG(5, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
 494                 tunnelsend(b, l + (q - b), t); // send it
 495         }
 496         else if (*p == EchoReply)
 497         {
 498                 // Ignore it, last_packet time is set earlier than this.
 499         }
 500         else if (*p == IdentRequest)
 501         {
 502                 *p = CodeRej;
 503                 if (l > MAXCONTROL)
 504                 {
 505                         LOG(1, 0, s, t, "Truncated Ident Packet (length=%d) to 1400 bytes\n", l);
 506                         l = 1400;
 507                 }
 508                 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
 509                 if (!q)
 510                 {
 511                         LOG(3, session[s].ip, s, t, "Failed to create IdentRej.\n");
 512                         return;
 513                 }
 514                 LOG_HEX(5, "LCPIdentRej", q, l + 4);
 515                 tunnelsend(b, 12 + 4 + l, t);
 516         }
 517         else
 518         {
 519                 LOG(1, session[s].ip, s, t, "Unexpected LCP code %d\n", *p);
 520                 STAT(tunnel_rx_errors);
 521                 return ;
 522         }
 523 }
 524
 525 // Process IPCP messages
 526 void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 527 {
 528         u16 hl;
 529
 530         CSTAT(call_processipcp);
 531
 532         LOG_HEX(5, "IPCP", p, l);
 533         if (l < 5)
 534         {
 535                 LOG(1, 0, s, t, "Short IPCP %d bytes\n", l);
 536                 STAT(tunnel_rx_errors);
 537                 return ;
 538         }
 539
 540         if ((hl = ntohs(*(u16 *) (p + 2))) > l)
 541         {
 542                 LOG(1, 0, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
 543                 STAT(tunnel_rx_errors);
 544                 return ;
 545         }
 546         l = hl;
 547
 548         if (*p == ConfigAck)
 549         {
 550                 // happy with our IPCP
 551                 u16 r = session[s].radius;
 552                 if ((!r || radius[r].state == RADIUSIPCP) && !session[s].walled_garden)
 553                 {
 554                         if (!r)
 555                                 r = radiusnew(s);
 556                         if (r)
 557                                 radiussend(r, RADIUSSTART); // send radius start, having got IPCP at last
 558                 }
 559                 session[s].flags |= SF_IPCP_ACKED;
 560
 561                 LOG(3, session[s].ip, s, t, "IPCP Acked, session is now active\n");
 562                 return;
 563         }
 564         if (*p != ConfigReq)
 565         {
 566                 LOG(1, 0, s, t, "Unexpected IPCP code %d\n", *p);
 567                 STAT(tunnel_rx_errors);
 568                 return ;
 569         }
 570         LOG(4, session[s].ip, s, t, "IPCP ConfigReq received\n");
 571
 572         if (!session[s].ip)
 573         {
 574                 LOG(3, 0, s, t, "Waiting on radius reply\n");
 575                 return;                 // have to wait on RADIUS reply
 576         }
 577         // form a config reply quoting the IP in the session
 578         {
 579                 u8 b[MAXCONTROL];
 580                 u8 *i,
 581                 *q;
 582
 583                 q = p + 4;
 584                 i = p + l;
 585                 while (q < i && q[1])
 586                 {
 587                         if (*q != 0x81 && *q != 0x83 && *q != 3)
 588                                 break;
 589                         q += q[1];
 590                 }
 591                 if (q < i)
 592                 {
 593                         // reject
 594                         u16 n = 4;
 595                         i = p + l;
 596                         if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
 597                         {
 598                                 LOG(2, 0, s, t, "Failed to send IPCP ConfigRej\n");
 599                                 return;
 600                         }
 601                         *q = ConfigRej;
 602                         p += 4;
 603                         while (p < i && p[1])
 604                         {
 605                                 if (*p != 0x81 && *p != 0x83 && *p != 3)
 606                                 {
 607                                         LOG(2, 0, s, t, "IPCP reject %d\n", *p);
 608                                         memcpy(q + n, p, p[1]);
 609                                         n += p[1];
 610                                 }
 611                                 p += p[1];
 612                         }
 613                         *(u16 *) (q + 2) = htons(n);
 614                         LOG(4, session[s].ip, s, t, "Sending ConfigRej\n");
 615                         tunnelsend(b, n + (q - b), t); // send it
 616                 }
 617                 else
 618                 {
 619                         LOG(4, session[s].ip, s, t, "Sending ConfigAck\n");
 620                         *p = ConfigAck;
 621                         if ((i = findppp(p, 0x81))) // Primary DNS address
 622                         {
 623                                 if (*(u32 *) (i + 2) != htonl(session[s].dns1))
 624                                 {
 625                                         *(u32 *) (i + 2) = htonl(session[s].dns1);
 626                                         *p = ConfigNak;
 627                                         LOG(5, session[s].ip, s, t, "   DNS1 = %s\n", inet_toa(session[s].dns1));
 628                                 }
 629                         }
 630                         if ((i = findppp(p, 0x83))) // Secondary DNS address (TBA, is it)
 631                         {
 632                                 if (*(u32 *) (i + 2) != htonl(session[s].dns2))
 633                                 {
 634                                         *(u32 *) (i + 2) = htonl(session[s].dns2);
 635                                         *p = ConfigNak;
 636                                         LOG(5, session[s].ip, s, t, "   DNS2 = %s\n", inet_toa(session[s].dns2));
 637                                 }
 638                         }
 639                         i = findppp(p, 3);              // IP address
 640                         if (!i || i[1] != 6)
 641                         {
 642                                 LOG(1, 0, s, t, "No IP in IPCP request\n");
 643                                 STAT(tunnel_rx_errors);
 644                                 return ;
 645                         }
 646                         if (*(u32 *) (i + 2) != htonl(session[s].ip))
 647                         {
 648                                 *(u32 *) (i + 2) = htonl(session[s].ip);
 649                                 *p = ConfigNak;
 650                                 LOG(4, session[s].ip, s, t, " No, a ConfigNak, client is requesting IP - sending %s\n",
 651                                                 inet_toa(htonl(session[s].ip)));
 652                         }
 653                         if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
 654                         {
 655                                 LOG(2, 0, s, t, " Failed to send IPCP packet.\n");
 656                                 return;
 657                         }
 658                         tunnelsend(b, l + (q - b), t); // send it
 659                 }
 660         }
 661 }
 662
 663 // process IP packet received
 664 //
 665 // This MUST be called with at least 4 byte behind 'p'.
 666 // (i.e. this routine writes to p[-4]).
 667 void processipin(tunnelidt t, sessionidt s, u8 *p, u16 l)
 668 {
 669         ipt ip;
 670
 671         CSTAT(call_processipin);
 672
 673         LOG_HEX(5, "IP", p, l);
 674
 675         ip = ntohl(*(u32 *)(p + 12));
 676
 677         if (l > MAXETHER)
 678         {
 679                 LOG(1, ip, s, t, "IP packet too long %d\n", l);
 680                 STAT(tunnel_rx_errors);
 681                 return ;
 682         }
 683
 684         // no spoof (do sessionbyip to handled statically routed subnets)
 685         if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
 686         {
 687                 LOG(5, ip, s, t, "Dropping packet with spoofed IP %s\n", inet_toa(htonl(ip)));
 688                 return;
 689         }
 690
 691         if (session[s].snoop_ip && session[s].snoop_port)
 692         {
 693                 // Snooping this session
 694                 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
 695         }
 696
 697         // Add on the tun header
 698         p -= 4;
 699         *(u32 *)p = htonl(0x00000800);
 700         l += 4;
 701
 702         if (session[s].tbf_in && !config->cluster_iam_master) { // Are we throttled and a slave?
 703                 master_throttle_packet(session[s].tbf_in, p, l); // Pass it to the master for handling.
 704                 return;
 705         }
 706
 707         session[s].cin += l - 4;
 708         session[s].total_cin += l - 4;
 709         sess_count[s].cin += l - 4;
 710
 711         session[s].pin++;
 712         eth_tx += l - 4;
 713
 714         STAT(tun_tx_packets);
 715         INC_STAT(tun_tx_bytes, l);
 716
 717         if (session[s].tbf_in && config->cluster_iam_master) { // Are we throttled and a master?? actually handle the throttled packets.
 718                 tbf_queue_packet(session[s].tbf_in, p, l);
 719                 return;
 720         }
 721
 722         // send to ethernet
 723         if (tun_write(p, l) < 0)
 724         {
 725                 STAT(tun_tx_errors);
 726                 LOG(0, 0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
 727                         l, strerror(errno), tunfd, p);
 728         }
 729
 730 }
 731
 732 //
 733 // Helper routine for the TBF filters.
 734 // Used to send queued data in from the user.
 735 //
 736 void send_ipin(sessionidt s, u8 *buf, int len)
 737 {
 738         LOG_HEX(5, "IP in throttled", buf, len);
 739         if (write(tunfd, buf, len) < 0)
 740         {
 741                 STAT(tun_tx_errors);
 742                 LOG(0, 0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
 743                         len, strerror(errno), tunfd, buf);
 744         }
 745
 746         // Increment packet counters
 747         session[s].cin += len - 4;
 748         session[s].total_cin += len - 4;
 749         sess_count[s].cin += len - 4;
 750
 751         session[s].pin++;
 752         eth_tx += len - 4;
 753 }
 754
 755
 756 // Process CCP messages
 757 void processccp(tunnelidt t, sessionidt s, u8 *p, u16 l)
 758 {
 759
 760         CSTAT(call_processccp);
 761
 762         LOG_HEX(5, "CCP", p, l);
 763         if (l < 2 || (*p != ConfigReq && *p != TerminateReq))
 764         {
 765                 LOG(1, 0, s, t, "Unexpected CCP request code %d\n", *p);
 766                 STAT(tunnel_rx_errors);
 767                 return ;
 768         }
 769         // reject
 770         {
 771                 u8 b[MAXCONTROL];
 772                 u8 *q;
 773                 if (*p == ConfigReq)
 774                 {
 775                         if (l < 6)
 776                         {
 777                                 *p = ConfigAck;         // accept no compression
 778                         }
 779                         else
 780                         {
 781                                 *p = ConfigRej;         // reject
 782                                 sendccp(t, s);
 783                         }
 784                 }
 785                 else
 786                         *p = TerminateAck;              // close
 787                 if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP)))
 788                 {
 789                         LOG(1,0,0,0, "Failed to send CCP packet.\n");
 790                         return;
 791                 }
 792                 tunnelsend(b, l + (q - b), t); // send it
 793         }
 794 }
 795
 796 // send a CHAP PP packet
 797 void sendchap(tunnelidt t, sessionidt s)
 798 {
 799         u8 b[MAXCONTROL];
 800         u16 r = session[s].radius;
 801         u8 *q;
 802
 803         CSTAT(call_sendchap);
 804
 805         if (!r)
 806         {
 807                 LOG(1, 0, s, t, "No RADIUS to send challenge\n");
 808                 STAT(tunnel_tx_errors);
 809                 return ;
 810         }
 811         LOG(1, 0, s, t, "Send CHAP challenge\n");
 812         {
 813                 // new challenge
 814                 int n;
 815                 for (n = 0; n < 15; n++)
 816                         radius[r].auth[n] = rand();
 817         }
 818         radius[r].chap = 1;             // CHAP not PAP
 819         radius[r].id++;
 820         if (radius[r].state != RADIUSCHAP)
 821                 radius[r].try = 0;
 822         radius[r].state = RADIUSCHAP;
 823         radius[r].retry = backoff(radius[r].try++);
 824         if (radius[r].try > 5)
 825         {
 826                 sessionshutdown(s, "Timeout CHAP");
 827                 STAT(tunnel_tx_errors);
 828                 return ;
 829         }
 830         q = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP);
 831         if (!q) {
 832                 LOG(1, 0, s, t, "failed to send CHAP challenge.\n");
 833                 return;
 834         }
 835         *q = 1;                                 // challenge
 836         q[1] = radius[r].id;                    // ID
 837         q[4] = 16;                              // length
 838         memcpy(q + 5, radius[r].auth, 16);      // challenge
 839         strcpy(q + 21, hostname);               // our name
 840         *(u16 *) (q + 2) = htons(strlen(hostname) + 21); // length
 841         tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
 842 }
 843
 844 // fill in a L2TP message with a PPP frame,
 845 // copies existing PPP message and changes magic number if seen
 846 // returns start of PPP frame
 847 u8 *makeppp(u8 *b, int size, u8 *p, int l, tunnelidt t, sessionidt s, u16 mtype)
 848 {
 849         if (size < 12)
 850                 return NULL;    // Need more space than this!!
 851
 852         *(u16 *) (b + 0) = htons(0x0002); // L2TP with no options
 853         *(u16 *) (b + 2) = htons(tunnel[t].far); // tunnel
 854         *(u16 *) (b + 4) = htons(session[s].far); // session
 855         b += 6;
 856         if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
 857         {
 858                 *(u16 *) b = htons(0xFF03); // HDLC header
 859                 b += 2;
 860         }
 861         if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
 862                 *b++ = mtype;
 863         else
 864         {
 865                 *(u16 *) b = htons(mtype);
 866                 b += 2;
 867         }
 868
 869         if (l + 12 > size) {
 870                 LOG(3,0,0,0, "Would have overflowed the buffer in makeppp: size %d, len %d.\n", size, l);
 871                 return NULL;    // Run out of room to hold the packet!
 872         }
 873         if (p && l)
 874                 memcpy(b, p, l);
 875         return b;
 876 }
 877
 878 // find a PPP option, returns point to option, or 0 if not found
 879 u8 *findppp(u8 *b, u8 mtype)
 880 {
 881         u16 l = ntohs(*(u16 *) (b + 2));
 882         if (l < 4)
 883                 return 0;
 884         b += 4;
 885         l -= 4;
 886         while (l)
 887         {
 888                 if (l < b[1] || !b[1])
 889                         return 0;               // faulty
 890                 if (*b == mtype)
 891                         return b;
 892                 l -= b[1];
 893                 b += b[1];
 894         }
 895         return 0;
 896 }
 897
 898 // Send initial LCP ConfigReq
 899 void initlcp(tunnelidt t, sessionidt s)
 900 {
 901         char b[500] = {0}, *q;
 902
 903         q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP);
 904         if (!q) {
 905                 LOG(1, 0, s, t, "Failed to send LCP ConfigReq.\n");
 906                 return;
 907         }
 908         LOG(4, 0, s, t, "Sending LCP ConfigReq for PAP\n");
 909         *q = ConfigReq;
 910         *(u8 *)(q + 1) = (time_now % 255) + 1; // ID
 911         *(u16 *)(q + 2) = htons(14); // Length
 912         *(u8 *)(q + 4) = 5;
 913         *(u8 *)(q + 5) = 6;
 914         *(u32 *)(q + 6) = htonl(session[s].magic);
 915         *(u8 *)(q + 10) = 3;
 916         *(u8 *)(q + 11) = 4;
 917         *(u16 *)(q + 12) = htons(PPPPAP); // PAP
 918         tunnelsend(b, 12 + 14, t);
 919 }
 920
 921 // Send CCP reply
 922 void sendccp(tunnelidt t, sessionidt s)
 923 {
 924         char *q, b[500] = {0};
 925
 926         q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPCCP);
 927         *q = ConfigReq;
 928         *(u8 *)(q + 1) = (time_now % 255) + 1; // ID
 929         *(u16 *)(q + 2) = htons(4); // Length
 930         LOG_HEX(5, "PPPCCP", q, 4);
 931         tunnelsend(b, (q - b) + 4 , t);
 932 }
 933