49f0858ddce32aff577d72dc55dc5151c70226b8
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.99 2006-04-18 06:00:08 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", CDN_ADMIN_DISC, TERM_USER_ERROR);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", CDN_ADMIN_DISC, TERM_USER_ERROR);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", CDN_UNAVAILABLE, TERM_SERVICE_UNAVAILABLE);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", CDN_ADMIN_DISC, TERM_USER_ERROR);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", CDN_ADMIN_DISC, TERM_USER_ERROR);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", CDN_ADMIN_DISC, TERM_USER_ERROR);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", CDN_ADMIN_DISC, TERM_USER_ERROR);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452 if (mru < MINMTU) mru = MINMTU;
453 if (mru > size) mru = size;
454
455 l += 4;
456 if (l > mru) l = mru;
457
458 q = makeppp(buf, size, 0, 0, s, t, proto);
459 if (!q) return;
460
461 *q = CodeRej;
462 *(q + 1) = ++sess_local[s].lcp_ident;
463 *(uint16_t *)(q + 2) = htons(l);
464 memcpy(q + 4, p, l - 4);
465
466 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
467 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
468 if (config->debug > 3) dumplcp(q, l);
469
470 tunnelsend(buf, l + (q - buf), t);
471 }
472
473 // Process LCP messages
474 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
475 {
476 uint8_t b[MAXETHER];
477 uint8_t *q = NULL;
478 uint16_t hl;
479
480 CSTAT(processlcp);
481
482 LOG_HEX(5, "LCP", p, l);
483 if (l < 4)
484 {
485 LOG(1, s, t, "Short LCP %d bytes\n", l);
486 STAT(tunnel_rx_errors);
487 return ;
488 }
489
490 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
491 {
492 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
493 STAT(tunnel_rx_errors);
494 return ;
495 }
496 l = hl;
497
498 if (session[s].die) // going down...
499 return;
500
501 LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
502 "LCP: recv %s\n", ppp_code(*p));
503
504 if (config->debug > 3) dumplcp(p, l);
505
506 if (*p == ConfigAck)
507 {
508 int x = l - 4;
509 uint8_t *o = (p + 4);
510 int authtype = 0;
511
512 while (x > 2)
513 {
514 int type = o[0];
515 int length = o[1];
516
517 if (length == 0 || type == 0 || x < length) break;
518 switch (type)
519 {
520 case 3: // Authentication-Protocol
521 {
522 int proto = ntohs(*(uint16_t *)(o + 2));
523 if (proto == PPPPAP)
524 authtype = AUTHPAP;
525 else if (proto == PPPCHAP && *(o + 4) == 5)
526 authtype = AUTHCHAP;
527 }
528
529 break;
530 }
531 x -= length;
532 o += length;
533 }
534
535 if (!session[s].ip && authtype)
536 sess_local[s].lcp_authtype = authtype;
537
538 switch (session[s].ppp.lcp)
539 {
540 case RequestSent:
541 initialise_restart_count(s, lcp);
542 change_state(s, lcp, AckReceived);
543 break;
544
545 case AckReceived:
546 case Opened:
547 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
548 if (session[s].ppp.lcp == Opened)
549 lcp_restart(s);
550
551 sendlcp(s, t);
552 change_state(s, lcp, RequestSent);
553 break;
554
555 case AckSent:
556 lcp_open(s, t);
557 break;
558
559 default:
560 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
561 }
562 }
563 else if (*p == ConfigReq)
564 {
565 int x = l - 4;
566 uint8_t *o = (p + 4);
567 uint8_t *response = 0;
568 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
569 static uint8_t authproto[5];
570
571 while (x > 2)
572 {
573 int type = o[0];
574 int length = o[1];
575
576 if (length == 0 || type == 0 || x < length) break;
577 switch (type)
578 {
579 case 1: // Maximum-Receive-Unit
580 {
581 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
582 if (mru >= MINMTU)
583 {
584 session[s].mru = mru;
585 cluster_send_session(s);
586 break;
587 }
588
589 LOG(3, s, t, " Remote requesting MRU of %u. Rejecting.\n", mru);
590 mru = htons(MRU);
591 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
592 }
593 break;
594
595 case 2: // Async-Control-Character-Map
596 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
597 break;
598
599 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
600 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
601 break;
602
603 case 3: // Authentication-Protocol
604 {
605 int proto = ntohs(*(uint16_t *)(o + 2));
606 char proto_name[] = "0x0000";
607 int alen;
608
609 if (proto == PPPPAP)
610 {
611 if (config->radius_authtypes & AUTHPAP)
612 {
613 sess_local[s].lcp_authtype = AUTHPAP;
614 break;
615 }
616
617 strcpy(proto_name, "PAP");
618 }
619 else if (proto == PPPCHAP)
620 {
621 if (config->radius_authtypes & AUTHCHAP
622 && *(o + 4) == 5) // MD5
623 {
624 sess_local[s].lcp_authtype = AUTHCHAP;
625 break;
626 }
627
628 strcpy(proto_name, "CHAP");
629 }
630 else
631 sprintf(proto_name, "%#4.4x", proto);
632
633 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
634
635 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
636 if (alen < 2) break; // paranoia
637
638 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
639 if (q && *response == ConfigNak &&
640 config->radius_authtypes != config->radius_authprefer)
641 {
642 // alternate type
643 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
644 if (alen < 2) break;
645 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
646 }
647
648 break;
649 }
650 break;
651
652 case 4: // Quality-Protocol
653 case 5: // Magic-Number
654 case 7: // Protocol-Field-Compression
655 case 8: // Address-And-Control-Field-Compression
656 break;
657
658 default: // Reject any unknown options
659 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
660 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
661 }
662 x -= length;
663 o += length;
664 }
665
666 if (response)
667 {
668 l = q - response; // LCP packet length
669 *((uint16_t *) (response + 2)) = htons(l); // update header
670 }
671 else
672 {
673 // Send packet back as ConfigAck
674 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
675 if (!response) return;
676 *response = ConfigAck;
677 }
678
679 switch (session[s].ppp.lcp)
680 {
681 case Closed:
682 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
683 if (!response) return;
684 *response = TerminateAck;
685 *((uint16_t *) (response + 2)) = htons(l = 4);
686 break;
687
688 case Stopped:
689 initialise_restart_count(s, lcp);
690 sendlcp(s, t);
691 if (*response == ConfigAck)
692 change_state(s, lcp, AckSent);
693 else
694 change_state(s, lcp, RequestSent);
695
696 break;
697
698 case RequestSent:
699 if (*response == ConfigAck)
700 change_state(s, lcp, AckSent);
701
702 break;
703
704 case AckReceived:
705 if (*response == ConfigAck)
706 lcp_open(s, t);
707
708 break;
709
710 case Opened:
711 lcp_restart(s);
712 sendlcp(s, t);
713 /* fallthrough */
714
715 case AckSent:
716 if (*response == ConfigAck)
717 change_state(s, lcp, AckSent);
718 else
719 change_state(s, lcp, RequestSent);
720
721 break;
722
723 default:
724 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
725 return;
726 }
727
728 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
729 if (config->debug > 3) dumplcp(response, l);
730
731 tunnelsend(b, l + (response - b), t);
732 }
733 else if (*p == ConfigNak || *p == ConfigRej)
734 {
735 int x = l - 4;
736 uint8_t *o = (p + 4);
737 int authtype = -1;
738
739 while (x > 2)
740 {
741 int type = o[0];
742 int length = o[1];
743
744 if (length == 0 || type == 0 || x < length) break;
745 switch (type)
746 {
747 case 1: // Maximum-Receive-Unit
748 if (*p == ConfigNak)
749 {
750 if (length < 4) break;
751 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
752 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
753 }
754 else
755 {
756 sess_local[s].ppp_mru = 0;
757 LOG(3, s, t, " Remote rejected MRU negotiation\n");
758 }
759
760 break;
761
762 case 3: // Authentication-Protocol
763 if (authtype > 0)
764 break;
765
766 if (*p == ConfigNak)
767 {
768 int proto;
769
770 if (length < 4) break;
771 proto = ntohs(*(uint16_t *)(o + 2));
772
773 if (proto == PPPPAP)
774 {
775 authtype = config->radius_authtypes & AUTHPAP;
776 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
777 authtype ? "accept" : "reject");
778 }
779 else if (proto == PPPCHAP && length > 4 && *(o + 4) == 5)
780 {
781 authtype = config->radius_authtypes & AUTHCHAP;
782 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
783 authtype ? "accept" : "reject");
784 }
785 else
786 {
787 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
788 proto);
789 }
790 }
791 else
792 {
793 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
794 authtype = 0; // shutdown
795 }
796
797 break;
798
799 case 5: // Magic-Number
800 session[s].magic = 0;
801 if (*p == ConfigNak)
802 {
803 if (length < 6) break;
804 session[s].magic = ntohl(*(uint32_t *)(o + 2));
805 }
806
807 if (session[s].magic)
808 LOG(3, s, t, " Remote requested magic-no %x\n", session[s].magic);
809 else
810 LOG(3, s, t, " Remote rejected magic-no\n");
811
812 cluster_send_session(s);
813 break;
814
815 default:
816 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
817 sessionshutdown(s, "Unable to negotiate LCP.", CDN_ADMIN_DISC, TERM_USER_ERROR);
818 return;
819 }
820 x -= length;
821 o += length;
822 }
823
824 if (!authtype)
825 {
826 sessionshutdown(s, "Unsupported authentication.", CDN_ADMIN_DISC, TERM_USER_ERROR);
827 return;
828 }
829
830 if (authtype > 0)
831 sess_local[s].lcp_authtype = authtype;
832
833 switch (session[s].ppp.lcp)
834 {
835 case Closed:
836 case Stopped:
837 {
838 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
839 if (!response) return;
840 *response = TerminateAck;
841 *((uint16_t *) (response + 2)) = htons(l = 4);
842
843 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
844 if (config->debug > 3) dumplcp(response, l);
845
846 tunnelsend(b, l + (response - b), t);
847 }
848 break;
849
850 case RequestSent:
851 case AckSent:
852 initialise_restart_count(s, lcp);
853 sendlcp(s, t);
854 break;
855
856 case AckReceived:
857 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
858 sendlcp(s, t);
859 break;
860
861 case Opened:
862 lcp_restart(s);
863 sendlcp(s, t);
864 break;
865
866 default:
867 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
868 return;
869 }
870 }
871 else if (*p == TerminateReq)
872 {
873 switch (session[s].ppp.lcp)
874 {
875 case Closed:
876 case Stopped:
877 case Closing:
878 case Stopping:
879 case RequestSent:
880 case AckReceived:
881 case AckSent:
882 break;
883
884 case Opened:
885 lcp_restart(s);
886 zero_restart_count(s, lcp);
887 change_state(s, lcp, Closing);
888 break;
889
890 default:
891 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
892 return;
893 }
894
895 *p = TerminateAck; // send ack
896 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
897 if (!q) return;
898
899 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
900 if (config->debug > 3) dumplcp(q, l);
901
902 tunnelsend(b, l + (q - b), t); // send it
903 }
904 else if (*p == ProtocolRej)
905 {
906 uint16_t proto = 0;
907
908 if (l > 4)
909 {
910 proto = *(p+4);
911 if (l > 5 && !(proto & 1))
912 {
913 proto <<= 8;
914 proto |= *(p+5);
915 }
916 }
917
918 if (proto == PPPIPV6CP)
919 {
920 LOG(3, s, t, "IPv6 rejected\n");
921 change_state(s, ipv6cp, Closed);
922 }
923 else
924 {
925 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
926 }
927 }
928 else if (*p == EchoReq)
929 {
930 *p = EchoReply; // reply
931 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
932 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
933 if (!q) return;
934
935 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
936 if (config->debug > 3) dumplcp(q, l);
937
938 tunnelsend(b, l + (q - b), t); // send it
939 }
940 else if (*p == EchoReply)
941 {
942 // Ignore it, last_packet time is set earlier than this.
943 }
944 else if (*p != CodeRej)
945 {
946 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
947 }
948 }
949
950 static void ipcp_open(sessionidt s, tunnelidt t)
951 {
952 LOG(3, s, t, "IPCP: Opened, session is now active\n");
953
954 change_state(s, ipcp, Opened);
955
956 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
957 {
958 uint16_t r = radiusnew(s);
959 if (r)
960 {
961 radiussend(r, RADIUSSTART); // send radius start
962
963 // don't send further Start records if IPCP is restarted
964 session[s].flags |= SESSION_STARTED;
965 cluster_send_session(s);
966 }
967 }
968
969 // start IPv6 if configured and still in passive state
970 if (session[s].ppp.ipv6cp == Stopped)
971 {
972 sendipv6cp(s, t);
973 change_state(s, ipv6cp, RequestSent);
974 }
975 }
976
977 // Process IPCP messages
978 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
979 {
980 uint8_t b[MAXETHER];
981 uint8_t *q = 0;
982 uint16_t hl;
983
984 CSTAT(processipcp);
985
986 LOG_HEX(5, "IPCP", p, l);
987 if (l < 4)
988 {
989 LOG(1, s, t, "Short IPCP %d bytes\n", l);
990 STAT(tunnel_rx_errors);
991 return ;
992 }
993
994 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
995 {
996 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
997 STAT(tunnel_rx_errors);
998 return ;
999 }
1000 l = hl;
1001
1002 if (session[s].ppp.phase < Network)
1003 {
1004 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1005 return;
1006 }
1007
1008 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
1009
1010 if (*p == ConfigAck)
1011 {
1012 switch (session[s].ppp.ipcp)
1013 {
1014 case RequestSent:
1015 initialise_restart_count(s, ipcp);
1016 change_state(s, ipcp, AckReceived);
1017 break;
1018
1019 case AckReceived:
1020 case Opened:
1021 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
1022 sendipcp(s, t);
1023 change_state(s, ipcp, RequestSent);
1024 break;
1025
1026 case AckSent:
1027 ipcp_open(s, t);
1028 break;
1029
1030 default:
1031 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1032 }
1033 }
1034 else if (*p == ConfigReq)
1035 {
1036 uint8_t *response = 0;
1037 uint8_t *o = p + 4;
1038 int length = l - 4;
1039 int gotip = 0;
1040 in_addr_t addr;
1041
1042 while (length > 2)
1043 {
1044 if (!o[1] || o[1] > length) return;
1045
1046 switch (*o)
1047 {
1048 case 3: // ip address
1049 gotip++; // seen address
1050 if (o[1] != 6) return;
1051
1052 addr = htonl(session[s].ip);
1053 if (memcmp(o + 2, &addr, (sizeof addr)))
1054 {
1055 uint8_t *oq = q;
1056 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1057 if (!q || (q != oq && *response == ConfigRej))
1058 {
1059 sessionshutdown(s, "Can't negotiate IPCP.", CDN_ADMIN_DISC, TERM_USER_ERROR);
1060 return;
1061 }
1062 }
1063
1064 break;
1065
1066 case 129: // primary DNS
1067 if (o[1] != 6) return;
1068
1069 addr = htonl(session[s].dns1);
1070 if (memcmp(o + 2, &addr, (sizeof addr)))
1071 {
1072 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1073 if (!q) return;
1074 }
1075
1076 break;
1077
1078 case 131: // secondary DNS
1079 if (o[1] != 6) return;
1080
1081 addr = htonl(session[s].dns2);
1082 if (memcmp(o + 2, &addr, sizeof(addr)))
1083 {
1084 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1085 if (!q) return;
1086 }
1087
1088 break;
1089
1090 default:
1091 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1092 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1093 if (!q) return;
1094 }
1095
1096 length -= o[1];
1097 o += o[1];
1098 }
1099
1100 if (response)
1101 {
1102 l = q - response; // IPCP packet length
1103 *((uint16_t *) (response + 2)) = htons(l); // update header
1104 }
1105 else if (gotip)
1106 {
1107 // Send packet back as ConfigAck
1108 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1109 if (!response) return;
1110 *response = ConfigAck;
1111 }
1112 else
1113 {
1114 LOG(1, s, t, "No IP in IPCP request\n");
1115 STAT(tunnel_rx_errors);
1116 return;
1117 }
1118
1119 switch (session[s].ppp.ipcp)
1120 {
1121 case Closed:
1122 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1123 if (!response) return;
1124 *response = TerminateAck;
1125 *((uint16_t *) (response + 2)) = htons(l = 4);
1126 break;
1127
1128 case Stopped:
1129 initialise_restart_count(s, ipcp);
1130 sendipcp(s, t);
1131 if (*response == ConfigAck)
1132 change_state(s, ipcp, AckSent);
1133 else
1134 change_state(s, ipcp, RequestSent);
1135
1136 break;
1137
1138 case RequestSent:
1139 if (*response == ConfigAck)
1140 change_state(s, ipcp, AckSent);
1141
1142 break;
1143
1144 case AckReceived:
1145 if (*response == ConfigAck)
1146 ipcp_open(s, t);
1147
1148 break;
1149
1150 case Opened:
1151 initialise_restart_count(s, ipcp);
1152 sendipcp(s, t);
1153 /* fallthrough */
1154
1155 case AckSent:
1156 if (*response == ConfigAck)
1157 change_state(s, ipcp, AckSent);
1158 else
1159 change_state(s, ipcp, RequestSent);
1160
1161 break;
1162
1163 default:
1164 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1165 return;
1166 }
1167
1168 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1169 tunnelsend(b, l + (response - b), t);
1170 }
1171 else if (*p == TerminateReq)
1172 {
1173 switch (session[s].ppp.ipcp)
1174 {
1175 case Closed:
1176 case Stopped:
1177 case Closing:
1178 case Stopping:
1179 case RequestSent:
1180 case AckReceived:
1181 case AckSent:
1182 break;
1183
1184 case Opened:
1185 zero_restart_count(s, ipcp);
1186 change_state(s, ipcp, Closing);
1187 break;
1188
1189 default:
1190 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1191 return;
1192 }
1193
1194 *p = TerminateAck; // send ack
1195 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1196 if (!q) return;
1197
1198 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1199 tunnelsend(b, l + (q - b), t); // send it
1200 }
1201 else if (*p != CodeRej)
1202 {
1203 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1204 }
1205 }
1206
1207 static void ipv6cp_open(sessionidt s, tunnelidt t)
1208 {
1209 LOG(3, s, t, "IPV6CP: Opened\n");
1210
1211 change_state(s, ipv6cp, Opened);
1212 if (session[s].ipv6prefixlen)
1213 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1214
1215 // Send an initial RA (TODO: Should we send these regularly?)
1216 send_ipv6_ra(s, t, NULL);
1217 }
1218
1219 // Process IPV6CP messages
1220 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1221 {
1222 uint8_t b[MAXETHER];
1223 uint8_t *q = 0;
1224 uint16_t hl;
1225
1226 CSTAT(processipv6cp);
1227
1228 LOG_HEX(5, "IPV6CP", p, l);
1229 if (l < 4)
1230 {
1231 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1232 STAT(tunnel_rx_errors);
1233 return ;
1234 }
1235
1236 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1237 {
1238 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1239 STAT(tunnel_rx_errors);
1240 return ;
1241 }
1242 l = hl;
1243
1244 if (session[s].ppp.phase < Network)
1245 {
1246 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1247 return;
1248 }
1249
1250 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1251
1252 if (!session[s].ip)
1253 {
1254 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1255 return; // need IPCP to complete...
1256 }
1257
1258 if (*p == ConfigAck)
1259 {
1260 switch (session[s].ppp.ipv6cp)
1261 {
1262 case RequestSent:
1263 initialise_restart_count(s, ipv6cp);
1264 change_state(s, ipv6cp, AckReceived);
1265 break;
1266
1267 case AckReceived:
1268 case Opened:
1269 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1270 sendipv6cp(s, t);
1271 change_state(s, ipv6cp, RequestSent);
1272 break;
1273
1274 case AckSent:
1275 ipv6cp_open(s, t);
1276 break;
1277
1278 default:
1279 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1280 }
1281 }
1282 else if (*p == ConfigReq)
1283 {
1284 uint8_t *response = 0;
1285 uint8_t *o = p + 4;
1286 int length = l - 4;
1287 int gotip = 0;
1288 uint8_t ident[8];
1289
1290 while (length > 2)
1291 {
1292 if (!o[1] || o[1] > length) return;
1293
1294 switch (*o)
1295 {
1296 case 1: // interface identifier
1297 gotip++; // seen address
1298 if (o[1] != 10) return;
1299
1300 *(uint32_t *) ident = htonl(session[s].ip);
1301 *(uint32_t *) (ident + 4) = 0;
1302
1303 if (memcmp(o + 2, ident, sizeof(ident)))
1304 {
1305 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1306 if (!q) return;
1307 }
1308
1309 break;
1310
1311 default:
1312 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1313 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1314 if (!q) return;
1315 }
1316
1317 length -= o[1];
1318 o += o[1];
1319 }
1320
1321 if (response)
1322 {
1323 l = q - response; // IPV6CP packet length
1324 *((uint16_t *) (response + 2)) = htons(l); // update header
1325 }
1326 else if (gotip)
1327 {
1328 // Send packet back as ConfigAck
1329 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1330 if (!response) return;
1331 *response = ConfigAck;
1332 }
1333 else
1334 {
1335 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1336 STAT(tunnel_rx_errors);
1337 return;
1338 }
1339
1340 switch (session[s].ppp.ipv6cp)
1341 {
1342 case Closed:
1343 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1344 if (!response) return;
1345 *response = TerminateAck;
1346 *((uint16_t *) (response + 2)) = htons(l = 4);
1347 break;
1348
1349 case Stopped:
1350 initialise_restart_count(s, ipv6cp);
1351 sendipv6cp(s, t);
1352 if (*response == ConfigAck)
1353 change_state(s, ipv6cp, AckSent);
1354 else
1355 change_state(s, ipv6cp, RequestSent);
1356
1357 break;
1358
1359 case RequestSent:
1360 if (*response == ConfigAck)
1361 change_state(s, ipv6cp, AckSent);
1362
1363 break;
1364
1365 case AckReceived:
1366 if (*response == ConfigAck)
1367 ipv6cp_open(s, t);
1368
1369 break;
1370
1371 case Opened:
1372 initialise_restart_count(s, ipv6cp);
1373 sendipv6cp(s, t);
1374 /* fallthrough */
1375
1376 case AckSent:
1377 if (*response == ConfigAck)
1378 change_state(s, ipv6cp, AckSent);
1379 else
1380 change_state(s, ipv6cp, RequestSent);
1381
1382 break;
1383
1384 default:
1385 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1386 return;
1387 }
1388
1389 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1390 tunnelsend(b, l + (response - b), t);
1391 }
1392 else if (*p == TerminateReq)
1393 {
1394 switch (session[s].ppp.ipv6cp)
1395 {
1396 case Closed:
1397 case Stopped:
1398 case Closing:
1399 case Stopping:
1400 case RequestSent:
1401 case AckReceived:
1402 case AckSent:
1403 break;
1404
1405 case Opened:
1406 zero_restart_count(s, ipv6cp);
1407 change_state(s, ipv6cp, Closing);
1408 break;
1409
1410 default:
1411 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1412 return;
1413 }
1414
1415 *p = TerminateAck; // send ack
1416 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1417 if (!q) return;
1418
1419 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1420 tunnelsend(b, l + (q - b), t); // send it
1421 }
1422 else if (*p != CodeRej)
1423 {
1424 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1425 }
1426 }
1427
1428 // process IP packet received
1429 //
1430 // This MUST be called with at least 4 byte behind 'p'.
1431 // (i.e. this routine writes to p[-4]).
1432 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1433 {
1434 in_addr_t ip;
1435
1436 CSTAT(processipin);
1437
1438 LOG_HEX(5, "IP", p, l);
1439
1440 if (l < 20)
1441 {
1442 LOG(1, s, t, "IP packet too short %d\n", l);
1443 STAT(tunnel_rx_errors);
1444 return ;
1445 }
1446
1447 ip = ntohl(*(uint32_t *)(p + 12));
1448
1449 if (l > MAXETHER)
1450 {
1451 LOG(1, s, t, "IP packet too long %d\n", l);
1452 STAT(tunnel_rx_errors);
1453 return ;
1454 }
1455
1456 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1457 return;
1458
1459 // no spoof (do sessionbyip to handled statically routed subnets)
1460 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1461 {
1462 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1463 return;
1464 }
1465
1466 // run access-list if any
1467 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1468 return;
1469
1470 // adjust MSS on SYN and SYN,ACK packets with options
1471 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1472 {
1473 int ihl = (p[0] & 0xf) * 4; // length of IP header
1474 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1475 adjust_tcp_mss(s, t, p, l, p + ihl);
1476 }
1477
1478 // Add on the tun header
1479 p -= 4;
1480 *(uint32_t *) p = htonl(PKTIP);
1481 l += 4;
1482
1483 // Are we throttled and a slave?
1484 if (session[s].tbf_in && !config->cluster_iam_master) {
1485 // Pass it to the master for handling.
1486 master_throttle_packet(session[s].tbf_in, p, l);
1487 return;
1488 }
1489
1490 // Are we throttled and a master??
1491 if (session[s].tbf_in && config->cluster_iam_master) {
1492 // Actually handle the throttled packets.
1493 tbf_queue_packet(session[s].tbf_in, p, l);
1494 return;
1495 }
1496
1497 // send to ethernet
1498 if (tun_write(p, l) < 0)
1499 {
1500 STAT(tun_tx_errors);
1501 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1502 l, strerror(errno), tunfd, p);
1503
1504 return;
1505 }
1506
1507 p += 4;
1508 l -= 4;
1509
1510 if (session[s].snoop_ip && session[s].snoop_port)
1511 {
1512 // Snooping this session
1513 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1514 }
1515
1516 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1517 session[s].cin_delta += l;
1518 session[s].pin++;
1519
1520 sess_local[s].cin += l;
1521 sess_local[s].pin++;
1522
1523 eth_tx += l;
1524
1525 STAT(tun_tx_packets);
1526 INC_STAT(tun_tx_bytes, l);
1527 }
1528
1529 // process IPv6 packet received
1530 //
1531 // This MUST be called with at least 4 byte behind 'p'.
1532 // (i.e. this routine writes to p[-4]).
1533 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1534 {
1535 struct in6_addr ip;
1536 in_addr_t ipv4;
1537
1538 CSTAT(processipv6in);
1539
1540 LOG_HEX(5, "IPv6", p, l);
1541
1542 ip = *(struct in6_addr *) (p + 8);
1543 ipv4 = ntohl(*(uint32_t *)(p + 16));
1544
1545 if (l > MAXETHER)
1546 {
1547 LOG(1, s, t, "IP packet too long %d\n", l);
1548 STAT(tunnel_rx_errors);
1549 return ;
1550 }
1551
1552 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1553 return;
1554
1555 // no spoof
1556 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1557 {
1558 char str[INET6_ADDRSTRLEN];
1559 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1560 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1561 return;
1562 }
1563
1564 // Check if it's a Router Solicition message.
1565 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1566 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1567 *(uint32_t *)(p + 34) == 0 &&
1568 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1569 LOG(3, s, t, "Got IPv6 RS\n");
1570 send_ipv6_ra(s, t, &ip);
1571 return;
1572 }
1573
1574 // Add on the tun header
1575 p -= 4;
1576 *(uint32_t *) p = htonl(PKTIPV6);
1577 l += 4;
1578
1579 // Are we throttled and a slave?
1580 if (session[s].tbf_in && !config->cluster_iam_master) {
1581 // Pass it to the master for handling.
1582 master_throttle_packet(session[s].tbf_in, p, l);
1583 return;
1584 }
1585
1586 // Are we throttled and a master??
1587 if (session[s].tbf_in && config->cluster_iam_master) {
1588 // Actually handle the throttled packets.
1589 tbf_queue_packet(session[s].tbf_in, p, l);
1590 return;
1591 }
1592
1593 // send to ethernet
1594 if (tun_write(p, l) < 0)
1595 {
1596 STAT(tun_tx_errors);
1597 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1598 l, strerror(errno), tunfd, p);
1599
1600 return;
1601 }
1602
1603 p += 4;
1604 l -= 4;
1605
1606 if (session[s].snoop_ip && session[s].snoop_port)
1607 {
1608 // Snooping this session
1609 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1610 }
1611
1612 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1613 session[s].cin_delta += l;
1614 session[s].pin++;
1615
1616 sess_local[s].cin += l;
1617 sess_local[s].pin++;
1618
1619 eth_tx += l;
1620
1621 STAT(tun_tx_packets);
1622 INC_STAT(tun_tx_bytes, l);
1623 }
1624
1625 //
1626 // Helper routine for the TBF filters.
1627 // Used to send queued data in from the user.
1628 //
1629 void send_ipin(sessionidt s, uint8_t *buf, int len)
1630 {
1631 LOG_HEX(5, "IP in throttled", buf, len);
1632
1633 if (write(tunfd, buf, len) < 0)
1634 {
1635 STAT(tun_tx_errors);
1636 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1637 len, strerror(errno), tunfd, buf);
1638
1639 return;
1640 }
1641
1642 buf += 4;
1643 len -= 4;
1644
1645 if (session[s].snoop_ip && session[s].snoop_port)
1646 {
1647 // Snooping this session
1648 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1649 }
1650
1651 // Increment packet counters
1652 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1653 session[s].cin_delta += len;
1654 session[s].pin++;
1655
1656 sess_local[s].cin += len;
1657 sess_local[s].pin++;
1658
1659 eth_tx += len;
1660
1661 STAT(tun_tx_packets);
1662 INC_STAT(tun_tx_bytes, len - 4);
1663 }
1664
1665
1666 // Process CCP messages
1667 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1668 {
1669 uint8_t b[MAXETHER];
1670 uint8_t *q;
1671
1672 CSTAT(processccp);
1673
1674 LOG_HEX(5, "CCP", p, l);
1675
1676 if (session[s].ppp.phase < Network)
1677 {
1678 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1679 return;
1680 }
1681
1682 if (l < 1)
1683 {
1684 LOG(1, s, t, "Short CCP packet\n");
1685 STAT(tunnel_rx_errors);
1686 }
1687
1688 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1689 if (*p == ConfigAck)
1690 {
1691 switch (session[s].ppp.ccp)
1692 {
1693 case RequestSent:
1694 initialise_restart_count(s, ccp);
1695 change_state(s, ccp, AckReceived);
1696 break;
1697
1698 case AckReceived:
1699 case Opened:
1700 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1701 sendccp(s, t);
1702 change_state(s, ccp, RequestSent);
1703 break;
1704
1705 case AckSent:
1706 LOG(3, s, t, "CCP: Opened\n");
1707 change_state(s, ccp, Opened);
1708 break;
1709
1710 default:
1711 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1712 }
1713 }
1714 else if (*p == ConfigReq)
1715 {
1716 if (l < 6) // accept no compression
1717 *p = ConfigAck;
1718 else // compression requested--reject
1719 *p = ConfigRej;
1720
1721 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1722 if (!q) return;
1723
1724 switch (session[s].ppp.ccp)
1725 {
1726 case Closed:
1727 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1728 if (!q) return;
1729 *q = TerminateAck;
1730 *((uint16_t *) (q + 2)) = htons(l = 4);
1731 break;
1732
1733 case Stopped:
1734 initialise_restart_count(s, ccp);
1735 sendccp(s, t);
1736 if (*q == ConfigAck)
1737 change_state(s, ccp, AckSent);
1738 else
1739 change_state(s, ccp, RequestSent);
1740
1741 break;
1742
1743 case RequestSent:
1744 if (*q == ConfigAck)
1745 change_state(s, ccp, AckSent);
1746
1747 break;
1748
1749 case AckReceived:
1750 if (*q == ConfigAck)
1751 change_state(s, ccp, Opened);
1752
1753 break;
1754
1755 case Opened:
1756 initialise_restart_count(s, ccp);
1757 sendccp(s, t);
1758 /* fallthrough */
1759
1760 case AckSent:
1761 if (*q == ConfigAck)
1762 change_state(s, ccp, AckSent);
1763 else
1764 change_state(s, ccp, RequestSent);
1765
1766 break;
1767
1768 default:
1769 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1770 return;
1771 }
1772
1773 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1774 tunnelsend(b, l + (q - b), t);
1775 }
1776 else if (*p == TerminateReq)
1777 {
1778 *p = TerminateAck;
1779 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1780 if (!q) return;
1781 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1782 tunnelsend(b, l + (q - b), t);
1783 change_state(s, ccp, Stopped);
1784 }
1785 else if (*p != CodeRej)
1786 {
1787 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1788 }
1789 }
1790
1791 // send a CHAP challenge
1792 void sendchap(sessionidt s, tunnelidt t)
1793 {
1794 uint8_t b[MAXETHER];
1795 uint16_t r;
1796 uint8_t *q;
1797
1798 CSTAT(sendchap);
1799
1800 r = radiusnew(s);
1801 if (!r)
1802 {
1803 LOG(1, s, t, "No RADIUS to send challenge\n");
1804 STAT(tunnel_tx_errors);
1805 return;
1806 }
1807
1808 LOG(1, s, t, "Send CHAP challenge\n");
1809
1810 radius[r].chap = 1; // CHAP not PAP
1811 radius[r].id++;
1812 if (radius[r].state != RADIUSCHAP)
1813 radius[r].try = 0;
1814
1815 radius[r].state = RADIUSCHAP;
1816 radius[r].retry = backoff(radius[r].try++);
1817 if (radius[r].try > 5)
1818 {
1819 sessionshutdown(s, "CHAP timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
1820 STAT(tunnel_tx_errors);
1821 return ;
1822 }
1823 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1824 if (!q) return;
1825
1826 *q = 1; // challenge
1827 q[1] = radius[r].id; // ID
1828 q[4] = 16; // value size (size of challenge)
1829 memcpy(q + 5, radius[r].auth, 16); // challenge
1830 strcpy((char *) q + 21, hostname); // our name
1831 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1832 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1833 }
1834
1835 // fill in a L2TP message with a PPP frame,
1836 // returns start of PPP frame
1837 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1838 {
1839 if (size < 12) // Need more space than this!!
1840 {
1841 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1842 return NULL;
1843 }
1844
1845 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1846 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1847 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1848 b += 6;
1849 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1850 {
1851 *(uint16_t *) b = htons(0xFF03); // HDLC header
1852 b += 2;
1853 }
1854 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1855 *b++ = mtype;
1856 else
1857 {
1858 *(uint16_t *) b = htons(mtype);
1859 b += 2;
1860 }
1861
1862 if (l + 12 > size)
1863 {
1864 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1865 return NULL;
1866 }
1867
1868 if (p && l)
1869 memcpy(b, p, l);
1870
1871 return b;
1872 }
1873
1874 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1875 {
1876 int len = 0;
1877 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1878 return 0;
1879
1880 *b++ = 3; // Authentication-Protocol
1881 if (authtype == AUTHCHAP)
1882 {
1883 len = *b++ = 5; // length
1884 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1885 *b++ = 5; // MD5
1886 }
1887 else if (authtype == AUTHPAP)
1888 {
1889 len = *b++ = 4; // length
1890 *(uint16_t *) b = htons(PPPPAP); b += 2;
1891 }
1892 else
1893 {
1894 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1895 }
1896
1897 return len;
1898 }
1899
1900 // Send LCP ConfigReq for MRU, authentication type and magic no
1901 void sendlcp(sessionidt s, tunnelidt t)
1902 {
1903 uint8_t b[500], *q, *l;
1904 int authtype = sess_local[s].lcp_authtype;
1905
1906 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1907 return;
1908
1909 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1910 authtype ? " (" : "",
1911 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1912 authtype ? ")" : "");
1913
1914 l = q;
1915 *l++ = ConfigReq;
1916 *l++ = ++sess_local[s].lcp_ident; // ID
1917
1918 l += 2; //Save space for length
1919
1920 if (sess_local[s].ppp_mru)
1921 {
1922 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1923 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1924 }
1925
1926 if (authtype)
1927 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1928
1929 if (session[s].magic)
1930 {
1931 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1932 *(uint32_t *) l = htonl(session[s].magic);
1933 l += 4;
1934 }
1935
1936 *(uint16_t *)(q + 2) = htons(l - q); // Length
1937
1938 LOG_HEX(5, "PPPLCP", q, l - q);
1939 if (config->debug > 3) dumplcp(q, l - q);
1940
1941 tunnelsend(b, (l - b), t);
1942 restart_timer(s, lcp);
1943 }
1944
1945 // Send CCP request for no compression
1946 void sendccp(sessionidt s, tunnelidt t)
1947 {
1948 uint8_t b[500], *q;
1949
1950 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1951 return;
1952
1953 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1954
1955 *q = ConfigReq;
1956 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1957 *(uint16_t *)(q + 2) = htons(4); // Length
1958
1959 LOG_HEX(5, "PPPCCP", q, 4);
1960 tunnelsend(b, (q - b) + 4 , t);
1961 restart_timer(s, ccp);
1962 }
1963
1964 // Reject unknown/unconfigured protocols
1965 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1966 {
1967
1968 uint8_t buf[MAXETHER];
1969 uint8_t *q;
1970 int mru = session[s].mru;
1971 if (mru < MINMTU) mru = MINMTU;
1972 if (mru > sizeof(buf)) mru = sizeof(buf);
1973
1974 l += 6;
1975 if (l > mru) l = mru;
1976
1977 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1978 if (!q) return;
1979
1980 *q = ProtocolRej;
1981 *(q + 1) = ++sess_local[s].lcp_ident;
1982 *(uint16_t *)(q + 2) = htons(l);
1983 *(uint16_t *)(q + 4) = htons(proto);
1984 memcpy(q + 6, p, l - 6);
1985
1986 if (proto == PPPIPV6CP)
1987 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1988 else
1989 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1990
1991 tunnelsend(buf, l + (q - buf), t);
1992 }