3 char const *cvs_id_ppp
= "$Id: ppp.c,v 1.45 2005-03-10 03:31:25 bodea Exp $";
11 #include "constants.h"
17 extern tunnelt
*tunnel
;
18 extern sessiont
*session
;
19 extern radiust
*radius
;
21 extern char hostname
[];
22 extern uint32_t eth_tx
;
23 extern time_t time_now
;
24 extern configt
*config
;
26 static void initccp(tunnelidt t
, sessionidt s
);
28 // Process PAP messages
29 void processpap(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
37 LOG_HEX(5, "PAP", p
, l
);
40 LOG(1, s
, t
, "Short PAP %u bytes\n", l
);
41 STAT(tunnel_rx_errors
);
45 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
47 LOG(1, s
, t
, "Length mismatch PAP %u/%u\n", hl
, l
);
48 STAT(tunnel_rx_errors
);
55 LOG(1, s
, t
, "Unexpected PAP code %d\n", *p
);
56 STAT(tunnel_rx_errors
);
63 user
[0] = pass
[0] = 0;
64 if (*b
&& *b
< sizeof(user
))
66 memcpy(user
, b
+ 1, *b
);
69 if (*b
&& *b
< sizeof(pass
))
71 memcpy(pass
, b
+ 1, *b
);
75 LOG(3, s
, t
, "PAP login %s/%s\n", user
, pass
);
77 if (session
[s
].ip
|| !session
[s
].radius
)
79 // respond now, either no RADIUS available or already authenticated
80 uint8_t b
[MAXCONTROL
];
82 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPPAP
);
88 *p
= 3; // cant authorise
90 *(uint16_t *) (p
+ 2) = htons(5); // length
91 p
[4] = 0; // no message
94 LOG(3, s
, t
, "Already an IP allocated: %s (%d)\n",
95 fmtaddr(htonl(session
[s
].ip
), 0), session
[s
].ip_pool_index
);
97 session
[s
].flags
&= ~SF_IPCP_ACKED
;
101 LOG(1, s
, t
, "No radius session available to authenticate session...\n");
103 LOG(3, s
, t
, "Fallback response to PAP (%s)\n", (session
[s
].ip
) ? "ACK" : "NAK");
104 tunnelsend(b
, 5 + (p
- b
), t
); // send it
108 // set up RADIUS request
109 uint16_t r
= session
[s
].radius
;
111 // Run PRE_AUTH plugins
112 struct param_pre_auth packet
= { &tunnel
[t
], &session
[s
], strdup(user
), strdup(pass
), PPPPAP
, 1 };
113 run_plugins(PLUGIN_PRE_AUTH
, &packet
);
114 if (!packet
.continue_auth
)
116 LOG(3, s
, t
, "A plugin rejected PRE_AUTH\n");
117 if (packet
.username
) free(packet
.username
);
118 if (packet
.password
) free(packet
.password
);
122 strncpy(session
[s
].user
, packet
.username
, sizeof(session
[s
].user
) - 1);
123 strncpy(radius
[r
].pass
, packet
.password
, sizeof(radius
[r
].pass
) - 1);
125 free(packet
.username
);
126 free(packet
.password
);
129 LOG(3, s
, t
, "Sending login for %s/%s to radius\n", user
, pass
);
130 radiussend(r
, RADIUSAUTH
);
134 // Process CHAP messages
135 void processchap(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
142 LOG_HEX(5, "CHAP", p
, l
);
143 r
= session
[s
].radius
;
146 LOG(1, s
, t
, "Unexpected CHAP message\n");
147 STAT(tunnel_rx_errors
);
153 LOG(1, s
, t
, "Short CHAP %u bytes\n", l
);
154 STAT(tunnel_rx_errors
);
158 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
160 LOG(1, s
, t
, "Length mismatch CHAP %u/%u\n", hl
, l
);
161 STAT(tunnel_rx_errors
);
168 LOG(1, s
, t
, "Unexpected CHAP response code %d\n", *p
);
169 STAT(tunnel_rx_errors
);
172 if (p
[1] != radius
[r
].id
)
174 LOG(1, s
, t
, "Wrong CHAP response ID %d (should be %d) (%d)\n", p
[1], radius
[r
].id
, r
);
175 STAT(tunnel_rx_errors
);
179 if (l
< 5 || p
[4] != 16)
181 LOG(1, s
, t
, "Bad CHAP response length %d\n", l
< 5 ? -1 : p
[4]);
182 STAT(tunnel_rx_errors
);
188 if (l
< 16 || l
- 16 >= sizeof(session
[s
].user
))
190 LOG(1, s
, t
, "CHAP user too long %d\n", l
- 16);
191 STAT(tunnel_rx_errors
);
195 // Run PRE_AUTH plugins
197 struct param_pre_auth packet
= { &tunnel
[t
], &session
[s
], NULL
, NULL
, PPPCHAP
, 1 };
199 packet
.password
= calloc(17, 1);
200 memcpy(packet
.password
, p
, 16);
205 packet
.username
= calloc(l
+ 1, 1);
206 memcpy(packet
.username
, p
, l
);
208 run_plugins(PLUGIN_PRE_AUTH
, &packet
);
209 if (!packet
.continue_auth
)
211 LOG(3, s
, t
, "A plugin rejected PRE_AUTH\n");
212 if (packet
.username
) free(packet
.username
);
213 if (packet
.password
) free(packet
.password
);
217 strncpy(session
[s
].user
, packet
.username
, sizeof(session
[s
].user
) - 1);
218 memcpy(radius
[r
].pass
, packet
.password
, 16);
220 free(packet
.username
);
221 free(packet
.password
);
225 LOG(3, s
, t
, "CHAP login %s\n", session
[s
].user
);
226 radiussend(r
, RADIUSAUTH
);
229 static void dumplcp(uint8_t *p
, int l
)
232 uint8_t *o
= (p
+ 4);
234 LOG_HEX(5, "PPP LCP Packet", p
, l
);
235 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p
, ppp_lcp_type((int)*p
), ntohs( ((uint16_t *) p
)[1]) );
236 LOG(4, 0, 0, "Length: %d\n", l
);
237 if (*p
!= ConfigReq
&& *p
!= ConfigRej
&& *p
!= ConfigAck
)
246 LOG(4, 0, 0, " Option length is %d...\n", length
);
251 LOG(4, 0, 0, " Option type is 0...\n");
258 case 1: // Maximum-Receive-Unit
260 LOG(4, 0, 0, " %s %d\n", lcp_type(type
), ntohs(*(uint16_t *)(o
+ 2)));
262 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
264 case 2: // Async-Control-Character-Map
267 uint32_t asyncmap
= ntohl(*(uint32_t *)(o
+ 2));
268 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), asyncmap
);
271 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
273 case 3: // Authentication-Protocol
276 int proto
= ntohs(*(uint16_t *)(o
+ 2));
277 LOG(4, 0, 0, " %s 0x%x (%s)\n", lcp_type(type
), proto
,
278 proto
== PPPCHAP
? "CHAP" :
279 proto
== PPPPAP
? "PAP" : "UNKNOWN");
282 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
284 case 4: // Quality-Protocol
286 uint32_t qp
= ntohl(*(uint32_t *)(o
+ 2));
287 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), qp
);
290 case 5: // Magic-Number
293 uint32_t magicno
= ntohl(*(uint32_t *)(o
+ 2));
294 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), magicno
);
297 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
299 case 7: // Protocol-Field-Compression
300 case 8: // Address-And-Control-Field-Compression
301 LOG(4, 0, 0, " %s\n", lcp_type(type
));
304 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type
);
312 // Process LCP messages
313 void processlcp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
315 uint8_t b
[MAXCONTROL
];
317 uint32_t magicno
= 0;
322 LOG_HEX(5, "LCP", p
, l
);
325 LOG(1, s
, t
, "Short LCP %d bytes\n", l
);
326 STAT(tunnel_rx_errors
);
330 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
332 LOG(1, s
, t
, "Length mismatch LCP %u/%u\n", hl
, l
);
333 STAT(tunnel_rx_errors
);
340 LOG(3, s
, t
, "LCP: Discarding ConfigAck\n");
341 session
[s
].flags
|= SF_LCP_ACKED
;
343 else if (*p
== ConfigReq
)
346 uint8_t *o
= (p
+ 4);
347 uint8_t *response
= 0;
349 LOG(3, s
, t
, "LCP: ConfigReq (%d bytes)...\n", l
);
350 if (config
->debug
> 3) dumplcp(p
, l
);
357 if (length
== 0 || type
== 0 || x
< length
) break;
360 case 1: // Maximum-Receive-Unit
361 session
[s
].mru
= ntohs(*(uint16_t *)(o
+ 2));
364 case 2: // Async-Control-Character-Map
365 if (!ntohl(*(uint32_t *)(o
+ 2))) // all bits zero is OK
368 if (response
&& *response
!= ConfigNak
) // rej already queued
371 LOG(2, s
, t
, " Remote requesting asyncmap. Rejecting.\n");
374 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
380 if ((q
- b
+ 11) > sizeof(b
))
382 LOG(2, s
, t
, "LCP overflow for asyncmap ConfigNak.\n");
388 memset(q
, 0, 4); // asyncmap 0
390 *((uint16_t *) (response
+ 2)) = htons(q
- response
); // LCP header length
393 case 3: // Authentication-Protocol
395 int proto
= ntohs(*(uint16_t *)(o
+ 2));
396 char proto_name
[] = "0x0000";
400 if (response
&& *response
!= ConfigNak
) // rej already queued
403 if (proto
== PPPCHAP
)
404 strcpy(proto_name
, "CHAP");
406 sprintf(proto_name
, "%#4.4x", proto
);
408 LOG(2, s
, t
, " Remote requesting %s authentication. Rejecting.\n", proto_name
);
412 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
418 if ((q
- b
+ length
) > sizeof(b
))
420 LOG(2, s
, t
, "LCP overflow for %s ConfigNak.\n", proto_name
);
424 memcpy(q
, o
, length
);
425 *(uint16_t *)(q
+= 2) = htons(PPPPAP
); // NAK -> Use PAP instead
427 *((uint16_t *) (response
+ 2)) = htons(q
- response
);
431 case 5: // Magic-Number
432 magicno
= ntohl(*(uint32_t *)(o
+ 2));
435 case 4: // Quality-Protocol
436 case 7: // Protocol-Field-Compression
437 case 8: // Address-And-Control-Field-Compression
440 default: // Reject any unknown options
441 LOG(2, s
, t
, " Rejecting PPP LCP Option type %d\n", type
);
442 if (!response
|| *response
!= ConfigRej
) // drop nak in favour of rej
444 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
450 if ((q
- b
+ length
) > sizeof(b
))
452 LOG(2, s
, t
, "LCP overflow for ConfigRej (type=%d).\n", type
);
456 memcpy(q
, o
, length
);
458 *((uint16_t *) (response
+ 2)) = htons(q
- response
); // LCP header length
466 // Send back a ConfigAck
467 q
= response
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
472 LOG(3, s
, t
, "Sending %s\n", ppp_lcp_type(*response
));
473 tunnelsend(b
, l
+ (q
- b
), t
);
475 if (!(session
[s
].flags
& SF_LCP_ACKED
))
478 else if (*p
== ConfigNak
)
480 LOG(1, s
, t
, "Remote end sent a ConfigNak. Ignoring\n");
481 if (config
->debug
> 3) dumplcp(p
, l
);
484 else if (*p
== TerminateReq
)
486 LOG(3, s
, t
, "LCP: Received TerminateReq. Sending TerminateAck\n");
487 *p
= TerminateAck
; // close
488 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
490 tunnelsend(b
, l
+ (q
- b
), t
); // send it
491 sessionshutdown(s
, "Remote end closed connection.");
493 else if (*p
== TerminateAck
)
495 sessionshutdown(s
, "Connection closed.");
497 else if (*p
== ProtocolRej
)
499 if (*(uint16_t *) (p
+4) == htons(PPPIPV6CP
))
501 LOG(3, s
, t
, "IPv6 rejected\n");
502 session
[s
].flags
|= SF_IPV6_NACKED
;
506 LOG(1, s
, t
, "Unexpected LCP protocol reject 0x%X\n",
507 ntohs(*(uint16_t *) (p
+4)));
508 STAT(tunnel_rx_errors
);
511 else if (*p
== EchoReq
)
513 LOG(5, s
, t
, "LCP: Received EchoReq. Sending EchoReply\n");
514 *p
= EchoReply
; // reply
515 *(uint32_t *) (p
+ 4) = htonl(session
[s
].magic
); // our magic number
516 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
518 tunnelsend(b
, l
+ (q
- b
), t
); // send it
520 else if (*p
== EchoReply
)
522 // Ignore it, last_packet time is set earlier than this.
524 else if (*p
== IdentRequest
)
529 LOG(1, s
, t
, "Truncated Ident Packet (length=%d) to 1400 bytes\n", l
);
532 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
534 LOG_HEX(5, "LCPIdentRej", q
, l
+ 4);
535 tunnelsend(b
, 12 + 4 + l
, t
);
539 LOG(1, s
, t
, "Unexpected LCP code %d\n", *p
);
540 STAT(tunnel_rx_errors
);
545 // find a PPP option, returns point to option, or 0 if not found
546 static uint8_t *findppp(uint8_t *b
, uint8_t mtype
)
548 uint16_t l
= ntohs(*(uint16_t *) (b
+ 2));
555 if (l
< b
[1] || !b
[1])
565 // Process IPCP messages
566 void processipcp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
572 LOG_HEX(5, "IPCP", p
, l
);
575 LOG(1, s
, t
, "Short IPCP %d bytes\n", l
);
576 STAT(tunnel_rx_errors
);
580 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
582 LOG(1, s
, t
, "Length mismatch IPCP %u/%u\n", hl
, l
);
583 STAT(tunnel_rx_errors
);
590 // happy with our IPCP
591 uint16_t r
= session
[s
].radius
;
592 if ((!r
|| radius
[r
].state
== RADIUSIPCP
) && !session
[s
].walled_garden
)
597 radiussend(r
, RADIUSSTART
); // send radius start, having got IPCP at last
599 session
[s
].flags
|= SF_IPCP_ACKED
;
601 LOG(3, s
, t
, "IPCP Acked, session is now active\n");
603 // clear LCP_ACKED/CCP_ACKED flag for possible fast renegotiaion for routers
604 session
[s
].flags
&= ~(SF_LCP_ACKED
|SF_CCP_ACKED
);
610 LOG(1, s
, t
, "Unexpected IPCP code %d\n", *p
);
611 STAT(tunnel_rx_errors
);
614 LOG(4, s
, t
, "IPCP ConfigReq received\n");
618 LOG(3, s
, t
, "Waiting on radius reply\n");
619 return; // have to wait on RADIUS reply
621 // form a config reply quoting the IP in the session
623 uint8_t b
[MAXCONTROL
];
628 while (q
< i
&& q
[1])
630 if (*q
!= 0x81 && *q
!= 0x83 && *q
!= 3)
639 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPCP
)))
644 while (p
< i
&& p
[1])
646 if (*p
!= 0x81 && *p
!= 0x83 && *p
!= 3)
648 LOG(2, s
, t
, "IPCP reject %d\n", *p
);
649 memcpy(q
+ n
, p
, p
[1]);
654 *(uint16_t *) (q
+ 2) = htons(n
);
655 LOG(4, s
, t
, "Sending ConfigRej\n");
656 tunnelsend(b
, n
+ (q
- b
), t
); // send it
660 LOG(4, s
, t
, "Sending ConfigAck\n");
662 if ((i
= findppp(p
, 0x81))) // Primary DNS address
664 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].dns1
))
666 *(uint32_t *) (i
+ 2) = htonl(session
[s
].dns1
);
668 LOG(5, s
, t
, " DNS1 = %s\n",
669 fmtaddr(htonl(session
[s
].dns1
), 0));
672 if ((i
= findppp(p
, 0x83))) // Secondary DNS address (TBA, is it)
674 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].dns2
))
676 *(uint32_t *) (i
+ 2) = htonl(session
[s
].dns2
);
678 LOG(5, s
, t
, " DNS2 = %s\n",
679 fmtaddr(htonl(session
[s
].dns2
), 0));
682 i
= findppp(p
, 3); // IP address
685 LOG(1, s
, t
, "No IP in IPCP request\n");
686 STAT(tunnel_rx_errors
);
689 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].ip
))
691 *(uint32_t *) (i
+ 2) = htonl(session
[s
].ip
);
693 LOG(4, s
, t
, " No, a ConfigNak, client is requesting IP - sending %s\n",
694 fmtaddr(htonl(session
[s
].ip
), 0));
696 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPCP
)))
699 tunnelsend(b
, l
+ (q
- b
), t
); // send it
704 // Process IPV6CP messages
705 void processipv6cp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
708 CSTAT(processipv6cp
);
710 LOG_HEX(5, "IPV6CP", p
, l
);
713 LOG(1, s
, t
, "Short IPV6CP %d bytes\n", l
);
714 STAT(tunnel_rx_errors
);
719 // happy with our IPV6CP
720 session
[s
].flags
|= SF_IPV6CP_ACKED
;
722 LOG(3, s
, t
, "IPV6CP Acked, IPv6 is now active\n");
723 // Add a routed block if configured.
724 if (session
[s
].ipv6prefixlen
)
726 route6set(s
, session
[s
].ipv6route
, session
[s
].ipv6prefixlen
, 1);
727 session
[s
].flags
|= SF_IPV6_ROUTED
;
730 // Send an initial RA (TODO: Should we send these regularly?)
731 send_ipv6_ra(t
, s
, NULL
);
736 LOG(1, s
, t
, "Unexpected IPV6CP code %d\n", *p
);
737 STAT(tunnel_rx_errors
);
741 LOG(4, s
, t
, "IPV6CP ConfigReq received\n");
742 if (ntohs(*(uint16_t *) (p
+ 2)) > l
)
744 LOG(1, s
, t
, "Length mismatch IPV6CP %d/%d\n", ntohs(*(uint16_t *) (p
+ 2)), l
);
745 STAT(tunnel_rx_errors
);
750 LOG(3, s
, t
, "Waiting on radius reply\n");
751 return; // have to wait on RADIUS reply
753 // form a config reply quoting the IP in the session
755 uint8_t b
[MAXCONTROL
];
759 l
= ntohs(*(uint16_t *) (p
+ 2)); // We must use length from IPV6CP len field
762 while (q
< i
&& q
[1])
773 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPV6CP
)))
775 LOG(2, s
, t
, "Failed to send IPV6CP ConfigRej\n");
780 while (p
< i
&& p
[1])
784 LOG(2, s
, t
, "IPV6CP reject %d\n", *p
);
785 memcpy(q
+ n
, p
, p
[1]);
790 *(uint16_t *) (q
+ 2) = htons(n
);
791 LOG(4, s
, t
, "Sending ConfigRej\n");
792 tunnelsend(b
, n
+ (q
- b
), t
); // send it
796 LOG(4, s
, t
, "Sending ConfigAck\n");
798 i
= findppp(p
, 1); // IP address
799 if (!i
|| i
[1] != 10)
801 LOG(1, s
, t
, "No IP in IPV6CP request\n");
802 STAT(tunnel_rx_errors
);
805 if ((*(uint32_t *) (i
+ 2) != htonl(session
[s
].ip
)) ||
806 (*(uint32_t *) (i
+ 6) != 0))
808 *(uint32_t *) (i
+ 2) = htonl(session
[s
].ip
);
809 *(uint32_t *) (i
+ 6) = 0;
812 " No, a ConfigNak, client is "
813 "requesting IP - sending %s\n",
814 fmtaddr(htonl(session
[s
].ip
), 0));
816 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPV6CP
)))
818 LOG(2, s
, t
, " Failed to send IPV6CP packet.\n");
821 tunnelsend(b
, l
+ (q
- b
), t
); // send it
826 // process IP packet received
828 // This MUST be called with at least 4 byte behind 'p'.
829 // (i.e. this routine writes to p[-4]).
830 void processipin(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
836 LOG_HEX(5, "IP", p
, l
);
838 ip
= ntohl(*(uint32_t *)(p
+ 12));
842 LOG(1, s
, t
, "IP packet too long %d\n", l
);
843 STAT(tunnel_rx_errors
);
847 // no spoof (do sessionbyip to handled statically routed subnets)
848 if (ip
!= session
[s
].ip
&& sessionbyip(htonl(ip
)) != s
)
850 LOG(5, s
, t
, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip
), 0));
854 // run access-list if any
855 if (session
[s
].filter_in
&& !ip_filter(p
, l
, session
[s
].filter_in
- 1))
858 // Add on the tun header
860 *(uint32_t *) p
= htonl(PKTIP
);
863 // Are we throttled and a slave?
864 if (session
[s
].tbf_in
&& !config
->cluster_iam_master
) {
865 // Pass it to the master for handling.
866 master_throttle_packet(session
[s
].tbf_in
, p
, l
);
870 // Are we throttled and a master??
871 if (session
[s
].tbf_in
&& config
->cluster_iam_master
) {
872 // Actually handle the throttled packets.
873 tbf_queue_packet(session
[s
].tbf_in
, p
, l
);
878 if (tun_write(p
, l
) < 0)
881 LOG(0, s
, t
, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
882 l
, strerror(errno
), tunfd
, p
);
887 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
889 // Snooping this session
890 snoop_send_packet(p
+ 4, l
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
893 session
[s
].cin
+= l
- 4;
894 session
[s
].total_cin
+= l
- 4;
895 sess_local
[s
].cin
+= l
- 4;
900 STAT(tun_tx_packets
);
901 INC_STAT(tun_tx_bytes
, l
- 4);
904 // process IPv6 packet received
906 // This MUST be called with at least 4 byte behind 'p'.
907 // (i.e. this routine writes to p[-4]).
908 void processipv6in(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
913 CSTAT(processipv6in
);
915 LOG_HEX(5, "IPv6", p
, l
);
917 ip
= *(struct in6_addr
*) (p
+ 8);
918 ipv4
= ntohl(*(uint32_t *)(p
+ 16));
922 LOG(1, s
, t
, "IP packet too long %d\n", l
);
923 STAT(tunnel_rx_errors
);
928 if (ipv4
!= session
[s
].ip
&& memcmp(&config
->ipv6_prefix
, &ip
, 8) && sessionbyipv6(ip
) != s
)
930 char str
[INET6_ADDRSTRLEN
];
931 LOG(5, s
, t
, "Dropping packet with spoofed IP %s\n",
932 inet_ntop(AF_INET6
, &ip
, str
, INET6_ADDRSTRLEN
));
936 // Check if it's a Router Solicition message.
937 if (*(p
+ 6) == 58 && *(p
+ 7) == 255 && *(p
+ 24) == 0xFF && *(p
+ 25) == 2 &&
938 *(uint32_t *)(p
+ 26) == 0 && *(uint32_t *)(p
+ 30) == 0 &&
939 *(uint32_t *)(p
+ 34) == 0 &&
940 *(p
+ 38) == 0 && *(p
+ 39) == 2 && *(p
+ 40) == 133) {
941 LOG(3, s
, t
, "Got IPv6 RS\n");
942 send_ipv6_ra(t
, s
, &ip
);
946 // Add on the tun header
948 *(uint32_t *) p
= htonl(PKTIPV6
);
951 // Are we throttled and a slave?
952 if (session
[s
].tbf_in
&& !config
->cluster_iam_master
) {
953 // Pass it to the master for handling.
954 master_throttle_packet(session
[s
].tbf_in
, p
, l
);
958 // Are we throttled and a master??
959 if (session
[s
].tbf_in
&& config
->cluster_iam_master
) {
960 // Actually handle the throttled packets.
961 tbf_queue_packet(session
[s
].tbf_in
, p
, l
);
966 if (tun_write(p
, l
) < 0)
969 LOG(0, s
, t
, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
970 l
, strerror(errno
), tunfd
, p
);
975 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
977 // Snooping this session
978 snoop_send_packet(p
+ 4, l
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
981 session
[s
].cin
+= l
- 4;
982 session
[s
].total_cin
+= l
- 4;
983 sess_local
[s
].cin
+= l
- 4;
988 STAT(tun_tx_packets
);
989 INC_STAT(tun_tx_bytes
, l
- 4);
993 // Helper routine for the TBF filters.
994 // Used to send queued data in from the user.
996 void send_ipin(sessionidt s
, uint8_t *buf
, int len
)
998 LOG_HEX(5, "IP in throttled", buf
, len
);
1000 if (write(tunfd
, buf
, len
) < 0)
1002 STAT(tun_tx_errors
);
1003 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1004 len
, strerror(errno
), tunfd
, buf
);
1009 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
1011 // Snooping this session
1012 snoop_send_packet(buf
+ 4, len
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
1015 // Increment packet counters
1016 session
[s
].cin
+= len
- 4;
1017 session
[s
].total_cin
+= len
- 4;
1018 sess_local
[s
].cin
+= len
- 4;
1023 STAT(tun_tx_packets
);
1024 INC_STAT(tun_tx_bytes
, len
- 4);
1028 // Process CCP messages
1029 void processccp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
1031 uint8_t b
[MAXCONTROL
];
1036 LOG_HEX(5, "CCP", p
, l
);
1037 switch (l
> 1 ? *p
: 0)
1040 session
[s
].flags
|= SF_CCP_ACKED
;
1044 if (l
< 6) // accept no compression
1050 // compression requested--reject
1053 // send CCP request for no compression for our end if not negotiated
1054 if (!(session
[s
].flags
& SF_CCP_ACKED
))
1065 LOG(1, s
, t
, "Unexpected CCP request code %d\n", *p
);
1067 LOG(1, s
, t
, "Short CCP packet\n");
1069 STAT(tunnel_rx_errors
);
1073 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPCCP
)))
1076 tunnelsend(b
, l
+ (q
- b
), t
); // send it
1079 // send a CHAP PP packet
1080 void sendchap(tunnelidt t
, sessionidt s
)
1082 uint8_t b
[MAXCONTROL
];
1083 uint16_t r
= session
[s
].radius
;
1090 LOG(1, s
, t
, "No RADIUS to send challenge\n");
1091 STAT(tunnel_tx_errors
);
1095 LOG(1, s
, t
, "Send CHAP challenge\n");
1098 random_data(radius
[r
].auth
, sizeof(radius
[r
].auth
));
1099 radius
[r
].chap
= 1; // CHAP not PAP
1101 if (radius
[r
].state
!= RADIUSCHAP
)
1104 radius
[r
].state
= RADIUSCHAP
;
1105 radius
[r
].retry
= backoff(radius
[r
].try++);
1106 if (radius
[r
].try > 5)
1108 sessionshutdown(s
, "Timeout CHAP");
1109 STAT(tunnel_tx_errors
);
1112 q
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPCHAP
);
1115 *q
= 1; // challenge
1116 q
[1] = radius
[r
].id
; // ID
1117 q
[4] = 16; // length
1118 memcpy(q
+ 5, radius
[r
].auth
, 16); // challenge
1119 strcpy(q
+ 21, hostname
); // our name
1120 *(uint16_t *) (q
+ 2) = htons(strlen(hostname
) + 21); // length
1121 tunnelsend(b
, strlen(hostname
) + 21 + (q
- b
), t
); // send it
1124 // fill in a L2TP message with a PPP frame,
1125 // copies existing PPP message and changes magic number if seen
1126 // returns start of PPP frame
1127 uint8_t *makeppp(uint8_t *b
, int size
, uint8_t *p
, int l
, tunnelidt t
, sessionidt s
, uint16_t mtype
)
1129 if (size
< 12) // Need more space than this!!
1131 static int backtrace_count
= 0;
1132 LOG(0, s
, t
, "makeppp buffer too small for L2TP header (size=%d)\n", size
);
1133 log_backtrace(backtrace_count
, 5)
1137 *(uint16_t *) (b
+ 0) = htons(0x0002); // L2TP with no options
1138 *(uint16_t *) (b
+ 2) = htons(tunnel
[t
].far
); // tunnel
1139 *(uint16_t *) (b
+ 4) = htons(session
[s
].far
); // session
1141 if (mtype
== PPPLCP
|| !(session
[s
].l2tp_flags
& SESSIONACFC
))
1143 *(uint16_t *) b
= htons(0xFF03); // HDLC header
1146 if (mtype
< 0x100 && session
[s
].l2tp_flags
& SESSIONPFC
)
1150 *(uint16_t *) b
= htons(mtype
);
1156 static int backtrace_count
= 0;
1157 LOG(2, s
, t
, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size
, l
+ 12);
1158 log_backtrace(backtrace_count
, 5)
1168 // Send initial LCP ConfigReq for PAP, set magic no.
1169 void initlcp(tunnelidt t
, sessionidt s
)
1173 if (!(q
= makeppp(b
, sizeof(b
), NULL
, 0, t
, s
, PPPLCP
)))
1176 LOG(4, s
, t
, "Sending LCP ConfigReq for PAP\n");
1178 *(uint8_t *)(q
+ 1) = (time_now
% 255) + 1; // ID
1179 *(uint16_t *)(q
+ 2) = htons(14); // Length
1180 *(uint8_t *)(q
+ 4) = 5;
1181 *(uint8_t *)(q
+ 5) = 6;
1182 *(uint32_t *)(q
+ 6) = htonl(session
[s
].magic
);
1183 *(uint8_t *)(q
+ 10) = 3;
1184 *(uint8_t *)(q
+ 11) = 4;
1185 *(uint16_t *)(q
+ 12) = htons(PPPPAP
); // PAP
1187 LOG_HEX(5, "PPPLCP", q
, 14);
1188 tunnelsend(b
, (q
- b
) + 14, t
);
1191 // Send CCP request for no compression
1192 static void initccp(tunnelidt t
, sessionidt s
)
1196 if (!(q
= makeppp(b
, sizeof(b
), NULL
, 0, t
, s
, PPPCCP
)))
1199 LOG(4, s
, t
, "Sending CCP ConfigReq for no compression\n");
1201 *(uint8_t *)(q
+ 1) = (time_now
% 255) + 1; // ID
1202 *(uint16_t *)(q
+ 2) = htons(4); // Length
1204 LOG_HEX(5, "PPPCCP", q
, 4);
1205 tunnelsend(b
, (q
- b
) + 4 , t
);