projects / l2tpns.git / blob
? search:


62e16e82a87792cffc509b778aba470ab5508e8d
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.80 2005/09/13 14:23:07 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452
453 if (!mru) mru = MAXMRU;
454 if (mru > size) mru = size;
455
456 l += 4;
457 if (l > mru) l = mru;
458
459 q = makeppp(buf, size, 0, 0, s, t, proto);
460 if (!q) return;
461
462 *q = CodeRej;
463 *(q + 1) = ++sess_local[s].lcp_ident;
464 *(uint16_t *)(q + 2) = l;
465 memcpy(q + 4, p, l - 4);
466
467 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
468 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
469 if (config->debug > 3) dumplcp(q, l);
470
471 tunnelsend(buf, l + (q - buf), t);
472 }
473
474 // Process LCP messages
475 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
476 {
477 uint8_t b[MAXETHER];
478 uint8_t *q = NULL;
479 uint32_t magicno = 0;
480 uint16_t hl;
481
482 CSTAT(processlcp);
483
484 LOG_HEX(5, "LCP", p, l);
485 if (l < 4)
486 {
487 LOG(1, s, t, "Short LCP %d bytes\n", l);
488 STAT(tunnel_rx_errors);
489 return ;
490 }
491
492 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
493 {
494 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
495 STAT(tunnel_rx_errors);
496 return ;
497 }
498 l = hl;
499
500 if (session[s].die) // going down...
501 return;
502
503 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
504 if (config->debug > 3) dumplcp(p, l);
505
506 if (*p == ConfigAck)
507 {
508 int x = l - 4;
509 uint8_t *o = (p + 4);
510 int authtype = 0;
511
512 while (x > 2)
513 {
514 int type = o[0];
515 int length = o[1];
516
517 if (length == 0 || type == 0 || x < length) break;
518 switch (type)
519 {
520 case 3: // Authentication-Protocol
521 {
522 int proto = ntohs(*(uint16_t *)(o + 2));
523 if (proto == PPPPAP)
524 authtype = AUTHPAP;
525 else if (proto == PPPCHAP && *(o + 4) == 5)
526 authtype = AUTHCHAP;
527 }
528
529 break;
530 }
531 x -= length;
532 o += length;
533 }
534
535 if (!session[s].ip && authtype)
536 sess_local[s].lcp_authtype = authtype;
537
538 switch (session[s].ppp.lcp)
539 {
540 case RequestSent:
541 initialise_restart_count(s, lcp);
542 change_state(s, lcp, AckReceived);
543 break;
544
545 case AckReceived:
546 case Opened:
547 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
548 if (session[s].ppp.lcp == Opened)
549 lcp_restart(s);
550
551 sendlcp(s, t);
552 change_state(s, lcp, RequestSent);
553 break;
554
555 case AckSent:
556 lcp_open(s, t);
557 break;
558
559 default:
560 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
561 }
562 }
563 else if (*p == ConfigReq)
564 {
565 int x = l - 4;
566 uint8_t *o = (p + 4);
567 uint8_t *response = 0;
568 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
569 static uint8_t authproto[5];
570
571 while (x > 2)
572 {
573 int type = o[0];
574 int length = o[1];
575
576 if (length == 0 || type == 0 || x < length) break;
577 switch (type)
578 {
579 case 1: // Maximum-Receive-Unit
580 session[s].mru = ntohs(*(uint16_t *)(o + 2));
581 break;
582
583 case 2: // Async-Control-Character-Map
584 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
585 break;
586
587 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
588 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
589 break;
590
591 case 3: // Authentication-Protocol
592 {
593 int proto = ntohs(*(uint16_t *)(o + 2));
594 char proto_name[] = "0x0000";
595 int alen;
596
597 if (proto == PPPPAP)
598 {
599 if (config->radius_authtypes & AUTHPAP)
600 {
601 sess_local[s].lcp_authtype = AUTHPAP;
602 break;
603 }
604
605 strcpy(proto_name, "PAP");
606 }
607 else if (proto == PPPCHAP)
608 {
609 if (config->radius_authtypes & AUTHCHAP
610 && *(o + 4) == 5) // MD5
611 {
612 sess_local[s].lcp_authtype = AUTHCHAP;
613 break;
614 }
615
616 strcpy(proto_name, "CHAP");
617 }
618 else
619 sprintf(proto_name, "%#4.4x", proto);
620
621 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
622
623 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
624 if (alen < 2) break; // paranoia
625
626 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
627 if (q && *response == ConfigNak &&
628 config->radius_authtypes != config->radius_authprefer)
629 {
630 // alternate type
631 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
632 if (alen < 2) break;
633 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
634 }
635
636 break;
637 }
638 break;
639
640 case 5: // Magic-Number
641 magicno = ntohl(*(uint32_t *)(o + 2));
642 break;
643
644 case 4: // Quality-Protocol
645 case 7: // Protocol-Field-Compression
646 case 8: // Address-And-Control-Field-Compression
647 break;
648
649 default: // Reject any unknown options
650 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
651 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
652 }
653 x -= length;
654 o += length;
655 }
656
657 if (response)
658 {
659 l = q - response; // LCP packet length
660 *((uint16_t *) (response + 2)) = htons(l); // update header
661 }
662 else
663 {
664 // Send packet back as ConfigAck
665 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
666 if (!response) return;
667 *response = ConfigAck;
668 }
669
670 switch (session[s].ppp.lcp)
671 {
672 case Closed:
673 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
674 if (!response) return;
675 *response = TerminateAck;
676 *((uint16_t *) (response + 2)) = htons(l = 4);
677 break;
678
679 case Stopped:
680 initialise_restart_count(s, lcp);
681 sendlcp(s, t);
682 if (*response == ConfigAck)
683 change_state(s, lcp, AckSent);
684 else
685 change_state(s, lcp, RequestSent);
686
687 break;
688
689 case RequestSent:
690 if (*response == ConfigAck)
691 change_state(s, lcp, AckSent);
692
693 break;
694
695 case AckReceived:
696 if (*response == ConfigAck)
697 lcp_open(s, t);
698
699 break;
700
701 case Opened:
702 lcp_restart(s);
703 sendlcp(s, t);
704 /* fallthrough */
705
706 case AckSent:
707 if (*response == ConfigAck)
708 change_state(s, lcp, AckSent);
709 else
710 change_state(s, lcp, RequestSent);
711
712 break;
713
714 default:
715 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
716 return;
717 }
718
719 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
720 if (config->debug > 3) dumplcp(response, l);
721
722 tunnelsend(b, l + (response - b), t);
723 }
724 else if (*p == ConfigNak || *p == ConfigRej)
725 {
726 int x = l - 4;
727 uint8_t *o = (p + 4);
728 int authtype = -1;
729
730 while (x > 2)
731 {
732 int type = o[0];
733 int length = o[1];
734
735 if (length == 0 || type == 0 || x < length) break;
736 switch (type)
737 {
738 case 1: // Maximum-Receive-Unit
739 if (*p == ConfigNak)
740 {
741 session[s].mru = ntohs(*(uint16_t *)(o + 2));
742 LOG(3, s, t, " Remote requested MRU of %u\n", session[s].mru);
743 }
744 else
745 {
746 session[s].mru = 0;
747 LOG(3, s, t, " Remote rejected MRU negotiation\n");
748 }
749
750 break;
751
752 case 3: // Authentication-Protocol
753 if (authtype > 0)
754 break;
755
756 if (*p == ConfigNak)
757 {
758 int proto = ntohs(*(uint16_t *)(o + 2));
759 if (proto == PPPPAP)
760 {
761 authtype = config->radius_authtypes & AUTHPAP;
762 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
763 authtype ? "accept" : "reject");
764 }
765 else if (proto == PPPCHAP && *(o + 4) == 5)
766 {
767 authtype = config->radius_authtypes & AUTHCHAP;
768 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
769 authtype ? "accept" : "reject");
770 }
771 else
772 {
773 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
774 proto);
775 }
776 }
777 else
778 {
779 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
780 authtype = 0; // shutdown
781 }
782
783 break;
784
785 default:
786 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
787 break;
788 }
789 x -= length;
790 o += length;
791 }
792
793 if (!authtype)
794 {
795 sessionshutdown(s, "Unsupported authentication.", 3, 0);
796 return;
797 }
798
799 if (authtype > 0)
800 sess_local[s].lcp_authtype = authtype;
801
802 switch (session[s].ppp.lcp)
803 {
804 case Closed:
805 case Stopped:
806 {
807 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
808 if (!response) return;
809 *response = TerminateAck;
810 *((uint16_t *) (response + 2)) = htons(l = 4);
811
812 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
813 if (config->debug > 3) dumplcp(response, l);
814
815 tunnelsend(b, l + (response - b), t);
816 }
817 break;
818
819 case RequestSent:
820 case AckSent:
821 initialise_restart_count(s, lcp);
822 sendlcp(s, t);
823 break;
824
825 case AckReceived:
826 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
827 sendlcp(s, t);
828 break;
829
830 case Opened:
831 lcp_restart(s);
832 sendlcp(s, t);
833 break;
834
835 default:
836 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
837 return;
838 }
839 }
840 else if (*p == TerminateReq)
841 {
842 *p = TerminateAck; // close
843 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
844 if (!q) return;
845
846 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
847 if (config->debug > 3) dumplcp(q, l);
848
849 tunnelsend(b, l + (q - b), t); // send it
850 sessionshutdown(s, "Remote end closed connection.", 3, 0);
851 }
852 else if (*p == TerminateAck)
853 {
854 sessionshutdown(s, "Connection closed.", 3, 0);
855 }
856 else if (*p == ProtocolRej)
857 {
858 uint16_t proto = 0;
859
860 if (l > 4)
861 {
862 proto = *(p+4);
863 if (l > 5 && !(proto & 1))
864 {
865 proto <<= 8;
866 proto |= *(p+5);
867 }
868 }
869
870 if (proto == PPPIPV6CP)
871 {
872 LOG(3, s, t, "IPv6 rejected\n");
873 change_state(s, ipv6cp, Closed);
874 }
875 else
876 {
877 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
878 }
879 }
880 else if (*p == EchoReq)
881 {
882 *p = EchoReply; // reply
883 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
884 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
885 if (!q) return;
886
887 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
888 if (config->debug > 3) dumplcp(q, l);
889
890 tunnelsend(b, l + (q - b), t); // send it
891 }
892 else if (*p == EchoReply)
893 {
894 // Ignore it, last_packet time is set earlier than this.
895 }
896 else if (*p != CodeRej)
897 {
898 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
899 }
900 }
901
902 static void ipcp_open(sessionidt s, tunnelidt t)
903 {
904 LOG(3, s, t, "IPCP: Opened, session is now active\n");
905
906 change_state(s, ipcp, Opened);
907
908 if (!session[s].walled_garden)
909 {
910 uint16_t r = radiusnew(s);
911 if (r)
912 radiussend(r, RADIUSSTART); // send radius start
913 }
914
915 // start IPv6 if configured and still in passive state
916 if (session[s].ppp.ipv6cp == Stopped)
917 {
918 sendipv6cp(s, t);
919 change_state(s, ipv6cp, RequestSent);
920 }
921 }
922
923 // Process IPCP messages
924 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
925 {
926 uint8_t b[MAXETHER];
927 uint8_t *q = 0;
928 uint16_t hl;
929
930 CSTAT(processipcp);
931
932 LOG_HEX(5, "IPCP", p, l);
933 if (l < 5)
934 {
935 LOG(1, s, t, "Short IPCP %d bytes\n", l);
936 STAT(tunnel_rx_errors);
937 return ;
938 }
939
940 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
941 {
942 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
943 STAT(tunnel_rx_errors);
944 return ;
945 }
946 l = hl;
947
948 if (session[s].ppp.phase < Network)
949 {
950 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
951 return;
952 }
953
954 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
955
956 if (*p == ConfigAck)
957 {
958 switch (session[s].ppp.ipcp)
959 {
960 case RequestSent:
961 initialise_restart_count(s, ipcp);
962 change_state(s, ipcp, AckReceived);
963 break;
964
965 case AckReceived:
966 case Opened:
967 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
968 sendipcp(s, t);
969 change_state(s, ipcp, RequestSent);
970 break;
971
972 case AckSent:
973 ipcp_open(s, t);
974 break;
975
976 default:
977 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
978 }
979 }
980 else if (*p == ConfigReq)
981 {
982 uint8_t *response = 0;
983 uint8_t *o = p + 4;
984 int length = l - 4;
985 int gotip = 0;
986 in_addr_t addr;
987
988 while (length > 2)
989 {
990 switch (*o)
991 {
992 case 3: // ip address
993 gotip++; // seen address
994 if (o[1] != 6 || o[1] > length) return;
995
996 addr = htonl(session[s].ip);
997 if (memcmp(o + 2, &addr, (sizeof addr)))
998 {
999 uint8_t *oq = q;
1000 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1001 if (!q || (q != oq && *response == ConfigRej))
1002 {
1003 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1004 return;
1005 }
1006 }
1007
1008 break;
1009
1010 case 129: // primary DNS
1011 if (o[1] != 6 || o[1] > length) return;
1012
1013 addr = htonl(session[s].dns1);
1014 if (memcmp(o + 2, &addr, (sizeof addr)))
1015 {
1016 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1017 if (!q) return;
1018 }
1019
1020 break;
1021
1022 case 131: // secondary DNS
1023 if (o[1] != 6 || o[1] > length) return;
1024
1025 addr = htonl(session[s].dns1);
1026 if (memcmp(o + 2, &addr, sizeof(addr)))
1027 {
1028 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1029 if (!q) return;
1030 }
1031
1032 break;
1033
1034 default:
1035 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1036 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1037 if (!q) return;
1038 }
1039
1040 length -= o[1];
1041 o += o[1];
1042 }
1043
1044 if (response)
1045 {
1046 l = q - response; // IPCP packet length
1047 *((uint16_t *) (response + 2)) = htons(l); // update header
1048 }
1049 else if (gotip)
1050 {
1051 // Send packet back as ConfigAck
1052 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1053 if (!response) return;
1054 *response = ConfigAck;
1055 }
1056 else
1057 {
1058 LOG(1, s, t, "No IP in IPCP request\n");
1059 STAT(tunnel_rx_errors);
1060 return;
1061 }
1062
1063 switch (session[s].ppp.ipcp)
1064 {
1065 case Closed:
1066 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1067 if (!response) return;
1068 *response = TerminateAck;
1069 *((uint16_t *) (response + 2)) = htons(l = 4);
1070 break;
1071
1072 case Stopped:
1073 initialise_restart_count(s, ipcp);
1074 sendipcp(s, t);
1075 if (*response == ConfigAck)
1076 change_state(s, ipcp, AckSent);
1077 else
1078 change_state(s, ipcp, RequestSent);
1079
1080 break;
1081
1082 case RequestSent:
1083 if (*response == ConfigAck)
1084 change_state(s, ipcp, AckSent);
1085
1086 break;
1087
1088 case AckReceived:
1089 if (*response == ConfigAck)
1090 ipcp_open(s, t);
1091
1092 break;
1093
1094 case Opened:
1095 initialise_restart_count(s, ipcp);
1096 sendipcp(s, t);
1097 /* fallthrough */
1098
1099 case AckSent:
1100 if (*response == ConfigAck)
1101 change_state(s, ipcp, AckSent);
1102 else
1103 change_state(s, ipcp, RequestSent);
1104
1105 break;
1106
1107 default:
1108 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1109 return;
1110 }
1111
1112 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1113 tunnelsend(b, l + (response - b), t);
1114 }
1115 else if (*p == TerminateReq)
1116 {
1117 *p = TerminateAck;
1118 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1119 if (!q) return;
1120 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1121 tunnelsend(b, l + (q - b), t);
1122 change_state(s, ipcp, Stopped);
1123 }
1124 else if (*p != CodeRej)
1125 {
1126 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1127 }
1128 }
1129
1130 static void ipv6cp_open(sessionidt s, tunnelidt t)
1131 {
1132 LOG(3, s, t, "IPV6CP: Opened\n");
1133
1134 change_state(s, ipv6cp, Opened);
1135 if (session[s].ipv6prefixlen)
1136 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1137
1138 // Send an initial RA (TODO: Should we send these regularly?)
1139 send_ipv6_ra(s, t, NULL);
1140 }
1141
1142 // Process IPV6CP messages
1143 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1144 {
1145 uint8_t b[MAXETHER];
1146 uint8_t *q = 0;
1147 uint16_t hl;
1148
1149 CSTAT(processipv6cp);
1150
1151 LOG_HEX(5, "IPV6CP", p, l);
1152 if (l < 4)
1153 {
1154 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1155 STAT(tunnel_rx_errors);
1156 return ;
1157 }
1158
1159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1160 {
1161 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1162 STAT(tunnel_rx_errors);
1163 return ;
1164 }
1165 l = hl;
1166
1167 if (session[s].ppp.phase < Network)
1168 {
1169 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1170 return;
1171 }
1172
1173 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1174
1175 if (!session[s].ip)
1176 {
1177 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1178 return; // need IPCP to complete...
1179 }
1180
1181 if (*p == ConfigAck)
1182 {
1183 switch (session[s].ppp.ipv6cp)
1184 {
1185 case RequestSent:
1186 initialise_restart_count(s, ipv6cp);
1187 change_state(s, ipv6cp, AckReceived);
1188 break;
1189
1190 case AckReceived:
1191 case Opened:
1192 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1193 sendipv6cp(s, t);
1194 change_state(s, ipv6cp, RequestSent);
1195 break;
1196
1197 case AckSent:
1198 ipv6cp_open(s, t);
1199 break;
1200
1201 default:
1202 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1203 }
1204 }
1205 else if (*p == ConfigReq)
1206 {
1207 uint8_t *response = 0;
1208 uint8_t *o = p + 4;
1209 int length = l - 4;
1210 int gotip = 0;
1211 uint8_t ident[8];
1212
1213 while (length > 2)
1214 {
1215 switch (*o)
1216 {
1217 case 1: // interface identifier
1218 gotip++; // seen address
1219 if (o[1] != 10 || o[1] > length) return;
1220
1221 *(uint32_t *) ident = htonl(session[s].ip);
1222 *(uint32_t *) (ident + 4) = 0;
1223
1224 if (memcmp(o + 2, ident, sizeof(ident)))
1225 {
1226 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1227 if (!q) return;
1228 }
1229
1230 break;
1231
1232 default:
1233 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1234 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1235 if (!q) return;
1236 }
1237
1238 length -= o[1];
1239 o += o[1];
1240 }
1241
1242 if (response)
1243 {
1244 l = q - response; // IPV6CP packet length
1245 *((uint16_t *) (response + 2)) = htons(l); // update header
1246 }
1247 else if (gotip)
1248 {
1249 // Send packet back as ConfigAck
1250 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1251 if (!response) return;
1252 *response = ConfigAck;
1253 }
1254 else
1255 {
1256 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1257 STAT(tunnel_rx_errors);
1258 return;
1259 }
1260
1261 switch (session[s].ppp.ipv6cp)
1262 {
1263 case Closed:
1264 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1265 if (!response) return;
1266 *response = TerminateAck;
1267 *((uint16_t *) (response + 2)) = htons(l = 4);
1268 break;
1269
1270 case Stopped:
1271 initialise_restart_count(s, ipv6cp);
1272 sendipv6cp(s, t);
1273 if (*response == ConfigAck)
1274 change_state(s, ipv6cp, AckSent);
1275 else
1276 change_state(s, ipv6cp, RequestSent);
1277
1278 break;
1279
1280 case RequestSent:
1281 if (*response == ConfigAck)
1282 change_state(s, ipv6cp, AckSent);
1283
1284 break;
1285
1286 case AckReceived:
1287 if (*response == ConfigAck)
1288 ipv6cp_open(s, t);
1289
1290 break;
1291
1292 case Opened:
1293 initialise_restart_count(s, ipv6cp);
1294 sendipv6cp(s, t);
1295 /* fallthrough */
1296
1297 case AckSent:
1298 if (*response == ConfigAck)
1299 change_state(s, ipv6cp, AckSent);
1300 else
1301 change_state(s, ipv6cp, RequestSent);
1302
1303 break;
1304
1305 default:
1306 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1307 return;
1308 }
1309
1310 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1311 tunnelsend(b, l + (response - b), t);
1312 }
1313 else if (*p == TerminateReq)
1314 {
1315 *p = TerminateAck;
1316 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1317 if (!q) return;
1318 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1319 tunnelsend(b, l + (q - b), t);
1320 change_state(s, ipv6cp, Stopped);
1321 }
1322 else if (*p != CodeRej)
1323 {
1324 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1325 }
1326 }
1327
1328 // process IP packet received
1329 //
1330 // This MUST be called with at least 4 byte behind 'p'.
1331 // (i.e. this routine writes to p[-4]).
1332 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1333 {
1334 in_addr_t ip;
1335
1336 CSTAT(processipin);
1337
1338 LOG_HEX(5, "IP", p, l);
1339
1340 ip = ntohl(*(uint32_t *)(p + 12));
1341
1342 if (l > MAXETHER)
1343 {
1344 LOG(1, s, t, "IP packet too long %d\n", l);
1345 STAT(tunnel_rx_errors);
1346 return ;
1347 }
1348
1349 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1350 return;
1351
1352 // no spoof (do sessionbyip to handled statically routed subnets)
1353 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1354 {
1355 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1356 return;
1357 }
1358
1359 // run access-list if any
1360 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1361 return;
1362
1363 // Add on the tun header
1364 p -= 4;
1365 *(uint32_t *) p = htonl(PKTIP);
1366 l += 4;
1367
1368 // Are we throttled and a slave?
1369 if (session[s].tbf_in && !config->cluster_iam_master) {
1370 // Pass it to the master for handling.
1371 master_throttle_packet(session[s].tbf_in, p, l);
1372 return;
1373 }
1374
1375 // Are we throttled and a master??
1376 if (session[s].tbf_in && config->cluster_iam_master) {
1377 // Actually handle the throttled packets.
1378 tbf_queue_packet(session[s].tbf_in, p, l);
1379 return;
1380 }
1381
1382 // send to ethernet
1383 if (tun_write(p, l) < 0)
1384 {
1385 STAT(tun_tx_errors);
1386 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1387 l, strerror(errno), tunfd, p);
1388
1389 return;
1390 }
1391
1392 p += 4;
1393 l -= 4;
1394
1395 if (session[s].snoop_ip && session[s].snoop_port)
1396 {
1397 // Snooping this session
1398 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1399 }
1400
1401 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1402 session[s].cin_delta += l;
1403 session[s].pin++;
1404
1405 sess_local[s].cin += l;
1406 sess_local[s].pin++;
1407
1408 eth_tx += l;
1409
1410 STAT(tun_tx_packets);
1411 INC_STAT(tun_tx_bytes, l);
1412 }
1413
1414 // process IPv6 packet received
1415 //
1416 // This MUST be called with at least 4 byte behind 'p'.
1417 // (i.e. this routine writes to p[-4]).
1418 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1419 {
1420 struct in6_addr ip;
1421 in_addr_t ipv4;
1422
1423 CSTAT(processipv6in);
1424
1425 LOG_HEX(5, "IPv6", p, l);
1426
1427 ip = *(struct in6_addr *) (p + 8);
1428 ipv4 = ntohl(*(uint32_t *)(p + 16));
1429
1430 if (l > MAXETHER)
1431 {
1432 LOG(1, s, t, "IP packet too long %d\n", l);
1433 STAT(tunnel_rx_errors);
1434 return ;
1435 }
1436
1437 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1438 return;
1439
1440 // no spoof
1441 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1442 {
1443 char str[INET6_ADDRSTRLEN];
1444 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1445 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1446 return;
1447 }
1448
1449 // Check if it's a Router Solicition message.
1450 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1451 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1452 *(uint32_t *)(p + 34) == 0 &&
1453 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1454 LOG(3, s, t, "Got IPv6 RS\n");
1455 send_ipv6_ra(s, t, &ip);
1456 return;
1457 }
1458
1459 // Add on the tun header
1460 p -= 4;
1461 *(uint32_t *) p = htonl(PKTIPV6);
1462 l += 4;
1463
1464 // Are we throttled and a slave?
1465 if (session[s].tbf_in && !config->cluster_iam_master) {
1466 // Pass it to the master for handling.
1467 master_throttle_packet(session[s].tbf_in, p, l);
1468 return;
1469 }
1470
1471 // Are we throttled and a master??
1472 if (session[s].tbf_in && config->cluster_iam_master) {
1473 // Actually handle the throttled packets.
1474 tbf_queue_packet(session[s].tbf_in, p, l);
1475 return;
1476 }
1477
1478 // send to ethernet
1479 if (tun_write(p, l) < 0)
1480 {
1481 STAT(tun_tx_errors);
1482 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1483 l, strerror(errno), tunfd, p);
1484
1485 return;
1486 }
1487
1488 p += 4;
1489 l -= 4;
1490
1491 if (session[s].snoop_ip && session[s].snoop_port)
1492 {
1493 // Snooping this session
1494 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1495 }
1496
1497 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1498 session[s].cin_delta += l;
1499 session[s].pin++;
1500
1501 sess_local[s].cin += l;
1502 sess_local[s].pin++;
1503
1504 eth_tx += l;
1505
1506 STAT(tun_tx_packets);
1507 INC_STAT(tun_tx_bytes, l);
1508 }
1509
1510 //
1511 // Helper routine for the TBF filters.
1512 // Used to send queued data in from the user.
1513 //
1514 void send_ipin(sessionidt s, uint8_t *buf, int len)
1515 {
1516 LOG_HEX(5, "IP in throttled", buf, len);
1517
1518 if (write(tunfd, buf, len) < 0)
1519 {
1520 STAT(tun_tx_errors);
1521 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1522 len, strerror(errno), tunfd, buf);
1523
1524 return;
1525 }
1526
1527 buf += 4;
1528 len -= 4;
1529
1530 if (session[s].snoop_ip && session[s].snoop_port)
1531 {
1532 // Snooping this session
1533 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1534 }
1535
1536 // Increment packet counters
1537 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1538 session[s].cin_delta += len;
1539 session[s].pin++;
1540
1541 sess_local[s].cin += len;
1542 sess_local[s].pin++;
1543
1544 eth_tx += len;
1545
1546 STAT(tun_tx_packets);
1547 INC_STAT(tun_tx_bytes, len - 4);
1548 }
1549
1550
1551 // Process CCP messages
1552 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1553 {
1554 uint8_t b[MAXETHER];
1555 uint8_t *q;
1556
1557 CSTAT(processccp);
1558
1559 LOG_HEX(5, "CCP", p, l);
1560
1561 if (session[s].ppp.phase < Network)
1562 {
1563 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1564 return;
1565 }
1566
1567 if (l < 1)
1568 {
1569 LOG(1, s, t, "Short CCP packet\n");
1570 STAT(tunnel_rx_errors);
1571 }
1572
1573 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1574 if (*p == ConfigAck)
1575 {
1576 switch (session[s].ppp.ccp)
1577 {
1578 case RequestSent:
1579 initialise_restart_count(s, ccp);
1580 change_state(s, ccp, AckReceived);
1581 break;
1582
1583 case AckReceived:
1584 case Opened:
1585 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1586 sendccp(s, t);
1587 change_state(s, ccp, RequestSent);
1588 break;
1589
1590 case AckSent:
1591 LOG(3, s, t, "CCP: Opened\n");
1592 change_state(s, ccp, Opened);
1593 break;
1594
1595 default:
1596 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1597 }
1598 }
1599 else if (*p == ConfigReq)
1600 {
1601 if (l < 6) // accept no compression
1602 *p = ConfigAck;
1603 else // compression requested--reject
1604 *p = ConfigRej;
1605
1606 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1607 if (!q) return;
1608
1609 switch (session[s].ppp.ccp)
1610 {
1611 case Closed:
1612 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1613 if (!q) return;
1614 *q = TerminateAck;
1615 *((uint16_t *) (q + 2)) = htons(l = 4);
1616 break;
1617
1618 case Stopped:
1619 initialise_restart_count(s, ccp);
1620 sendccp(s, t);
1621 if (*q == ConfigAck)
1622 change_state(s, ccp, AckSent);
1623 else
1624 change_state(s, ccp, RequestSent);
1625
1626 break;
1627
1628 case RequestSent:
1629 if (*q == ConfigAck)
1630 change_state(s, ccp, AckSent);
1631
1632 break;
1633
1634 case AckReceived:
1635 if (*q == ConfigAck)
1636 change_state(s, ccp, Opened);
1637
1638 break;
1639
1640 case Opened:
1641 initialise_restart_count(s, ccp);
1642 sendccp(s, t);
1643 /* fallthrough */
1644
1645 case AckSent:
1646 if (*q == ConfigAck)
1647 change_state(s, ccp, AckSent);
1648 else
1649 change_state(s, ccp, RequestSent);
1650
1651 break;
1652
1653 default:
1654 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1655 return;
1656 }
1657
1658 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1659 tunnelsend(b, l + (q - b), t);
1660 }
1661 else if (*p == TerminateReq)
1662 {
1663 *p = TerminateAck;
1664 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1665 if (!q) return;
1666 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1667 tunnelsend(b, l + (q - b), t);
1668 change_state(s, ccp, Stopped);
1669 }
1670 else if (*p != CodeRej)
1671 {
1672 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1673 }
1674 }
1675
1676 // send a CHAP challenge
1677 void sendchap(sessionidt s, tunnelidt t)
1678 {
1679 uint8_t b[MAXETHER];
1680 uint16_t r;
1681 uint8_t *q;
1682
1683 CSTAT(sendchap);
1684
1685 r = radiusnew(s);
1686 if (!r)
1687 {
1688 LOG(1, s, t, "No RADIUS to send challenge\n");
1689 STAT(tunnel_tx_errors);
1690 return;
1691 }
1692
1693 LOG(1, s, t, "Send CHAP challenge\n");
1694
1695 radius[r].chap = 1; // CHAP not PAP
1696 radius[r].id++;
1697 if (radius[r].state != RADIUSCHAP)
1698 radius[r].try = 0;
1699
1700 radius[r].state = RADIUSCHAP;
1701 radius[r].retry = backoff(radius[r].try++);
1702 if (radius[r].try > 5)
1703 {
1704 sessionshutdown(s, "CHAP timeout.", 3, 0);
1705 STAT(tunnel_tx_errors);
1706 return ;
1707 }
1708 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1709 if (!q) return;
1710
1711 *q = 1; // challenge
1712 q[1] = radius[r].id; // ID
1713 q[4] = 16; // value size (size of challenge)
1714 memcpy(q + 5, radius[r].auth, 16); // challenge
1715 strcpy((char *) q + 21, hostname); // our name
1716 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1717 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1718 }
1719
1720 // fill in a L2TP message with a PPP frame,
1721 // copies existing PPP message and changes magic number if seen
1722 // returns start of PPP frame
1723 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1724 {
1725 if (size < 12) // Need more space than this!!
1726 {
1727 static int backtrace_count = 0;
1728 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1729 log_backtrace(backtrace_count, 5)
1730 return NULL;
1731 }
1732
1733 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1734 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1735 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1736 b += 6;
1737 if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1738 {
1739 *(uint16_t *) b = htons(0xFF03); // HDLC header
1740 b += 2;
1741 }
1742 if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1743 *b++ = mtype;
1744 else
1745 {
1746 *(uint16_t *) b = htons(mtype);
1747 b += 2;
1748 }
1749
1750 if (l + 12 > size)
1751 {
1752 static int backtrace_count = 0;
1753 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1754 log_backtrace(backtrace_count, 5)
1755 return NULL;
1756 }
1757
1758 if (p && l)
1759 memcpy(b, p, l);
1760
1761 return b;
1762 }
1763
1764 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1765 {
1766 int len = 0;
1767 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1768 return 0;
1769
1770 *b++ = 3; // Authentication-Protocol
1771 if (authtype == AUTHCHAP)
1772 {
1773 len = *b++ = 5; // length
1774 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1775 *b++ = 5; // MD5
1776 }
1777 else if (authtype == AUTHPAP)
1778 {
1779 len = *b++ = 4; // length
1780 *(uint16_t *) b = htons(PPPPAP); b += 2;
1781 }
1782 else
1783 {
1784 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1785 }
1786
1787 return len;
1788 }
1789
1790 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1791 void sendlcp(sessionidt s, tunnelidt t)
1792 {
1793 uint8_t b[500], *q, *l;
1794 int authtype = sess_local[s].lcp_authtype;
1795
1796 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1797 return;
1798
1799 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1800 authtype ? " (" : "",
1801 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1802 authtype ? ")" : "");
1803
1804 l = q;
1805 *l++ = ConfigReq;
1806 *l++ = ++sess_local[s].lcp_ident; // ID
1807
1808 l += 2; //Save space for length
1809
1810 if (session[s].mru)
1811 {
1812 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1813 *(uint16_t *) l = htons(session[s].mru); l += 2;
1814 }
1815
1816 if (authtype)
1817 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1818
1819 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1820 *(uint32_t *) l = htonl(session[s].magic);
1821 l += 4;
1822
1823 *(uint16_t *)(q + 2) = htons(l - q); // Length
1824
1825 LOG_HEX(5, "PPPLCP", q, l - q);
1826 if (config->debug > 3) dumplcp(q, l - q);
1827
1828 tunnelsend(b, (l - b), t);
1829 }
1830
1831 // Send CCP request for no compression
1832 void sendccp(sessionidt s, tunnelidt t)
1833 {
1834 uint8_t b[500], *q;
1835
1836 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1837 return;
1838
1839 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1840
1841 *q = ConfigReq;
1842 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1843 *(uint16_t *)(q + 2) = htons(4); // Length
1844
1845 LOG_HEX(5, "PPPCCP", q, 4);
1846 tunnelsend(b, (q - b) + 4 , t);
1847 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"