ppp.c

   1 // L2TPNS PPP Stuff
   2
   3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.83 2005/09/16 05:20:32 bodea Exp $";
   4
   5 #include <stdio.h>
   6 #include <string.h>
   7 #include <unistd.h>
   8 #include <errno.h>
   9 #include <stdlib.h>
  10 #include "l2tpns.h"
  11 #include "constants.h"
  12 #include "plugin.h"
  13 #include "util.h"
  14 #include "tbf.h"
  15 #include "cluster.h"
  16
  17 extern tunnelt *tunnel;
  18 extern sessiont *session;
  19 extern radiust *radius;
  20 extern int tunfd;
  21 extern char hostname[];
  22 extern uint32_t eth_tx;
  23 extern time_t time_now;
  24 extern configt *config;
  25
  26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
  27
  28 // Process PAP messages
  29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
  30 {
  31         char user[MAXUSER];
  32         char pass[MAXPASS];
  33         uint16_t hl;
  34         uint16_t r;
  35
  36         CSTAT(processpap);
  37
  38         LOG_HEX(5, "PAP", p, l);
  39         if (l < 4)
  40         {
  41                 LOG(1, s, t, "Short PAP %u bytes\n", l);
  42                 STAT(tunnel_rx_errors);
  43                 sessionshutdown(s, "Short PAP packet.", 3, 0);
  44                 return;
  45         }
  46
  47         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
  48         {
  49                 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
  50                 STAT(tunnel_rx_errors);
  51                 sessionshutdown(s, "PAP length mismatch.", 3, 0);
  52                 return;
  53         }
  54         l = hl;
  55
  56         if (*p != 1)
  57         {
  58                 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
  59                 STAT(tunnel_rx_errors);
  60                 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
  61                 return;
  62         }
  63
  64         if (session[s].ppp.phase != Authenticate)
  65         {
  66                 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
  67                 return;
  68         }
  69
  70         {
  71                 uint8_t *b = p;
  72                 b += 4;
  73                 user[0] = pass[0] = 0;
  74                 if (*b && *b < sizeof(user))
  75                 {
  76                         memcpy(user, b + 1, *b);
  77                         user[*b] = 0;
  78                         b += 1 + *b;
  79                         if (*b && *b < sizeof(pass))
  80                         {
  81                                 memcpy(pass, b + 1, *b);
  82                                 pass[*b] = 0;
  83                         }
  84                 }
  85                 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
  86         }
  87
  88         if (session[s].ip || !(r = radiusnew(s)))
  89         {
  90                 // respond now, either no RADIUS available or already authenticated
  91                 uint8_t b[MAXETHER];
  92                 uint8_t id = p[1];
  93                 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
  94                 if (!p) return;
  95
  96                 if (session[s].ip)
  97                         *p = 2;                         // ACK
  98                 else
  99                         *p = 3;                         // cant authorise
 100                 p[1] = id;
 101                 *(uint16_t *) (p + 2) = htons(5);       // length
 102                 p[4] = 0;                               // no message
 103                 tunnelsend(b, 5 + (p - b), t);          // send it
 104
 105                 if (session[s].ip)
 106                 {
 107                         LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
 108                                 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
 109                 }
 110                 else
 111                 {
 112                         LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
 113                         sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
 114                 }
 115         }
 116         else
 117         {
 118                 // Run PRE_AUTH plugins
 119                 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
 120                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 121                 if (!packet.continue_auth)
 122                 {
 123                         LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
 124                         if (packet.username) free(packet.username);
 125                         if (packet.password) free(packet.password);
 126                         return;
 127                 }
 128
 129                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 130                 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
 131
 132                 free(packet.username);
 133                 free(packet.password);
 134
 135                 radius[r].id = p[1];
 136                 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
 137                 radiussend(r, RADIUSAUTH);
 138         }
 139 }
 140
 141 // Process CHAP messages
 142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 143 {
 144         uint16_t r;
 145         uint16_t hl;
 146
 147         CSTAT(processchap);
 148
 149         LOG_HEX(5, "CHAP", p, l);
 150
 151         if (l < 4)
 152         {
 153                 LOG(1, s, t, "Short CHAP %u bytes\n", l);
 154                 STAT(tunnel_rx_errors);
 155                 sessionshutdown(s, "Short CHAP packet.", 3, 0);
 156                 return;
 157         }
 158
 159         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 160         {
 161                 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
 162                 STAT(tunnel_rx_errors);
 163                 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
 164                 return;
 165         }
 166         l = hl;
 167
 168         if (*p != 2)
 169         {
 170                 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
 171                 STAT(tunnel_rx_errors);
 172                 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
 173                 return;
 174         }
 175
 176         r = sess_local[s].radius;
 177         if (!r)
 178         {
 179                 LOG(3, s, t, "Unexpected CHAP message\n");
 180                 return;
 181         }
 182
 183         if (session[s].ppp.phase != Authenticate)
 184         {
 185                 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
 186                 return;
 187         }
 188
 189         if (p[1] != radius[r].id)
 190         {
 191                 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
 192                 STAT(tunnel_rx_errors);
 193                 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
 194                 return;
 195         }
 196
 197         if (l < 5 || p[4] != 16)
 198         {
 199                 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
 200                 STAT(tunnel_rx_errors);
 201                 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
 202                 return;
 203         }
 204
 205         l -= 5;
 206         p += 5;
 207         if (l < 16 || l - 16 >= sizeof(session[s].user))
 208         {
 209                 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
 210                 STAT(tunnel_rx_errors);
 211                 sessionshutdown(s, "CHAP username too long.", 3, 0);
 212                 return;
 213         }
 214
 215         // Run PRE_AUTH plugins
 216         {
 217                 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
 218
 219                 packet.password = calloc(17, 1);
 220                 memcpy(packet.password, p, 16);
 221
 222                 p += 16;
 223                 l -= 16;
 224
 225                 packet.username = calloc(l + 1, 1);
 226                 memcpy(packet.username, p, l);
 227
 228                 run_plugins(PLUGIN_PRE_AUTH, &packet);
 229                 if (!packet.continue_auth)
 230                 {
 231                         LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
 232                         if (packet.username) free(packet.username);
 233                         if (packet.password) free(packet.password);
 234                         return;
 235                 }
 236
 237                 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 238                 memcpy(radius[r].pass, packet.password, 16);
 239
 240                 free(packet.username);
 241                 free(packet.password);
 242         }
 243
 244         radius[r].chap = 1;
 245         LOG(3, s, t, "CHAP login %s\n", session[s].user);
 246         radiussend(r, RADIUSAUTH);
 247 }
 248
 249 static void dumplcp(uint8_t *p, int l)
 250 {
 251         int x = l - 4;
 252         uint8_t *o = (p + 4);
 253
 254         LOG_HEX(5, "PPP LCP Packet", p, l);
 255         LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
 256         LOG(4, 0, 0, "Length: %d\n", l);
 257         if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
 258                 return;
 259
 260         while (x > 2)
 261         {
 262                 int type = o[0];
 263                 int length = o[1];
 264                 if (length < 2)
 265                 {
 266                         LOG(4, 0, 0, "  Option length is %d...\n", length);
 267                         break;
 268                 }
 269                 if (type == 0)
 270                 {
 271                         LOG(4, 0, 0, "  Option type is 0...\n");
 272                         x -= length;
 273                         o += length;
 274                         continue;
 275                 }
 276                 switch (type)
 277                 {
 278                         case 1: // Maximum-Receive-Unit
 279                                 if (length == 4)
 280                                         LOG(4, 0, 0, "    %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
 281                                 else
 282                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 283                                 break;
 284                         case 2: // Async-Control-Character-Map
 285                                 if (length == 6)
 286                                 {
 287                                         uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
 288                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), asyncmap);
 289                                 }
 290                                 else
 291                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 292                                 break;
 293                         case 3: // Authentication-Protocol
 294                                 if (length == 4)
 295                                 {
 296                                         int proto = ntohs(*(uint16_t *)(o + 2));
 297                                         LOG(4, 0, 0, "    %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
 298                                                 proto == PPPPAP  ? "PAP"  : "UNSUPPORTED");
 299                                 }
 300                                 else if (length == 5)
 301                                 {
 302                                         int proto = ntohs(*(uint16_t *)(o + 2));
 303                                         int algo = *(o + 4);
 304                                         LOG(4, 0, 0, "    %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
 305                                                 (proto == PPPCHAP && algo == 5) ? "CHAP MD5"  : "UNSUPPORTED");
 306                                 }
 307                                 else
 308                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 309                                 break;
 310                         case 4: // Quality-Protocol
 311                                 {
 312                                         uint32_t qp = ntohl(*(uint32_t *)(o + 2));
 313                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), qp);
 314                                 }
 315                                 break;
 316                         case 5: // Magic-Number
 317                                 if (length == 6)
 318                                 {
 319                                         uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
 320                                         LOG(4, 0, 0, "    %s %x\n", ppp_lcp_option(type), magicno);
 321                                 }
 322                                 else
 323                                         LOG(4, 0, 0, "    %s odd length %d\n", ppp_lcp_option(type), length);
 324                                 break;
 325                         case 7: // Protocol-Field-Compression
 326                         case 8: // Address-And-Control-Field-Compression
 327                                 LOG(4, 0, 0, "    %s\n", ppp_lcp_option(type));
 328                                 break;
 329                         default:
 330                                 LOG(2, 0, 0, "    Unknown PPP LCP Option type %d\n", type);
 331                                 break;
 332                 }
 333                 x -= length;
 334                 o += length;
 335         }
 336 }
 337
 338 void lcp_open(sessionidt s, tunnelidt t)
 339 {
 340         // transition to Authentication or Network phase:
 341         session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
 342
 343         LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
 344
 345         // LCP now Opened
 346         change_state(s, lcp, Opened);
 347
 348         if (session[s].ppp.phase == Authenticate)
 349         {
 350                 if (sess_local[s].lcp_authtype == AUTHCHAP)
 351                         sendchap(s, t);
 352         }
 353         else
 354         {
 355                 // This-Layer-Up
 356                 sendipcp(s, t);
 357                 change_state(s, ipcp, RequestSent);
 358                 // move to passive state for IPv6 (if configured), CCP
 359                 if (config->ipv6_prefix.s6_addr[0])
 360                         change_state(s, ipv6cp, Stopped);
 361                 else
 362                         change_state(s, ipv6cp, Closed);
 363
 364                 change_state(s, ccp, Stopped);
 365         }
 366 }
 367
 368 static void lcp_restart(sessionidt s)
 369 {
 370         session[s].ppp.phase = Establish;
 371         // This-Layer-Down
 372         change_state(s, ipcp, Dead);
 373         change_state(s, ipv6cp, Dead);
 374         change_state(s, ccp, Dead);
 375 }
 376
 377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
 378         uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
 379 {
 380         if (!*response || **response != ConfigRej)
 381         {
 382                 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
 383                 if (!queued)
 384                         return 0;
 385
 386                 *queued = ConfigRej;
 387                 queued += 4;
 388         }
 389
 390         if ((queued - buf + option[1]) > blen)
 391         {
 392                 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
 393                 return 0;
 394         }
 395
 396         memcpy(queued, option, option[1]);
 397         return queued + option[1];
 398 }
 399
 400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
 401         uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
 402         uint8_t *value, size_t vlen)
 403 {
 404         int *nak_sent;
 405         switch (mtype)
 406         {
 407         case PPPLCP:    nak_sent = &sess_local[s].lcp.nak_sent;    break;
 408         case PPPIPCP:   nak_sent = &sess_local[s].ipcp.nak_sent;   break;
 409         case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
 410         default:        return 0; // ?
 411         }
 412
 413         if (*response && **response != ConfigNak)
 414         {
 415                 if (*nak_sent < config->ppp_max_failure) // reject queued
 416                         return queued;
 417
 418                 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
 419         }
 420
 421         if (!*response)
 422         {
 423                 if (*nak_sent >= config->ppp_max_failure)
 424                         return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
 425
 426                 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
 427                 if (!queued)
 428                         return 0;
 429
 430                 (*nak_sent)++;
 431                 *queued = ConfigNak;
 432                 queued += 4;
 433         }
 434
 435         if ((queued - buf + vlen + 2) > blen)
 436         {
 437                 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
 438                 return 0;
 439         }
 440
 441         *queued++ = *option;
 442         *queued++ = vlen + 2;
 443         memcpy(queued, value, vlen);
 444         return queued + vlen;
 445 }
 446
 447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
 448         char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
 449 {
 450         uint8_t *q;
 451         int mru = session[s].mru;
 452         if (mru > size) mru = size;
 453
 454         l += 4;
 455         if (l > mru) l = mru;
 456
 457         q = makeppp(buf, size, 0, 0, s, t, proto);
 458         if (!q) return;
 459
 460         *q = CodeRej;
 461         *(q + 1) = ++sess_local[s].lcp_ident;
 462         *(uint16_t *)(q + 2) = l;
 463         memcpy(q + 4, p, l - 4);
 464
 465         LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
 466         LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
 467         if (config->debug > 3) dumplcp(q, l);
 468
 469         tunnelsend(buf, l + (q - buf), t);
 470 }
 471
 472 // Process LCP messages
 473 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 474 {
 475         uint8_t b[MAXETHER];
 476         uint8_t *q = NULL;
 477         uint32_t magicno = 0;
 478         uint16_t hl;
 479
 480         CSTAT(processlcp);
 481
 482         LOG_HEX(5, "LCP", p, l);
 483         if (l < 4)
 484         {
 485                 LOG(1, s, t, "Short LCP %d bytes\n", l);
 486                 STAT(tunnel_rx_errors);
 487                 return ;
 488         }
 489
 490         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 491         {
 492                 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
 493                 STAT(tunnel_rx_errors);
 494                 return ;
 495         }
 496         l = hl;
 497
 498         if (session[s].die) // going down...
 499                 return;
 500
 501         LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
 502         if (config->debug > 3) dumplcp(p, l);
 503
 504         if (*p == ConfigAck)
 505         {
 506                 int x = l - 4;
 507                 uint8_t *o = (p + 4);
 508                 int authtype = 0;
 509
 510                 while (x > 2)
 511                 {
 512                         int type = o[0];
 513                         int length = o[1];
 514
 515                         if (length == 0 || type == 0 || x < length) break;
 516                         switch (type)
 517                         {
 518                                 case 3: // Authentication-Protocol
 519                                         {
 520                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 521                                                 if (proto == PPPPAP)
 522                                                         authtype = AUTHPAP;
 523                                                 else if (proto == PPPCHAP && *(o + 4) == 5)
 524                                                         authtype = AUTHCHAP;
 525                                         }
 526
 527                                         break;
 528                         }
 529                         x -= length;
 530                         o += length;
 531                 }
 532
 533                 if (!session[s].ip && authtype)
 534                         sess_local[s].lcp_authtype = authtype;
 535
 536                 switch (session[s].ppp.lcp)
 537                 {
 538                 case RequestSent:
 539                         initialise_restart_count(s, lcp);
 540                         change_state(s, lcp, AckReceived);
 541                         break;
 542
 543                 case AckReceived:
 544                 case Opened:
 545                         LOG(2, s, t, "LCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
 546                         if (session[s].ppp.lcp == Opened)
 547                                 lcp_restart(s);
 548
 549                         sendlcp(s, t);
 550                         change_state(s, lcp, RequestSent);
 551                         break;
 552
 553                 case AckSent:
 554                         lcp_open(s, t);
 555                         break;
 556
 557                 default:
 558                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 559                 }
 560         }
 561         else if (*p == ConfigReq)
 562         {
 563                 int x = l - 4;
 564                 uint8_t *o = (p + 4);
 565                 uint8_t *response = 0;
 566                 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
 567                 static uint8_t authproto[5];
 568
 569                 while (x > 2)
 570                 {
 571                         int type = o[0];
 572                         int length = o[1];
 573
 574                         if (length == 0 || type == 0 || x < length) break;
 575                         switch (type)
 576                         {
 577                                 case 1: // Maximum-Receive-Unit
 578                                         session[s].mru = ntohs(*(uint16_t *)(o + 2));
 579                                         break;
 580
 581                                 case 2: // Async-Control-Character-Map
 582                                         if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
 583                                                 break;
 584
 585                                         LOG(3, s, t, "    Remote requesting asyncmap.  Rejecting.\n");
 586                                         q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
 587                                         break;
 588
 589                                 case 3: // Authentication-Protocol
 590                                         {
 591                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 592                                                 char proto_name[] = "0x0000";
 593                                                 int alen;
 594
 595                                                 if (proto == PPPPAP)
 596                                                 {
 597                                                         if (config->radius_authtypes & AUTHPAP)
 598                                                         {
 599                                                                 sess_local[s].lcp_authtype = AUTHPAP;
 600                                                                 break;
 601                                                         }
 602
 603                                                         strcpy(proto_name, "PAP");
 604                                                 }
 605                                                 else if (proto == PPPCHAP)
 606                                                 {
 607                                                         if (config->radius_authtypes & AUTHCHAP
 608                                                             && *(o + 4) == 5) // MD5
 609                                                         {
 610                                                                 sess_local[s].lcp_authtype = AUTHCHAP;
 611                                                                 break;
 612                                                         }
 613
 614                                                         strcpy(proto_name, "CHAP");
 615                                                 }
 616                                                 else
 617                                                         sprintf(proto_name, "%#4.4x", proto);
 618
 619                                                 LOG(3, s, t, "    Remote requesting %s authentication.  Rejecting.\n", proto_name);
 620
 621                                                 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
 622                                                 if (alen < 2) break; // paranoia
 623
 624                                                 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
 625                                                 if (q && *response == ConfigNak &&
 626                                                         config->radius_authtypes != config->radius_authprefer)
 627                                                 {
 628                                                         // alternate type
 629                                                         alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
 630                                                         if (alen < 2) break;
 631                                                         q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
 632                                                 }
 633
 634                                                 break;
 635                                         }
 636                                         break;
 637
 638                                 case 5: // Magic-Number
 639                                         magicno = ntohl(*(uint32_t *)(o + 2));
 640                                         break;
 641
 642                                 case 4: // Quality-Protocol
 643                                 case 7: // Protocol-Field-Compression
 644                                 case 8: // Address-And-Control-Field-Compression
 645                                         break;
 646
 647                                 default: // Reject any unknown options
 648                                         LOG(3, s, t, "    Rejecting unknown PPP LCP option %d\n", type);
 649                                         q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
 650                         }
 651                         x -= length;
 652                         o += length;
 653                 }
 654
 655                 if (response)
 656                 {
 657                         l = q - response; // LCP packet length
 658                         *((uint16_t *) (response + 2)) = htons(l); // update header
 659                 }
 660                 else
 661                 {
 662                         // Send packet back as ConfigAck
 663                         response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
 664                         if (!response) return;
 665                         *response = ConfigAck;
 666                 }
 667
 668                 switch (session[s].ppp.lcp)
 669                 {
 670                 case Closed:
 671                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
 672                         if (!response) return;
 673                         *response = TerminateAck;
 674                         *((uint16_t *) (response + 2)) = htons(l = 4);
 675                         break;
 676
 677                 case Stopped:
 678                         initialise_restart_count(s, lcp);
 679                         sendlcp(s, t);
 680                         if (*response == ConfigAck)
 681                                 change_state(s, lcp, AckSent);
 682                         else
 683                                 change_state(s, lcp, RequestSent);
 684
 685                         break;
 686
 687                 case RequestSent:
 688                         if (*response == ConfigAck)
 689                                 change_state(s, lcp, AckSent);
 690
 691                         break;
 692
 693                 case AckReceived:
 694                         if (*response == ConfigAck)
 695                                 lcp_open(s, t);
 696
 697                         break;
 698
 699                 case Opened:
 700                         lcp_restart(s);
 701                         sendlcp(s, t);
 702                         /* fallthrough */
 703
 704                 case AckSent:
 705                         if (*response == ConfigAck)
 706                                 change_state(s, lcp, AckSent);
 707                         else
 708                                 change_state(s, lcp, RequestSent);
 709
 710                         break;
 711
 712                 default:
 713                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 714                         return;
 715                 }
 716
 717                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
 718                 if (config->debug > 3) dumplcp(response, l);
 719
 720                 tunnelsend(b, l + (response - b), t);
 721         }
 722         else if (*p == ConfigNak || *p == ConfigRej)
 723         {
 724                 int x = l - 4;
 725                 uint8_t *o = (p + 4);
 726                 int authtype = -1;
 727
 728                 while (x > 2)
 729                 {
 730                         int type = o[0];
 731                         int length = o[1];
 732
 733                         if (length == 0 || type == 0 || x < length) break;
 734                         switch (type)
 735                         {
 736                                 case 1: // Maximum-Receive-Unit
 737                                         if (*p == ConfigNak)
 738                                         {
 739                                                 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
 740                                                 LOG(3, s, t, "    Remote requested MRU of %u\n", sess_local[s].ppp_mru);
 741                                         }
 742                                         else
 743                                         {
 744                                                 sess_local[s].ppp_mru = 0;
 745                                                 LOG(3, s, t, "    Remote rejected MRU negotiation\n");
 746                                         }
 747
 748                                         break;
 749
 750                                 case 3: // Authentication-Protocol
 751                                         if (authtype > 0)
 752                                                 break;
 753
 754                                         if (*p == ConfigNak)
 755                                         {
 756                                                 int proto = ntohs(*(uint16_t *)(o + 2));
 757                                                 if (proto == PPPPAP)
 758                                                 {
 759                                                         authtype = config->radius_authtypes & AUTHPAP;
 760                                                         LOG(3, s, t, "    Remote requested PAP authentication...%sing\n",
 761                                                                 authtype ? "accept" : "reject");
 762                                                 }
 763                                                 else if (proto == PPPCHAP && *(o + 4) == 5)
 764                                                 {
 765                                                         authtype = config->radius_authtypes & AUTHCHAP;
 766                                                         LOG(3, s, t, "    Remote requested CHAP authentication...%sing\n",
 767                                                                 authtype ? "accept" : "reject");
 768                                                 }
 769                                                 else
 770                                                 {
 771                                                         LOG(3, s, t, "    Rejecting unsupported authentication %#4x\n",
 772                                                                 proto);
 773                                                 }
 774                                         }
 775                                         else
 776                                         {
 777                                                 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
 778                                                 authtype = 0; // shutdown
 779                                         }
 780
 781                                         break;
 782
 783                                 default:
 784                                         LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
 785                                         break;
 786                         }
 787                         x -= length;
 788                         o += length;
 789                 }
 790
 791                 if (!authtype)
 792                 {
 793                         sessionshutdown(s, "Unsupported authentication.", 3, 0);
 794                         return;
 795                 }
 796
 797                 if (authtype > 0)
 798                         sess_local[s].lcp_authtype = authtype;
 799
 800                 switch (session[s].ppp.lcp)
 801                 {
 802                 case Closed:
 803                 case Stopped:
 804                         {
 805                                 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
 806                                 if (!response) return;
 807                                 *response = TerminateAck;
 808                                 *((uint16_t *) (response + 2)) = htons(l = 4);
 809
 810                                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
 811                                 if (config->debug > 3) dumplcp(response, l);
 812
 813                                 tunnelsend(b, l + (response - b), t);
 814                         }
 815                         break;
 816
 817                 case RequestSent:
 818                 case AckSent:
 819                         initialise_restart_count(s, lcp);
 820                         sendlcp(s, t);
 821                         break;
 822
 823                 case AckReceived:
 824                         LOG(2, s, t, "LCP: ConfigNak in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
 825                         sendlcp(s, t);
 826                         break;
 827
 828                 case Opened:
 829                         lcp_restart(s);
 830                         sendlcp(s, t);
 831                         break;
 832
 833                 default:
 834                         LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
 835                         return;
 836                 }
 837         }
 838         else if (*p == TerminateReq)
 839         {
 840                 *p = TerminateAck;      // close
 841                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPLCP);
 842                 if (!q) return;
 843
 844                 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
 845                 if (config->debug > 3) dumplcp(q, l);
 846
 847                 tunnelsend(b, l + (q - b), t); // send it
 848                 sessionshutdown(s, "Remote end closed connection.", 3, 0);
 849         }
 850         else if (*p == TerminateAck)
 851         {
 852                 sessionshutdown(s, "Connection closed.", 3, 0);
 853         }
 854         else if (*p == ProtocolRej)
 855         {
 856                 uint16_t proto = 0;
 857
 858                 if (l > 4)
 859                 {
 860                         proto = *(p+4);
 861                         if (l > 5 && !(proto & 1))
 862                         {
 863                                 proto <<= 8;
 864                                 proto |= *(p+5);
 865                         }
 866                 }
 867
 868                 if (proto == PPPIPV6CP)
 869                 {
 870                         LOG(3, s, t, "IPv6 rejected\n");
 871                         change_state(s, ipv6cp, Closed);
 872                 }
 873                 else
 874                 {
 875                         LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
 876                 }
 877         }
 878         else if (*p == EchoReq)
 879         {
 880                 *p = EchoReply;         // reply
 881                 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
 882                 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
 883                 if (!q) return;
 884
 885                 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
 886                 if (config->debug > 3) dumplcp(q, l);
 887
 888                 tunnelsend(b, l + (q - b), t); // send it
 889         }
 890         else if (*p == EchoReply)
 891         {
 892                 // Ignore it, last_packet time is set earlier than this.
 893         }
 894         else if (*p != CodeRej)
 895         {
 896                 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
 897         }
 898 }
 899
 900 static void ipcp_open(sessionidt s, tunnelidt t)
 901 {
 902         LOG(3, s, t, "IPCP: Opened, session is now active\n");
 903
 904         change_state(s, ipcp, Opened);
 905
 906         if (!session[s].walled_garden)
 907         {
 908                 uint16_t r = radiusnew(s);
 909                 if (r)
 910                         radiussend(r, RADIUSSTART); // send radius start
 911         }
 912
 913         // start IPv6 if configured and still in passive state
 914         if (session[s].ppp.ipv6cp == Stopped)
 915         {
 916                 sendipv6cp(s, t);
 917                 change_state(s, ipv6cp, RequestSent);
 918         }
 919 }
 920
 921 // Process IPCP messages
 922 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 923 {
 924         uint8_t b[MAXETHER];
 925         uint8_t *q = 0;
 926         uint16_t hl;
 927
 928         CSTAT(processipcp);
 929
 930         LOG_HEX(5, "IPCP", p, l);
 931         if (l < 5)
 932         {
 933                 LOG(1, s, t, "Short IPCP %d bytes\n", l);
 934                 STAT(tunnel_rx_errors);
 935                 return ;
 936         }
 937
 938         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
 939         {
 940                 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
 941                 STAT(tunnel_rx_errors);
 942                 return ;
 943         }
 944         l = hl;
 945
 946         if (session[s].ppp.phase < Network)
 947         {
 948                 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
 949                 return;
 950         }
 951
 952         LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
 953
 954         if (*p == ConfigAck)
 955         {
 956                 switch (session[s].ppp.ipcp)
 957                 {
 958                 case RequestSent:
 959                         initialise_restart_count(s, ipcp);
 960                         change_state(s, ipcp, AckReceived);
 961                         break;
 962
 963                 case AckReceived:
 964                 case Opened:
 965                         LOG(2, s, t, "IPCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
 966                         sendipcp(s, t);
 967                         change_state(s, ipcp, RequestSent);
 968                         break;
 969
 970                 case AckSent:
 971                         ipcp_open(s, t);
 972                         break;
 973
 974                 default:
 975                         LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
 976                 }
 977         }
 978         else if (*p == ConfigReq)
 979         {
 980                 uint8_t *response = 0;
 981                 uint8_t *o = p + 4;
 982                 int length = l - 4;
 983                 int gotip = 0;
 984                 in_addr_t addr;
 985
 986                 while (length > 2)
 987                 {
 988                         switch (*o)
 989                         {
 990                         case 3: // ip address
 991                                 gotip++; // seen address
 992                                 if (o[1] != 6 || o[1] > length) return;
 993
 994                                 addr = htonl(session[s].ip);
 995                                 if (memcmp(o + 2, &addr, (sizeof addr)))
 996                                 {
 997                                         uint8_t *oq = q;
 998                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
 999                                         if (!q || (q != oq && *response == ConfigRej))
1000                                         {
1001                                                 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1002                                                 return;
1003                                         }
1004                                 }
1005
1006                                 break;
1007
1008                         case 129: // primary DNS
1009                                 if (o[1] != 6 || o[1] > length) return;
1010
1011                                 addr = htonl(session[s].dns1);
1012                                 if (memcmp(o + 2, &addr, (sizeof addr)))
1013                                 {
1014                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1015                                         if (!q) return;
1016                                 }
1017
1018                                 break;
1019
1020                         case 131: // secondary DNS
1021                                 if (o[1] != 6 || o[1] > length) return;
1022
1023                                 addr = htonl(session[s].dns1);
1024                                 if (memcmp(o + 2, &addr, sizeof(addr)))
1025                                 {
1026                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1027                                         if (!q) return;
1028                                 }
1029
1030                                 break;
1031
1032                         default:
1033                                 LOG(2, s, t, "    Rejecting PPP IPCP Option type %d\n", *o);
1034                                 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1035                                 if (!q) return;
1036                         }
1037
1038                         length -= o[1];
1039                         o += o[1];
1040                 }
1041
1042                 if (response)
1043                 {
1044                         l = q - response; // IPCP packet length
1045                         *((uint16_t *) (response + 2)) = htons(l); // update header
1046                 }
1047                 else if (gotip)
1048                 {
1049                         // Send packet back as ConfigAck
1050                         response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1051                         if (!response) return;
1052                         *response = ConfigAck;
1053                 }
1054                 else
1055                 {
1056                         LOG(1, s, t, "No IP in IPCP request\n");
1057                         STAT(tunnel_rx_errors);
1058                         return;
1059                 }
1060
1061                 switch (session[s].ppp.ipcp)
1062                 {
1063                 case Closed:
1064                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1065                         if (!response) return;
1066                         *response = TerminateAck;
1067                         *((uint16_t *) (response + 2)) = htons(l = 4);
1068                         break;
1069
1070                 case Stopped:
1071                         initialise_restart_count(s, ipcp);
1072                         sendipcp(s, t);
1073                         if (*response == ConfigAck)
1074                                 change_state(s, ipcp, AckSent);
1075                         else
1076                                 change_state(s, ipcp, RequestSent);
1077
1078                         break;
1079
1080                 case RequestSent:
1081                         if (*response == ConfigAck)
1082                                 change_state(s, ipcp, AckSent);
1083
1084                         break;
1085
1086                 case AckReceived:
1087                         if (*response == ConfigAck)
1088                                 ipcp_open(s, t);
1089
1090                         break;
1091
1092                 case Opened:
1093                         initialise_restart_count(s, ipcp);
1094                         sendipcp(s, t);
1095                         /* fallthrough */
1096
1097                 case AckSent:
1098                         if (*response == ConfigAck)
1099                                 change_state(s, ipcp, AckSent);
1100                         else
1101                                 change_state(s, ipcp, RequestSent);
1102
1103                         break;
1104
1105                 default:
1106                         LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1107                         return;
1108                 }
1109
1110                 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1111                 tunnelsend(b, l + (response - b), t);
1112         }
1113         else if (*p == TerminateReq)
1114         {
1115                 *p = TerminateAck;
1116                 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1117                 if (!q) return;
1118                 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1119                 tunnelsend(b, l + (q - b), t);
1120                 change_state(s, ipcp, Stopped);
1121         }
1122         else if (*p != CodeRej)
1123         {
1124                 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1125         }
1126 }
1127
1128 static void ipv6cp_open(sessionidt s, tunnelidt t)
1129 {
1130         LOG(3, s, t, "IPV6CP: Opened\n");
1131
1132         change_state(s, ipv6cp, Opened);
1133         if (session[s].ipv6prefixlen)
1134                 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1135
1136         // Send an initial RA (TODO: Should we send these regularly?)
1137         send_ipv6_ra(s, t, NULL);
1138 }
1139
1140 // Process IPV6CP messages
1141 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1142 {
1143         uint8_t b[MAXETHER];
1144         uint8_t *q = 0;
1145         uint16_t hl;
1146
1147         CSTAT(processipv6cp);
1148
1149         LOG_HEX(5, "IPV6CP", p, l);
1150         if (l < 4)
1151         {
1152                 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1153                 STAT(tunnel_rx_errors);
1154                 return ;
1155         }
1156
1157         if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1158         {
1159                 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1160                 STAT(tunnel_rx_errors);
1161                 return ;
1162         }
1163         l = hl;
1164
1165         if (session[s].ppp.phase < Network)
1166         {
1167                 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1168                 return;
1169         }
1170
1171         LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1172
1173         if (!session[s].ip)
1174         {
1175                 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1176                 return; // need IPCP to complete...
1177         }
1178
1179         if (*p == ConfigAck)
1180         {
1181                 switch (session[s].ppp.ipv6cp)
1182                 {
1183                 case RequestSent:
1184                         initialise_restart_count(s, ipv6cp);
1185                         change_state(s, ipv6cp, AckReceived);
1186                         break;
1187
1188                 case AckReceived:
1189                 case Opened:
1190                         LOG(2, s, t, "IPV6CP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1191                         sendipv6cp(s, t);
1192                         change_state(s, ipv6cp, RequestSent);
1193                         break;
1194
1195                 case AckSent:
1196                         ipv6cp_open(s, t);
1197                         break;
1198
1199                 default:
1200                         LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1201                 }
1202         }
1203         else if (*p == ConfigReq)
1204         {
1205                 uint8_t *response = 0;
1206                 uint8_t *o = p + 4;
1207                 int length = l - 4;
1208                 int gotip = 0;
1209                 uint8_t ident[8];
1210
1211                 while (length > 2)
1212                 {
1213                         switch (*o)
1214                         {
1215                         case 1: // interface identifier
1216                                 gotip++; // seen address
1217                                 if (o[1] != 10 || o[1] > length) return;
1218
1219                                 *(uint32_t *) ident = htonl(session[s].ip);
1220                                 *(uint32_t *) (ident + 4) = 0;
1221
1222                                 if (memcmp(o + 2, ident, sizeof(ident)))
1223                                 {
1224                                         q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1225                                         if (!q) return;
1226                                 }
1227
1228                                 break;
1229
1230                         default:
1231                                 LOG(2, s, t, "    Rejecting PPP IPV6CP Option type %d\n", *o);
1232                                 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1233                                 if (!q) return;
1234                         }
1235
1236                         length -= o[1];
1237                         o += o[1];
1238                 }
1239
1240                 if (response)
1241                 {
1242                         l = q - response; // IPV6CP packet length
1243                         *((uint16_t *) (response + 2)) = htons(l); // update header
1244                 }
1245                 else if (gotip)
1246                 {
1247                         // Send packet back as ConfigAck
1248                         response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1249                         if (!response) return;
1250                         *response = ConfigAck;
1251                 }
1252                 else
1253                 {
1254                         LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1255                         STAT(tunnel_rx_errors);
1256                         return;
1257                 }
1258
1259                 switch (session[s].ppp.ipv6cp)
1260                 {
1261                 case Closed:
1262                         response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1263                         if (!response) return;
1264                         *response = TerminateAck;
1265                         *((uint16_t *) (response + 2)) = htons(l = 4);
1266                         break;
1267
1268                 case Stopped:
1269                         initialise_restart_count(s, ipv6cp);
1270                         sendipv6cp(s, t);
1271                         if (*response == ConfigAck)
1272                                 change_state(s, ipv6cp, AckSent);
1273                         else
1274                                 change_state(s, ipv6cp, RequestSent);
1275
1276                         break;
1277
1278                 case RequestSent:
1279                         if (*response == ConfigAck)
1280                                 change_state(s, ipv6cp, AckSent);
1281
1282                         break;
1283
1284                 case AckReceived:
1285                         if (*response == ConfigAck)
1286                                 ipv6cp_open(s, t);
1287
1288                         break;
1289
1290                 case Opened:
1291                         initialise_restart_count(s, ipv6cp);
1292                         sendipv6cp(s, t);
1293                         /* fallthrough */
1294
1295                 case AckSent:
1296                         if (*response == ConfigAck)
1297                                 change_state(s, ipv6cp, AckSent);
1298                         else
1299                                 change_state(s, ipv6cp, RequestSent);
1300
1301                         break;
1302
1303                 default:
1304                         LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1305                         return;
1306                 }
1307
1308                 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1309                 tunnelsend(b, l + (response - b), t);
1310         }
1311         else if (*p == TerminateReq)
1312         {
1313                 *p = TerminateAck;
1314                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPIPV6CP);
1315                 if (!q) return;
1316                 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1317                 tunnelsend(b, l + (q - b), t);
1318                 change_state(s, ipv6cp, Stopped);
1319         }
1320         else if (*p != CodeRej)
1321         {
1322                 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1323         }
1324 }
1325
1326 // process IP packet received
1327 //
1328 // This MUST be called with at least 4 byte behind 'p'.
1329 // (i.e. this routine writes to p[-4]).
1330 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1331 {
1332         in_addr_t ip;
1333
1334         CSTAT(processipin);
1335
1336         LOG_HEX(5, "IP", p, l);
1337
1338         if (l < 20)
1339         {
1340                 LOG(1, s, t, "IP packet too short %d\n", l);
1341                 STAT(tunnel_rx_errors);
1342                 return ;
1343         }
1344
1345         ip = ntohl(*(uint32_t *)(p + 12));
1346
1347         if (l > MAXETHER)
1348         {
1349                 LOG(1, s, t, "IP packet too long %d\n", l);
1350                 STAT(tunnel_rx_errors);
1351                 return ;
1352         }
1353
1354         if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1355                 return;
1356
1357         // no spoof (do sessionbyip to handled statically routed subnets)
1358         if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1359         {
1360                 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1361                 return;
1362         }
1363
1364         // run access-list if any
1365         if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1366                 return;
1367
1368         // adjust MSS on SYN and SYN,ACK packets with options
1369         if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1370         {
1371                 int ihl = (p[0] & 0xf) * 4; // length of IP header
1372                 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1373                         adjust_tcp_mss(s, t, p, l, p + ihl);
1374         }
1375
1376         // Add on the tun header
1377         p -= 4;
1378         *(uint32_t *) p = htonl(PKTIP);
1379         l += 4;
1380
1381         // Are we throttled and a slave?
1382         if (session[s].tbf_in && !config->cluster_iam_master) {
1383                 // Pass it to the master for handling.
1384                 master_throttle_packet(session[s].tbf_in, p, l);
1385                 return;
1386         }
1387
1388         // Are we throttled and a master??
1389         if (session[s].tbf_in && config->cluster_iam_master) {
1390                 // Actually handle the throttled packets.
1391                 tbf_queue_packet(session[s].tbf_in, p, l);
1392                 return;
1393         }
1394
1395         // send to ethernet
1396         if (tun_write(p, l) < 0)
1397         {
1398                 STAT(tun_tx_errors);
1399                 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1400                         l, strerror(errno), tunfd, p);
1401
1402                 return;
1403         }
1404
1405         p += 4;
1406         l -= 4;
1407
1408         if (session[s].snoop_ip && session[s].snoop_port)
1409         {
1410                 // Snooping this session
1411                 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1412         }
1413
1414         increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1415         session[s].cin_delta += l;
1416         session[s].pin++;
1417
1418         sess_local[s].cin += l;
1419         sess_local[s].pin++;
1420
1421         eth_tx += l;
1422
1423         STAT(tun_tx_packets);
1424         INC_STAT(tun_tx_bytes, l);
1425 }
1426
1427 // process IPv6 packet received
1428 //
1429 // This MUST be called with at least 4 byte behind 'p'.
1430 // (i.e. this routine writes to p[-4]).
1431 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1432 {
1433         struct in6_addr ip;
1434         in_addr_t ipv4;
1435
1436         CSTAT(processipv6in);
1437
1438         LOG_HEX(5, "IPv6", p, l);
1439
1440         ip = *(struct in6_addr *) (p + 8);
1441         ipv4 = ntohl(*(uint32_t *)(p + 16));
1442
1443         if (l > MAXETHER)
1444         {
1445                 LOG(1, s, t, "IP packet too long %d\n", l);
1446                 STAT(tunnel_rx_errors);
1447                 return ;
1448         }
1449
1450         if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1451                 return;
1452
1453         // no spoof
1454         if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1455         {
1456                 char str[INET6_ADDRSTRLEN];
1457                 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1458                                 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1459                 return;
1460         }
1461
1462         // Check if it's a Router Solicition message.
1463         if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1464                         *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1465                         *(uint32_t *)(p + 34) == 0 &&
1466                         *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1467                 LOG(3, s, t, "Got IPv6 RS\n");
1468                 send_ipv6_ra(s, t, &ip);
1469                 return;
1470         }
1471
1472         // Add on the tun header
1473         p -= 4;
1474         *(uint32_t *) p = htonl(PKTIPV6);
1475         l += 4;
1476
1477         // Are we throttled and a slave?
1478         if (session[s].tbf_in && !config->cluster_iam_master) {
1479                 // Pass it to the master for handling.
1480                 master_throttle_packet(session[s].tbf_in, p, l);
1481                 return;
1482         }
1483
1484         // Are we throttled and a master??
1485         if (session[s].tbf_in && config->cluster_iam_master) {
1486                 // Actually handle the throttled packets.
1487                 tbf_queue_packet(session[s].tbf_in, p, l);
1488                 return;
1489         }
1490
1491         // send to ethernet
1492         if (tun_write(p, l) < 0)
1493         {
1494                 STAT(tun_tx_errors);
1495                 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1496                         l, strerror(errno), tunfd, p);
1497
1498                 return;
1499         }
1500
1501         p += 4;
1502         l -= 4;
1503
1504         if (session[s].snoop_ip && session[s].snoop_port)
1505         {
1506                 // Snooping this session
1507                 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1508         }
1509
1510         increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1511         session[s].cin_delta += l;
1512         session[s].pin++;
1513
1514         sess_local[s].cin += l;
1515         sess_local[s].pin++;
1516
1517         eth_tx += l;
1518
1519         STAT(tun_tx_packets);
1520         INC_STAT(tun_tx_bytes, l);
1521 }
1522
1523 //
1524 // Helper routine for the TBF filters.
1525 // Used to send queued data in from the user.
1526 //
1527 void send_ipin(sessionidt s, uint8_t *buf, int len)
1528 {
1529         LOG_HEX(5, "IP in throttled", buf, len);
1530
1531         if (write(tunfd, buf, len) < 0)
1532         {
1533                 STAT(tun_tx_errors);
1534                 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1535                         len, strerror(errno), tunfd, buf);
1536
1537                 return;
1538         }
1539
1540         buf += 4;
1541         len -= 4;
1542
1543         if (session[s].snoop_ip && session[s].snoop_port)
1544         {
1545                 // Snooping this session
1546                 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1547         }
1548
1549         // Increment packet counters
1550         increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1551         session[s].cin_delta += len;
1552         session[s].pin++;
1553
1554         sess_local[s].cin += len;
1555         sess_local[s].pin++;
1556
1557         eth_tx += len;
1558
1559         STAT(tun_tx_packets);
1560         INC_STAT(tun_tx_bytes, len - 4);
1561 }
1562
1563
1564 // Process CCP messages
1565 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1566 {
1567         uint8_t b[MAXETHER];
1568         uint8_t *q;
1569
1570         CSTAT(processccp);
1571
1572         LOG_HEX(5, "CCP", p, l);
1573
1574         if (session[s].ppp.phase < Network)
1575         {
1576                 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1577                 return;
1578         }
1579
1580         if (l < 1)
1581         {
1582                 LOG(1, s, t, "Short CCP packet\n");
1583                 STAT(tunnel_rx_errors);
1584         }
1585
1586         LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1587         if (*p == ConfigAck)
1588         {
1589                 switch (session[s].ppp.ccp)
1590                 {
1591                 case RequestSent:
1592                         initialise_restart_count(s, ccp);
1593                         change_state(s, ccp, AckReceived);
1594                         break;
1595
1596                 case AckReceived:
1597                 case Opened:
1598                         LOG(2, s, t, "CCP: ConfigAck in state %s?  Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1599                         sendccp(s, t);
1600                         change_state(s, ccp, RequestSent);
1601                         break;
1602
1603                 case AckSent:
1604                         LOG(3, s, t, "CCP: Opened\n");
1605                         change_state(s, ccp, Opened);
1606                         break;
1607
1608                 default:
1609                         LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1610                 }
1611         }
1612         else if (*p == ConfigReq)
1613         {
1614                 if (l < 6) // accept no compression
1615                         *p = ConfigAck;
1616                 else // compression requested--reject
1617                         *p = ConfigRej;
1618
1619                 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1620                 if (!q) return;
1621
1622                 switch (session[s].ppp.ccp)
1623                 {
1624                 case Closed:
1625                         q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1626                         if (!q) return;
1627                         *q = TerminateAck;
1628                         *((uint16_t *) (q + 2)) = htons(l = 4);
1629                         break;
1630
1631                 case Stopped:
1632                         initialise_restart_count(s, ccp);
1633                         sendccp(s, t);
1634                         if (*q == ConfigAck)
1635                                 change_state(s, ccp, AckSent);
1636                         else
1637                                 change_state(s, ccp, RequestSent);
1638
1639                         break;
1640
1641                 case RequestSent:
1642                         if (*q == ConfigAck)
1643                                 change_state(s, ccp, AckSent);
1644
1645                         break;
1646
1647                 case AckReceived:
1648                         if (*q == ConfigAck)
1649                                 change_state(s, ccp, Opened);
1650
1651                         break;
1652
1653                 case Opened:
1654                         initialise_restart_count(s, ccp);
1655                         sendccp(s, t);
1656                         /* fallthrough */
1657
1658                 case AckSent:
1659                         if (*q == ConfigAck)
1660                                 change_state(s, ccp, AckSent);
1661                         else
1662                                 change_state(s, ccp, RequestSent);
1663
1664                         break;
1665
1666                 default:
1667                         LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1668                         return;
1669                 }
1670
1671                 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1672                 tunnelsend(b, l + (q - b), t);
1673         }
1674         else if (*p == TerminateReq)
1675         {
1676                 *p = TerminateAck;
1677                 q = makeppp(b, sizeof(b),  p, l, s, t, PPPCCP);
1678                 if (!q) return;
1679                 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1680                 tunnelsend(b, l + (q - b), t);
1681                 change_state(s, ccp, Stopped);
1682         }
1683         else if (*p != CodeRej)
1684         {
1685                 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1686         }
1687 }
1688
1689 // send a CHAP challenge
1690 void sendchap(sessionidt s, tunnelidt t)
1691 {
1692         uint8_t b[MAXETHER];
1693         uint16_t r;
1694         uint8_t *q;
1695
1696         CSTAT(sendchap);
1697
1698         r = radiusnew(s);
1699         if (!r)
1700         {
1701                 LOG(1, s, t, "No RADIUS to send challenge\n");
1702                 STAT(tunnel_tx_errors);
1703                 return;
1704         }
1705
1706         LOG(1, s, t, "Send CHAP challenge\n");
1707
1708         radius[r].chap = 1;             // CHAP not PAP
1709         radius[r].id++;
1710         if (radius[r].state != RADIUSCHAP)
1711                 radius[r].try = 0;
1712
1713         radius[r].state = RADIUSCHAP;
1714         radius[r].retry = backoff(radius[r].try++);
1715         if (radius[r].try > 5)
1716         {
1717                 sessionshutdown(s, "CHAP timeout.", 3, 0);
1718                 STAT(tunnel_tx_errors);
1719                 return ;
1720         }
1721         q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1722         if (!q) return;
1723
1724         *q = 1;                                 // challenge
1725         q[1] = radius[r].id;                    // ID
1726         q[4] = 16;                              // value size (size of challenge)
1727         memcpy(q + 5, radius[r].auth, 16);      // challenge
1728         strcpy((char *) q + 21, hostname);      // our name
1729         *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1730         tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1731 }
1732
1733 // fill in a L2TP message with a PPP frame,
1734 // copies existing PPP message and changes magic number if seen
1735 // returns start of PPP frame
1736 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1737 {
1738         if (size < 12) // Need more space than this!!
1739         {
1740                 static int backtrace_count = 0;
1741                 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1742                 log_backtrace(backtrace_count, 5)
1743                 return NULL;
1744         }
1745
1746         *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1747         *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1748         *(uint16_t *) (b + 4) = htons(session[s].far); // session
1749         b += 6;
1750         if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1751         {
1752                 *(uint16_t *) b = htons(0xFF03); // HDLC header
1753                 b += 2;
1754         }
1755         if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1756                 *b++ = mtype;
1757         else
1758         {
1759                 *(uint16_t *) b = htons(mtype);
1760                 b += 2;
1761         }
1762
1763         if (l + 12 > size)
1764         {
1765                 static int backtrace_count = 0;
1766                 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1767                 log_backtrace(backtrace_count, 5)
1768                 return NULL;
1769         }
1770
1771         if (p && l)
1772                 memcpy(b, p, l);
1773
1774         return b;
1775 }
1776
1777 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1778 {
1779         int len = 0;
1780         if ((authtype == AUTHCHAP && size < 5) || size < 4)
1781                 return 0;
1782
1783         *b++ = 3; // Authentication-Protocol
1784         if (authtype == AUTHCHAP)
1785         {
1786                 len = *b++ = 5; // length
1787                 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1788                 *b++ = 5; // MD5
1789         }
1790         else if (authtype == AUTHPAP)
1791         {
1792                 len = *b++ = 4; // length
1793                 *(uint16_t *) b = htons(PPPPAP); b += 2;
1794         }
1795         else
1796         {
1797                 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1798         }
1799
1800         return len;
1801 }
1802
1803 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1804 void sendlcp(sessionidt s, tunnelidt t)
1805 {
1806         uint8_t b[500], *q, *l;
1807         int authtype = sess_local[s].lcp_authtype;
1808
1809         if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1810                 return;
1811
1812         LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1813             authtype ? " (" : "",
1814             authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1815             authtype ? ")" : "");
1816
1817         l = q;
1818         *l++ = ConfigReq;
1819         *l++ = ++sess_local[s].lcp_ident; // ID
1820
1821         l += 2; //Save space for length
1822
1823         if (sess_local[s].ppp_mru)
1824         {
1825                 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1826                 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1827         }
1828
1829         if (authtype)
1830                 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1831
1832         *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1833         *(uint32_t *) l = htonl(session[s].magic);
1834         l += 4;
1835
1836         *(uint16_t *)(q + 2) = htons(l - q); // Length
1837
1838         LOG_HEX(5, "PPPLCP", q, l - q);
1839         if (config->debug > 3) dumplcp(q, l - q);
1840
1841         tunnelsend(b, (l - b), t);
1842 }
1843
1844 // Send CCP request for no compression
1845 void sendccp(sessionidt s, tunnelidt t)
1846 {
1847         uint8_t b[500], *q;
1848
1849         if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1850                 return;
1851
1852         LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1853
1854         *q = ConfigReq;
1855         *(q + 1) = ++sess_local[s].lcp_ident; // ID
1856         *(uint16_t *)(q + 2) = htons(4); // Length
1857
1858         LOG_HEX(5, "PPPCCP", q, 4);
1859         tunnelsend(b, (q - b) + 4 , t);
1860 }