6b1bb6e55b96ec545d5d5413f6e0891db428e59b
3 char const *cvs_id_ppp
= "$Id: ppp.c,v 1.43 2005/01/25 04:38:49 bodea Exp $";
11 #include "constants.h"
17 extern tunnelt
*tunnel
;
18 extern sessiont
*session
;
19 extern radiust
*radius
;
21 extern char hostname
[];
22 extern uint32_t eth_tx
;
23 extern time_t time_now
;
24 extern configt
*config
;
26 static void initccp(tunnelidt t
, sessionidt s
);
28 // Process PAP messages
29 void processpap(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
37 LOG_HEX(5, "PAP", p
, l
);
40 LOG(1, s
, t
, "Short PAP %u bytes\n", l
);
41 STAT(tunnel_rx_errors
);
45 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
47 LOG(1, s
, t
, "Length mismatch PAP %u/%u\n", hl
, l
);
48 STAT(tunnel_rx_errors
);
55 LOG(1, s
, t
, "Unexpected PAP code %d\n", *p
);
56 STAT(tunnel_rx_errors
);
63 if (*b
&& *b
< sizeof(user
))
64 memcpy(user
, b
+ 1, *b
);
67 if (*b
&& *b
< sizeof(pass
))
68 memcpy(pass
, b
+ 1, *b
);
70 LOG(3, s
, t
, "PAP login %s/%s\n", user
, pass
);
72 if (session
[s
].ip
|| !session
[s
].radius
)
74 // respond now, either no RADIUS available or already authenticated
75 uint8_t b
[MAXCONTROL
];
77 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPPAP
);
83 *p
= 3; // cant authorise
85 *(uint16_t *) (p
+ 2) = htons(5); // length
86 p
[4] = 0; // no message
89 LOG(3, s
, t
, "Already an IP allocated: %s (%d)\n",
90 fmtaddr(htonl(session
[s
].ip
), 0), session
[s
].ip_pool_index
);
92 session
[s
].flags
&= ~SF_IPCP_ACKED
;
96 LOG(1, s
, t
, "No radius session available to authenticate session...\n");
98 LOG(3, s
, t
, "Fallback response to PAP (%s)\n", (session
[s
].ip
) ? "ACK" : "NAK");
99 tunnelsend(b
, 5 + (p
- b
), t
); // send it
103 // set up RADIUS request
104 uint16_t r
= session
[s
].radius
;
106 // Run PRE_AUTH plugins
107 struct param_pre_auth packet
= { &tunnel
[t
], &session
[s
], strdup(user
), strdup(pass
), PPPPAP
, 1 };
108 run_plugins(PLUGIN_PRE_AUTH
, &packet
);
109 if (!packet
.continue_auth
)
111 LOG(3, s
, t
, "A plugin rejected PRE_AUTH\n");
112 if (packet
.username
) free(packet
.username
);
113 if (packet
.password
) free(packet
.password
);
117 strncpy(session
[s
].user
, packet
.username
, sizeof(session
[s
].user
) - 1);
118 strncpy(radius
[r
].pass
, packet
.password
, sizeof(radius
[r
].pass
) - 1);
120 free(packet
.username
);
121 free(packet
.password
);
124 LOG(3, s
, t
, "Sending login for %s/%s to radius\n", user
, pass
);
125 radiussend(r
, RADIUSAUTH
);
129 // Process CHAP messages
130 void processchap(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
137 LOG_HEX(5, "CHAP", p
, l
);
138 r
= session
[s
].radius
;
141 LOG(1, s
, t
, "Unexpected CHAP message\n");
142 STAT(tunnel_rx_errors
);
148 LOG(1, s
, t
, "Short CHAP %u bytes\n", l
);
149 STAT(tunnel_rx_errors
);
153 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
155 LOG(1, s
, t
, "Length mismatch CHAP %u/%u\n", hl
, l
);
156 STAT(tunnel_rx_errors
);
163 LOG(1, s
, t
, "Unexpected CHAP response code %d\n", *p
);
164 STAT(tunnel_rx_errors
);
167 if (p
[1] != radius
[r
].id
)
169 LOG(1, s
, t
, "Wrong CHAP response ID %d (should be %d) (%d)\n", p
[1], radius
[r
].id
, r
);
170 STAT(tunnel_rx_errors
);
174 if (l
< 5 || p
[4] != 16)
176 LOG(1, s
, t
, "Bad CHAP response length %d\n", l
< 5 ? -1 : p
[4]);
177 STAT(tunnel_rx_errors
);
183 if (l
< 16 || l
- 16 >= sizeof(session
[s
].user
))
185 LOG(1, s
, t
, "CHAP user too long %d\n", l
- 16);
186 STAT(tunnel_rx_errors
);
190 // Run PRE_AUTH plugins
192 struct param_pre_auth packet
= { &tunnel
[t
], &session
[s
], NULL
, NULL
, PPPCHAP
, 1 };
194 packet
.password
= calloc(17, 1);
195 memcpy(packet
.password
, p
, 16);
200 packet
.username
= calloc(l
+ 1, 1);
201 memcpy(packet
.username
, p
, l
);
203 run_plugins(PLUGIN_PRE_AUTH
, &packet
);
204 if (!packet
.continue_auth
)
206 LOG(3, s
, t
, "A plugin rejected PRE_AUTH\n");
207 if (packet
.username
) free(packet
.username
);
208 if (packet
.password
) free(packet
.password
);
212 strncpy(session
[s
].user
, packet
.username
, sizeof(session
[s
].user
) - 1);
213 memcpy(radius
[r
].pass
, packet
.password
, 16);
215 free(packet
.username
);
216 free(packet
.password
);
220 LOG(3, s
, t
, "CHAP login %s\n", session
[s
].user
);
221 radiussend(r
, RADIUSAUTH
);
224 static void dumplcp(uint8_t *p
, int l
)
227 uint8_t *o
= (p
+ 4);
229 LOG_HEX(5, "PPP LCP Packet", p
, l
);
230 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p
, ppp_lcp_type((int)*p
), ntohs( ((uint16_t *) p
)[1]) );
231 LOG(4, 0, 0, "Length: %d\n", l
);
232 if (*p
!= ConfigReq
&& *p
!= ConfigRej
&& *p
!= ConfigAck
)
241 LOG(4, 0, 0, " Option length is %d...\n", length
);
246 LOG(4, 0, 0, " Option type is 0...\n");
253 case 1: // Maximum-Receive-Unit
255 LOG(4, 0, 0, " %s %d\n", lcp_type(type
), ntohs(*(uint16_t *)(o
+ 2)));
257 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
259 case 2: // Async-Control-Character-Map
262 uint32_t asyncmap
= ntohl(*(uint32_t *)(o
+ 2));
263 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), asyncmap
);
266 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
268 case 3: // Authentication-Protocol
271 int proto
= ntohs(*(uint16_t *)(o
+ 2));
272 LOG(4, 0, 0, " %s 0x%x (%s)\n", lcp_type(type
), proto
,
273 proto
== PPPCHAP
? "CHAP" :
274 proto
== PPPPAP
? "PAP" : "UNKNOWN");
277 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
279 case 4: // Quality-Protocol
281 uint32_t qp
= ntohl(*(uint32_t *)(o
+ 2));
282 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), qp
);
285 case 5: // Magic-Number
288 uint32_t magicno
= ntohl(*(uint32_t *)(o
+ 2));
289 LOG(4, 0, 0, " %s %x\n", lcp_type(type
), magicno
);
292 LOG(4, 0, 0, " %s odd length %d\n", lcp_type(type
), length
);
294 case 7: // Protocol-Field-Compression
295 case 8: // Address-And-Control-Field-Compression
296 LOG(4, 0, 0, " %s\n", lcp_type(type
));
299 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type
);
307 // Process LCP messages
308 void processlcp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
310 uint8_t b
[MAXCONTROL
];
312 uint32_t magicno
= 0;
317 LOG_HEX(5, "LCP", p
, l
);
320 LOG(1, s
, t
, "Short LCP %d bytes\n", l
);
321 STAT(tunnel_rx_errors
);
325 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
327 LOG(1, s
, t
, "Length mismatch LCP %u/%u\n", hl
, l
);
328 STAT(tunnel_rx_errors
);
335 LOG(3, s
, t
, "LCP: Discarding ConfigAck\n");
336 session
[s
].flags
|= SF_LCP_ACKED
;
338 else if (*p
== ConfigReq
)
341 uint8_t *o
= (p
+ 4);
342 uint8_t *response
= 0;
344 LOG(3, s
, t
, "LCP: ConfigReq (%d bytes)...\n", l
);
345 if (config
->debug
> 3) dumplcp(p
, l
);
352 if (length
== 0 || type
== 0 || x
< length
) break;
355 case 1: // Maximum-Receive-Unit
356 session
[s
].mru
= ntohs(*(uint16_t *)(o
+ 2));
359 case 2: // Async-Control-Character-Map
360 if (!ntohl(*(uint32_t *)(o
+ 2))) // all bits zero is OK
363 if (response
&& *response
!= ConfigNak
) // rej already queued
366 LOG(2, s
, t
, " Remote requesting asyncmap. Rejecting.\n");
369 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
375 if ((q
- b
+ 11) > sizeof(b
))
377 LOG(2, s
, t
, "LCP overflow for asyncmap ConfigNak.\n");
383 memset(q
, 0, 4); // asyncmap 0
385 *((uint16_t *) (response
+ 2)) = htons(q
- response
); // LCP header length
388 case 3: // Authentication-Protocol
390 int proto
= ntohs(*(uint16_t *)(o
+ 2));
391 char proto_name
[] = "0x0000";
395 if (response
&& *response
!= ConfigNak
) // rej already queued
398 if (proto
== PPPCHAP
)
399 strcpy(proto_name
, "CHAP");
401 sprintf(proto_name
, "%#4.4x", proto
);
403 LOG(2, s
, t
, " Remote requesting %s authentication. Rejecting.\n", proto_name
);
407 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
413 if ((q
- b
+ length
) > sizeof(b
))
415 LOG(2, s
, t
, "LCP overflow for %s ConfigNak.\n", proto_name
);
419 memcpy(q
, o
, length
);
420 *(uint16_t *)(q
+= 2) = htons(PPPPAP
); // NAK -> Use PAP instead
422 *((uint16_t *) (response
+ 2)) = htons(q
- response
);
426 case 5: // Magic-Number
427 magicno
= ntohl(*(uint32_t *)(o
+ 2));
430 case 4: // Quality-Protocol
431 case 7: // Protocol-Field-Compression
432 case 8: // Address-And-Control-Field-Compression
435 default: // Reject any unknown options
436 LOG(2, s
, t
, " Rejecting PPP LCP Option type %d\n", type
);
437 if (!response
|| *response
!= ConfigRej
) // drop nak in favour of rej
439 q
= response
= makeppp(b
, sizeof(b
), p
, 2, t
, s
, PPPLCP
);
445 if ((q
- b
+ length
) > sizeof(b
))
447 LOG(2, s
, t
, "LCP overflow for ConfigRej (type=%d).\n", type
);
451 memcpy(q
, o
, length
);
453 *((uint16_t *) (response
+ 2)) = htons(q
- response
); // LCP header length
461 // Send back a ConfigAck
462 q
= response
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
467 LOG(3, s
, t
, "Sending %s\n", ppp_lcp_type(*response
));
468 tunnelsend(b
, l
+ (q
- b
), t
);
470 if (!(session
[s
].flags
& SF_LCP_ACKED
))
473 else if (*p
== ConfigNak
)
475 LOG(1, s
, t
, "Remote end sent a ConfigNak. Ignoring\n");
476 if (config
->debug
> 3) dumplcp(p
, l
);
479 else if (*p
== TerminateReq
)
481 LOG(3, s
, t
, "LCP: Received TerminateReq. Sending TerminateAck\n");
482 *p
= TerminateAck
; // close
483 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
485 tunnelsend(b
, l
+ (q
- b
), t
); // send it
486 sessionshutdown(s
, "Remote end closed connection.");
488 else if (*p
== TerminateAck
)
490 sessionshutdown(s
, "Connection closed.");
492 else if (*p
== ProtocolRej
)
494 if (*(uint16_t *) (p
+4) == htons(PPPIPV6CP
))
496 LOG(3, s
, t
, "IPv6 rejected\n");
497 session
[s
].flags
|= SF_IPV6_NACKED
;
501 LOG(1, s
, t
, "Unexpected LCP protocol reject 0x%X\n",
502 ntohs(*(uint16_t *) (p
+4)));
503 STAT(tunnel_rx_errors
);
506 else if (*p
== EchoReq
)
508 LOG(5, s
, t
, "LCP: Received EchoReq. Sending EchoReply\n");
509 *p
= EchoReply
; // reply
510 *(uint32_t *) (p
+ 4) = htonl(session
[s
].magic
); // our magic number
511 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
513 tunnelsend(b
, l
+ (q
- b
), t
); // send it
515 else if (*p
== EchoReply
)
517 // Ignore it, last_packet time is set earlier than this.
519 else if (*p
== IdentRequest
)
524 LOG(1, s
, t
, "Truncated Ident Packet (length=%d) to 1400 bytes\n", l
);
527 q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPLCP
);
529 LOG_HEX(5, "LCPIdentRej", q
, l
+ 4);
530 tunnelsend(b
, 12 + 4 + l
, t
);
534 LOG(1, s
, t
, "Unexpected LCP code %d\n", *p
);
535 STAT(tunnel_rx_errors
);
540 // find a PPP option, returns point to option, or 0 if not found
541 static uint8_t *findppp(uint8_t *b
, uint8_t mtype
)
543 uint16_t l
= ntohs(*(uint16_t *) (b
+ 2));
550 if (l
< b
[1] || !b
[1])
560 // Process IPCP messages
561 void processipcp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
567 LOG_HEX(5, "IPCP", p
, l
);
570 LOG(1, s
, t
, "Short IPCP %d bytes\n", l
);
571 STAT(tunnel_rx_errors
);
575 if ((hl
= ntohs(*(uint16_t *) (p
+ 2))) > l
)
577 LOG(1, s
, t
, "Length mismatch IPCP %u/%u\n", hl
, l
);
578 STAT(tunnel_rx_errors
);
585 // happy with our IPCP
586 uint16_t r
= session
[s
].radius
;
587 if ((!r
|| radius
[r
].state
== RADIUSIPCP
) && !session
[s
].walled_garden
)
592 radiussend(r
, RADIUSSTART
); // send radius start, having got IPCP at last
594 session
[s
].flags
|= SF_IPCP_ACKED
;
596 LOG(3, s
, t
, "IPCP Acked, session is now active\n");
598 // clear LCP_ACKED/CCP_ACKED flag for possible fast renegotiaion for routers
599 session
[s
].flags
&= ~(SF_LCP_ACKED
|SF_CCP_ACKED
);
605 LOG(1, s
, t
, "Unexpected IPCP code %d\n", *p
);
606 STAT(tunnel_rx_errors
);
609 LOG(4, s
, t
, "IPCP ConfigReq received\n");
613 LOG(3, s
, t
, "Waiting on radius reply\n");
614 return; // have to wait on RADIUS reply
616 // form a config reply quoting the IP in the session
618 uint8_t b
[MAXCONTROL
];
623 while (q
< i
&& q
[1])
625 if (*q
!= 0x81 && *q
!= 0x83 && *q
!= 3)
634 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPCP
)))
639 while (p
< i
&& p
[1])
641 if (*p
!= 0x81 && *p
!= 0x83 && *p
!= 3)
643 LOG(2, s
, t
, "IPCP reject %d\n", *p
);
644 memcpy(q
+ n
, p
, p
[1]);
649 *(uint16_t *) (q
+ 2) = htons(n
);
650 LOG(4, s
, t
, "Sending ConfigRej\n");
651 tunnelsend(b
, n
+ (q
- b
), t
); // send it
655 LOG(4, s
, t
, "Sending ConfigAck\n");
657 if ((i
= findppp(p
, 0x81))) // Primary DNS address
659 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].dns1
))
661 *(uint32_t *) (i
+ 2) = htonl(session
[s
].dns1
);
663 LOG(5, s
, t
, " DNS1 = %s\n",
664 fmtaddr(htonl(session
[s
].dns1
), 0));
667 if ((i
= findppp(p
, 0x83))) // Secondary DNS address (TBA, is it)
669 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].dns2
))
671 *(uint32_t *) (i
+ 2) = htonl(session
[s
].dns2
);
673 LOG(5, s
, t
, " DNS2 = %s\n",
674 fmtaddr(htonl(session
[s
].dns2
), 0));
677 i
= findppp(p
, 3); // IP address
680 LOG(1, s
, t
, "No IP in IPCP request\n");
681 STAT(tunnel_rx_errors
);
684 if (*(uint32_t *) (i
+ 2) != htonl(session
[s
].ip
))
686 *(uint32_t *) (i
+ 2) = htonl(session
[s
].ip
);
688 LOG(4, s
, t
, " No, a ConfigNak, client is requesting IP - sending %s\n",
689 fmtaddr(htonl(session
[s
].ip
), 0));
691 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPCP
)))
694 tunnelsend(b
, l
+ (q
- b
), t
); // send it
699 // Process IPV6CP messages
700 void processipv6cp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
703 CSTAT(processipv6cp
);
705 LOG_HEX(5, "IPV6CP", p
, l
);
708 LOG(1, s
, t
, "Short IPV6CP %d bytes\n", l
);
709 STAT(tunnel_rx_errors
);
714 // happy with our IPV6CP
715 session
[s
].flags
|= SF_IPV6CP_ACKED
;
717 LOG(3, s
, t
, "IPV6CP Acked, IPv6 is now active\n");
718 // Add a routed block if configured.
719 if (session
[s
].ipv6prefixlen
)
721 route6set(s
, session
[s
].ipv6route
, session
[s
].ipv6prefixlen
, 1);
722 session
[s
].flags
|= SF_IPV6_ROUTED
;
725 // Send an initial RA (TODO: Should we send these regularly?)
726 send_ipv6_ra(t
, s
, NULL
);
731 LOG(1, s
, t
, "Unexpected IPV6CP code %d\n", *p
);
732 STAT(tunnel_rx_errors
);
736 LOG(4, s
, t
, "IPV6CP ConfigReq received\n");
737 if (ntohs(*(uint16_t *) (p
+ 2)) > l
)
739 LOG(1, s
, t
, "Length mismatch IPV6CP %d/%d\n", ntohs(*(uint16_t *) (p
+ 2)), l
);
740 STAT(tunnel_rx_errors
);
745 LOG(3, s
, t
, "Waiting on radius reply\n");
746 return; // have to wait on RADIUS reply
748 // form a config reply quoting the IP in the session
750 uint8_t b
[MAXCONTROL
];
754 l
= ntohs(*(uint16_t *) (p
+ 2)); // We must use length from IPV6CP len field
757 while (q
< i
&& q
[1])
768 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPV6CP
)))
770 LOG(2, s
, t
, "Failed to send IPV6CP ConfigRej\n");
775 while (p
< i
&& p
[1])
779 LOG(2, s
, t
, "IPV6CP reject %d\n", *p
);
780 memcpy(q
+ n
, p
, p
[1]);
785 *(uint16_t *) (q
+ 2) = htons(n
);
786 LOG(4, s
, t
, "Sending ConfigRej\n");
787 tunnelsend(b
, n
+ (q
- b
), t
); // send it
791 LOG(4, s
, t
, "Sending ConfigAck\n");
793 i
= findppp(p
, 1); // IP address
794 if (!i
|| i
[1] != 10)
796 LOG(1, s
, t
, "No IP in IPV6CP request\n");
797 STAT(tunnel_rx_errors
);
800 if ((*(uint32_t *) (i
+ 2) != htonl(session
[s
].ip
)) ||
801 (*(uint32_t *) (i
+ 6) != 0))
803 *(uint32_t *) (i
+ 2) = htonl(session
[s
].ip
);
804 *(uint32_t *) (i
+ 6) = 0;
807 " No, a ConfigNak, client is "
808 "requesting IP - sending %s\n",
809 fmtaddr(htonl(session
[s
].ip
), 0));
811 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPIPV6CP
)))
813 LOG(2, s
, t
, " Failed to send IPV6CP packet.\n");
816 tunnelsend(b
, l
+ (q
- b
), t
); // send it
821 // process IP packet received
823 // This MUST be called with at least 4 byte behind 'p'.
824 // (i.e. this routine writes to p[-4]).
825 void processipin(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
831 LOG_HEX(5, "IP", p
, l
);
833 ip
= ntohl(*(uint32_t *)(p
+ 12));
837 LOG(1, s
, t
, "IP packet too long %d\n", l
);
838 STAT(tunnel_rx_errors
);
842 // no spoof (do sessionbyip to handled statically routed subnets)
843 if (ip
!= session
[s
].ip
&& sessionbyip(htonl(ip
)) != s
)
845 LOG(5, s
, t
, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip
), 0));
849 // run access-list if any
850 if (session
[s
].filter_in
&& !ip_filter(p
, l
, session
[s
].filter_in
- 1))
853 // Add on the tun header
855 *(uint32_t *) p
= htonl(PKTIP
);
858 // Are we throttled and a slave?
859 if (session
[s
].tbf_in
&& !config
->cluster_iam_master
) {
860 // Pass it to the master for handling.
861 master_throttle_packet(session
[s
].tbf_in
, p
, l
);
865 // Are we throttled and a master??
866 if (session
[s
].tbf_in
&& config
->cluster_iam_master
) {
867 // Actually handle the throttled packets.
868 tbf_queue_packet(session
[s
].tbf_in
, p
, l
);
873 if (tun_write(p
, l
) < 0)
876 LOG(0, s
, t
, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
877 l
, strerror(errno
), tunfd
, p
);
882 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
884 // Snooping this session
885 snoop_send_packet(p
+ 4, l
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
888 session
[s
].cin
+= l
- 4;
889 session
[s
].total_cin
+= l
- 4;
890 sess_local
[s
].cin
+= l
- 4;
895 STAT(tun_tx_packets
);
896 INC_STAT(tun_tx_bytes
, l
- 4);
899 // process IPv6 packet received
901 // This MUST be called with at least 4 byte behind 'p'.
902 // (i.e. this routine writes to p[-4]).
903 void processipv6in(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
908 CSTAT(processipv6in
);
910 LOG_HEX(5, "IPv6", p
, l
);
912 ip
= *(struct in6_addr
*) (p
+ 8);
913 ipv4
= ntohl(*(uint32_t *)(p
+ 16));
917 LOG(1, s
, t
, "IP packet too long %d\n", l
);
918 STAT(tunnel_rx_errors
);
923 if (ipv4
!= session
[s
].ip
&& memcmp(&config
->ipv6_prefix
, &ip
, 8) && sessionbyipv6(ip
) != s
)
925 char str
[INET6_ADDRSTRLEN
];
926 LOG(5, s
, t
, "Dropping packet with spoofed IP %s\n",
927 inet_ntop(AF_INET6
, &ip
, str
, INET6_ADDRSTRLEN
));
931 // Check if it's a Router Solicition message.
932 if (*(p
+ 6) == 58 && *(p
+ 7) == 255 && *(p
+ 24) == 0xFF && *(p
+ 25) == 2 &&
933 *(uint32_t *)(p
+ 26) == 0 && *(uint32_t *)(p
+ 30) == 0 &&
934 *(uint32_t *)(p
+ 34) == 0 &&
935 *(p
+ 38) == 0 && *(p
+ 39) == 2 && *(p
+ 40) == 133) {
936 LOG(3, s
, t
, "Got IPv6 RS\n");
937 send_ipv6_ra(t
, s
, &ip
);
941 // Add on the tun header
943 *(uint32_t *) p
= htonl(PKTIPV6
);
946 // Are we throttled and a slave?
947 if (session
[s
].tbf_in
&& !config
->cluster_iam_master
) {
948 // Pass it to the master for handling.
949 master_throttle_packet(session
[s
].tbf_in
, p
, l
);
953 // Are we throttled and a master??
954 if (session
[s
].tbf_in
&& config
->cluster_iam_master
) {
955 // Actually handle the throttled packets.
956 tbf_queue_packet(session
[s
].tbf_in
, p
, l
);
961 if (tun_write(p
, l
) < 0)
964 LOG(0, s
, t
, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
965 l
, strerror(errno
), tunfd
, p
);
970 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
972 // Snooping this session
973 snoop_send_packet(p
+ 4, l
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
976 session
[s
].cin
+= l
- 4;
977 session
[s
].total_cin
+= l
- 4;
978 sess_local
[s
].cin
+= l
- 4;
983 STAT(tun_tx_packets
);
984 INC_STAT(tun_tx_bytes
, l
- 4);
988 // Helper routine for the TBF filters.
989 // Used to send queued data in from the user.
991 void send_ipin(sessionidt s
, uint8_t *buf
, int len
)
993 LOG_HEX(5, "IP in throttled", buf
, len
);
995 if (write(tunfd
, buf
, len
) < 0)
998 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
999 len
, strerror(errno
), tunfd
, buf
);
1004 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
1006 // Snooping this session
1007 snoop_send_packet(buf
+ 4, len
- 4, session
[s
].snoop_ip
, session
[s
].snoop_port
);
1010 // Increment packet counters
1011 session
[s
].cin
+= len
- 4;
1012 session
[s
].total_cin
+= len
- 4;
1013 sess_local
[s
].cin
+= len
- 4;
1018 STAT(tun_tx_packets
);
1019 INC_STAT(tun_tx_bytes
, len
- 4);
1023 // Process CCP messages
1024 void processccp(tunnelidt t
, sessionidt s
, uint8_t *p
, uint16_t l
)
1026 uint8_t b
[MAXCONTROL
];
1031 LOG_HEX(5, "CCP", p
, l
);
1032 switch (l
> 1 ? *p
: 0)
1035 session
[s
].flags
|= SF_CCP_ACKED
;
1039 if (l
< 6) // accept no compression
1045 // compression requested--reject
1048 // send CCP request for no compression for our end if not negotiated
1049 if (!(session
[s
].flags
& SF_CCP_ACKED
))
1060 LOG(1, s
, t
, "Unexpected CCP request code %d\n", *p
);
1062 LOG(1, s
, t
, "Short CCP packet\n");
1064 STAT(tunnel_rx_errors
);
1068 if (!(q
= makeppp(b
, sizeof(b
), p
, l
, t
, s
, PPPCCP
)))
1071 tunnelsend(b
, l
+ (q
- b
), t
); // send it
1074 // send a CHAP PP packet
1075 void sendchap(tunnelidt t
, sessionidt s
)
1077 uint8_t b
[MAXCONTROL
];
1078 uint16_t r
= session
[s
].radius
;
1085 LOG(1, s
, t
, "No RADIUS to send challenge\n");
1086 STAT(tunnel_tx_errors
);
1090 LOG(1, s
, t
, "Send CHAP challenge\n");
1093 random_data(radius
[r
].auth
, sizeof(radius
[r
].auth
));
1094 radius
[r
].chap
= 1; // CHAP not PAP
1096 if (radius
[r
].state
!= RADIUSCHAP
)
1099 radius
[r
].state
= RADIUSCHAP
;
1100 radius
[r
].retry
= backoff(radius
[r
].try++);
1101 if (radius
[r
].try > 5)
1103 sessionshutdown(s
, "Timeout CHAP");
1104 STAT(tunnel_tx_errors
);
1107 q
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPCHAP
);
1110 *q
= 1; // challenge
1111 q
[1] = radius
[r
].id
; // ID
1112 q
[4] = 16; // length
1113 memcpy(q
+ 5, radius
[r
].auth
, 16); // challenge
1114 strcpy(q
+ 21, hostname
); // our name
1115 *(uint16_t *) (q
+ 2) = htons(strlen(hostname
) + 21); // length
1116 tunnelsend(b
, strlen(hostname
) + 21 + (q
- b
), t
); // send it
1119 // fill in a L2TP message with a PPP frame,
1120 // copies existing PPP message and changes magic number if seen
1121 // returns start of PPP frame
1122 uint8_t *makeppp(uint8_t *b
, int size
, uint8_t *p
, int l
, tunnelidt t
, sessionidt s
, uint16_t mtype
)
1124 if (size
< 12) // Need more space than this!!
1126 static int backtrace_count
= 0;
1127 LOG(0, s
, t
, "makeppp buffer too small for L2TP header (size=%d)\n", size
);
1128 log_backtrace(backtrace_count
, 5)
1132 *(uint16_t *) (b
+ 0) = htons(0x0002); // L2TP with no options
1133 *(uint16_t *) (b
+ 2) = htons(tunnel
[t
].far
); // tunnel
1134 *(uint16_t *) (b
+ 4) = htons(session
[s
].far
); // session
1136 if (mtype
== PPPLCP
|| !(session
[s
].l2tp_flags
& SESSIONACFC
))
1138 *(uint16_t *) b
= htons(0xFF03); // HDLC header
1141 if (mtype
< 0x100 && session
[s
].l2tp_flags
& SESSIONPFC
)
1145 *(uint16_t *) b
= htons(mtype
);
1151 static int backtrace_count
= 0;
1152 LOG(2, s
, t
, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size
, l
+ 12);
1153 log_backtrace(backtrace_count
, 5)
1163 // Send initial LCP ConfigReq for PAP, set magic no.
1164 void initlcp(tunnelidt t
, sessionidt s
)
1168 if (!(q
= makeppp(b
, sizeof(b
), NULL
, 0, t
, s
, PPPLCP
)))
1171 LOG(4, s
, t
, "Sending LCP ConfigReq for PAP\n");
1173 *(uint8_t *)(q
+ 1) = (time_now
% 255) + 1; // ID
1174 *(uint16_t *)(q
+ 2) = htons(14); // Length
1175 *(uint8_t *)(q
+ 4) = 5;
1176 *(uint8_t *)(q
+ 5) = 6;
1177 *(uint32_t *)(q
+ 6) = htonl(session
[s
].magic
);
1178 *(uint8_t *)(q
+ 10) = 3;
1179 *(uint8_t *)(q
+ 11) = 4;
1180 *(uint16_t *)(q
+ 12) = htons(PPPPAP
); // PAP
1182 LOG_HEX(5, "PPPLCP", q
, 14);
1183 tunnelsend(b
, (q
- b
) + 14, t
);
1186 // Send CCP request for no compression
1187 static void initccp(tunnelidt t
, sessionidt s
)
1191 if (!(q
= makeppp(b
, sizeof(b
), NULL
, 0, t
, s
, PPPCCP
)))
1194 LOG(4, s
, t
, "Sending CCP ConfigReq for no compression\n");
1196 *(uint8_t *)(q
+ 1) = (time_now
% 255) + 1; // ID
1197 *(uint16_t *)(q
+ 2) = htons(4); // Length
1199 LOG_HEX(5, "PPPCCP", q
, 4);
1200 tunnelsend(b
, (q
- b
) + 4 , t
);