radius.c

   1 // L2TPNS Radius Stuff
   2
   3 #include <time.h>
   4 #include <stdio.h>
   5 #include <sys/types.h>
   6 #include <sys/socket.h>
   7 #include <malloc.h>
   8 #include <string.h>
   9 #include <fcntl.h>
  10 #include <arpa/inet.h>
  11 #include <ctype.h>
  12 #include <netinet/in.h>
  13 #include <errno.h>
  14
  15 #include "md5.h"
  16 #include "constants.h"
  17 #include "l2tpns.h"
  18 #include "plugin.h"
  19 #include "util.h"
  20 #include "cluster.h"
  21
  22 #include "l2tplac.h"
  23 #include "pppoe.h"
  24
  25 extern radiust *radius;
  26 extern sessiont *session;
  27 extern tunnelt *tunnel;
  28 extern configt *config;
  29 extern int *radfds;
  30 extern ip_filtert *ip_filters;
  31
  32 static const hasht zero;
  33
  34 static void calc_auth(const void *buf, size_t len, const uint8_t *in, uint8_t *out)
  35 {
  36         MD5_CTX ctx;
  37
  38         MD5_Init(&ctx);
  39         MD5_Update(&ctx, (void *)buf, 4); // code, id, length
  40         MD5_Update(&ctx, (void *)in, 16); // auth
  41         MD5_Update(&ctx, (void *)(buf + 20), len - 20);
  42         MD5_Update(&ctx, config->radiussecret, strlen(config->radiussecret));
  43         MD5_Final(out, &ctx);
  44 }
  45
  46 // Set up socket for radius requests
  47 void initrad(void)
  48 {
  49         int i;
  50         uint16_t port = 0;
  51         uint16_t min = config->radius_bind_min;
  52         uint16_t max = config->radius_bind_max;
  53         int inc = 1;
  54         struct sockaddr_in addr;
  55
  56         if (min)
  57         {
  58                 port = min;
  59                 if (!max)
  60                         max = ~0 - 1;
  61         }
  62         else if (max) /* no minimum specified, bind from max down */
  63         {
  64                 port = max;
  65                 min = 1;
  66                 inc = -1;
  67         }
  68
  69         LOG(3, 0, 0, "Creating %d sockets for RADIUS queries\n", RADIUS_FDS);
  70         radfds = calloc(sizeof(int), RADIUS_FDS);
  71         for (i = 0; i < RADIUS_FDS; i++)
  72         {
  73                 int flags;
  74                 radfds[i] = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  75                 flags = fcntl(radfds[i], F_GETFL, 0);
  76                 fcntl(radfds[i], F_SETFL, flags | O_NONBLOCK);
  77
  78                 if (port)
  79                 {
  80                         int b;
  81
  82                         memset(&addr, 0, sizeof(addr));
  83                         addr.sin_family = AF_INET;
  84                         addr.sin_addr.s_addr = INADDR_ANY;
  85
  86                         do {
  87                                 addr.sin_port = htons(port);
  88                                 if ((b = bind(radfds[i], (struct sockaddr *) &addr, sizeof(addr))) < 0)
  89                                 {
  90                                         if ((port += inc) < min || port > max)
  91                                         {
  92                                                 LOG(0, 0, 0, "Can't bind RADIUS socket in range %u-%u\n", min, max);
  93                                                 exit(1);
  94                                         }
  95                                 }
  96                         } while (b < 0);
  97                 }
  98         }
  99 }
 100
 101 void radiusclear(uint16_t r, sessionidt s)
 102 {
 103         if (s) sess_local[s].radius = 0;
 104         memset(&radius[r], 0, sizeof(radius[r])); // radius[r].state = RADIUSNULL;
 105 }
 106
 107 static uint16_t get_free_radius()
 108 {
 109         int count;
 110         static uint32_t next_radius_id = 0;
 111
 112         for (count = MAXRADIUS; count > 0; --count)
 113         {
 114                 ++next_radius_id;               // Find the next ID to check.
 115                 if (next_radius_id >= MAXRADIUS)
 116                         next_radius_id = 1;
 117
 118                 if (radius[next_radius_id].state == RADIUSNULL)
 119                 {
 120                         return next_radius_id;
 121                 }
 122         }
 123
 124         LOG(0, 0, 0, "Can't find a free radius session! This is very bad!\n");
 125         return 0;
 126 }
 127
 128 uint16_t radiusnew(sessionidt s)
 129 {
 130         uint16_t r = sess_local[s].radius;
 131
 132         /* re-use */
 133         if (r)
 134         {
 135                 LOG(3, s, session[s].tunnel, "Re-used radius %d\n", r);
 136                 return r;
 137         }
 138
 139         if (!(r = get_free_radius()))
 140         {
 141                 LOG(1, s, session[s].tunnel, "No free RADIUS sessions\n");
 142                 STAT(radius_overflow);
 143                 return 0;
 144         };
 145
 146         memset(&radius[r], 0, sizeof(radius[r]));
 147         sess_local[s].radius = r;
 148         radius[r].session = s;
 149         radius[r].state = RADIUSWAIT;
 150         radius[r].retry = TIME + 1200; // Wait at least 120 seconds to re-claim this.
 151
 152         random_data(radius[r].auth, sizeof(radius[r].auth));
 153
 154         LOG(3, s, session[s].tunnel, "Allocated radius %d\n", r);
 155         return r;
 156 }
 157
 158 // Send a RADIUS request
 159 void radiussend(uint16_t r, uint8_t state)
 160 {
 161         struct sockaddr_in addr;
 162         uint8_t b[4096];            // RADIUS packet
 163         char pass[129];
 164         int pl;
 165         uint8_t *p;
 166         sessionidt s;
 167
 168         CSTAT(radiussend);
 169
 170         s = radius[r].session;
 171         if (!config->numradiusservers)
 172         {
 173                 LOG(0, s, session[s].tunnel, "No RADIUS servers\n");
 174                 return;
 175         }
 176         if (!*config->radiussecret)
 177         {
 178                 LOG(0, s, session[s].tunnel, "No RADIUS secret\n");
 179                 return;
 180         }
 181
 182         if (state != RADIUSAUTH && state != RADIUSJUSTAUTH && !config->radius_accounting)
 183         {
 184                 // Radius accounting is turned off
 185                 radiusclear(r, s);
 186                 return;
 187         }
 188
 189         if (radius[r].state != state)
 190                 radius[r].try = 0;
 191
 192         radius[r].state = state;
 193         radius[r].retry = backoff(radius[r].try++) + 20; // 3s, 4s, 6s, 10s...
 194         LOG(4, s, session[s].tunnel, "Send RADIUS id %d sock %d state %s try %d\n",
 195                 r >> RADIUS_SHIFT, r & RADIUS_MASK,
 196                 radius_state(radius[r].state), radius[r].try);
 197
 198         if (radius[r].try > config->numradiusservers * 2)
 199         {
 200                 if (s)
 201                 {
 202                         if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
 203                                 sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
 204                         else
 205                         {
 206                                 LOG(1, s, session[s].tunnel, "RADIUS timeout, but in state %s so don't timeout session\n",
 207                                         radius_state(state));
 208                                 radiusclear(r, s);
 209                         }
 210                         STAT(radius_timeout);
 211                 }
 212                 else
 213                 {
 214                         STAT(radius_retries);
 215                         radius[r].state = RADIUSWAIT;
 216                         radius[r].retry = 100;
 217                 }
 218                 return;
 219         }
 220         // contruct RADIUS access request
 221         switch (state)
 222         {
 223                 case RADIUSAUTH:
 224                 case RADIUSJUSTAUTH:
 225                         b[0] = AccessRequest;               // access request
 226                         break;
 227                 case RADIUSSTART:
 228                 case RADIUSSTOP:
 229                 case RADIUSINTERIM:
 230                         b[0] = AccountingRequest;               // accounting request
 231                         break;
 232                 default:
 233                         LOG(0, 0, 0, "Unknown radius state %d\n", state);
 234         }
 235         b[1] = r >> RADIUS_SHIFT;       // identifier
 236         memcpy(b + 4, radius[r].auth, 16);
 237
 238         p = b + 20;
 239         if (s)
 240         {
 241                 *p = 1;                 // user name
 242                 p[1] = strlen(session[s].user) + 2;
 243                 strcpy((char *) p + 2, session[s].user);
 244                 p += p[1];
 245         }
 246         if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
 247         {
 248                 if (radius[r].chap)
 249                 {
 250                         *p = 3;            // CHAP password
 251                         p[1] = 19;         // length
 252                         p[2] = radius[r].id; // ID
 253                         memcpy(p + 3, radius[r].pass, 16); // response from CHAP request
 254                         p += p[1];
 255                         *p = 60;           // CHAP Challenge
 256                         p[1] = 18;         // length
 257                         memcpy(p + 2, radius[r].auth, 16);
 258                         p += p[1];
 259                 }
 260                 else
 261                 {
 262                         strcpy(pass, radius[r].pass);
 263                         pl = strlen(pass);
 264                         while (pl & 15)
 265                                 pass[pl++] = 0; // pad
 266                         if (pl)
 267                         {                // encrypt
 268                                 hasht hash;
 269                                 int p = 0;
 270                                 while (p < pl)
 271                                 {
 272                                         MD5_CTX ctx;
 273                                         MD5_Init(&ctx);
 274                                         MD5_Update(&ctx, config->radiussecret, strlen(config->radiussecret));
 275                                         if (p)
 276                                                 MD5_Update(&ctx, pass + p - 16, 16);
 277                                         else
 278                                                 MD5_Update(&ctx, radius[r].auth, 16);
 279                                         MD5_Final(hash, &ctx);
 280                                         do
 281                                         {
 282                                                 pass[p] ^= hash[p & 15];
 283                                                 p++;
 284                                         }
 285                                         while (p & 15);
 286                                 }
 287                         }
 288                         *p = 2;            // password
 289                         p[1] = pl + 2;
 290                         if (pl)
 291                                 memcpy(p + 2, pass, pl);
 292                         p += p[1];
 293                 }
 294         }
 295         else // accounting
 296         {
 297                 *p = 40;        // accounting type
 298                 p[1] = 6;
 299                 *(uint32_t *) (p + 2) = htonl(state - RADIUSSTART + 1); // start=1, stop=2, interim=3
 300                 p += p[1];
 301                 if (s)
 302                 {
 303                         *p = 44;        // session ID
 304                         p[1] = 18;
 305                         sprintf((char *) p + 2, "%08X%08X", session[s].unique_id, session[s].opened);
 306                         p += p[1];
 307                         if (state == RADIUSSTART)
 308                         {                       // start
 309                                 *p = 41;        // delay
 310                                 p[1] = 6;
 311                                 *(uint32_t *) (p + 2) = htonl(time(NULL) - session[s].opened);
 312                                 p += p[1];
 313                                 sess_local[s].last_interim = time_now; // Setup "first" Interim
 314                         }
 315                         else
 316                         {                       // stop, interim
 317                                 *p = 42;        // input octets
 318                                 p[1] = 6;
 319                                 *(uint32_t *) (p + 2) = htonl(session[s].cin);
 320                                 p += p[1];
 321
 322                                 *p = 43;        // output octets
 323                                 p[1] = 6;
 324                                 *(uint32_t *) (p + 2) = htonl(session[s].cout);
 325                                 p += p[1];
 326
 327                                 *p = 46;        // session time
 328                                 p[1] = 6;
 329                                 *(uint32_t *) (p + 2) = htonl(time(NULL) - session[s].opened);
 330                                 p += p[1];
 331
 332                                 *p = 47;        // input packets
 333                                 p[1] = 6;
 334                                 *(uint32_t *) (p + 2) = htonl(session[s].pin);
 335                                 p += p[1];
 336
 337                                 *p = 48;        // output packets
 338                                 p[1] = 6;
 339                                 *(uint32_t *) (p + 2) = htonl(session[s].pout);
 340                                 p += p[1];
 341
 342                                 *p = 52;        // input gigawords
 343                                 p[1] = 6;
 344                                 *(uint32_t *) (p + 2) = htonl(session[s].cin_wrap);
 345                                 p += p[1];
 346
 347                                 *p = 53;        // output gigawords
 348                                 p[1] = 6;
 349                                 *(uint32_t *) (p + 2) = htonl(session[s].cout_wrap);
 350                                 p += p[1];
 351
 352                                 if (state == RADIUSSTOP && radius[r].term_cause)
 353                                 {
 354                                         *p = 49; // acct-terminate-cause
 355                                         p[1] = 6;
 356                                         *(uint32_t *) (p + 2) = htonl(radius[r].term_cause);
 357                                         p += p[1];
 358
 359                                         if (radius[r].term_msg)
 360                                         {
 361                                                 *p = 26;                                // vendor-specific
 362                                                 *(uint32_t *) (p + 2) = htonl(9);       // Cisco
 363                                                 p[6] = 1;                               // Cisco-AVPair
 364                                                 p[7] = 2 + sprintf((char *) p + 8, "disc-cause-ext=%s", radius[r].term_msg);
 365                                                 p[1] = p[7] + 6;
 366                                                 p += p[1];
 367                                         }
 368                                 }
 369                         }
 370
 371                         if (session[s].classlen) {
 372                                 *p = 25;        // class
 373                                 p[1] = session[s].classlen + 2;
 374                                 memcpy(p + 2, session[s].class, session[s].classlen);
 375                                 p += p[1];
 376                         }
 377
 378                         {
 379                                 struct param_radius_account acct = { &tunnel[session[s].tunnel], &session[s], &p };
 380                                 run_plugins(PLUGIN_RADIUS_ACCOUNT, &acct);
 381                         }
 382                 }
 383         }
 384
 385         if (s)
 386         {
 387                 *p = 5;         // NAS-Port
 388                 p[1] = 6;
 389                 *(uint32_t *) (p + 2) = htonl(s);
 390                 p += p[1];
 391
 392                 *p = 6;         // Service-Type
 393                 p[1] = 6;
 394                 *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 8 : 2)); // Authenticate only or Framed-User respectevily
 395                 p += p[1];
 396
 397                 *p = 7;         // Framed-Protocol
 398                 p[1] = htonl((state == RADIUSJUSTAUTH ? 0 : 6));
 399                 *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 0 : 1)); // PPP
 400                 p += p[1];
 401
 402                 if (session[s].ip)
 403                 {
 404                         *p = 8;                 // Framed-IP-Address
 405                         p[1] = 6;
 406                         *(uint32_t *) (p + 2) = htonl(session[s].ip);
 407                         p += p[1];
 408                 }
 409
 410                 if (session[s].route[0].ip)
 411                 {
 412                         int r;
 413                         for (r = 0; s && r < MAXROUTE && session[s].route[r].ip; r++)
 414                         {
 415                                 *p = 22;        // Framed-Route
 416                                 p[1] = sprintf((char *) p + 2, "%s/%d %s 1",
 417                                         fmtaddr(htonl(session[s].route[r].ip), 0),
 418                                         session[s].route[r].prefixlen,
 419                                         fmtaddr(htonl(session[s].ip), 1)) + 2;
 420
 421                                 p += p[1];
 422                         }
 423                 }
 424
 425                 if (session[s].session_timeout)
 426                 {
 427                         *p = 27;                // Session-Timeout
 428                         p[1] = 6;
 429                         *(uint32_t *) (p + 2) = htonl(session[s].session_timeout);
 430                         p += p[1];
 431                 }
 432
 433                 if (session[s].idle_timeout)
 434                 {
 435                         *p = 28;                // Idle-Timeout
 436                         p[1] = 6;
 437                         *(uint32_t *) (p + 2) = htonl(session[s].idle_timeout);
 438                         p += p[1];
 439                 }
 440
 441                 if (*session[s].called)
 442                 {
 443                         *p = 30;                // called
 444                         p[1] = strlen(session[s].called) + 2;
 445                         strcpy((char *) p + 2, session[s].called);
 446                         p += p[1];
 447                 }
 448
 449                 if (*session[s].calling)
 450                 {
 451                         *p = 31;                // calling
 452                         p[1] = strlen(session[s].calling) + 2;
 453                         strcpy((char *) p + 2, session[s].calling);
 454                         p += p[1];
 455                 }
 456         }
 457
 458         // NAS-IP-Address
 459         *p = 4;
 460         p[1] = 6;
 461         *(uint32_t *)(p + 2) = config->bind_address;
 462         p += p[1];
 463
 464         // All AVpairs added
 465         *(uint16_t *) (b + 2) = htons(p - b);
 466         if (state != RADIUSAUTH && state != RADIUSJUSTAUTH)
 467         {
 468                 // Build auth for accounting packet
 469                 calc_auth(b, p - b, zero, b + 4);
 470                 memcpy(radius[r].auth, b + 4, 16);
 471         }
 472         memset(&addr, 0, sizeof(addr));
 473         addr.sin_family = AF_INET;
 474         *(uint32_t *) & addr.sin_addr = config->radiusserver[(radius[r].try - 1) % config->numradiusservers];
 475         {
 476                 // get radius port
 477                 uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers];
 478                 // assume RADIUS accounting port is the authentication port +1
 479                 addr.sin_port = htons((state == RADIUSAUTH || state == RADIUSJUSTAUTH) ? port : port+1);
 480         }
 481
 482         LOG_HEX(5, "RADIUS Send", b, (p - b));
 483         sendto(radfds[r & RADIUS_MASK], b, p - b, 0, (void *) &addr, sizeof(addr));
 484 }
 485
 486 static void handle_avpair(sessionidt s, uint8_t *avp, int len)
 487 {
 488         uint8_t *key = avp;
 489         uint8_t *value = memchr(avp, '=', len);
 490         uint8_t tmp[2048] = "";
 491
 492         if (value)
 493         {
 494                 *value++ = 0;
 495                 len -= value - key;
 496         }
 497         else
 498         {
 499                 value = tmp;
 500                 len = 0;
 501         }
 502
 503         // strip quotes
 504         if (len > 2 && (*value == '"' || *value == '\'') && value[len - 1] == *value)
 505         {
 506                 value++;
 507                 len--;
 508                 value[len - 1] = 0;
 509         }
 510         // copy and null terminate
 511         else if (len < sizeof(tmp) - 1)
 512         {
 513                 memcpy(tmp, value, len);
 514                 tmp[len] = 0;
 515                 value = tmp;
 516         }
 517         else
 518                 return;
 519
 520         // Run hooks
 521         {
 522                 struct param_radius_response p = { &tunnel[session[s].tunnel], &session[s], (char *) key, (char *) value };
 523                 run_plugins(PLUGIN_RADIUS_RESPONSE, &p);
 524         }
 525 }
 526
 527 // process RADIUS response
 528 void processrad(uint8_t *buf, int len, char socket_index)
 529 {
 530         uint8_t b[MAXETHER];
 531         uint16_t r;
 532         sessionidt s;
 533         tunnelidt t = 0;
 534         hasht hash;
 535         uint8_t routes = 0;
 536         int r_code;
 537         int r_id;
 538         int OpentunnelReq = 0;
 539
 540         CSTAT(processrad);
 541
 542         LOG_HEX(5, "RADIUS Response", buf, len);
 543         if (len < 20 || len < ntohs(*(uint16_t *) (buf + 2)))
 544         {
 545                 LOG(1, 0, 0, "Duff RADIUS response length %d\n", len);
 546                 return ;
 547         }
 548
 549         r_code = buf[0]; // response type
 550         r_id = buf[1]; // radius reply indentifier.
 551
 552         len = ntohs(*(uint16_t *) (buf + 2));
 553         r = socket_index | (r_id << RADIUS_SHIFT);
 554         s = radius[r].session;
 555         LOG(3, s, session[s].tunnel, "Received %s, radius %d response for session %u (%s, id %d)\n",
 556                         radius_state(radius[r].state), r, s, radius_code(r_code), r_id);
 557
 558         if (!s && radius[r].state != RADIUSSTOP)
 559         {
 560                 LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");
 561                 return;
 562         }
 563         if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSJUSTAUTH && radius[r].state != RADIUSSTART
 564             && radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM)
 565         {
 566                 LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");
 567                 return;
 568         }
 569         t = session[s].tunnel;
 570         calc_auth(buf, len, radius[r].auth, hash);
 571         do {
 572                 if (memcmp(hash, buf + 4, 16))
 573                 {
 574                         LOG(0, s, session[s].tunnel, "   Incorrect auth on RADIUS response!! (wrong secret in radius config?)\n");
 575                         return; // Do nothing. On timeout, it will try the next radius server.
 576                 }
 577
 578                 if (((radius[r].state == RADIUSAUTH ||radius[r].state == RADIUSJUSTAUTH) && r_code != AccessAccept && r_code != AccessReject) ||
 579                         ((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse))
 580                 {
 581                         LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response %s\n", radius_code(r_code));
 582                         return; // We got something we didn't expect. Let the timeouts take
 583                                 // care off finishing the radius session if that's really correct.
 584                 }
 585
 586                 if (radius[r].state == RADIUSAUTH || radius[r].state == RADIUSJUSTAUTH)
 587                 {
 588                         // run post-auth plugin
 589                         struct param_post_auth packet = {
 590                                 &tunnel[t],
 591                                 &session[s],
 592                                 session[s].user,
 593                                 (r_code == AccessAccept),
 594                                 radius[r].chap ? PPPCHAP : PPPPAP
 595                         };
 596
 597                         run_plugins(PLUGIN_POST_AUTH, &packet);
 598                         r_code = packet.auth_allowed ? AccessAccept : AccessReject;
 599
 600                         if (r_code == AccessAccept)
 601                         {
 602                                 // Login successful
 603                                 // Extract IP, routes, etc
 604                                 uint8_t *p = buf + 20;
 605                                 uint8_t *e = buf + len;
 606                                 uint8_t tag;
 607                                 uint8_t strtemp[256];
 608                                 lac_reset_rad_tag_tunnel_ctxt();
 609
 610                                 for (; p + 2 <= e && p[1] && p + p[1] <= e; p += p[1])
 611                                 {
 612                                         if (*p == 26 && p[1] >= 7)
 613                                         {
 614                                                 // Vendor-Specific Attribute
 615                                                 uint32_t vendor = ntohl(*(int *)(p + 2));
 616                                                 uint8_t attrib = *(p + 6);
 617                                                 int attrib_length = *(p + 7) - 2;
 618
 619                                                 LOG(4, s, session[s].tunnel, "   Radius reply contains Vendor-Specific.  Vendor=%u Attrib=%u Length=%d\n", vendor, attrib, attrib_length);
 620                                                 if (vendor == 9 && attrib == 1) // Cisco-AVPair
 621                                                 {
 622                                                         if (attrib_length < 0) continue;
 623                                                         LOG(3, s, session[s].tunnel, "      Cisco-AVPair value: %.*s\n",
 624                                                                 attrib_length, p + 8);
 625
 626                                                         handle_avpair(s, p + 8, attrib_length);
 627                                                         continue;
 628                                                 }
 629                                                 else if (vendor == 529 && attrib >= 135 && attrib <= 136) // Ascend
 630                                                 {
 631                                                         // handle old-format ascend DNS attributes below
 632                                                         p += 6;
 633                                                 }
 634                                                 else
 635                                                 {
 636                                                         LOG(3, s, session[s].tunnel, "      Unknown vendor-specific\n");
 637                                                         continue;
 638                                                 }
 639                                         }
 640
 641                                         if (*p == 8)
 642                                         {
 643                                                 // Framed-IP-Address
 644                                                 if (p[1] < 6) continue;
 645                                                 session[s].ip = ntohl(*(uint32_t *) (p + 2));
 646                                                 session[s].ip_pool_index = -1;
 647                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains IP address %s\n",
 648                                                         fmtaddr(htonl(session[s].ip), 0));
 649
 650                                                 if (session[s].ip == 0xFFFFFFFE)
 651                                                         session[s].ip = 0; // assign from pool
 652                                         }
 653                                         else if (*p == 135)
 654                                         {
 655                                                 // DNS address
 656                                                 if (p[1] < 6) continue;
 657                                                 session[s].dns1 = ntohl(*(uint32_t *) (p + 2));
 658                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains primary DNS address %s\n",
 659                                                         fmtaddr(htonl(session[s].dns1), 0));
 660                                         }
 661                                         else if (*p == 136)
 662                                         {
 663                                                 // DNS address
 664                                                 if (p[1] < 6) continue;
 665                                                 session[s].dns2 = ntohl(*(uint32_t *) (p + 2));
 666                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains secondary DNS address %s\n",
 667                                                         fmtaddr(htonl(session[s].dns2), 0));
 668                                         }
 669                                         else if (*p == 22)
 670                                         {
 671                                                 // Framed-Route
 672                                                 in_addr_t ip = 0;
 673                                                 uint8_t u = 0;
 674                                                 uint8_t bits = 0;
 675                                                 uint8_t *n = p + 2;
 676                                                 uint8_t *e = p + p[1];
 677                                                 while (n < e && (isdigit(*n) || *n == '.'))
 678                                                 {
 679                                                         if (*n == '.')
 680                                                         {
 681                                                                 ip = (ip << 8) + u;
 682                                                                 u = 0;
 683                                                         }
 684                                                         else
 685                                                                 u = u * 10 + *n - '0';
 686                                                         n++;
 687                                                 }
 688                                                 ip = (ip << 8) + u;
 689                                                 if (*n == '/')
 690                                                 {
 691                                                         n++;
 692                                                         while (n < e && isdigit(*n))
 693                                                                 bits = bits * 10 + *n++ - '0';
 694                                                 }
 695                                                 else if ((ip >> 24) < 128)
 696                                                         bits = 8;
 697                                                 else if ((ip >> 24) < 192)
 698                                                         bits = 16;
 699                                                 else
 700                                                         bits = 24;
 701
 702                                                 if (routes == MAXROUTE)
 703                                                 {
 704                                                         LOG(1, s, session[s].tunnel, "   Too many routes\n");
 705                                                 }
 706                                                 else if (ip)
 707                                                 {
 708                                                         LOG(3, s, session[s].tunnel, "   Radius reply contains route for %s/%d\n",
 709                                                                 fmtaddr(htonl(ip), 0), bits);
 710
 711                                                         session[s].route[routes].ip = ip;
 712                                                         session[s].route[routes].prefixlen = bits;
 713                                                         routes++;
 714                                                 }
 715                                         }
 716                                         else if (*p == 11)
 717                                         {
 718                                                 // Filter-Id
 719                                                 char *filter = (char *) p + 2;
 720                                                 int l = p[1] - 2;
 721                                                 char *suffix;
 722                                                 int f;
 723                                                 uint8_t *fp = 0;
 724
 725                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains Filter-Id \"%.*s\"\n", l, filter);
 726                                                 if ((suffix = memchr(filter, '.', l)))
 727                                                 {
 728                                                         int b = suffix - filter;
 729                                                         if (l - b == 3 && !memcmp("in", suffix+1, 2))
 730                                                                 fp = &session[s].filter_in;
 731                                                         else if (l - b == 4 && !memcmp("out", suffix+1, 3))
 732                                                                 fp = &session[s].filter_out;
 733
 734                                                         l = b;
 735                                                 }
 736
 737                                                 if (!fp)
 738                                                 {
 739                                                         LOG(3, s, session[s].tunnel, "    Invalid filter\n");
 740                                                         continue;
 741                                                 }
 742
 743                                                 if ((f = find_filter(filter, l)) < 0 || !*ip_filters[f].name)
 744                                                 {
 745                                                         LOG(3, s, session[s].tunnel, "    Unknown filter\n");
 746                                                 }
 747                                                 else
 748                                                 {
 749                                                         *fp = f + 1;
 750                                                         ip_filters[f].used++;
 751                                                 }
 752                                         }
 753                                         else if (*p == 27)
 754                                         {
 755                                                 // Session-Timeout
 756                                                 if (p[1] < 6) continue;
 757                                                 session[s].session_timeout = ntohl(*(uint32_t *)(p + 2));
 758                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains Session-Timeout = %u\n", session[s].session_timeout);
 759                                                 if(!session[s].session_timeout && config->kill_timedout_sessions)
 760                                                         sessionshutdown(s, "Session timeout is zero", CDN_ADMIN_DISC, 0);
 761                                         }
 762                                         else if (*p == 28)
 763                                         {
 764                                                 // Idle-Timeout
 765                                                 if (p[1] < 6) continue;
 766                                                 session[s].idle_timeout = ntohl(*(uint32_t *)(p + 2));
 767                                                 LOG(3, s, session[s].tunnel, "   Radius reply contains Idle-Timeout = %u\n", session[s].idle_timeout);
 768                                         }
 769                                         else if (*p == 99)
 770                                         {
 771                                                 // Framed-IPv6-Route
 772                                                 struct in6_addr r6;
 773                                                 int prefixlen;
 774                                                 uint8_t *n = p + 2;
 775                                                 uint8_t *e = p + p[1];
 776                                                 uint8_t *m = memchr(n, '/', e - p);
 777
 778                                                 *m++ = 0;
 779                                                 inet_pton(AF_INET6, (char *) n, &r6);
 780
 781                                                 prefixlen = 0;
 782                                                 while (m < e && isdigit(*m)) {
 783                                                         prefixlen = prefixlen * 10 + *m++ - '0';
 784                                                 }
 785
 786                                                 if (prefixlen)
 787                                                 {
 788                                                         LOG(3, s, session[s].tunnel,
 789                                                                 "   Radius reply contains route for %s/%d\n",
 790                                                                 n, prefixlen);
 791                                                         session[s].ipv6route = r6;
 792                                                         session[s].ipv6prefixlen = prefixlen;
 793                                                 }
 794                                         }
 795                                         else if (*p == 25)
 796                                         {
 797                                                 // Class
 798                                                 if (p[1] < 3) continue;
 799                                                 session[s].classlen = p[1] - 2;
 800                                                 if (session[s].classlen > MAXCLASS)
 801                                                         session[s].classlen = MAXCLASS;
 802                                                 memcpy(session[s].class, p + 2, session[s].classlen);
 803                                         }
 804                                         else if (*p == 64)
 805                                         {
 806                                                 // Tunnel-Type
 807                                                 if (p[1] != 6) continue;
 808                                                 tag = p[2];
 809                                                 LOG(3, s, session[s].tunnel, "   Radius reply Tunnel-Type:%d %d\n",
 810                                                         tag, ntohl(*(uint32_t *)(p + 2)) & 0xFFFFFF);
 811                                                 // Fill context
 812                                                 lac_set_rad_tag_tunnel_type(tag, ntohl(*(uint32_t *)(p + 2)) & 0xFFFFFF);
 813                                                 /* Request open tunnel to remote LNS*/
 814                                                 OpentunnelReq = 1;
 815                                         }
 816                                         else if (*p == 65)
 817                                         {
 818                                                 // Tunnel-Medium-Type
 819                                                 if (p[1] < 6) continue;
 820                                                 tag = p[2];
 821                                                 LOG(3, s, session[s].tunnel, "   Radius reply Tunnel-Medium-Type:%d %d\n",
 822                                                         tag, ntohl(*(uint32_t *)(p + 2)) & 0xFFFFFF);
 823                                                 // Fill context
 824                                                 lac_set_rad_tag_tunnel_medium_type(tag, ntohl(*(uint32_t *)(p + 2)) & 0xFFFFFF);
 825                                         }
 826                                         else if (*p == 67)
 827                                         {
 828                                                 // Tunnel-Server-Endpoint
 829                                                 if (p[1] < 3) continue;
 830                                                 tag = p[2];
 831                                                 //If the Tag field is greater than 0x1F,
 832                                                 // it SHOULD be interpreted as the first byte of the following String field.
 833                                                 memset(strtemp, 0, 256);
 834                                                 if (tag > 0x1F)
 835                                                 {
 836                                                         tag = 0;
 837                                                         memcpy(strtemp, (p + 2), p[1]-2);
 838                                                 }
 839                                                 else
 840                                                         memcpy(strtemp, (p + 3), p[1]-3);
 841
 842                                                 LOG(3, s, session[s].tunnel, "   Radius reply Tunnel-Server-Endpoint:%d %s\n", tag, strtemp);
 843                                                 // Fill context
 844                                                 lac_set_rad_tag_tunnel_serv_endpt(tag, (char *) strtemp);
 845                                         }
 846                                         else if (*p == 69)
 847                                         {
 848                                                 // Tunnel-Password
 849                                                 size_t lentemp;
 850
 851                                                 if (p[1] < 5) continue;
 852                                                 tag = p[2];
 853
 854                                                 memset(strtemp, 0, 256);
 855                                                 lentemp = p[1]-3;
 856                                                 memcpy(strtemp, (p + 3), lentemp);
 857                                                 if (!rad_tunnel_pwdecode(strtemp, &lentemp, config->radiussecret, radius[r].auth))
 858                                                 {
 859                                                         LOG_HEX(3, "Error Decode Tunnel-Password, Dump Radius reponse:", p, p[1]);
 860                                                         continue;
 861                                                 }
 862
 863                                                 LOG(3, s, session[s].tunnel, "   Radius reply Tunnel-Password:%d %s\n", tag, strtemp);
 864                                                 if (strlen((char *) strtemp) > 63)
 865                                                 {
 866                                                         LOG(1, s, session[s].tunnel, "tunnel password is too long (>63)\n");
 867                                                         continue;
 868                                                 }
 869                                                 // Fill context
 870                                                 lac_set_rad_tag_tunnel_password(tag, (char *) strtemp);
 871                                         }
 872                                         else if (*p == 82)
 873                                         {
 874                                                 // Tunnel-Assignment-Id
 875                                                 if (p[1] < 3) continue;
 876                                                 tag = p[2];
 877                                                 //If the Tag field is greater than 0x1F,
 878                                                 // it SHOULD be interpreted as the first byte of the following String field.
 879                                                 memset(strtemp, 0, 256);
 880                                                 if (tag > 0x1F)
 881                                                 {
 882                                                         tag = 0;
 883                                                         memcpy(strtemp, (p + 2), p[1]-2);
 884                                                 }
 885                                                 else
 886                                                         memcpy(strtemp, (p + 3), p[1]-3);
 887
 888                                                 LOG(3, s, session[s].tunnel, "   Radius reply Tunnel-Assignment-Id:%d %s\n", tag, strtemp);
 889                                                 // Fill context
 890                                                 lac_set_rad_tag_tunnel_assignment_id(tag, (char *) strtemp);
 891                                         }
 892                                 }
 893                         }
 894                         else if (r_code == AccessReject)
 895                         {
 896                                 LOG(2, s, session[s].tunnel, "   Authentication rejected for %s\n", session[s].user);
 897                                 sessionkill(s, "Authentication rejected");
 898                                 break;
 899                         }
 900
 901                         if ((!config->disable_lac_func) && OpentunnelReq)
 902                         {
 903                                 char assignment_id[256];
 904                                 // Save radius tag context to conf
 905                                 lac_save_rad_tag_tunnels(s);
 906
 907                                 memset(assignment_id, 0, 256);
 908                                 if (!lac_rad_select_assignment_id(s, assignment_id))
 909                                         break; // Error no assignment_id
 910
 911                                 LOG(3, s, session[s].tunnel, "Select Tunnel Remote LNS for assignment_id == %s\n", assignment_id);
 912
 913                                 if (lac_rad_forwardtoremotelns(s, assignment_id, session[s].user))
 914                                 {
 915                                         int ro;
 916                                         // Sanity check, no local IP to session forwarded
 917                                         session[s].ip = 0;
 918                                         for (ro = 0; r < MAXROUTE && session[s].route[ro].ip; r++)
 919                                         {
 920                                                 session[s].route[ro].ip = 0;
 921                                         }
 922                                         break;
 923                                 }
 924                         }
 925
 926                         // process auth response
 927                         if (radius[r].chap)
 928                         {
 929                                 // CHAP
 930                                 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP, 0, 0, 0);
 931                                 if (!p) return; // Abort!
 932
 933                                 *p = (r_code == AccessAccept) ? 3 : 4;     // ack/nak
 934                                 p[1] = radius[r].id;
 935                                 *(uint16_t *) (p + 2) = ntohs(4); // no message
 936                                 tunnelsend(b, (p - b) + 4, t); // send it
 937
 938                                 LOG(3, s, session[s].tunnel, "   CHAP User %s authentication %s.\n", session[s].user,
 939                                                 (r_code == AccessAccept) ? "allowed" : "denied");
 940                         }
 941                         else
 942                         {
 943                                 // PAP
 944                                 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP, 0, 0, 0);
 945                                 if (!p) return;         // Abort!
 946
 947                                 // ack/nak
 948                                 *p = r_code;
 949                                 p[1] = radius[r].id;
 950                                 *(uint16_t *) (p + 2) = ntohs(5);
 951                                 p[4] = 0; // no message
 952                                 tunnelsend(b, (p - b) + 5, t); // send it
 953
 954                                 LOG(3, s, session[s].tunnel, "   PAP User %s authentication %s.\n", session[s].user,
 955                                                 (r_code == AccessAccept) ? "allowed" : "denied");
 956                         }
 957
 958                         if (!session[s].dns1 && config->default_dns1)
 959                         {
 960                                 session[s].dns1 = ntohl(config->default_dns1);
 961                                 LOG(3, s, t, "   Sending dns1 = %s\n", fmtaddr(config->default_dns1, 0));
 962                         }
 963                         if (!session[s].dns2 && config->default_dns2)
 964                         {
 965                                 session[s].dns2 = ntohl(config->default_dns2);
 966                                 LOG(3, s, t, "   Sending dns2 = %s\n", fmtaddr(config->default_dns2, 0));
 967                         }
 968
 969                         // Valid Session, set it up
 970                         session[s].unique_id = 0;
 971                         sessionsetup(s, t);
 972                 }
 973                 else
 974                 {
 975                                 // An ack for a stop or start record.
 976                         LOG(3, s, t, "   RADIUS accounting ack recv in state %s\n", radius_state(radius[r].state));
 977                         break;
 978                 }
 979         } while (0);
 980
 981         // finished with RADIUS
 982         radiusclear(r, s);
 983 }
 984
 985 // Send a retry for RADIUS/CHAP message
 986 void radiusretry(uint16_t r)
 987 {
 988         sessionidt s = radius[r].session;
 989         tunnelidt t = 0;
 990
 991         CSTAT(radiusretry);
 992
 993         if (s) t = session[s].tunnel;
 994
 995         switch (radius[r].state)
 996         {
 997                 case RADIUSCHAP:        // sending CHAP down PPP
 998                         sendchap(s, t);
 999                         break;
1000                 case RADIUSAUTH:        // sending auth to RADIUS server
1001                 case RADIUSJUSTAUTH:    // sending auth to RADIUS server
1002                 case RADIUSSTART:       // sending start accounting to RADIUS server
1003                 case RADIUSSTOP:        // sending stop accounting to RADIUS server
1004                 case RADIUSINTERIM:     // sending interim accounting to RADIUS server
1005                         radiussend(r, radius[r].state);
1006                         break;
1007                 default:
1008                 case RADIUSNULL:        // Not in use
1009                 case RADIUSWAIT:        // waiting timeout before available, in case delayed reply from RADIUS server
1010                         // free up RADIUS task
1011                         radiusclear(r, s);
1012                         LOG(3, s, session[s].tunnel, "Freeing up radius session %d\n", r);
1013                         break;
1014         }
1015 }
1016
1017 extern int daefd;
1018
1019 void processdae(uint8_t *buf, int len, struct sockaddr_in *addr, int alen, struct in_addr *local)
1020 {
1021         int i, r_code, r_id, length, attribute_length;
1022         uint8_t *packet, attribute;
1023         hasht hash;
1024         char username[MAXUSER] = "";
1025         in_addr_t nas = 0;
1026         in_addr_t ip = 0;
1027         uint32_t port = 0;
1028         uint32_t error = 0;
1029         sessionidt s = 0;
1030         tunnelidt t;
1031         int fin = -1;
1032         int fout = -1;
1033         uint8_t *avpair[64];
1034         int avpair_len[sizeof(avpair)/sizeof(*avpair)];
1035         int avp = 0;
1036         int auth_only = 0;
1037         uint8_t *p;
1038
1039         LOG(3, 0, 0, "DAE request from %s\n", fmtaddr(addr->sin_addr.s_addr, 0));
1040         LOG_HEX(5, "DAE Request", buf, len);
1041
1042         if (len < 20 || len < ntohs(*(uint16_t *) (buf + 2)))
1043         {
1044                 LOG(1, 0, 0, "Duff DAE request length %d\n", len);
1045                 return;
1046         }
1047
1048         r_code = buf[0]; // request type
1049         r_id = buf[1]; // radius indentifier.
1050
1051         if (r_code != DisconnectRequest && r_code != CoARequest)
1052         {
1053                 LOG(1, 0, 0, "Unrecognised DAE request %s\n", radius_code(r_code));
1054                 return;
1055         }
1056
1057         if (!config->cluster_iam_master)
1058         {
1059                 master_forward_dae_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
1060                 return;
1061         }
1062
1063         len = ntohs(*(uint16_t *) (buf + 2));
1064
1065         LOG(3, 0, 0, "Received DAE %s, id %d\n", radius_code(r_code), r_id);
1066
1067         // check authenticator
1068         calc_auth(buf, len, zero, hash);
1069         if (memcmp(hash, buf + 4, 16) != 0)
1070         {
1071                 LOG(1, 0, 0, "Incorrect vector in DAE request (wrong secret in radius config?)\n");
1072                 return;
1073         }
1074
1075         // unpack attributes
1076         packet = buf + 20;
1077         length = len - 20;
1078
1079         while (length > 0)
1080         {
1081                 attribute = *packet++;
1082                 attribute_length = *packet++;
1083                 if (attribute_length < 2)
1084                         break;
1085
1086                 length -= attribute_length;
1087                 attribute_length -= 2;
1088                 switch (attribute)
1089                 {
1090                 case 1: /* username */
1091                         len = attribute_length < MAXUSER ? attribute_length : MAXUSER - 1;
1092                         memcpy(username, packet, len);
1093                         username[len] = 0;
1094                         LOG(4, 0, 0, "    Received DAE User-Name: %s\n", username);
1095                         break;
1096
1097                 case 4: /* nas ip address */
1098                         nas = *(uint32_t *) packet; // net order
1099                         if (nas != config->bind_address)
1100                                 error = 403; // NAS identification mismatch
1101
1102                         LOG(4, 0, 0, "    Received DAE NAS-IP-Address: %s\n", fmtaddr(nas, 0));
1103                         break;
1104
1105                 case 5: /* nas port */
1106                         port = ntohl(*(uint32_t *) packet);
1107                         if (port < 1 || port > MAXSESSION)
1108                                 error = 404;
1109
1110                         LOG(4, 0, 0, "    Received DAE NAS-Port: %u\n", port);
1111                         break;
1112
1113                 case 6: /* service type */
1114                         {
1115                                 uint32_t service_type = ntohl(*(uint32_t *) packet);
1116                                 auth_only = service_type == 8; // Authenticate only
1117
1118                                 LOG(4, 0, 0, "    Received DAE Service-Type: %u\n", service_type);
1119                         }
1120                         break;
1121
1122                 case 8: /* ip address */
1123                         ip = *(uint32_t *) packet; // net order
1124                         LOG(4, 0, 0, "    Received DAE Framed-IP-Address: %s\n", fmtaddr(ip, 0));
1125                         break;
1126
1127                 case 11: /* filter id */
1128                         LOG(4, 0, 0, "    Received DAE Filter-Id: %.*s\n", attribute_length, packet);
1129                         if (!(p = memchr(packet, '.', attribute_length)))
1130                         {
1131                                 error = 404; // invalid request
1132                                 break;
1133                         }
1134
1135                         len = p - packet;
1136                         i = find_filter((char *) packet, len);
1137                         if (i < 0 || !*ip_filters[i].name)
1138                         {
1139                                 error = 404;
1140                                 break;
1141                         }
1142
1143                         if (!memcmp(p, ".in", attribute_length - len))
1144                                 fin = i + 1;
1145                         else if (!memcmp(p, ".out", attribute_length - len))
1146                                 fout = i + 1;
1147                         else
1148                                 error = 404;
1149
1150                         break;
1151
1152                 case 26: /* vendor specific */
1153                         if (attribute_length >= 6
1154                             && ntohl(*(uint32_t *) packet) == 9 // Cisco
1155                             && *(packet + 4) == 1               // Cisco-AVPair
1156                             && *(packet + 5) >= 2)              // length
1157                         {
1158                                 int len = *(packet + 5) - 2;
1159                                 uint8_t *a = packet + 6;
1160
1161                                 LOG(4, 0, 0, "    Received DAE Cisco-AVPair: %.*s\n", len, a);
1162                                 if (avp < sizeof(avpair)/sizeof(*avpair) - 1)
1163                                 {
1164                                         avpair[avp] = a;
1165                                         avpair_len[avp++] = len;
1166                                 }
1167                         }
1168                         break;
1169                 }
1170
1171                 packet += attribute_length;
1172         }
1173
1174         if (!error && auth_only)
1175         {
1176                 if (fin != -1 || fout != -1 || avp)
1177                         error = 401; // unsupported attribute
1178                 else
1179                         error = 405; // unsupported service
1180         }
1181
1182         if (!error && !(port || ip || *username))
1183                 error = 402; // missing attribute
1184
1185         // exact match for SID if given
1186         if (!error && port)
1187         {
1188                 s = port;
1189                 if (!session[s].opened)
1190                         error = 503; // not found
1191         }
1192
1193         if (!error && ip)
1194         {
1195                 // find/check session by IP
1196                 i = sessionbyip(ip);
1197                 if (!i || (s && s != i)) // not found or mismatching port
1198                         error = 503;
1199                 else
1200                         s = i;
1201         }
1202
1203         if (!error && *username)
1204         {
1205                 if (s)
1206                 {
1207                         if (strcmp(session[s].user, username))
1208                                 error = 503;
1209                 }
1210                 else if (!(s = sessionbyuser(username)))
1211                         error = 503;
1212         }
1213
1214         t = session[s].tunnel;
1215
1216         switch (r_code)
1217         {
1218         case DisconnectRequest: // Packet of Disconnect/Death
1219                 if (error)
1220                 {
1221                         r_code = DisconnectNAK;
1222                         break;
1223                 }
1224
1225                 LOG(3, s, t, "    DAE Disconnect %d (%s)\n", s, session[s].user);
1226                 r_code = DisconnectACK;
1227
1228                 sessionshutdown(s, "Requested by PoD", CDN_ADMIN_DISC, TERM_ADMIN_RESET); // disconnect session
1229                 break;
1230
1231         case CoARequest: // Change of Authorization
1232                 if (error)
1233                 {
1234                         r_code = CoANAK;
1235                         break;
1236                 }
1237
1238                 LOG(3, s, t, "    DAE Change %d (%s)\n", s, session[s].user);
1239                 r_code = CoAACK;
1240
1241                 // reset
1242                 {
1243                         struct param_radius_reset p = { &tunnel[session[s].tunnel], &session[s] };
1244                         run_plugins(PLUGIN_RADIUS_RESET, &p);
1245                 }
1246
1247                 // apply filters
1248                 if (fin == -1)
1249                         fin = 0;
1250                 else
1251                         LOG(3, s, t, "        Filter in %d (%s)\n", fin, ip_filters[fin - 1].name);
1252
1253                 if (fout == -1)
1254                         fout = 0;
1255                 else
1256                         LOG(3, s, t, "        Filter out %d (%s)\n", fout, ip_filters[fout - 1].name);
1257
1258                 filter_session(s, fin, fout);
1259
1260                 // process cisco av-pair(s)
1261                 for (i = 0; i < avp; i++)
1262                 {
1263                         LOG(3, s, t, "        Cisco-AVPair: %.*s\n", avpair_len[i], avpair[i]);
1264                         handle_avpair(s, avpair[i], avpair_len[i]);
1265                 }
1266
1267                 cluster_send_session(s);
1268                 break;
1269         }
1270
1271         // send response
1272         packet = buf;
1273         *packet++ = r_code;
1274         *packet++ = r_id;
1275         // skip len + auth
1276         packet += 2 + 16;
1277         len = packet - buf;
1278
1279         // add attributes
1280         if (error)
1281         {
1282                 // add error cause
1283                 *packet++ = 101;
1284                 *packet++ = 6;
1285                 *(uint32_t *) packet = htonl(error);
1286                 len += 6;
1287         }
1288
1289         *((uint16_t *)(buf + 2)) = htons(len);
1290
1291         // make vector
1292         calc_auth(buf, len, hash, buf + 4);
1293
1294         LOG(3, 0, 0, "Sending DAE %s, id=%d\n", radius_code(r_code), r_id);
1295
1296         // send DAE response
1297         if (sendtofrom(daefd, buf, len, MSG_DONTWAIT | MSG_NOSIGNAL, (struct sockaddr *) addr, alen, local) < 0)
1298                 LOG(0, 0, 0, "Error sending DAE response packet: %s\n", strerror(errno));
1299 }
1300
1301 // Decrypte the encrypted Tunnel Password.
1302 // Defined in RFC-2868.
1303 // the pl2tpsecret buffer must set to 256 characters.
1304 // return 0 on decoding error else length of decoded l2tpsecret
1305 int rad_tunnel_pwdecode(uint8_t *pl2tpsecret, size_t *pl2tpsecretlen,
1306                                                 const char *radiussecret, const uint8_t * auth)
1307 {
1308         MD5_CTX ctx, oldctx;
1309         hasht hash;
1310         int secretlen;
1311         unsigned i, n, len, decodedlen;
1312
1313 /* 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 6 7
1314 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1315   |     Salt      |     Salt      |   String ..........
1316   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*/
1317
1318         len = *pl2tpsecretlen;
1319
1320         if (len < 2)
1321         {
1322                 LOG(1, 0, 0, "tunnel password is too short, We need at least a salt\n");
1323                 return 0;
1324         }
1325
1326         if (len <= 3)
1327         {
1328                 pl2tpsecret[0] = 0;
1329                 *pl2tpsecretlen = 0;
1330                 LOG(1, 0, 0, "tunnel passwd is empty !!!\n");
1331                 return 0;
1332         }
1333
1334         len -= 2;       /* discount the salt */
1335
1336         //Use the secret to setup the decryption
1337         secretlen = strlen(radiussecret);
1338
1339         MD5_Init(&ctx);
1340         MD5_Update(&ctx, (void *) radiussecret, secretlen);
1341         oldctx = ctx;   /* save intermediate work */
1342
1343         // Set up the initial key:
1344         //      b(1) = MD5(radiussecret + auth + salt)
1345         MD5_Update(&ctx, (void *) auth, 16);
1346         MD5_Update(&ctx, pl2tpsecret, 2);
1347
1348         decodedlen = 0;
1349         for (n = 0; n < len; n += 16)
1350         {
1351                 int base = 0;
1352
1353                 if (n == 0)
1354                 {
1355                         MD5_Final(hash, &ctx);
1356
1357                         ctx = oldctx;
1358
1359                          // the first octet, it's the 'data_len'
1360                          // Check is correct
1361                         decodedlen = pl2tpsecret[2] ^ hash[0];
1362                         if (decodedlen >= len)
1363                         {
1364                                 LOG(1, 0, 0, "tunnel password is too long !!!\n");
1365                                 return 0;
1366                         }
1367
1368                         MD5_Update(&ctx, pl2tpsecret + 2, 16);
1369                         base = 1;
1370                 } else
1371                 {
1372                         MD5_Final(hash, &ctx);
1373
1374                         ctx = oldctx;
1375                         MD5_Update(&ctx, pl2tpsecret + n + 2, 16);
1376                 }
1377
1378                 for (i = base; i < 16; i++)
1379                 {
1380                         pl2tpsecret[n + i - 1] = pl2tpsecret[n + i + 2] ^ hash[i];
1381                 }
1382         }
1383
1384         if (decodedlen > 239) decodedlen = 239;
1385
1386         *pl2tpsecretlen = decodedlen;
1387         pl2tpsecret[decodedlen] = 0;
1388
1389         return decodedlen;
1390 };