projects / l2tpns.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
lcp logging
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.69 2005/08/11 05:50:49 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 r = radiusnew(s);
89 if (session[s].ip || !r)
90 {
91 // respond now, either no RADIUS available or already authenticated
92 uint8_t b[MAXCONTROL];
93 uint8_t id = p[1];
94 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
95 if (!p) return;
96
97 if (session[s].ip)
98 *p = 2; // ACK
99 else
100 *p = 3; // cant authorise
101 p[1] = id;
102 *(uint16_t *) (p + 2) = htons(5); // length
103 p[4] = 0; // no message
104 tunnelsend(b, 5 + (p - b), t); // send it
105
106 if (session[s].ip)
107 {
108 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
109 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
110 }
111 else
112 {
113 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
114 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
115 }
116 }
117 else
118 {
119 // Run PRE_AUTH plugins
120 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
121 run_plugins(PLUGIN_PRE_AUTH, &packet);
122 if (!packet.continue_auth)
123 {
124 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
125 if (packet.username) free(packet.username);
126 if (packet.password) free(packet.password);
127 return;
128 }
129
130 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
131 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
132
133 free(packet.username);
134 free(packet.password);
135
136 radius[r].id = p[1];
137 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
138 radiussend(r, RADIUSAUTH);
139 }
140 }
141
142 // Process CHAP messages
143 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
144 {
145 uint16_t r;
146 uint16_t hl;
147
148 CSTAT(processchap);
149
150 LOG_HEX(5, "CHAP", p, l);
151 r = sess_local[s].radius;
152 if (!r)
153 {
154 LOG(1, s, t, "Unexpected CHAP message\n");
155 STAT(tunnel_rx_errors);
156 return;
157 }
158
159 if (l < 4)
160 {
161 LOG(1, s, t, "Short CHAP %u bytes\n", l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "Short CHAP packet.", 3, 0);
164 return;
165 }
166
167 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
168 {
169 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
170 STAT(tunnel_rx_errors);
171 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
172 return;
173 }
174 l = hl;
175
176 if (*p != 2)
177 {
178 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
179 STAT(tunnel_rx_errors);
180 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
181 return;
182 }
183
184 if (session[s].ppp.phase != Authenticate)
185 {
186 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
187 return;
188 }
189
190 if (p[1] != radius[r].id)
191 {
192 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
193 STAT(tunnel_rx_errors);
194 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
195 return;
196 }
197
198 if (l < 5 || p[4] != 16)
199 {
200 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
201 STAT(tunnel_rx_errors);
202 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
203 return;
204 }
205
206 l -= 5;
207 p += 5;
208 if (l < 16 || l - 16 >= sizeof(session[s].user))
209 {
210 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
211 STAT(tunnel_rx_errors);
212 sessionshutdown(s, "CHAP username too long.", 3, 0);
213 return;
214 }
215
216 // Run PRE_AUTH plugins
217 {
218 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
219
220 packet.password = calloc(17, 1);
221 memcpy(packet.password, p, 16);
222
223 p += 16;
224 l -= 16;
225
226 packet.username = calloc(l + 1, 1);
227 memcpy(packet.username, p, l);
228
229 run_plugins(PLUGIN_PRE_AUTH, &packet);
230 if (!packet.continue_auth)
231 {
232 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
233 if (packet.username) free(packet.username);
234 if (packet.password) free(packet.password);
235 return;
236 }
237
238 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
239 memcpy(radius[r].pass, packet.password, 16);
240
241 free(packet.username);
242 free(packet.password);
243 }
244
245 radius[r].chap = 1;
246 LOG(3, s, t, "CHAP login %s\n", session[s].user);
247 radiussend(r, RADIUSAUTH);
248 }
249
250 static void dumplcp(uint8_t *p, int l)
251 {
252 int x = l - 4;
253 uint8_t *o = (p + 4);
254
255 LOG_HEX(5, "PPP LCP Packet", p, l);
256 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
257 LOG(4, 0, 0, "Length: %d\n", l);
258 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
259 return;
260
261 while (x > 2)
262 {
263 int type = o[0];
264 int length = o[1];
265 if (length < 2)
266 {
267 LOG(4, 0, 0, " Option length is %d...\n", length);
268 break;
269 }
270 if (type == 0)
271 {
272 LOG(4, 0, 0, " Option type is 0...\n");
273 x -= length;
274 o += length;
275 continue;
276 }
277 switch (type)
278 {
279 case 1: // Maximum-Receive-Unit
280 if (length == 4)
281 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
282 else
283 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
284 break;
285 case 2: // Async-Control-Character-Map
286 if (length == 6)
287 {
288 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
289 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
290 }
291 else
292 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
293 break;
294 case 3: // Authentication-Protocol
295 if (length == 4)
296 {
297 int proto = ntohs(*(uint16_t *)(o + 2));
298 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
299 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
300 }
301 else if (length == 5)
302 {
303 int proto = ntohs(*(uint16_t *)(o + 2));
304 int algo = *(uint8_t *)(o + 4);
305 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
306 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
307 }
308 else
309 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
310 break;
311 case 4: // Quality-Protocol
312 {
313 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
314 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
315 }
316 break;
317 case 5: // Magic-Number
318 if (length == 6)
319 {
320 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
321 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
322 }
323 else
324 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
325 break;
326 case 7: // Protocol-Field-Compression
327 case 8: // Address-And-Control-Field-Compression
328 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
329 break;
330 default:
331 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
332 break;
333 }
334 x -= length;
335 o += length;
336 }
337 }
338
339 void lcp_open(sessionidt s, tunnelidt t)
340 {
341 // transition to Authentication or Network phase:
342 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
343
344 // LCP now Opened
345 change_state(s, lcp, Opened);
346
347 if (session[s].ppp.phase == Authenticate)
348 {
349 if (sess_local[s].lcp_authtype == AUTHCHAP)
350 sendchap(s, t);
351 }
352 else
353 {
354 // This-Layer-Up
355 sendipcp(s, t);
356 change_state(s, ipcp, RequestSent);
357 // move to passive state for IPv6 (if configured), CCP
358 if (config->ipv6_prefix.s6_addr[0])
359 change_state(s, ipv6cp, Stopped);
360 else
361 change_state(s, ipv6cp, Closed);
362
363 change_state(s, ccp, Stopped);
364 }
365 }
366
367 static void lcp_restart(sessionidt s)
368 {
369 session[s].ppp.phase = Establish;
370 // This-Layer-Down
371 change_state(s, ipcp, Dead);
372 change_state(s, ipv6cp, Dead);
373 change_state(s, ccp, Dead);
374 }
375
376 static uint8_t *ppp_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
377 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
378 {
379 if (!*response || **response != ConfigRej)
380 {
381 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
382 if (!queued)
383 return 0;
384
385 *queued = ConfigRej;
386 queued += 4;
387 }
388
389 if ((queued - buf + option[1]) > blen)
390 {
391 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
392 return 0;
393 }
394
395 memcpy(queued, option, option[1]);
396 return queued + option[1];
397 }
398
399 static uint8_t *ppp_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
400 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
401 uint8_t *value, size_t vlen)
402 {
403 int *nak_sent;
404 switch (mtype)
405 {
406 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
407 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
408 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
409 default: return 0; // ?
410 }
411
412 if (*response && **response != ConfigNak)
413 {
414 if (*nak_sent < config->ppp_max_failure) // reject queued
415 return queued;
416
417 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
418 }
419
420 if (!*response)
421 {
422 if (*nak_sent >= config->ppp_max_failure)
423 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
424
425 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
426 if (!queued)
427 return 0;
428
429 *nak_sent++;
430 *queued = ConfigNak;
431 queued += 4;
432 }
433
434 if ((queued - buf + vlen + 2) > blen)
435 {
436 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
437 return 0;
438 }
439
440 *queued++ = *option;
441 *queued++ = vlen + 2;
442 memcpy(queued, value, vlen);
443 return queued + vlen;
444 }
445
446 // Process LCP messages
447 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
448 {
449 uint8_t b[MAXCONTROL];
450 uint8_t *q = NULL;
451 uint32_t magicno = 0;
452 uint16_t hl;
453
454 CSTAT(processlcp);
455
456 LOG_HEX(5, "LCP", p, l);
457 if (l < 4)
458 {
459 LOG(1, s, t, "Short LCP %d bytes\n", l);
460 STAT(tunnel_rx_errors);
461 return ;
462 }
463
464 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
465 {
466 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
467 STAT(tunnel_rx_errors);
468 return ;
469 }
470 l = hl;
471
472 if (session[s].die) // going down...
473 return;
474
475 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
476 if (config->debug > 3) dumplcp(p, l);
477
478 if (*p == ConfigAck)
479 {
480 int x = l - 4;
481 uint8_t *o = (p + 4);
482 int authtype = 0;
483
484 while (x > 2)
485 {
486 int type = o[0];
487 int length = o[1];
488
489 if (length == 0 || type == 0 || x < length) break;
490 switch (type)
491 {
492 case 3: // Authentication-Protocol
493 {
494 int proto = ntohs(*(uint16_t *)(o + 2));
495 if (proto == PPPPAP)
496 authtype = AUTHPAP;
497 else if (proto == PPPCHAP && *(o + 4) == 5)
498 authtype = AUTHCHAP;
499 }
500
501 break;
502 }
503 x -= length;
504 o += length;
505 }
506
507 if (!session[s].ip && authtype)
508 sess_local[s].lcp_authtype = authtype;
509
510 switch (session[s].ppp.lcp)
511 {
512 case RequestSent:
513 initialise_restart_count(s, lcp);
514 change_state(s, lcp, AckReceived);
515 break;
516
517 case AckReceived:
518 case Opened:
519 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
520 if (session[s].ppp.lcp == Opened)
521 lcp_restart(s);
522
523 sendlcp(s, t, sess_local[s].lcp_authtype);
524 change_state(s, lcp, RequestSent);
525 break;
526
527 case AckSent:
528 lcp_open(s, t);
529 break;
530
531 default:
532 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
533 }
534 }
535 else if (*p == ConfigReq)
536 {
537 int x = l - 4;
538 uint8_t *o = (p + 4);
539 uint8_t *response = 0;
540 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
541 static uint8_t authproto[5];
542
543 while (x > 2)
544 {
545 int type = o[0];
546 int length = o[1];
547
548 if (length == 0 || type == 0 || x < length) break;
549 switch (type)
550 {
551 case 1: // Maximum-Receive-Unit
552 session[s].mru = ntohs(*(uint16_t *)(o + 2));
553 break;
554
555 case 2: // Async-Control-Character-Map
556 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
557 break;
558
559 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
560 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
561 break;
562
563 case 3: // Authentication-Protocol
564 {
565 int proto = ntohs(*(uint16_t *)(o + 2));
566 char proto_name[] = "0x0000";
567 int alen;
568
569 if (proto == PPPPAP)
570 {
571 if (config->radius_authtypes & AUTHPAP)
572 {
573 sess_local[s].lcp_authtype = AUTHPAP;
574 break;
575 }
576
577 strcpy(proto_name, "PAP");
578 }
579 else if (proto == PPPCHAP)
580 {
581 if (config->radius_authtypes & AUTHCHAP
582 && *(o + 4) == 5) // MD5
583 {
584 sess_local[s].lcp_authtype = AUTHCHAP;
585 break;
586 }
587
588 strcpy(proto_name, "CHAP");
589 }
590 else
591 sprintf(proto_name, "%#4.4x", proto);
592
593 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
594
595 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
596 if (alen < 2) break; // paranoia
597
598 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
599 if (q && *response == ConfigNak &&
600 config->radius_authtypes != config->radius_authprefer)
601 {
602 // alternate type
603 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
604 if (alen < 2) break;
605 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
606 }
607
608 break;
609 }
610 break;
611
612 case 5: // Magic-Number
613 magicno = ntohl(*(uint32_t *)(o + 2));
614 break;
615
616 case 4: // Quality-Protocol
617 case 7: // Protocol-Field-Compression
618 case 8: // Address-And-Control-Field-Compression
619 break;
620
621 default: // Reject any unknown options
622 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
623 q = ppp_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
624 }
625 x -= length;
626 o += length;
627 }
628
629 if (response)
630 {
631 l = q - response; // LCP packet length
632 *((uint16_t *) (response + 2)) = htons(l); // update header
633 }
634 else
635 {
636 // Send packet back as ConfigAck
637 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
638 if (!response) return;
639 *response = ConfigAck;
640 }
641
642 switch (session[s].ppp.lcp)
643 {
644 case Closed:
645 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
646 if (!response) return;
647 *response = TerminateAck;
648 *((uint16_t *) (response + 2)) = htons(l = 4);
649 break;
650
651 case Stopped:
652 initialise_restart_count(s, lcp);
653 sendlcp(s, t, sess_local[s].lcp_authtype);
654 if (*response == ConfigAck)
655 change_state(s, lcp, AckSent);
656 else
657 change_state(s, lcp, RequestSent);
658
659 break;
660
661 case RequestSent:
662 if (*response == ConfigAck)
663 change_state(s, lcp, AckSent);
664
665 break;
666
667 case AckReceived:
668 if (*response == ConfigAck)
669 lcp_open(s, t);
670
671 break;
672
673 case Opened:
674 lcp_restart(s);
675 sendlcp(s, t, sess_local[s].lcp_authtype);
676 /* fallthrough */
677
678 case AckSent:
679 if (*response == ConfigAck)
680 change_state(s, lcp, AckSent);
681 else
682 change_state(s, lcp, RequestSent);
683
684 break;
685
686 default:
687 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
688 return;
689 }
690
691 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
692 if (config->debug > 3) dumplcp(response, l);
693
694 tunnelsend(b, l + (response - b), t);
695 }
696 else if (*p == ConfigNak)
697 {
698 int x = l - 4;
699 uint8_t *o = (p + 4);
700 int authtype = -1;
701
702 while (x > 2)
703 {
704 int type = o[0];
705 int length = o[1];
706
707 if (length == 0 || type == 0 || x < length) break;
708 switch (type)
709 {
710 case 1: // Maximum-Receive-Unit
711 session[s].mru = ntohs(*(uint16_t *)(o + 2));
712 LOG(3, s, t, " Remote requested MRU of %u\n", session[s].mru);
713 break;
714
715 case 3: // Authentication-Protocol
716 if (authtype > 0)
717 break;
718
719 {
720 int proto = ntohs(*(uint16_t *)(o + 2));
721 if (proto == PPPPAP)
722 {
723 authtype = config->radius_authtypes & AUTHPAP;
724 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
725 authtype ? "accept" : "reject");
726 }
727 else if (proto == PPPCHAP && *(o + 4) == 5)
728 {
729 authtype = config->radius_authtypes & AUTHCHAP;
730 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
731 authtype ? "accept" : "reject");
732 }
733 else
734 {
735 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
736 proto);
737 }
738 }
739
740 break;
741
742 default:
743 LOG(2, s, t, " Remote NAKed LCP type %u?\n", type);
744 break;
745 }
746 x -= length;
747 o += length;
748 }
749
750 if (!authtype)
751 {
752 sessionshutdown(s, "Unsupported authentication.", 3, 0);
753 return;
754 }
755
756 if (authtype > 0)
757 sess_local[s].lcp_authtype = authtype;
758
759 switch (session[s].ppp.lcp)
760 {
761 case Closed:
762 case Stopped:
763 {
764 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
765 if (!response) return;
766 *response = TerminateAck;
767 *((uint16_t *) (response + 2)) = htons(l = 4);
768 tunnelsend(b, l + (response - b), t);
769 }
770 break;
771
772 case RequestSent:
773 case AckSent:
774 initialise_restart_count(s, lcp);
775 sendlcp(s, t, sess_local[s].lcp_authtype);
776 break;
777
778 case AckReceived:
779 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
780 sendlcp(s, t, sess_local[s].lcp_authtype);
781 break;
782
783 case Opened:
784 lcp_restart(s);
785 sendlcp(s, t, sess_local[s].lcp_authtype);
786 break;
787
788 default:
789 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
790 return;
791 }
792 }
793 else if (*p == TerminateReq)
794 {
795 *p = TerminateAck; // close
796 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
797 if (!q) return;
798 tunnelsend(b, l + (q - b), t); // send it
799 sessionshutdown(s, "Remote end closed connection.", 3, 0);
800 }
801 else if (*p == TerminateAck)
802 {
803 sessionshutdown(s, "Connection closed.", 3, 0);
804 }
805 else if (*p == ProtocolRej)
806 {
807 if (*(uint16_t *) (p+4) == htons(PPPIPV6CP))
808 {
809 LOG(3, s, t, "IPv6 rejected\n");
810 change_state(s, ipv6cp, Closed);
811 }
812 else
813 {
814 LOG(1, s, t, "Unexpected LCP protocol reject 0x%X\n",
815 ntohs(*(uint16_t *) (p+4)));
816 STAT(tunnel_rx_errors);
817 }
818 }
819 else if (*p == EchoReq)
820 {
821 *p = EchoReply; // reply
822 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
823 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
824 if (!q) return;
825 tunnelsend(b, l + (q - b), t); // send it
826 }
827 else if (*p == EchoReply)
828 {
829 // Ignore it, last_packet time is set earlier than this.
830 }
831 else
832 {
833 int code = *p;
834 int mru = session[s].mru;
835 if (!mru)
836 mru = DEFAULT_MRU;
837
838 if (l > mru) l = mru;
839
840 *p = CodeRej;
841 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
842 if (!q) return;
843
844 LOG(3, s, t, "Unexpected LCP code %s\n", ppp_code(code));
845 tunnelsend(b, l + (q - b), t);
846 }
847 }
848
849 static void ipcp_open(sessionidt s, tunnelidt t)
850 {
851 LOG(3, s, t, "IPCP: Opened, session is now active\n");
852
853 change_state(s, ipcp, Opened);
854
855 if (!session[s].walled_garden)
856 {
857 uint16_t r = radiusnew(s);
858 if (r)
859 radiussend(r, RADIUSSTART); // send radius start
860 }
861
862 // start IPv6 if configured and still in passive state
863 if (session[s].ppp.ipv6cp == Stopped)
864 {
865 sendipv6cp(s, t);
866 change_state(s, ipv6cp, RequestSent);
867 }
868 }
869
870 // Process IPCP messages
871 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
872 {
873 uint8_t b[MAXCONTROL];
874 uint8_t *q = 0;
875 uint16_t hl;
876
877 CSTAT(processipcp);
878
879 LOG_HEX(5, "IPCP", p, l);
880 if (l < 5)
881 {
882 LOG(1, s, t, "Short IPCP %d bytes\n", l);
883 STAT(tunnel_rx_errors);
884 return ;
885 }
886
887 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
888 {
889 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
890 STAT(tunnel_rx_errors);
891 return ;
892 }
893 l = hl;
894
895 if (session[s].ppp.phase < Network)
896 {
897 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
898 return;
899 }
900
901 if (*p == ConfigAck)
902 {
903 switch (session[s].ppp.ipcp)
904 {
905 case RequestSent:
906 initialise_restart_count(s, ipcp);
907 change_state(s, ipcp, AckReceived);
908 break;
909
910 case AckReceived:
911 case Opened:
912 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
913 sendipcp(s, t);
914 change_state(s, ipcp, RequestSent);
915 break;
916
917 case AckSent:
918 ipcp_open(s, t);
919 break;
920
921 default:
922 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
923 }
924 }
925 else if (*p == ConfigReq)
926 {
927 uint8_t *response = 0;
928 uint8_t *o = p + 4;
929 int length = l - 4;
930 int gotip = 0;
931 in_addr_t addr;
932
933 LOG(3, s, t, "IPCP: ConfigReq received\n");
934
935 while (length > 2)
936 {
937 switch (*o)
938 {
939 case 3: // ip address
940 gotip++; // seen address
941 if (o[1] != 6 || o[1] > length) return;
942
943 addr = htonl(session[s].ip);
944 if (memcmp(o + 2, &addr, (sizeof addr)))
945 {
946 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
947 if (!q || *response == ConfigRej)
948 {
949 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
950 return;
951 }
952 }
953
954 break;
955
956 case 129: // primary DNS
957 if (o[1] != 6 || o[1] > length) return;
958
959 addr = htonl(session[s].dns1);
960 if (memcmp(o + 2, &addr, (sizeof addr)))
961 {
962 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
963 if (!q) return;
964 }
965
966 break;
967
968 case 131: // secondary DNS
969 if (o[1] != 6 || o[1] > length) return;
970
971 addr = htonl(session[s].dns1);
972 if (memcmp(o + 2, &addr, sizeof(addr)))
973 {
974 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
975 if (!q) return;
976 }
977
978 break;
979
980 default:
981 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
982 q = ppp_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
983 if (!q) return;
984 }
985
986 length -= o[1];
987 o += o[1];
988 }
989
990 if (response)
991 {
992 l = q - response; // IPCP packet length
993 *((uint16_t *) (response + 2)) = htons(l); // update header
994 }
995 else if (gotip)
996 {
997 // Send packet back as ConfigAck
998 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
999 if (!response) return;
1000 *response = ConfigAck;
1001 }
1002 else
1003 {
1004 LOG(1, s, t, "No IP in IPCP request\n");
1005 STAT(tunnel_rx_errors);
1006 return;
1007 }
1008
1009 switch (session[s].ppp.ipcp)
1010 {
1011 case Closed:
1012 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1013 if (!response) return;
1014 *response = TerminateAck;
1015 *((uint16_t *) (response + 2)) = htons(l = 4);
1016 break;
1017
1018 case Stopped:
1019 initialise_restart_count(s, ipcp);
1020 sendipcp(s, t);
1021 if (*response == ConfigAck)
1022 change_state(s, ipcp, AckSent);
1023 else
1024 change_state(s, ipcp, RequestSent);
1025
1026 break;
1027
1028 case RequestSent:
1029 if (*response == ConfigAck)
1030 change_state(s, ipcp, AckSent);
1031
1032 break;
1033
1034 case AckReceived:
1035 if (*response == ConfigAck)
1036 ipcp_open(s, t);
1037
1038 break;
1039
1040 case Opened:
1041 initialise_restart_count(s, ipcp);
1042 sendipcp(s, t);
1043 /* fallthrough */
1044
1045 case AckSent:
1046 if (*response == ConfigAck)
1047 change_state(s, ipcp, AckSent);
1048 else
1049 change_state(s, ipcp, RequestSent);
1050
1051 break;
1052
1053 default:
1054 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1055 return;
1056 }
1057
1058 LOG(3, s, t, "IPCP: Sending %s\n", ppp_code(*response));
1059 tunnelsend(b, l + (response - b), t);
1060 }
1061 else if (*p == TerminateReq)
1062 {
1063 LOG(3, s, t, "IPCP: Received TerminateReq. Sending TerminateAck\n");
1064 *p = TerminateAck;
1065 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1066 if (!q) return;
1067 tunnelsend(b, l + (q - b), t);
1068 change_state(s, ipcp, Stopped);
1069 }
1070 else
1071 {
1072 int code = *p;
1073 int mru = session[s].mru;
1074 if (!mru)
1075 mru = DEFAULT_MRU;
1076
1077 if (l > mru) l = mru;
1078
1079 *p = CodeRej;
1080 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1081 if (!q) return;
1082
1083 LOG(3, s, t, "Unexpected IPCP code %s\n", ppp_code(code));
1084 tunnelsend(b, l + (q - b), t);
1085 }
1086 }
1087
1088 static void ipv6cp_open(sessionidt s, tunnelidt t)
1089 {
1090 LOG(3, s, t, "IPV6CP: Opened\n");
1091
1092 change_state(s, ipv6cp, Opened);
1093 if (session[s].ipv6prefixlen)
1094 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1095
1096 // Send an initial RA (TODO: Should we send these regularly?)
1097 send_ipv6_ra(s, t, NULL);
1098 }
1099
1100 // Process IPV6CP messages
1101 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1102 {
1103 uint8_t b[MAXCONTROL];
1104 uint8_t *q = 0;
1105 uint16_t hl;
1106
1107 CSTAT(processipv6cp);
1108
1109 LOG_HEX(5, "IPV6CP", p, l);
1110 if (l < 4)
1111 {
1112 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1113 STAT(tunnel_rx_errors);
1114 return ;
1115 }
1116
1117 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1118 {
1119 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1120 STAT(tunnel_rx_errors);
1121 return ;
1122 }
1123 l = hl;
1124
1125 if (session[s].ppp.phase < Network)
1126 {
1127 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1128 return;
1129 }
1130
1131 if (!config->ipv6_prefix.s6_addr[0])
1132 {
1133 LOG(2, s, t, "IPV6CP: %s rejected (not configured)\n", ppp_code(*p));
1134 *p = ProtocolRej;
1135 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1136 if (!q) return;
1137 tunnelsend(b, l + (q - b), t);
1138 return;
1139 }
1140
1141 if (!session[s].ip)
1142 {
1143 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1144 return; // need IPCP to complete...
1145 }
1146
1147 if (*p == ConfigAck)
1148 {
1149 switch (session[s].ppp.ipv6cp)
1150 {
1151 case RequestSent:
1152 initialise_restart_count(s, ipv6cp);
1153 change_state(s, ipv6cp, AckReceived);
1154 break;
1155
1156 case AckReceived:
1157 case Opened:
1158 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1159 sendipv6cp(s, t);
1160 change_state(s, ipv6cp, RequestSent);
1161 break;
1162
1163 case AckSent:
1164 ipv6cp_open(s, t);
1165 break;
1166
1167 default:
1168 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1169 }
1170 }
1171 else if (*p == ConfigReq)
1172 {
1173 uint8_t *response = 0;
1174 uint8_t *o = p + 4;
1175 int length = l - 4;
1176 int gotip = 0;
1177 uint8_t ident[8];
1178
1179 LOG(3, s, t, "IPV6CP: ConfigReq received\n");
1180
1181 while (length > 2)
1182 {
1183 switch (*o)
1184 {
1185 case 1: // interface identifier
1186 gotip++; // seen address
1187 if (o[1] != 10 || o[1] > length) return;
1188
1189 *(uint32_t *) ident = htonl(session[s].ip);
1190 *(uint32_t *) (ident + 4) = 0;
1191
1192 if (memcmp(o + 2, ident, sizeof(ident)))
1193 {
1194 q = ppp_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1195 if (!q) return;
1196 }
1197
1198 break;
1199
1200 default:
1201 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1202 q = ppp_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1203 if (!q) return;
1204 }
1205
1206 length -= o[1];
1207 o += o[1];
1208 }
1209
1210 if (response)
1211 {
1212 l = q - response; // IPV6CP packet length
1213 *((uint16_t *) (response + 2)) = htons(l); // update header
1214 }
1215 else if (gotip)
1216 {
1217 // Send packet back as ConfigAck
1218 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1219 if (!response) return;
1220 *response = ConfigAck;
1221 }
1222 else
1223 {
1224 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1225 STAT(tunnel_rx_errors);
1226 return;
1227 }
1228
1229 switch (session[s].ppp.ipv6cp)
1230 {
1231 case Closed:
1232 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1233 if (!response) return;
1234 *response = TerminateAck;
1235 *((uint16_t *) (response + 2)) = htons(l = 4);
1236 break;
1237
1238 case Stopped:
1239 initialise_restart_count(s, ipv6cp);
1240 sendipv6cp(s, t);
1241 if (*response == ConfigAck)
1242 change_state(s, ipv6cp, AckSent);
1243 else
1244 change_state(s, ipv6cp, RequestSent);
1245
1246 break;
1247
1248 case RequestSent:
1249 if (*response == ConfigAck)
1250 change_state(s, ipv6cp, AckSent);
1251
1252 break;
1253
1254 case AckReceived:
1255 if (*response == ConfigAck)
1256 ipv6cp_open(s, t);
1257
1258 break;
1259
1260 case Opened:
1261 initialise_restart_count(s, ipv6cp);
1262 sendipv6cp(s, t);
1263 /* fallthrough */
1264
1265 case AckSent:
1266 if (*response == ConfigAck)
1267 change_state(s, ipv6cp, AckSent);
1268 else
1269 change_state(s, ipv6cp, RequestSent);
1270
1271 break;
1272
1273 default:
1274 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1275 return;
1276 }
1277
1278 LOG(3, s, t, "IPV6CP: Sending %s\n", ppp_code(*response));
1279 tunnelsend(b, l + (response - b), t);
1280 }
1281 else if (*p == TerminateReq)
1282 {
1283 LOG(3, s, t, "IPV6CP: Received TerminateReq. Sending TerminateAck\n");
1284 *p = TerminateAck;
1285 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1286 if (!q) return;
1287 tunnelsend(b, l + (q - b), t);
1288 change_state(s, ipv6cp, Stopped);
1289 }
1290 else
1291 {
1292 int code = *p;
1293 int mru = session[s].mru;
1294 if (!mru)
1295 mru = DEFAULT_MRU;
1296
1297 if (l > mru) l = mru;
1298
1299 *p = CodeRej;
1300 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1301 if (!q) return;
1302
1303 LOG(3, s, t, "Unexpected IPV6CP code %s\n", ppp_code(code));
1304 tunnelsend(b, l + (q - b), t);
1305 }
1306 }
1307
1308 // process IP packet received
1309 //
1310 // This MUST be called with at least 4 byte behind 'p'.
1311 // (i.e. this routine writes to p[-4]).
1312 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1313 {
1314 in_addr_t ip;
1315
1316 CSTAT(processipin);
1317
1318 LOG_HEX(5, "IP", p, l);
1319
1320 ip = ntohl(*(uint32_t *)(p + 12));
1321
1322 if (l > MAXETHER)
1323 {
1324 LOG(1, s, t, "IP packet too long %d\n", l);
1325 STAT(tunnel_rx_errors);
1326 return ;
1327 }
1328
1329 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1330 return;
1331
1332 // no spoof (do sessionbyip to handled statically routed subnets)
1333 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1334 {
1335 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1336 return;
1337 }
1338
1339 // run access-list if any
1340 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1341 return;
1342
1343 // Add on the tun header
1344 p -= 4;
1345 *(uint32_t *) p = htonl(PKTIP);
1346 l += 4;
1347
1348 // Are we throttled and a slave?
1349 if (session[s].tbf_in && !config->cluster_iam_master) {
1350 // Pass it to the master for handling.
1351 master_throttle_packet(session[s].tbf_in, p, l);
1352 return;
1353 }
1354
1355 // Are we throttled and a master??
1356 if (session[s].tbf_in && config->cluster_iam_master) {
1357 // Actually handle the throttled packets.
1358 tbf_queue_packet(session[s].tbf_in, p, l);
1359 return;
1360 }
1361
1362 // send to ethernet
1363 if (tun_write(p, l) < 0)
1364 {
1365 STAT(tun_tx_errors);
1366 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1367 l, strerror(errno), tunfd, p);
1368
1369 return;
1370 }
1371
1372 p += 4;
1373 l -= 4;
1374
1375 if (session[s].snoop_ip && session[s].snoop_port)
1376 {
1377 // Snooping this session
1378 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1379 }
1380
1381 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1382 session[s].cin_delta += l;
1383 session[s].pin++;
1384
1385 sess_local[s].cin += l;
1386 sess_local[s].pin++;
1387
1388 eth_tx += l;
1389
1390 STAT(tun_tx_packets);
1391 INC_STAT(tun_tx_bytes, l);
1392 }
1393
1394 // process IPv6 packet received
1395 //
1396 // This MUST be called with at least 4 byte behind 'p'.
1397 // (i.e. this routine writes to p[-4]).
1398 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1399 {
1400 struct in6_addr ip;
1401 in_addr_t ipv4;
1402
1403 CSTAT(processipv6in);
1404
1405 LOG_HEX(5, "IPv6", p, l);
1406
1407 ip = *(struct in6_addr *) (p + 8);
1408 ipv4 = ntohl(*(uint32_t *)(p + 16));
1409
1410 if (l > MAXETHER)
1411 {
1412 LOG(1, s, t, "IP packet too long %d\n", l);
1413 STAT(tunnel_rx_errors);
1414 return ;
1415 }
1416
1417 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1418 return;
1419
1420 // no spoof
1421 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1422 {
1423 char str[INET6_ADDRSTRLEN];
1424 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1425 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1426 return;
1427 }
1428
1429 // Check if it's a Router Solicition message.
1430 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1431 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1432 *(uint32_t *)(p + 34) == 0 &&
1433 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1434 LOG(3, s, t, "Got IPv6 RS\n");
1435 send_ipv6_ra(s, t, &ip);
1436 return;
1437 }
1438
1439 // Add on the tun header
1440 p -= 4;
1441 *(uint32_t *) p = htonl(PKTIPV6);
1442 l += 4;
1443
1444 // Are we throttled and a slave?
1445 if (session[s].tbf_in && !config->cluster_iam_master) {
1446 // Pass it to the master for handling.
1447 master_throttle_packet(session[s].tbf_in, p, l);
1448 return;
1449 }
1450
1451 // Are we throttled and a master??
1452 if (session[s].tbf_in && config->cluster_iam_master) {
1453 // Actually handle the throttled packets.
1454 tbf_queue_packet(session[s].tbf_in, p, l);
1455 return;
1456 }
1457
1458 // send to ethernet
1459 if (tun_write(p, l) < 0)
1460 {
1461 STAT(tun_tx_errors);
1462 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1463 l, strerror(errno), tunfd, p);
1464
1465 return;
1466 }
1467
1468 p += 4;
1469 l -= 4;
1470
1471 if (session[s].snoop_ip && session[s].snoop_port)
1472 {
1473 // Snooping this session
1474 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1475 }
1476
1477 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1478 session[s].cin_delta += l;
1479 session[s].pin++;
1480
1481 sess_local[s].cin += l;
1482 sess_local[s].pin++;
1483
1484 eth_tx += l;
1485
1486 STAT(tun_tx_packets);
1487 INC_STAT(tun_tx_bytes, l);
1488 }
1489
1490 //
1491 // Helper routine for the TBF filters.
1492 // Used to send queued data in from the user.
1493 //
1494 void send_ipin(sessionidt s, uint8_t *buf, int len)
1495 {
1496 LOG_HEX(5, "IP in throttled", buf, len);
1497
1498 if (write(tunfd, buf, len) < 0)
1499 {
1500 STAT(tun_tx_errors);
1501 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1502 len, strerror(errno), tunfd, buf);
1503
1504 return;
1505 }
1506
1507 buf += 4;
1508 len -= 4;
1509
1510 if (session[s].snoop_ip && session[s].snoop_port)
1511 {
1512 // Snooping this session
1513 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1514 }
1515
1516 // Increment packet counters
1517 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1518 session[s].cin_delta += len;
1519 session[s].pin++;
1520
1521 sess_local[s].cin += len;
1522 sess_local[s].pin++;
1523
1524 eth_tx += len;
1525
1526 STAT(tun_tx_packets);
1527 INC_STAT(tun_tx_bytes, len - 4);
1528 }
1529
1530
1531 // Process CCP messages
1532 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1533 {
1534 uint8_t b[MAXCONTROL];
1535 uint8_t *q;
1536
1537 CSTAT(processccp);
1538
1539 LOG_HEX(5, "CCP", p, l);
1540
1541 if (session[s].ppp.phase < Network)
1542 {
1543 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1544 return;
1545 }
1546
1547 if (l < 1)
1548 {
1549 LOG(1, s, t, "Short CCP packet\n");
1550 STAT(tunnel_rx_errors);
1551 }
1552
1553 if (*p == ConfigAck)
1554 {
1555 switch (session[s].ppp.ccp)
1556 {
1557 case RequestSent:
1558 initialise_restart_count(s, ccp);
1559 change_state(s, ccp, AckReceived);
1560 break;
1561
1562 case AckReceived:
1563 case Opened:
1564 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1565 sendccp(s, t);
1566 change_state(s, ccp, RequestSent);
1567 break;
1568
1569 case AckSent:
1570 LOG(3, s, t, "CCP: Opened\n");
1571 change_state(s, ccp, Opened);
1572 break;
1573
1574 default:
1575 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1576 }
1577 }
1578 else if (*p == ConfigReq)
1579 {
1580 if (l < 6) // accept no compression
1581 *p = ConfigAck;
1582 else // compression requested--reject
1583 *p = ConfigRej;
1584
1585 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1586 if (!q) return;
1587
1588 switch (session[s].ppp.ccp)
1589 {
1590 case Closed:
1591 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1592 if (!q) return;
1593 *q = TerminateAck;
1594 *((uint16_t *) (q + 2)) = htons(l = 4);
1595 break;
1596
1597 case Stopped:
1598 initialise_restart_count(s, ccp);
1599 sendccp(s, t);
1600 if (*q == ConfigAck)
1601 change_state(s, ccp, AckSent);
1602 else
1603 change_state(s, ccp, RequestSent);
1604
1605 break;
1606
1607 case RequestSent:
1608 if (*q == ConfigAck)
1609 change_state(s, ccp, AckSent);
1610
1611 break;
1612
1613 case AckReceived:
1614 if (*q == ConfigAck)
1615 change_state(s, ccp, Opened);
1616
1617 break;
1618
1619 case Opened:
1620 initialise_restart_count(s, ccp);
1621 sendccp(s, t);
1622 /* fallthrough */
1623
1624 case AckSent:
1625 if (*q == ConfigAck)
1626 change_state(s, ccp, AckSent);
1627 else
1628 change_state(s, ccp, RequestSent);
1629
1630 break;
1631
1632 default:
1633 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1634 return;
1635 }
1636
1637 LOG(3, s, t, "CCP: Sending %s\n", ppp_code(*q));
1638 tunnelsend(b, l + (q - b), t);
1639 }
1640 else if (*p == TerminateReq)
1641 {
1642 LOG(3, s, t, "CCP: Received TerminateReq. Sending TerminateAck\n");
1643 *p = TerminateAck;
1644 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1645 if (!q) return;
1646 tunnelsend(b, l + (q - b), t);
1647 change_state(s, ccp, Stopped);
1648 }
1649 else
1650 {
1651 int code = *p;
1652 int mru = session[s].mru;
1653 if (!mru)
1654 mru = DEFAULT_MRU;
1655
1656 if (l > mru) l = mru;
1657
1658 *p = CodeRej;
1659 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1660 if (!q) return;
1661
1662 LOG(3, s, t, "Unexpected CCP code %s\n", ppp_code(code));
1663 tunnelsend(b, l + (q - b), t);
1664 }
1665 }
1666
1667 // send a CHAP challenge
1668 void sendchap(sessionidt s, tunnelidt t)
1669 {
1670 uint8_t b[MAXCONTROL];
1671 uint16_t r;
1672 uint8_t *q;
1673
1674 CSTAT(sendchap);
1675
1676 r = radiusnew(s);
1677 if (!r)
1678 {
1679 LOG(1, s, t, "No RADIUS to send challenge\n");
1680 STAT(tunnel_tx_errors);
1681 return;
1682 }
1683
1684 LOG(1, s, t, "Send CHAP challenge\n");
1685
1686 radius[r].chap = 1; // CHAP not PAP
1687 radius[r].id++;
1688 if (radius[r].state != RADIUSCHAP)
1689 radius[r].try = 0;
1690
1691 radius[r].state = RADIUSCHAP;
1692 radius[r].retry = backoff(radius[r].try++);
1693 if (radius[r].try > 5)
1694 {
1695 sessionshutdown(s, "CHAP timeout.", 3, 0);
1696 STAT(tunnel_tx_errors);
1697 return ;
1698 }
1699 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1700 if (!q) return;
1701
1702 *q = 1; // challenge
1703 q[1] = radius[r].id; // ID
1704 q[4] = 16; // value size (size of challenge)
1705 memcpy(q + 5, radius[r].auth, 16); // challenge
1706 strcpy((char *) q + 21, hostname); // our name
1707 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1708 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1709 }
1710
1711 // fill in a L2TP message with a PPP frame,
1712 // copies existing PPP message and changes magic number if seen
1713 // returns start of PPP frame
1714 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1715 {
1716 if (size < 12) // Need more space than this!!
1717 {
1718 static int backtrace_count = 0;
1719 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1720 log_backtrace(backtrace_count, 5)
1721 return NULL;
1722 }
1723
1724 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1725 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1726 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1727 b += 6;
1728 if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1729 {
1730 *(uint16_t *) b = htons(0xFF03); // HDLC header
1731 b += 2;
1732 }
1733 if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1734 *b++ = mtype;
1735 else
1736 {
1737 *(uint16_t *) b = htons(mtype);
1738 b += 2;
1739 }
1740
1741 if (l + 12 > size)
1742 {
1743 static int backtrace_count = 0;
1744 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1745 log_backtrace(backtrace_count, 5)
1746 return NULL;
1747 }
1748
1749 if (p && l)
1750 memcpy(b, p, l);
1751
1752 return b;
1753 }
1754
1755 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1756 {
1757 int len = 0;
1758 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1759 return 0;
1760
1761 *b++ = 3; // Authentication-Protocol
1762 if (authtype == AUTHCHAP)
1763 {
1764 len = *b++ = 5; // length
1765 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1766 *b++ = 5; // MD5
1767 }
1768 else if (authtype == AUTHPAP)
1769 {
1770 len = *b++ = 4; // length
1771 *(uint16_t *) b = htons(PPPPAP); b += 2;
1772 }
1773 else
1774 {
1775 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1776 }
1777
1778 return len;
1779 }
1780
1781 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1782 void sendlcp(sessionidt s, tunnelidt t, int authtype)
1783 {
1784 uint8_t b[500], *q, *l;
1785
1786 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1787 return;
1788
1789 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1790 authtype ? " (" : "",
1791 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1792 authtype ? ")" : "");
1793
1794 if (!session[s].mru)
1795 session[s].mru = DEFAULT_MRU;
1796
1797 l = q;
1798 *l++ = ConfigReq;
1799 *l++ = (time_now % 255) + 1; // ID
1800
1801 l += 2; //Save space for length
1802
1803 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1804 *(uint16_t *) l = htons(session[s].mru); l += 2;
1805
1806 if (authtype)
1807 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1808
1809 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1810 *(uint32_t *) l = htonl(session[s].magic);
1811 l += 4;
1812
1813 *(uint16_t *)(q + 2) = htons(l - q); // Length
1814
1815 LOG_HEX(5, "PPPLCP", q, l - q);
1816 if (config->debug > 3) dumplcp(q, l - q);
1817
1818 tunnelsend(b, (l - b), t);
1819 }
1820
1821 // Send CCP request for no compression
1822 void sendccp(sessionidt s, tunnelidt t)
1823 {
1824 uint8_t b[500], *q;
1825
1826 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1827 return;
1828
1829 LOG(4, s, t, "Sending CCP ConfigReq for no compression\n");
1830 *q = ConfigReq;
1831 *(uint8_t *)(q + 1) = (time_now % 255) + 1; // ID
1832 *(uint16_t *)(q + 2) = htons(4); // Length
1833
1834 LOG_HEX(5, "PPPCCP", q, 4);
1835 tunnelsend(b, (q - b) + 4 , t);
1836 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"