projects / l2tpns.git / blob
? search:


a01c2c038de442b14c9336b90aeaff4cffad0d2c
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.89 2005/12/14 02:19:15 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452 if (mru < MINMTU) mru = MINMTU;
453 if (mru > size) mru = size;
454
455 l += 4;
456 if (l > mru) l = mru;
457
458 q = makeppp(buf, size, 0, 0, s, t, proto);
459 if (!q) return;
460
461 *q = CodeRej;
462 *(q + 1) = ++sess_local[s].lcp_ident;
463 *(uint16_t *)(q + 2) = htons(l);
464 memcpy(q + 4, p, l - 4);
465
466 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
467 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
468 if (config->debug > 3) dumplcp(q, l);
469
470 tunnelsend(buf, l + (q - buf), t);
471 }
472
473 // Process LCP messages
474 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
475 {
476 uint8_t b[MAXETHER];
477 uint8_t *q = NULL;
478 uint32_t magicno = 0;
479 uint16_t hl;
480
481 CSTAT(processlcp);
482
483 LOG_HEX(5, "LCP", p, l);
484 if (l < 4)
485 {
486 LOG(1, s, t, "Short LCP %d bytes\n", l);
487 STAT(tunnel_rx_errors);
488 return ;
489 }
490
491 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
492 {
493 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
494 STAT(tunnel_rx_errors);
495 return ;
496 }
497 l = hl;
498
499 if (session[s].die) // going down...
500 return;
501
502 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
503 if (config->debug > 3) dumplcp(p, l);
504
505 if (*p == ConfigAck)
506 {
507 int x = l - 4;
508 uint8_t *o = (p + 4);
509 int authtype = 0;
510
511 while (x > 2)
512 {
513 int type = o[0];
514 int length = o[1];
515
516 if (length == 0 || type == 0 || x < length) break;
517 switch (type)
518 {
519 case 3: // Authentication-Protocol
520 {
521 int proto = ntohs(*(uint16_t *)(o + 2));
522 if (proto == PPPPAP)
523 authtype = AUTHPAP;
524 else if (proto == PPPCHAP && *(o + 4) == 5)
525 authtype = AUTHCHAP;
526 }
527
528 break;
529 }
530 x -= length;
531 o += length;
532 }
533
534 if (!session[s].ip && authtype)
535 sess_local[s].lcp_authtype = authtype;
536
537 switch (session[s].ppp.lcp)
538 {
539 case RequestSent:
540 initialise_restart_count(s, lcp);
541 change_state(s, lcp, AckReceived);
542 break;
543
544 case AckReceived:
545 case Opened:
546 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
547 if (session[s].ppp.lcp == Opened)
548 lcp_restart(s);
549
550 sendlcp(s, t);
551 change_state(s, lcp, RequestSent);
552 break;
553
554 case AckSent:
555 lcp_open(s, t);
556 break;
557
558 default:
559 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
560 }
561 }
562 else if (*p == ConfigReq)
563 {
564 int x = l - 4;
565 uint8_t *o = (p + 4);
566 uint8_t *response = 0;
567 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
568 static uint8_t authproto[5];
569
570 while (x > 2)
571 {
572 int type = o[0];
573 int length = o[1];
574
575 if (length == 0 || type == 0 || x < length) break;
576 switch (type)
577 {
578 case 1: // Maximum-Receive-Unit
579 {
580 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
581 if (mru >= MINMTU)
582 {
583 session[s].mru = mru;
584 break;
585 }
586
587 LOG(3, s, t, " Remote requesting MRU of %u. Rejecting.\n", mru);
588 mru = htons(MRU);
589 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
590 }
591 break;
592
593 case 2: // Async-Control-Character-Map
594 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
595 break;
596
597 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
598 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
599 break;
600
601 case 3: // Authentication-Protocol
602 {
603 int proto = ntohs(*(uint16_t *)(o + 2));
604 char proto_name[] = "0x0000";
605 int alen;
606
607 if (proto == PPPPAP)
608 {
609 if (config->radius_authtypes & AUTHPAP)
610 {
611 sess_local[s].lcp_authtype = AUTHPAP;
612 break;
613 }
614
615 strcpy(proto_name, "PAP");
616 }
617 else if (proto == PPPCHAP)
618 {
619 if (config->radius_authtypes & AUTHCHAP
620 && *(o + 4) == 5) // MD5
621 {
622 sess_local[s].lcp_authtype = AUTHCHAP;
623 break;
624 }
625
626 strcpy(proto_name, "CHAP");
627 }
628 else
629 sprintf(proto_name, "%#4.4x", proto);
630
631 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
632
633 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
634 if (alen < 2) break; // paranoia
635
636 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
637 if (q && *response == ConfigNak &&
638 config->radius_authtypes != config->radius_authprefer)
639 {
640 // alternate type
641 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
642 if (alen < 2) break;
643 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
644 }
645
646 break;
647 }
648 break;
649
650 case 5: // Magic-Number
651 magicno = ntohl(*(uint32_t *)(o + 2));
652 break;
653
654 case 4: // Quality-Protocol
655 case 7: // Protocol-Field-Compression
656 case 8: // Address-And-Control-Field-Compression
657 break;
658
659 default: // Reject any unknown options
660 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
661 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
662 }
663 x -= length;
664 o += length;
665 }
666
667 if (response)
668 {
669 l = q - response; // LCP packet length
670 *((uint16_t *) (response + 2)) = htons(l); // update header
671 }
672 else
673 {
674 // Send packet back as ConfigAck
675 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
676 if (!response) return;
677 *response = ConfigAck;
678 }
679
680 switch (session[s].ppp.lcp)
681 {
682 case Closed:
683 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
684 if (!response) return;
685 *response = TerminateAck;
686 *((uint16_t *) (response + 2)) = htons(l = 4);
687 break;
688
689 case Stopped:
690 initialise_restart_count(s, lcp);
691 sendlcp(s, t);
692 if (*response == ConfigAck)
693 change_state(s, lcp, AckSent);
694 else
695 change_state(s, lcp, RequestSent);
696
697 break;
698
699 case RequestSent:
700 if (*response == ConfigAck)
701 change_state(s, lcp, AckSent);
702
703 break;
704
705 case AckReceived:
706 if (*response == ConfigAck)
707 lcp_open(s, t);
708
709 break;
710
711 case Opened:
712 lcp_restart(s);
713 sendlcp(s, t);
714 /* fallthrough */
715
716 case AckSent:
717 if (*response == ConfigAck)
718 change_state(s, lcp, AckSent);
719 else
720 change_state(s, lcp, RequestSent);
721
722 break;
723
724 default:
725 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
726 return;
727 }
728
729 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
730 if (config->debug > 3) dumplcp(response, l);
731
732 tunnelsend(b, l + (response - b), t);
733 }
734 else if (*p == ConfigNak || *p == ConfigRej)
735 {
736 int x = l - 4;
737 uint8_t *o = (p + 4);
738 int authtype = -1;
739
740 while (x > 2)
741 {
742 int type = o[0];
743 int length = o[1];
744
745 if (length == 0 || type == 0 || x < length) break;
746 switch (type)
747 {
748 case 1: // Maximum-Receive-Unit
749 if (*p == ConfigNak)
750 {
751 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
752 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
753 }
754 else
755 {
756 sess_local[s].ppp_mru = 0;
757 LOG(3, s, t, " Remote rejected MRU negotiation\n");
758 }
759
760 break;
761
762 case 3: // Authentication-Protocol
763 if (authtype > 0)
764 break;
765
766 if (*p == ConfigNak)
767 {
768 int proto = ntohs(*(uint16_t *)(o + 2));
769 if (proto == PPPPAP)
770 {
771 authtype = config->radius_authtypes & AUTHPAP;
772 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
773 authtype ? "accept" : "reject");
774 }
775 else if (proto == PPPCHAP && *(o + 4) == 5)
776 {
777 authtype = config->radius_authtypes & AUTHCHAP;
778 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
779 authtype ? "accept" : "reject");
780 }
781 else
782 {
783 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
784 proto);
785 }
786 }
787 else
788 {
789 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
790 authtype = 0; // shutdown
791 }
792
793 break;
794
795 default:
796 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
797 break;
798 }
799 x -= length;
800 o += length;
801 }
802
803 if (!authtype)
804 {
805 sessionshutdown(s, "Unsupported authentication.", 3, 0);
806 return;
807 }
808
809 if (authtype > 0)
810 sess_local[s].lcp_authtype = authtype;
811
812 switch (session[s].ppp.lcp)
813 {
814 case Closed:
815 case Stopped:
816 {
817 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
818 if (!response) return;
819 *response = TerminateAck;
820 *((uint16_t *) (response + 2)) = htons(l = 4);
821
822 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
823 if (config->debug > 3) dumplcp(response, l);
824
825 tunnelsend(b, l + (response - b), t);
826 }
827 break;
828
829 case RequestSent:
830 case AckSent:
831 initialise_restart_count(s, lcp);
832 sendlcp(s, t);
833 break;
834
835 case AckReceived:
836 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
837 sendlcp(s, t);
838 break;
839
840 case Opened:
841 lcp_restart(s);
842 sendlcp(s, t);
843 break;
844
845 default:
846 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
847 return;
848 }
849 }
850 else if (*p == TerminateReq)
851 {
852 *p = TerminateAck; // close
853 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
854 if (!q) return;
855
856 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
857 if (config->debug > 3) dumplcp(q, l);
858
859 tunnelsend(b, l + (q - b), t); // send it
860 sessionshutdown(s, "Remote end closed connection.", 3, 0);
861 }
862 else if (*p == TerminateAck)
863 {
864 sessionshutdown(s, "Connection closed.", 3, 0);
865 }
866 else if (*p == ProtocolRej)
867 {
868 uint16_t proto = 0;
869
870 if (l > 4)
871 {
872 proto = *(p+4);
873 if (l > 5 && !(proto & 1))
874 {
875 proto <<= 8;
876 proto |= *(p+5);
877 }
878 }
879
880 if (proto == PPPIPV6CP)
881 {
882 LOG(3, s, t, "IPv6 rejected\n");
883 change_state(s, ipv6cp, Closed);
884 }
885 else
886 {
887 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
888 }
889 }
890 else if (*p == EchoReq)
891 {
892 *p = EchoReply; // reply
893 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
894 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
895 if (!q) return;
896
897 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
898 if (config->debug > 3) dumplcp(q, l);
899
900 tunnelsend(b, l + (q - b), t); // send it
901 }
902 else if (*p == EchoReply)
903 {
904 // Ignore it, last_packet time is set earlier than this.
905 }
906 else if (*p != CodeRej)
907 {
908 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
909 }
910 }
911
912 static void ipcp_open(sessionidt s, tunnelidt t)
913 {
914 LOG(3, s, t, "IPCP: Opened, session is now active\n");
915
916 change_state(s, ipcp, Opened);
917
918 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
919 {
920 uint16_t r = radiusnew(s);
921 if (r)
922 {
923 radiussend(r, RADIUSSTART); // send radius start
924
925 // don't send further Start records if IPCP is restarted
926 session[s].flags |= SESSION_STARTED;
927 cluster_send_session(s);
928 }
929 }
930
931 // start IPv6 if configured and still in passive state
932 if (session[s].ppp.ipv6cp == Stopped)
933 {
934 sendipv6cp(s, t);
935 change_state(s, ipv6cp, RequestSent);
936 }
937 }
938
939 // Process IPCP messages
940 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
941 {
942 uint8_t b[MAXETHER];
943 uint8_t *q = 0;
944 uint16_t hl;
945
946 CSTAT(processipcp);
947
948 LOG_HEX(5, "IPCP", p, l);
949 if (l < 5)
950 {
951 LOG(1, s, t, "Short IPCP %d bytes\n", l);
952 STAT(tunnel_rx_errors);
953 return ;
954 }
955
956 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
957 {
958 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
959 STAT(tunnel_rx_errors);
960 return ;
961 }
962 l = hl;
963
964 if (session[s].ppp.phase < Network)
965 {
966 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
967 return;
968 }
969
970 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
971
972 if (*p == ConfigAck)
973 {
974 switch (session[s].ppp.ipcp)
975 {
976 case RequestSent:
977 initialise_restart_count(s, ipcp);
978 change_state(s, ipcp, AckReceived);
979 break;
980
981 case AckReceived:
982 case Opened:
983 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
984 sendipcp(s, t);
985 change_state(s, ipcp, RequestSent);
986 break;
987
988 case AckSent:
989 ipcp_open(s, t);
990 break;
991
992 default:
993 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
994 }
995 }
996 else if (*p == ConfigReq)
997 {
998 uint8_t *response = 0;
999 uint8_t *o = p + 4;
1000 int length = l - 4;
1001 int gotip = 0;
1002 in_addr_t addr;
1003
1004 while (length > 2)
1005 {
1006 switch (*o)
1007 {
1008 case 3: // ip address
1009 gotip++; // seen address
1010 if (o[1] != 6 || o[1] > length) return;
1011
1012 addr = htonl(session[s].ip);
1013 if (memcmp(o + 2, &addr, (sizeof addr)))
1014 {
1015 uint8_t *oq = q;
1016 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1017 if (!q || (q != oq && *response == ConfigRej))
1018 {
1019 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1020 return;
1021 }
1022 }
1023
1024 break;
1025
1026 case 129: // primary DNS
1027 if (o[1] != 6 || o[1] > length) return;
1028
1029 addr = htonl(session[s].dns1);
1030 if (memcmp(o + 2, &addr, (sizeof addr)))
1031 {
1032 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1033 if (!q) return;
1034 }
1035
1036 break;
1037
1038 case 131: // secondary DNS
1039 if (o[1] != 6 || o[1] > length) return;
1040
1041 addr = htonl(session[s].dns2);
1042 if (memcmp(o + 2, &addr, sizeof(addr)))
1043 {
1044 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1045 if (!q) return;
1046 }
1047
1048 break;
1049
1050 default:
1051 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1052 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1053 if (!q) return;
1054 }
1055
1056 length -= o[1];
1057 o += o[1];
1058 }
1059
1060 if (response)
1061 {
1062 l = q - response; // IPCP packet length
1063 *((uint16_t *) (response + 2)) = htons(l); // update header
1064 }
1065 else if (gotip)
1066 {
1067 // Send packet back as ConfigAck
1068 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1069 if (!response) return;
1070 *response = ConfigAck;
1071 }
1072 else
1073 {
1074 LOG(1, s, t, "No IP in IPCP request\n");
1075 STAT(tunnel_rx_errors);
1076 return;
1077 }
1078
1079 switch (session[s].ppp.ipcp)
1080 {
1081 case Closed:
1082 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1083 if (!response) return;
1084 *response = TerminateAck;
1085 *((uint16_t *) (response + 2)) = htons(l = 4);
1086 break;
1087
1088 case Stopped:
1089 initialise_restart_count(s, ipcp);
1090 sendipcp(s, t);
1091 if (*response == ConfigAck)
1092 change_state(s, ipcp, AckSent);
1093 else
1094 change_state(s, ipcp, RequestSent);
1095
1096 break;
1097
1098 case RequestSent:
1099 if (*response == ConfigAck)
1100 change_state(s, ipcp, AckSent);
1101
1102 break;
1103
1104 case AckReceived:
1105 if (*response == ConfigAck)
1106 ipcp_open(s, t);
1107
1108 break;
1109
1110 case Opened:
1111 initialise_restart_count(s, ipcp);
1112 sendipcp(s, t);
1113 /* fallthrough */
1114
1115 case AckSent:
1116 if (*response == ConfigAck)
1117 change_state(s, ipcp, AckSent);
1118 else
1119 change_state(s, ipcp, RequestSent);
1120
1121 break;
1122
1123 default:
1124 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1125 return;
1126 }
1127
1128 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1129 tunnelsend(b, l + (response - b), t);
1130 }
1131 else if (*p == TerminateReq)
1132 {
1133 *p = TerminateAck;
1134 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1135 if (!q) return;
1136 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1137 tunnelsend(b, l + (q - b), t);
1138 change_state(s, ipcp, Stopped);
1139 }
1140 else if (*p != CodeRej)
1141 {
1142 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1143 }
1144 }
1145
1146 static void ipv6cp_open(sessionidt s, tunnelidt t)
1147 {
1148 LOG(3, s, t, "IPV6CP: Opened\n");
1149
1150 change_state(s, ipv6cp, Opened);
1151 if (session[s].ipv6prefixlen)
1152 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1153
1154 // Send an initial RA (TODO: Should we send these regularly?)
1155 send_ipv6_ra(s, t, NULL);
1156 }
1157
1158 // Process IPV6CP messages
1159 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1160 {
1161 uint8_t b[MAXETHER];
1162 uint8_t *q = 0;
1163 uint16_t hl;
1164
1165 CSTAT(processipv6cp);
1166
1167 LOG_HEX(5, "IPV6CP", p, l);
1168 if (l < 4)
1169 {
1170 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1171 STAT(tunnel_rx_errors);
1172 return ;
1173 }
1174
1175 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1176 {
1177 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1178 STAT(tunnel_rx_errors);
1179 return ;
1180 }
1181 l = hl;
1182
1183 if (session[s].ppp.phase < Network)
1184 {
1185 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1186 return;
1187 }
1188
1189 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1190
1191 if (!session[s].ip)
1192 {
1193 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1194 return; // need IPCP to complete...
1195 }
1196
1197 if (*p == ConfigAck)
1198 {
1199 switch (session[s].ppp.ipv6cp)
1200 {
1201 case RequestSent:
1202 initialise_restart_count(s, ipv6cp);
1203 change_state(s, ipv6cp, AckReceived);
1204 break;
1205
1206 case AckReceived:
1207 case Opened:
1208 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1209 sendipv6cp(s, t);
1210 change_state(s, ipv6cp, RequestSent);
1211 break;
1212
1213 case AckSent:
1214 ipv6cp_open(s, t);
1215 break;
1216
1217 default:
1218 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1219 }
1220 }
1221 else if (*p == ConfigReq)
1222 {
1223 uint8_t *response = 0;
1224 uint8_t *o = p + 4;
1225 int length = l - 4;
1226 int gotip = 0;
1227 uint8_t ident[8];
1228
1229 while (length > 2)
1230 {
1231 switch (*o)
1232 {
1233 case 1: // interface identifier
1234 gotip++; // seen address
1235 if (o[1] != 10 || o[1] > length) return;
1236
1237 *(uint32_t *) ident = htonl(session[s].ip);
1238 *(uint32_t *) (ident + 4) = 0;
1239
1240 if (memcmp(o + 2, ident, sizeof(ident)))
1241 {
1242 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1243 if (!q) return;
1244 }
1245
1246 break;
1247
1248 default:
1249 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1250 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1251 if (!q) return;
1252 }
1253
1254 length -= o[1];
1255 o += o[1];
1256 }
1257
1258 if (response)
1259 {
1260 l = q - response; // IPV6CP packet length
1261 *((uint16_t *) (response + 2)) = htons(l); // update header
1262 }
1263 else if (gotip)
1264 {
1265 // Send packet back as ConfigAck
1266 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1267 if (!response) return;
1268 *response = ConfigAck;
1269 }
1270 else
1271 {
1272 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1273 STAT(tunnel_rx_errors);
1274 return;
1275 }
1276
1277 switch (session[s].ppp.ipv6cp)
1278 {
1279 case Closed:
1280 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1281 if (!response) return;
1282 *response = TerminateAck;
1283 *((uint16_t *) (response + 2)) = htons(l = 4);
1284 break;
1285
1286 case Stopped:
1287 initialise_restart_count(s, ipv6cp);
1288 sendipv6cp(s, t);
1289 if (*response == ConfigAck)
1290 change_state(s, ipv6cp, AckSent);
1291 else
1292 change_state(s, ipv6cp, RequestSent);
1293
1294 break;
1295
1296 case RequestSent:
1297 if (*response == ConfigAck)
1298 change_state(s, ipv6cp, AckSent);
1299
1300 break;
1301
1302 case AckReceived:
1303 if (*response == ConfigAck)
1304 ipv6cp_open(s, t);
1305
1306 break;
1307
1308 case Opened:
1309 initialise_restart_count(s, ipv6cp);
1310 sendipv6cp(s, t);
1311 /* fallthrough */
1312
1313 case AckSent:
1314 if (*response == ConfigAck)
1315 change_state(s, ipv6cp, AckSent);
1316 else
1317 change_state(s, ipv6cp, RequestSent);
1318
1319 break;
1320
1321 default:
1322 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1323 return;
1324 }
1325
1326 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1327 tunnelsend(b, l + (response - b), t);
1328 }
1329 else if (*p == TerminateReq)
1330 {
1331 *p = TerminateAck;
1332 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1333 if (!q) return;
1334 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1335 tunnelsend(b, l + (q - b), t);
1336 change_state(s, ipv6cp, Stopped);
1337 }
1338 else if (*p != CodeRej)
1339 {
1340 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1341 }
1342 }
1343
1344 // process IP packet received
1345 //
1346 // This MUST be called with at least 4 byte behind 'p'.
1347 // (i.e. this routine writes to p[-4]).
1348 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1349 {
1350 in_addr_t ip;
1351
1352 CSTAT(processipin);
1353
1354 LOG_HEX(5, "IP", p, l);
1355
1356 if (l < 20)
1357 {
1358 LOG(1, s, t, "IP packet too short %d\n", l);
1359 STAT(tunnel_rx_errors);
1360 return ;
1361 }
1362
1363 ip = ntohl(*(uint32_t *)(p + 12));
1364
1365 if (l > MAXETHER)
1366 {
1367 LOG(1, s, t, "IP packet too long %d\n", l);
1368 STAT(tunnel_rx_errors);
1369 return ;
1370 }
1371
1372 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1373 return;
1374
1375 // no spoof (do sessionbyip to handled statically routed subnets)
1376 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1377 {
1378 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1379 return;
1380 }
1381
1382 // run access-list if any
1383 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1384 return;
1385
1386 // adjust MSS on SYN and SYN,ACK packets with options
1387 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1388 {
1389 int ihl = (p[0] & 0xf) * 4; // length of IP header
1390 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1391 adjust_tcp_mss(s, t, p, l, p + ihl);
1392 }
1393
1394 // Add on the tun header
1395 p -= 4;
1396 *(uint32_t *) p = htonl(PKTIP);
1397 l += 4;
1398
1399 // Are we throttled and a slave?
1400 if (session[s].tbf_in && !config->cluster_iam_master) {
1401 // Pass it to the master for handling.
1402 master_throttle_packet(session[s].tbf_in, p, l);
1403 return;
1404 }
1405
1406 // Are we throttled and a master??
1407 if (session[s].tbf_in && config->cluster_iam_master) {
1408 // Actually handle the throttled packets.
1409 tbf_queue_packet(session[s].tbf_in, p, l);
1410 return;
1411 }
1412
1413 // send to ethernet
1414 if (tun_write(p, l) < 0)
1415 {
1416 STAT(tun_tx_errors);
1417 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1418 l, strerror(errno), tunfd, p);
1419
1420 return;
1421 }
1422
1423 p += 4;
1424 l -= 4;
1425
1426 if (session[s].snoop_ip && session[s].snoop_port)
1427 {
1428 // Snooping this session
1429 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1430 }
1431
1432 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1433 session[s].cin_delta += l;
1434 session[s].pin++;
1435
1436 sess_local[s].cin += l;
1437 sess_local[s].pin++;
1438
1439 eth_tx += l;
1440
1441 STAT(tun_tx_packets);
1442 INC_STAT(tun_tx_bytes, l);
1443 }
1444
1445 // process IPv6 packet received
1446 //
1447 // This MUST be called with at least 4 byte behind 'p'.
1448 // (i.e. this routine writes to p[-4]).
1449 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1450 {
1451 struct in6_addr ip;
1452 in_addr_t ipv4;
1453
1454 CSTAT(processipv6in);
1455
1456 LOG_HEX(5, "IPv6", p, l);
1457
1458 ip = *(struct in6_addr *) (p + 8);
1459 ipv4 = ntohl(*(uint32_t *)(p + 16));
1460
1461 if (l > MAXETHER)
1462 {
1463 LOG(1, s, t, "IP packet too long %d\n", l);
1464 STAT(tunnel_rx_errors);
1465 return ;
1466 }
1467
1468 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1469 return;
1470
1471 // no spoof
1472 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1473 {
1474 char str[INET6_ADDRSTRLEN];
1475 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1476 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1477 return;
1478 }
1479
1480 // Check if it's a Router Solicition message.
1481 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1482 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1483 *(uint32_t *)(p + 34) == 0 &&
1484 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1485 LOG(3, s, t, "Got IPv6 RS\n");
1486 send_ipv6_ra(s, t, &ip);
1487 return;
1488 }
1489
1490 // Add on the tun header
1491 p -= 4;
1492 *(uint32_t *) p = htonl(PKTIPV6);
1493 l += 4;
1494
1495 // Are we throttled and a slave?
1496 if (session[s].tbf_in && !config->cluster_iam_master) {
1497 // Pass it to the master for handling.
1498 master_throttle_packet(session[s].tbf_in, p, l);
1499 return;
1500 }
1501
1502 // Are we throttled and a master??
1503 if (session[s].tbf_in && config->cluster_iam_master) {
1504 // Actually handle the throttled packets.
1505 tbf_queue_packet(session[s].tbf_in, p, l);
1506 return;
1507 }
1508
1509 // send to ethernet
1510 if (tun_write(p, l) < 0)
1511 {
1512 STAT(tun_tx_errors);
1513 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1514 l, strerror(errno), tunfd, p);
1515
1516 return;
1517 }
1518
1519 p += 4;
1520 l -= 4;
1521
1522 if (session[s].snoop_ip && session[s].snoop_port)
1523 {
1524 // Snooping this session
1525 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1526 }
1527
1528 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1529 session[s].cin_delta += l;
1530 session[s].pin++;
1531
1532 sess_local[s].cin += l;
1533 sess_local[s].pin++;
1534
1535 eth_tx += l;
1536
1537 STAT(tun_tx_packets);
1538 INC_STAT(tun_tx_bytes, l);
1539 }
1540
1541 //
1542 // Helper routine for the TBF filters.
1543 // Used to send queued data in from the user.
1544 //
1545 void send_ipin(sessionidt s, uint8_t *buf, int len)
1546 {
1547 LOG_HEX(5, "IP in throttled", buf, len);
1548
1549 if (write(tunfd, buf, len) < 0)
1550 {
1551 STAT(tun_tx_errors);
1552 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1553 len, strerror(errno), tunfd, buf);
1554
1555 return;
1556 }
1557
1558 buf += 4;
1559 len -= 4;
1560
1561 if (session[s].snoop_ip && session[s].snoop_port)
1562 {
1563 // Snooping this session
1564 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1565 }
1566
1567 // Increment packet counters
1568 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1569 session[s].cin_delta += len;
1570 session[s].pin++;
1571
1572 sess_local[s].cin += len;
1573 sess_local[s].pin++;
1574
1575 eth_tx += len;
1576
1577 STAT(tun_tx_packets);
1578 INC_STAT(tun_tx_bytes, len - 4);
1579 }
1580
1581
1582 // Process CCP messages
1583 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1584 {
1585 uint8_t b[MAXETHER];
1586 uint8_t *q;
1587
1588 CSTAT(processccp);
1589
1590 LOG_HEX(5, "CCP", p, l);
1591
1592 if (session[s].ppp.phase < Network)
1593 {
1594 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1595 return;
1596 }
1597
1598 if (l < 1)
1599 {
1600 LOG(1, s, t, "Short CCP packet\n");
1601 STAT(tunnel_rx_errors);
1602 }
1603
1604 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1605 if (*p == ConfigAck)
1606 {
1607 switch (session[s].ppp.ccp)
1608 {
1609 case RequestSent:
1610 initialise_restart_count(s, ccp);
1611 change_state(s, ccp, AckReceived);
1612 break;
1613
1614 case AckReceived:
1615 case Opened:
1616 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1617 sendccp(s, t);
1618 change_state(s, ccp, RequestSent);
1619 break;
1620
1621 case AckSent:
1622 LOG(3, s, t, "CCP: Opened\n");
1623 change_state(s, ccp, Opened);
1624 break;
1625
1626 default:
1627 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1628 }
1629 }
1630 else if (*p == ConfigReq)
1631 {
1632 if (l < 6) // accept no compression
1633 *p = ConfigAck;
1634 else // compression requested--reject
1635 *p = ConfigRej;
1636
1637 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1638 if (!q) return;
1639
1640 switch (session[s].ppp.ccp)
1641 {
1642 case Closed:
1643 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1644 if (!q) return;
1645 *q = TerminateAck;
1646 *((uint16_t *) (q + 2)) = htons(l = 4);
1647 break;
1648
1649 case Stopped:
1650 initialise_restart_count(s, ccp);
1651 sendccp(s, t);
1652 if (*q == ConfigAck)
1653 change_state(s, ccp, AckSent);
1654 else
1655 change_state(s, ccp, RequestSent);
1656
1657 break;
1658
1659 case RequestSent:
1660 if (*q == ConfigAck)
1661 change_state(s, ccp, AckSent);
1662
1663 break;
1664
1665 case AckReceived:
1666 if (*q == ConfigAck)
1667 change_state(s, ccp, Opened);
1668
1669 break;
1670
1671 case Opened:
1672 initialise_restart_count(s, ccp);
1673 sendccp(s, t);
1674 /* fallthrough */
1675
1676 case AckSent:
1677 if (*q == ConfigAck)
1678 change_state(s, ccp, AckSent);
1679 else
1680 change_state(s, ccp, RequestSent);
1681
1682 break;
1683
1684 default:
1685 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1686 return;
1687 }
1688
1689 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1690 tunnelsend(b, l + (q - b), t);
1691 }
1692 else if (*p == TerminateReq)
1693 {
1694 *p = TerminateAck;
1695 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1696 if (!q) return;
1697 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1698 tunnelsend(b, l + (q - b), t);
1699 change_state(s, ccp, Stopped);
1700 }
1701 else if (*p != CodeRej)
1702 {
1703 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1704 }
1705 }
1706
1707 // send a CHAP challenge
1708 void sendchap(sessionidt s, tunnelidt t)
1709 {
1710 uint8_t b[MAXETHER];
1711 uint16_t r;
1712 uint8_t *q;
1713
1714 CSTAT(sendchap);
1715
1716 r = radiusnew(s);
1717 if (!r)
1718 {
1719 LOG(1, s, t, "No RADIUS to send challenge\n");
1720 STAT(tunnel_tx_errors);
1721 return;
1722 }
1723
1724 LOG(1, s, t, "Send CHAP challenge\n");
1725
1726 radius[r].chap = 1; // CHAP not PAP
1727 radius[r].id++;
1728 if (radius[r].state != RADIUSCHAP)
1729 radius[r].try = 0;
1730
1731 radius[r].state = RADIUSCHAP;
1732 radius[r].retry = backoff(radius[r].try++);
1733 if (radius[r].try > 5)
1734 {
1735 sessionshutdown(s, "CHAP timeout.", 3, 0);
1736 STAT(tunnel_tx_errors);
1737 return ;
1738 }
1739 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1740 if (!q) return;
1741
1742 *q = 1; // challenge
1743 q[1] = radius[r].id; // ID
1744 q[4] = 16; // value size (size of challenge)
1745 memcpy(q + 5, radius[r].auth, 16); // challenge
1746 strcpy((char *) q + 21, hostname); // our name
1747 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1748 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1749 }
1750
1751 // fill in a L2TP message with a PPP frame,
1752 // copies existing PPP message and changes magic number if seen
1753 // returns start of PPP frame
1754 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1755 {
1756 if (size < 12) // Need more space than this!!
1757 {
1758 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1759 return NULL;
1760 }
1761
1762 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1763 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1764 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1765 b += 6;
1766 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1767 {
1768 *(uint16_t *) b = htons(0xFF03); // HDLC header
1769 b += 2;
1770 }
1771 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1772 *b++ = mtype;
1773 else
1774 {
1775 *(uint16_t *) b = htons(mtype);
1776 b += 2;
1777 }
1778
1779 if (l + 12 > size)
1780 {
1781 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1782 return NULL;
1783 }
1784
1785 if (p && l)
1786 memcpy(b, p, l);
1787
1788 return b;
1789 }
1790
1791 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1792 {
1793 int len = 0;
1794 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1795 return 0;
1796
1797 *b++ = 3; // Authentication-Protocol
1798 if (authtype == AUTHCHAP)
1799 {
1800 len = *b++ = 5; // length
1801 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1802 *b++ = 5; // MD5
1803 }
1804 else if (authtype == AUTHPAP)
1805 {
1806 len = *b++ = 4; // length
1807 *(uint16_t *) b = htons(PPPPAP); b += 2;
1808 }
1809 else
1810 {
1811 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1812 }
1813
1814 return len;
1815 }
1816
1817 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1818 void sendlcp(sessionidt s, tunnelidt t)
1819 {
1820 uint8_t b[500], *q, *l;
1821 int authtype = sess_local[s].lcp_authtype;
1822
1823 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1824 return;
1825
1826 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1827 authtype ? " (" : "",
1828 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1829 authtype ? ")" : "");
1830
1831 l = q;
1832 *l++ = ConfigReq;
1833 *l++ = ++sess_local[s].lcp_ident; // ID
1834
1835 l += 2; //Save space for length
1836
1837 if (sess_local[s].ppp_mru)
1838 {
1839 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1840 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1841 }
1842
1843 if (authtype)
1844 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1845
1846 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1847 *(uint32_t *) l = htonl(session[s].magic);
1848 l += 4;
1849
1850 *(uint16_t *)(q + 2) = htons(l - q); // Length
1851
1852 LOG_HEX(5, "PPPLCP", q, l - q);
1853 if (config->debug > 3) dumplcp(q, l - q);
1854
1855 tunnelsend(b, (l - b), t);
1856 restart_timer(s, lcp);
1857 }
1858
1859 // Send CCP request for no compression
1860 void sendccp(sessionidt s, tunnelidt t)
1861 {
1862 uint8_t b[500], *q;
1863
1864 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1865 return;
1866
1867 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1868
1869 *q = ConfigReq;
1870 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1871 *(uint16_t *)(q + 2) = htons(4); // Length
1872
1873 LOG_HEX(5, "PPPCCP", q, 4);
1874 tunnelsend(b, (q - b) + 4 , t);
1875 restart_timer(s, ccp);
1876 }
1877
1878 // Reject unknown/unconfigured protocols
1879 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1880 {
1881
1882 uint8_t buf[MAXETHER];
1883 uint8_t *q;
1884 int mru = session[s].mru;
1885 if (mru < MINMTU) mru = MINMTU;
1886 if (mru > sizeof(buf)) mru = sizeof(buf);
1887
1888 l += 6;
1889 if (l > mru) l = mru;
1890
1891 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1892 if (!q) return;
1893
1894 *q = ProtocolRej;
1895 *(q + 1) = ++sess_local[s].lcp_ident;
1896 *(uint16_t *)(q + 2) = htons(l);
1897 *(uint16_t *)(q + 4) = htons(proto);
1898 memcpy(q + 6, p, l - 6);
1899
1900 if (proto == PPPIPV6CP)
1901 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1902 else
1903 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1904
1905 tunnelsend(buf, l + (q - buf), t);
1906 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"