projects / l2tpns.git / blob
? search:


a60475534c4ba673f2a51d41ed3634b3438969aa
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.65 2005-07-31 10:04:10 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 r = radiusnew(s);
89 if (session[s].ip || !r)
90 {
91 // respond now, either no RADIUS available or already authenticated
92 uint8_t b[MAXCONTROL];
93 uint8_t id = p[1];
94 uint8_t *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP);
95 if (!p) return;
96
97 if (session[s].ip)
98 *p = 2; // ACK
99 else
100 *p = 3; // cant authorise
101 p[1] = id;
102 *(uint16_t *) (p + 2) = htons(5); // length
103 p[4] = 0; // no message
104 tunnelsend(b, 5 + (p - b), t); // send it
105
106 if (session[s].ip)
107 {
108 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
109 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
110 }
111 else
112 {
113 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
114 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
115 }
116 }
117 else
118 {
119 // Run PRE_AUTH plugins
120 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
121 run_plugins(PLUGIN_PRE_AUTH, &packet);
122 if (!packet.continue_auth)
123 {
124 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
125 if (packet.username) free(packet.username);
126 if (packet.password) free(packet.password);
127 return;
128 }
129
130 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
131 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
132
133 free(packet.username);
134 free(packet.password);
135
136 radius[r].id = p[1];
137 LOG(3, s, t, "Sending login for %s/%s to radius\n", user, pass);
138 radiussend(r, RADIUSAUTH);
139 }
140 }
141
142 // Process CHAP messages
143 void processchap(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
144 {
145 uint16_t r;
146 uint16_t hl;
147
148 CSTAT(processchap);
149
150 LOG_HEX(5, "CHAP", p, l);
151 r = sess_local[s].radius;
152 if (!r)
153 {
154 LOG(1, s, t, "Unexpected CHAP message\n");
155 STAT(tunnel_rx_errors);
156 return;
157 }
158
159 if (l < 4)
160 {
161 LOG(1, s, t, "Short CHAP %u bytes\n", l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "Short CHAP packet.", 3, 0);
164 return;
165 }
166
167 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
168 {
169 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
170 STAT(tunnel_rx_errors);
171 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
172 return;
173 }
174 l = hl;
175
176 if (*p != 2)
177 {
178 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
179 STAT(tunnel_rx_errors);
180 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
181 return;
182 }
183
184 if (session[s].ppp.phase != Authenticate)
185 {
186 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
187 return;
188 }
189
190 if (p[1] != radius[r].id)
191 {
192 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
193 STAT(tunnel_rx_errors);
194 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
195 return;
196 }
197
198 if (l < 5 || p[4] != 16)
199 {
200 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
201 STAT(tunnel_rx_errors);
202 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
203 return;
204 }
205
206 l -= 5;
207 p += 5;
208 if (l < 16 || l - 16 >= sizeof(session[s].user))
209 {
210 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
211 STAT(tunnel_rx_errors);
212 sessionshutdown(s, "CHAP username too long.", 3, 0);
213 return;
214 }
215
216 // Run PRE_AUTH plugins
217 {
218 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
219
220 packet.password = calloc(17, 1);
221 memcpy(packet.password, p, 16);
222
223 p += 16;
224 l -= 16;
225
226 packet.username = calloc(l + 1, 1);
227 memcpy(packet.username, p, l);
228
229 run_plugins(PLUGIN_PRE_AUTH, &packet);
230 if (!packet.continue_auth)
231 {
232 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
233 if (packet.username) free(packet.username);
234 if (packet.password) free(packet.password);
235 return;
236 }
237
238 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
239 memcpy(radius[r].pass, packet.password, 16);
240
241 free(packet.username);
242 free(packet.password);
243 }
244
245 radius[r].chap = 1;
246 LOG(3, s, t, "CHAP login %s\n", session[s].user);
247 radiussend(r, RADIUSAUTH);
248 }
249
250 static void dumplcp(uint8_t *p, int l)
251 {
252 int x = l - 4;
253 uint8_t *o = (p + 4);
254
255 LOG_HEX(5, "PPP LCP Packet", p, l);
256 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
257 LOG(4, 0, 0, "Length: %d\n", l);
258 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
259 return;
260
261 while (x > 2)
262 {
263 int type = o[0];
264 int length = o[1];
265 if (length < 2)
266 {
267 LOG(4, 0, 0, " Option length is %d...\n", length);
268 break;
269 }
270 if (type == 0)
271 {
272 LOG(4, 0, 0, " Option type is 0...\n");
273 x -= length;
274 o += length;
275 continue;
276 }
277 switch (type)
278 {
279 case 1: // Maximum-Receive-Unit
280 if (length == 4)
281 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
282 else
283 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
284 break;
285 case 2: // Async-Control-Character-Map
286 if (length == 6)
287 {
288 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
289 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
290 }
291 else
292 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
293 break;
294 case 3: // Authentication-Protocol
295 if (length == 4)
296 {
297 int proto = ntohs(*(uint16_t *)(o + 2));
298 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
299 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
300 }
301 else if (length == 5)
302 {
303 int proto = ntohs(*(uint16_t *)(o + 2));
304 int algo = *(uint8_t *)(o + 4);
305 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
306 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
307 }
308 else
309 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
310 break;
311 case 4: // Quality-Protocol
312 {
313 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
314 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
315 }
316 break;
317 case 5: // Magic-Number
318 if (length == 6)
319 {
320 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
321 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
322 }
323 else
324 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
325 break;
326 case 7: // Protocol-Field-Compression
327 case 8: // Address-And-Control-Field-Compression
328 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
329 break;
330 default:
331 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
332 break;
333 }
334 x -= length;
335 o += length;
336 }
337 }
338
339 void lcp_open(tunnelidt t, sessionidt s)
340 {
341 // transition to Authentication or Network phase:
342 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
343
344 // LCP now Opened
345 change_state(s, lcp, Opened);
346
347 if (session[s].ppp.phase == Authenticate)
348 {
349 if (sess_local[s].lcp_authtype == AUTHCHAP)
350 sendchap(t, s);
351 }
352 else
353 {
354 // This-Layer-Up
355 sendipcp(t, s);
356 change_state(s, ipcp, RequestSent);
357 // move to passive state for IPv6 (if configured), CCP
358 if (config->ipv6_prefix.s6_addr[0])
359 change_state(s, ipv6cp, Stopped);
360 else
361 change_state(s, ipv6cp, Closed);
362
363 change_state(s, ccp, Stopped);
364 }
365 }
366
367 static void lcp_restart(sessionidt s)
368 {
369 session[s].ppp.phase = Establish;
370 // This-Layer-Down
371 change_state(s, ipcp, Dead);
372 change_state(s, ipv6cp, Dead);
373 change_state(s, ccp, Dead);
374 }
375
376 static uint8_t *ppp_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
377 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
378 {
379 if (!*response || **response != ConfigRej)
380 {
381 queued = *response = makeppp(buf, blen, packet, 2, session[s].tunnel, s, mtype);
382 if (!queued)
383 return 0;
384
385 *queued = ConfigRej;
386 queued += 4;
387 }
388
389 if ((queued - buf + option[1]) > blen)
390 {
391 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
392 return 0;
393 }
394
395 memcpy(queued, option, option[1]);
396 return queued + option[1];
397 }
398
399 static uint8_t *ppp_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
400 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
401 uint8_t *value, size_t vlen)
402 {
403 int *nak_sent;
404 switch (mtype)
405 {
406 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
407 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
408 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
409 default: return 0; // ?
410 }
411
412 if (*response && **response != ConfigNak)
413 {
414 if (*nak_sent < config->ppp_max_failure) // reject queued
415 return queued;
416
417 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
418 }
419
420 if (!*response)
421 {
422 if (*nak_sent >= config->ppp_max_failure)
423 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
424
425 queued = *response = makeppp(buf, blen, packet, 2, session[s].tunnel, s, mtype);
426 if (!queued)
427 return 0;
428
429 *nak_sent++;
430 *queued = ConfigNak;
431 queued += 4;
432 }
433
434 if ((queued - buf + vlen + 2) > blen)
435 {
436 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
437 return 0;
438 }
439
440 *queued++ = *option;
441 *queued++ = vlen + 2;
442 memcpy(queued, value, vlen);
443 return queued + vlen;
444 }
445
446 // Process LCP messages
447 void processlcp(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
448 {
449 uint8_t b[MAXCONTROL];
450 uint8_t *q = NULL;
451 uint32_t magicno = 0;
452 uint16_t hl;
453
454 CSTAT(processlcp);
455
456 LOG_HEX(5, "LCP", p, l);
457 if (l < 4)
458 {
459 LOG(1, s, t, "Short LCP %d bytes\n", l);
460 STAT(tunnel_rx_errors);
461 return ;
462 }
463
464 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
465 {
466 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
467 STAT(tunnel_rx_errors);
468 return ;
469 }
470 l = hl;
471
472 if (session[s].die) // going down...
473 return;
474
475 if (*p == ConfigAck)
476 {
477 int x = l - 4;
478 uint8_t *o = (p + 4);
479 int authtype = 0;
480
481 LOG(3, s, t, "LCP: ConfigAck (%d bytes)...\n", l);
482 if (config->debug > 3) dumplcp(p, l);
483
484 while (x > 2)
485 {
486 int type = o[0];
487 int length = o[1];
488
489 if (length == 0 || type == 0 || x < length) break;
490 switch (type)
491 {
492 case 3: // Authentication-Protocol
493 {
494 int proto = ntohs(*(uint16_t *)(o + 2));
495 if (proto == PPPPAP)
496 authtype = AUTHPAP;
497 else if (proto == PPPCHAP && *(o + 4) == 5)
498 authtype = AUTHCHAP;
499 }
500
501 break;
502 }
503 x -= length;
504 o += length;
505 }
506
507 if (!session[s].ip && authtype)
508 sess_local[s].lcp_authtype = authtype;
509
510 switch (session[s].ppp.lcp)
511 {
512 case RequestSent:
513 initialise_restart_count(s, lcp);
514 change_state(s, lcp, AckReceived);
515 break;
516
517 case AckReceived:
518 case Opened:
519 LOG(3, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
520 if (session[s].ppp.lcp == Opened)
521 lcp_restart(s);
522
523 sendlcp(s, t, sess_local[s].lcp_authtype);
524 change_state(s, lcp, RequestSent);
525 break;
526
527 case AckSent:
528 lcp_open(t, s);
529 break;
530
531 default:
532 LOG(3, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
533 }
534 }
535 else if (*p == ConfigReq)
536 {
537 int x = l - 4;
538 uint8_t *o = (p + 4);
539 uint8_t *response = 0;
540 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
541 static uint8_t authproto[5];
542
543 LOG(3, s, t, "LCP: ConfigReq (%d bytes)...\n", l);
544 if (config->debug > 3) dumplcp(p, l);
545
546 while (x > 2)
547 {
548 int type = o[0];
549 int length = o[1];
550
551 if (length == 0 || type == 0 || x < length) break;
552 switch (type)
553 {
554 case 1: // Maximum-Receive-Unit
555 session[s].mru = ntohs(*(uint16_t *)(o + 2));
556 break;
557
558 case 2: // Async-Control-Character-Map
559 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
560 break;
561
562 LOG(2, s, t, " Remote requesting asyncmap. Rejecting.\n");
563 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
564 break;
565
566 case 3: // Authentication-Protocol
567 {
568 int proto = ntohs(*(uint16_t *)(o + 2));
569 char proto_name[] = "0x0000";
570 int alen;
571
572 if (proto == PPPPAP)
573 {
574 if (config->radius_authtypes & AUTHPAP)
575 {
576 sess_local[s].lcp_authtype = AUTHPAP;
577 break;
578 }
579
580 strcpy(proto_name, "PAP");
581 }
582 else if (proto == PPPCHAP)
583 {
584 if (config->radius_authtypes & AUTHCHAP
585 && *(o + 4) == 5) // MD5
586 {
587 sess_local[s].lcp_authtype = AUTHCHAP;
588 break;
589 }
590
591 strcpy(proto_name, "CHAP");
592 }
593 else
594 sprintf(proto_name, "%#4.4x", proto);
595
596 LOG(2, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
597
598 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
599 if (alen < 2) break; // paranoia
600
601 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
602 if (q && *response == ConfigNak &&
603 config->radius_authtypes != config->radius_authprefer)
604 {
605 // alternate type
606 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
607 if (alen < 2) break;
608 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
609 }
610
611 break;
612 }
613 break;
614
615 case 5: // Magic-Number
616 magicno = ntohl(*(uint32_t *)(o + 2));
617 break;
618
619 case 4: // Quality-Protocol
620 case 7: // Protocol-Field-Compression
621 case 8: // Address-And-Control-Field-Compression
622 break;
623
624 default: // Reject any unknown options
625 LOG(2, s, t, " Rejecting PPP LCP Option type %d\n", type);
626 q = ppp_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
627 }
628 x -= length;
629 o += length;
630 }
631
632 if (response)
633 {
634 l = q - response; // LCP packet length
635 *((uint16_t *) (response + 2)) = htons(l); // update header
636 }
637 else
638 {
639 // Send packet back as ConfigAck
640 response = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
641 if (!response) return;
642 *response = ConfigAck;
643 }
644
645 switch (session[s].ppp.lcp)
646 {
647 case Closed:
648 response = makeppp(b, sizeof(b), p, 2, t, s, PPPLCP);
649 if (!response) return;
650 *response = TerminateAck;
651 *((uint16_t *) (response + 2)) = htons(l = 4);
652 break;
653
654 case Stopped:
655 initialise_restart_count(s, lcp);
656 sendlcp(s, t, sess_local[s].lcp_authtype);
657 if (*response == ConfigAck)
658 change_state(s, lcp, AckSent);
659 else
660 change_state(s, lcp, RequestSent);
661
662 break;
663
664 case RequestSent:
665 if (*response == ConfigAck)
666 change_state(s, lcp, AckSent);
667
668 break;
669
670 case AckReceived:
671 if (*response == ConfigAck)
672 lcp_open(t, s);
673
674 break;
675
676 case Opened:
677 lcp_restart(s);
678 sendlcp(s, t, sess_local[s].lcp_authtype);
679 /* fallthrough */
680
681 case AckSent:
682 if (*response == ConfigAck)
683 change_state(s, lcp, AckSent);
684 else
685 change_state(s, lcp, RequestSent);
686
687 break;
688
689 default:
690 LOG(3, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
691 return;
692 }
693
694 LOG(3, s, t, "LCP: Sending %s\n", ppp_code(*response));
695 tunnelsend(b, l + (response - b), t);
696 }
697 else if (*p == ConfigNak)
698 {
699 int x = l - 4;
700 uint8_t *o = (p + 4);
701 int authtype = -1;
702
703 LOG(3, s, t, "LCP: ConfigNak (%d bytes)...\n", l);
704 if (config->debug > 3) dumplcp(p, l);
705
706 while (x > 2)
707 {
708 int type = o[0];
709 int length = o[1];
710
711 if (length == 0 || type == 0 || x < length) break;
712 switch (type)
713 {
714 case 1: // Maximum-Receive-Unit
715 session[s].mru = ntohs(*(uint16_t *)(o + 2));
716 LOG(3, s, t, " Remote requested MRU of %u\n", session[s].mru);
717 break;
718
719 case 3: // Authentication-Protocol
720 if (authtype > 0)
721 break;
722
723 {
724 int proto = ntohs(*(uint16_t *)(o + 2));
725 if (proto == PPPPAP)
726 {
727 authtype = config->radius_authtypes & AUTHPAP;
728 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
729 authtype ? "accept" : "reject");
730 }
731 else if (proto == PPPCHAP && *(o + 4) == 5)
732 {
733 authtype = config->radius_authtypes & AUTHCHAP;
734 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
735 authtype ? "accept" : "reject");
736 }
737 else
738 {
739 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
740 proto);
741 }
742 }
743
744 break;
745
746 default:
747 LOG(2, s, t, " Remote NAKed LCP type %u?\n", type);
748 break;
749 }
750 x -= length;
751 o += length;
752 }
753
754 if (!authtype)
755 {
756 sessionshutdown(s, "Unsupported authentication.", 3, 0);
757 return;
758 }
759
760 if (authtype > 0)
761 sess_local[s].lcp_authtype = authtype;
762
763 switch (session[s].ppp.lcp)
764 {
765 case Closed:
766 case Stopped:
767 {
768 uint8_t *response = makeppp(b, sizeof(b), p, 2, t, s, PPPLCP);
769 if (!response) return;
770 *response = TerminateAck;
771 *((uint16_t *) (response + 2)) = htons(l = 4);
772 tunnelsend(b, l + (response - b), t);
773 }
774 break;
775
776 case RequestSent:
777 case AckSent:
778 initialise_restart_count(s, lcp);
779 sendlcp(s, t, sess_local[s].lcp_authtype);
780 break;
781
782 case AckReceived:
783 LOG(3, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
784 sendlcp(s, t, sess_local[s].lcp_authtype);
785 break;
786
787 case Opened:
788 lcp_restart(s);
789 sendlcp(s, t, sess_local[s].lcp_authtype);
790 break;
791
792 default:
793 LOG(3, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
794 return;
795 }
796 }
797 else if (*p == TerminateReq)
798 {
799 LOG(3, s, t, "LCP: Received TerminateReq. Sending TerminateAck\n");
800 *p = TerminateAck; // close
801 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
802 if (!q) return;
803 tunnelsend(b, l + (q - b), t); // send it
804 sessionshutdown(s, "Remote end closed connection.", 3, 0);
805 }
806 else if (*p == TerminateAck)
807 {
808 sessionshutdown(s, "Connection closed.", 3, 0);
809 }
810 else if (*p == ProtocolRej)
811 {
812 if (*(uint16_t *) (p+4) == htons(PPPIPV6CP))
813 {
814 LOG(3, s, t, "IPv6 rejected\n");
815 change_state(s, ipv6cp, Closed);
816 }
817 else
818 {
819 LOG(1, s, t, "Unexpected LCP protocol reject 0x%X\n",
820 ntohs(*(uint16_t *) (p+4)));
821 STAT(tunnel_rx_errors);
822 }
823 }
824 else if (*p == EchoReq)
825 {
826 LOG(5, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
827 *p = EchoReply; // reply
828 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
829 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
830 if (!q) return;
831 tunnelsend(b, l + (q - b), t); // send it
832 }
833 else if (*p == EchoReply)
834 {
835 // Ignore it, last_packet time is set earlier than this.
836 }
837 else
838 {
839 int code = *p;
840 int mru = session[s].mru;
841 if (!mru)
842 mru = DEFAULT_MRU;
843
844 if (l > mru) l = mru;
845
846 *p = CodeRej;
847 q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
848 if (!q) return;
849
850 LOG(3, s, t, "Unexpected LCP code %s\n", ppp_code(code));
851 tunnelsend(b, l + (q - b), t);
852 }
853 }
854
855 static void ipcp_open(tunnelidt t, sessionidt s)
856 {
857 LOG(3, s, t, "IPCP Acked, session is now active\n");
858
859 change_state(s, ipcp, Opened);
860
861 if (!session[s].walled_garden)
862 {
863 uint16_t r = radiusnew(s);
864 if (r)
865 radiussend(r, RADIUSSTART); // send radius start
866 }
867
868 // start IPv6 if configured and still in passive state
869 if (session[s].ppp.ipv6cp == Stopped)
870 {
871 sendipv6cp(t, s);
872 change_state(s, ipv6cp, RequestSent);
873 }
874 }
875
876 // Process IPCP messages
877 void processipcp(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
878 {
879 uint8_t b[MAXCONTROL];
880 uint8_t *q = 0;
881 uint16_t hl;
882
883 CSTAT(processipcp);
884
885 LOG_HEX(5, "IPCP", p, l);
886 if (l < 5)
887 {
888 LOG(1, s, t, "Short IPCP %d bytes\n", l);
889 STAT(tunnel_rx_errors);
890 return ;
891 }
892
893 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
894 {
895 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
896 STAT(tunnel_rx_errors);
897 return ;
898 }
899 l = hl;
900
901 if (session[s].ppp.phase < Network)
902 {
903 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
904 return;
905 }
906
907 if (*p == ConfigAck)
908 {
909 switch (session[s].ppp.ipcp)
910 {
911 case RequestSent:
912 initialise_restart_count(s, ipcp);
913 change_state(s, ipcp, AckReceived);
914 break;
915
916 case AckReceived:
917 case Opened:
918 LOG(3, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
919 sendipcp(s, t);
920 change_state(s, ipcp, RequestSent);
921 break;
922
923 case AckSent:
924 ipcp_open(t, s);
925 break;
926
927 default:
928 LOG(3, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
929 }
930 }
931 else if (*p == ConfigReq)
932 {
933 uint8_t *response = 0;
934 uint8_t *o = p + 4;
935 int length = l - 4;
936 int gotip = 0;
937 in_addr_t addr;
938
939 LOG(4, s, t, "IPCP ConfigReq received\n");
940
941 while (length > 2)
942 {
943 switch (*o)
944 {
945 case 3: // ip address
946 gotip++; // seen address
947 if (o[1] != 6 || o[1] > length) return;
948
949 addr = htonl(session[s].ip);
950 if (memcmp(o + 2, &addr, (sizeof addr)))
951 {
952 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
953 if (!q || *response == ConfigRej)
954 {
955 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
956 return;
957 }
958 }
959
960 break;
961
962 case 129: // primary DNS
963 if (o[1] != 6 || o[1] > length) return;
964
965 addr = htonl(session[s].dns1);
966 if (memcmp(o + 2, &addr, (sizeof addr)))
967 {
968 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
969 if (!q) return;
970 }
971
972 break;
973
974 case 131: // secondary DNS
975 if (o[1] != 6 || o[1] > length) return;
976
977 addr = htonl(session[s].dns1);
978 if (memcmp(o + 2, &addr, sizeof(addr)))
979 {
980 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
981 if (!q) return;
982 }
983
984 break;
985
986 default:
987 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
988 q = ppp_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
989 if (!q) return;
990 }
991
992 length -= o[1];
993 o += o[1];
994 }
995
996 if (response)
997 {
998 l = q - response; // IPCP packet length
999 *((uint16_t *) (response + 2)) = htons(l); // update header
1000 }
1001 else if (gotip)
1002 {
1003 // Send packet back as ConfigAck
1004 response = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP);
1005 if (!response) return;
1006 *response = ConfigAck;
1007 }
1008 else
1009 {
1010 LOG(1, s, t, "No IP in IPCP request\n");
1011 STAT(tunnel_rx_errors);
1012 return;
1013 }
1014
1015 switch (session[s].ppp.ipcp)
1016 {
1017 case Closed:
1018 response = makeppp(b, sizeof(b), p, 2, t, s, PPPIPCP);
1019 if (!response) return;
1020 *response = TerminateAck;
1021 *((uint16_t *) (response + 2)) = htons(l = 4);
1022 break;
1023
1024 case Stopped:
1025 initialise_restart_count(s, ipcp);
1026 sendipcp(s, t);
1027 if (*response == ConfigAck)
1028 change_state(s, ipcp, AckSent);
1029 else
1030 change_state(s, ipcp, RequestSent);
1031
1032 break;
1033
1034 case RequestSent:
1035 if (*response == ConfigAck)
1036 change_state(s, ipcp, AckSent);
1037
1038 break;
1039
1040 case AckReceived:
1041 if (*response == ConfigAck)
1042 ipcp_open(t, s);
1043
1044 break;
1045
1046 case Opened:
1047 initialise_restart_count(s, ipcp);
1048 sendipcp(s, t);
1049 /* fallthrough */
1050
1051 case AckSent:
1052 if (*response == ConfigAck)
1053 change_state(s, ipcp, AckSent);
1054 else
1055 change_state(s, ipcp, RequestSent);
1056
1057 break;
1058
1059 default:
1060 LOG(3, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1061 return;
1062 }
1063
1064 LOG(3, s, t, "IPCP: Sending %s\n", ppp_code(*response));
1065 tunnelsend(b, l + (response - b), t);
1066 }
1067 else if (*p == TerminateReq)
1068 {
1069 LOG(3, s, t, "IPCP: Received TerminateReq. Sending TerminateAck\n");
1070 *p = TerminateAck;
1071 q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP);
1072 if (!q) return;
1073 tunnelsend(b, l + (q - b), t);
1074 change_state(s, ipcp, Stopped);
1075 }
1076 else
1077 {
1078 int code = *p;
1079 int mru = session[s].mru;
1080 if (!mru)
1081 mru = DEFAULT_MRU;
1082
1083 if (l > mru) l = mru;
1084
1085 *p = CodeRej;
1086 q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP);
1087 if (!q) return;
1088
1089 LOG(3, s, t, "Unexpected IPCP code %s\n", ppp_code(code));
1090 tunnelsend(b, l + (q - b), t);
1091 }
1092 }
1093
1094 static void ipv6cp_open(tunnelidt t, sessionidt s)
1095 {
1096 LOG(3, s, t, "IPV6CP Acked\n");
1097
1098 change_state(s, ipv6cp, Opened);
1099 if (session[s].ipv6prefixlen)
1100 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1101
1102 // Send an initial RA (TODO: Should we send these regularly?)
1103 send_ipv6_ra(t, s, NULL);
1104 }
1105
1106 // Process IPV6CP messages
1107 void processipv6cp(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
1108 {
1109 uint8_t b[MAXCONTROL];
1110 uint8_t *q = 0;
1111 uint16_t hl;
1112
1113 CSTAT(processipv6cp);
1114
1115 LOG_HEX(5, "IPV6CP", p, l);
1116 if (l < 4)
1117 {
1118 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1119 STAT(tunnel_rx_errors);
1120 return ;
1121 }
1122
1123 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1124 {
1125 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1126 STAT(tunnel_rx_errors);
1127 return ;
1128 }
1129 l = hl;
1130
1131 if (session[s].ppp.phase < Network)
1132 {
1133 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1134 return;
1135 }
1136
1137 if (!config->ipv6_prefix.s6_addr[0])
1138 {
1139 LOG(2, s, t, "IPV6CP %s rejected (not configured)\n", ppp_code(*p));
1140 *p = ProtocolRej;
1141 q = makeppp(b, sizeof(b), p, l, t, s, PPPIPV6CP);
1142 if (!q) return;
1143 tunnelsend(b, l + (q - b), t);
1144 return;
1145 }
1146
1147 if (!session[s].ip)
1148 {
1149 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1150 return; // need IPCP to complete...
1151 }
1152
1153 if (*p == ConfigAck)
1154 {
1155 switch (session[s].ppp.ipv6cp)
1156 {
1157 case RequestSent:
1158 initialise_restart_count(s, ipv6cp);
1159 change_state(s, ipv6cp, AckReceived);
1160 break;
1161
1162 case AckReceived:
1163 case Opened:
1164 LOG(3, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1165 sendipv6cp(s, t);
1166 change_state(s, ipv6cp, RequestSent);
1167 break;
1168
1169 case AckSent:
1170 ipv6cp_open(t, s);
1171 break;
1172
1173 default:
1174 LOG(3, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1175 }
1176 }
1177 else if (*p == ConfigReq)
1178 {
1179 uint8_t *response = 0;
1180 uint8_t *o = p + 4;
1181 int length = l - 4;
1182 int gotip = 0;
1183 uint8_t ident[8];
1184
1185 LOG(4, s, t, "IPV6CP ConfigReq received\n");
1186
1187 while (length > 2)
1188 {
1189 switch (*o)
1190 {
1191 case 1: // interface identifier
1192 gotip++; // seen address
1193 if (o[1] != 10 || o[1] > length) return;
1194
1195 *(uint32_t *) ident = htonl(session[s].ip);
1196 *(uint32_t *) (ident + 4) = 0;
1197
1198 if (memcmp(o + 2, ident, sizeof(ident)))
1199 {
1200 q = ppp_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1201 if (!q) return;
1202 }
1203
1204 break;
1205
1206 default:
1207 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1208 q = ppp_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1209 if (!q) return;
1210 }
1211
1212 length -= o[1];
1213 o += o[1];
1214 }
1215
1216 if (response)
1217 {
1218 l = q - response; // IPV6CP packet length
1219 *((uint16_t *) (response + 2)) = htons(l); // update header
1220 }
1221 else if (gotip)
1222 {
1223 // Send packet back as ConfigAck
1224 response = makeppp(b, sizeof(b), p, l, t, s, PPPIPV6CP);
1225 if (!response) return;
1226 *response = ConfigAck;
1227 }
1228 else
1229 {
1230 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1231 STAT(tunnel_rx_errors);
1232 return;
1233 }
1234
1235 switch (session[s].ppp.ipv6cp)
1236 {
1237 case Closed:
1238 response = makeppp(b, sizeof(b), p, 2, t, s, PPPIPV6CP);
1239 if (!response) return;
1240 *response = TerminateAck;
1241 *((uint16_t *) (response + 2)) = htons(l = 4);
1242 break;
1243
1244 case Stopped:
1245 initialise_restart_count(s, ipv6cp);
1246 sendipv6cp(s, t);
1247 if (*response == ConfigAck)
1248 change_state(s, ipv6cp, AckSent);
1249 else
1250 change_state(s, ipv6cp, RequestSent);
1251
1252 break;
1253
1254 case RequestSent:
1255 if (*response == ConfigAck)
1256 change_state(s, ipv6cp, AckSent);
1257
1258 break;
1259
1260 case AckReceived:
1261 if (*response == ConfigAck)
1262 ipv6cp_open(t, s);
1263
1264 break;
1265
1266 case Opened:
1267 initialise_restart_count(s, ipv6cp);
1268 sendipv6cp(s, t);
1269 /* fallthrough */
1270
1271 case AckSent:
1272 if (*response == ConfigAck)
1273 change_state(s, ipv6cp, AckSent);
1274 else
1275 change_state(s, ipv6cp, RequestSent);
1276
1277 break;
1278
1279 default:
1280 LOG(3, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1281 return;
1282 }
1283
1284 LOG(3, s, t, "IPV6CP: Sending %s\n", ppp_code(*response));
1285 tunnelsend(b, l + (response - b), t);
1286 }
1287 else if (*p == TerminateReq)
1288 {
1289 LOG(3, s, t, "IPV6CP: Received TerminateReq. Sending TerminateAck\n");
1290 *p = TerminateAck;
1291 q = makeppp(b, sizeof(b), p, l, t, s, PPPIPV6CP);
1292 if (!q) return;
1293 tunnelsend(b, l + (q - b), t);
1294 change_state(s, ipv6cp, Stopped);
1295 }
1296 else
1297 {
1298 int code = *p;
1299 int mru = session[s].mru;
1300 if (!mru)
1301 mru = DEFAULT_MRU;
1302
1303 if (l > mru) l = mru;
1304
1305 *p = CodeRej;
1306 q = makeppp(b, sizeof(b), p, l, t, s, PPPIPV6CP);
1307 if (!q) return;
1308
1309 LOG(3, s, t, "Unexpected IPV6CP code %s\n", ppp_code(code));
1310 tunnelsend(b, l + (q - b), t);
1311 }
1312 }
1313
1314 // process IP packet received
1315 //
1316 // This MUST be called with at least 4 byte behind 'p'.
1317 // (i.e. this routine writes to p[-4]).
1318 void processipin(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
1319 {
1320 in_addr_t ip;
1321
1322 CSTAT(processipin);
1323
1324 LOG_HEX(5, "IP", p, l);
1325
1326 ip = ntohl(*(uint32_t *)(p + 12));
1327
1328 if (l > MAXETHER)
1329 {
1330 LOG(1, s, t, "IP packet too long %d\n", l);
1331 STAT(tunnel_rx_errors);
1332 return ;
1333 }
1334
1335 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1336 return;
1337
1338 // no spoof (do sessionbyip to handled statically routed subnets)
1339 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1340 {
1341 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1342 return;
1343 }
1344
1345 // run access-list if any
1346 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1347 return;
1348
1349 // Add on the tun header
1350 p -= 4;
1351 *(uint32_t *) p = htonl(PKTIP);
1352 l += 4;
1353
1354 // Are we throttled and a slave?
1355 if (session[s].tbf_in && !config->cluster_iam_master) {
1356 // Pass it to the master for handling.
1357 master_throttle_packet(session[s].tbf_in, p, l);
1358 return;
1359 }
1360
1361 // Are we throttled and a master??
1362 if (session[s].tbf_in && config->cluster_iam_master) {
1363 // Actually handle the throttled packets.
1364 tbf_queue_packet(session[s].tbf_in, p, l);
1365 return;
1366 }
1367
1368 // send to ethernet
1369 if (tun_write(p, l) < 0)
1370 {
1371 STAT(tun_tx_errors);
1372 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1373 l, strerror(errno), tunfd, p);
1374
1375 return;
1376 }
1377
1378 p += 4;
1379 l -= 4;
1380
1381 if (session[s].snoop_ip && session[s].snoop_port)
1382 {
1383 // Snooping this session
1384 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1385 }
1386
1387 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1388 session[s].cin_delta += l;
1389 session[s].pin++;
1390
1391 sess_local[s].cin += l;
1392 sess_local[s].pin++;
1393
1394 eth_tx += l;
1395
1396 STAT(tun_tx_packets);
1397 INC_STAT(tun_tx_bytes, l);
1398 }
1399
1400 // process IPv6 packet received
1401 //
1402 // This MUST be called with at least 4 byte behind 'p'.
1403 // (i.e. this routine writes to p[-4]).
1404 void processipv6in(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
1405 {
1406 struct in6_addr ip;
1407 in_addr_t ipv4;
1408
1409 CSTAT(processipv6in);
1410
1411 LOG_HEX(5, "IPv6", p, l);
1412
1413 ip = *(struct in6_addr *) (p + 8);
1414 ipv4 = ntohl(*(uint32_t *)(p + 16));
1415
1416 if (l > MAXETHER)
1417 {
1418 LOG(1, s, t, "IP packet too long %d\n", l);
1419 STAT(tunnel_rx_errors);
1420 return ;
1421 }
1422
1423 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1424 return;
1425
1426 // no spoof
1427 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1428 {
1429 char str[INET6_ADDRSTRLEN];
1430 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1431 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1432 return;
1433 }
1434
1435 // Check if it's a Router Solicition message.
1436 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1437 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1438 *(uint32_t *)(p + 34) == 0 &&
1439 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1440 LOG(3, s, t, "Got IPv6 RS\n");
1441 send_ipv6_ra(t, s, &ip);
1442 return;
1443 }
1444
1445 // Add on the tun header
1446 p -= 4;
1447 *(uint32_t *) p = htonl(PKTIPV6);
1448 l += 4;
1449
1450 // Are we throttled and a slave?
1451 if (session[s].tbf_in && !config->cluster_iam_master) {
1452 // Pass it to the master for handling.
1453 master_throttle_packet(session[s].tbf_in, p, l);
1454 return;
1455 }
1456
1457 // Are we throttled and a master??
1458 if (session[s].tbf_in && config->cluster_iam_master) {
1459 // Actually handle the throttled packets.
1460 tbf_queue_packet(session[s].tbf_in, p, l);
1461 return;
1462 }
1463
1464 // send to ethernet
1465 if (tun_write(p, l) < 0)
1466 {
1467 STAT(tun_tx_errors);
1468 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1469 l, strerror(errno), tunfd, p);
1470
1471 return;
1472 }
1473
1474 p += 4;
1475 l -= 4;
1476
1477 if (session[s].snoop_ip && session[s].snoop_port)
1478 {
1479 // Snooping this session
1480 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1481 }
1482
1483 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1484 session[s].cin_delta += l;
1485 session[s].pin++;
1486
1487 sess_local[s].cin += l;
1488 sess_local[s].pin++;
1489
1490 eth_tx += l;
1491
1492 STAT(tun_tx_packets);
1493 INC_STAT(tun_tx_bytes, l);
1494 }
1495
1496 //
1497 // Helper routine for the TBF filters.
1498 // Used to send queued data in from the user.
1499 //
1500 void send_ipin(sessionidt s, uint8_t *buf, int len)
1501 {
1502 LOG_HEX(5, "IP in throttled", buf, len);
1503
1504 if (write(tunfd, buf, len) < 0)
1505 {
1506 STAT(tun_tx_errors);
1507 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1508 len, strerror(errno), tunfd, buf);
1509
1510 return;
1511 }
1512
1513 buf += 4;
1514 len -= 4;
1515
1516 if (session[s].snoop_ip && session[s].snoop_port)
1517 {
1518 // Snooping this session
1519 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1520 }
1521
1522 // Increment packet counters
1523 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1524 session[s].cin_delta += len;
1525 session[s].pin++;
1526
1527 sess_local[s].cin += len;
1528 sess_local[s].pin++;
1529
1530 eth_tx += len;
1531
1532 STAT(tun_tx_packets);
1533 INC_STAT(tun_tx_bytes, len - 4);
1534 }
1535
1536
1537 // Process CCP messages
1538 void processccp(tunnelidt t, sessionidt s, uint8_t *p, uint16_t l)
1539 {
1540 uint8_t b[MAXCONTROL];
1541 uint8_t *q;
1542
1543 CSTAT(processccp);
1544
1545 LOG_HEX(5, "CCP", p, l);
1546
1547 if (session[s].ppp.phase < Network)
1548 {
1549 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1550 return;
1551 }
1552
1553 if (l < 1)
1554 {
1555 LOG(1, s, t, "Short CCP packet\n");
1556 STAT(tunnel_rx_errors);
1557 }
1558
1559 if (*p == ConfigAck)
1560 {
1561 switch (session[s].ppp.ccp)
1562 {
1563 case RequestSent:
1564 initialise_restart_count(s, ccp);
1565 change_state(s, ccp, AckReceived);
1566 break;
1567
1568 case AckReceived:
1569 case Opened:
1570 LOG(3, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1571 sendccp(s, t);
1572 change_state(s, ccp, RequestSent);
1573 break;
1574
1575 case AckSent:
1576 LOG(3, s, t, "CCP Acked\n");
1577 change_state(s, ccp, Opened);
1578 break;
1579
1580 default:
1581 LOG(3, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1582 }
1583 }
1584 else if (*p == ConfigReq)
1585 {
1586 if (l < 6) // accept no compression
1587 *p = ConfigAck;
1588 else // compression requested--reject
1589 *p = ConfigRej;
1590
1591 q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP);
1592 if (!q) return;
1593
1594 switch (session[s].ppp.ccp)
1595 {
1596 case Closed:
1597 q = makeppp(b, sizeof(b), p, 2, t, s, PPPCCP);
1598 if (!q) return;
1599 *q = TerminateAck;
1600 *((uint16_t *) (q + 2)) = htons(l = 4);
1601 break;
1602
1603 case Stopped:
1604 initialise_restart_count(s, ccp);
1605 sendccp(s, t);
1606 if (*q == ConfigAck)
1607 change_state(s, ccp, AckSent);
1608 else
1609 change_state(s, ccp, RequestSent);
1610
1611 break;
1612
1613 case RequestSent:
1614 if (*q == ConfigAck)
1615 change_state(s, ccp, AckSent);
1616
1617 break;
1618
1619 case AckReceived:
1620 if (*q == ConfigAck)
1621 change_state(s, ccp, Opened);
1622
1623 break;
1624
1625 case Opened:
1626 initialise_restart_count(s, ccp);
1627 sendccp(s, t);
1628 /* fallthrough */
1629
1630 case AckSent:
1631 if (*q == ConfigAck)
1632 change_state(s, ccp, AckSent);
1633 else
1634 change_state(s, ccp, RequestSent);
1635
1636 break;
1637
1638 default:
1639 LOG(3, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1640 return;
1641 }
1642
1643 LOG(3, s, t, "CCP: Sending %s\n", ppp_code(*q));
1644 tunnelsend(b, l + (q - b), t);
1645 }
1646 else if (*p == TerminateReq)
1647 {
1648 LOG(3, s, t, "CCP: Received TerminateReq. Sending TerminateAck\n");
1649 *p = TerminateAck;
1650 q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP);
1651 if (!q) return;
1652 tunnelsend(b, l + (q - b), t);
1653 change_state(s, ccp, Stopped);
1654 }
1655 else
1656 {
1657 int code = *p;
1658 int mru = session[s].mru;
1659 if (!mru)
1660 mru = DEFAULT_MRU;
1661
1662 if (l > mru) l = mru;
1663
1664 *p = CodeRej;
1665 q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP);
1666 if (!q) return;
1667
1668 LOG(3, s, t, "Unexpected CCP code %s\n", ppp_code(code));
1669 tunnelsend(b, l + (q - b), t);
1670 }
1671 }
1672
1673 // send a CHAP challenge
1674 void sendchap(tunnelidt t, sessionidt s)
1675 {
1676 uint8_t b[MAXCONTROL];
1677 uint16_t r = sess_local[s].radius;
1678 uint8_t *q;
1679
1680 CSTAT(sendchap);
1681
1682 if (!r)
1683 {
1684 LOG(1, s, t, "No RADIUS to send challenge\n");
1685 STAT(tunnel_tx_errors);
1686 return;
1687 }
1688
1689 LOG(1, s, t, "Send CHAP challenge\n");
1690
1691 radius[r].chap = 1; // CHAP not PAP
1692 radius[r].id++;
1693 if (radius[r].state != RADIUSCHAP)
1694 radius[r].try = 0;
1695
1696 radius[r].state = RADIUSCHAP;
1697 radius[r].retry = backoff(radius[r].try++);
1698 if (radius[r].try > 5)
1699 {
1700 sessionshutdown(s, "CHAP timeout.", 3, 0);
1701 STAT(tunnel_tx_errors);
1702 return ;
1703 }
1704 q = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP);
1705 if (!q) return;
1706
1707 *q = 1; // challenge
1708 q[1] = radius[r].id; // ID
1709 q[4] = 16; // value size (size of challenge)
1710 memcpy(q + 5, radius[r].auth, 16); // challenge
1711 strcpy((char *) q + 21, hostname); // our name
1712 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1713 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1714 }
1715
1716 // fill in a L2TP message with a PPP frame,
1717 // copies existing PPP message and changes magic number if seen
1718 // returns start of PPP frame
1719 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, tunnelidt t, sessionidt s, uint16_t mtype)
1720 {
1721 if (size < 12) // Need more space than this!!
1722 {
1723 static int backtrace_count = 0;
1724 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1725 log_backtrace(backtrace_count, 5)
1726 return NULL;
1727 }
1728
1729 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1730 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1731 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1732 b += 6;
1733 if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1734 {
1735 *(uint16_t *) b = htons(0xFF03); // HDLC header
1736 b += 2;
1737 }
1738 if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1739 *b++ = mtype;
1740 else
1741 {
1742 *(uint16_t *) b = htons(mtype);
1743 b += 2;
1744 }
1745
1746 if (l + 12 > size)
1747 {
1748 static int backtrace_count = 0;
1749 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1750 log_backtrace(backtrace_count, 5)
1751 return NULL;
1752 }
1753
1754 if (p && l)
1755 memcpy(b, p, l);
1756
1757 return b;
1758 }
1759
1760 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1761 {
1762 int len = 0;
1763 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1764 return 0;
1765
1766 *b++ = 3; // Authentication-Protocol
1767 if (authtype == AUTHCHAP)
1768 {
1769 len = *b++ = 5; // length
1770 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1771 *b++ = 5; // MD5
1772 }
1773 else if (authtype == AUTHPAP)
1774 {
1775 len = *b++ = 4; // length
1776 *(uint16_t *) b = htons(PPPPAP); b += 2;
1777 }
1778 else
1779 {
1780 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1781 }
1782
1783 return len;
1784 }
1785
1786 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1787 void sendlcp(tunnelidt t, sessionidt s, int authtype)
1788 {
1789 uint8_t b[500], *q, *l;
1790
1791 if (!(q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP)))
1792 return;
1793
1794 LOG(4, s, t, "Sending LCP ConfigReq%s%s\n",
1795 authtype ? " for " : "",
1796 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "");
1797
1798 if (!session[s].mru)
1799 session[s].mru = DEFAULT_MRU;
1800
1801 l = q;
1802 *l++ = ConfigReq;
1803 *l++ = (time_now % 255) + 1; // ID
1804
1805 l += 2; //Save space for length
1806
1807 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1808 *(uint16_t *) l = htons(session[s].mru); l += 2;
1809
1810 if (authtype)
1811 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1812
1813 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1814 *(uint32_t *) l = htonl(session[s].magic);
1815 l += 4;
1816
1817 *(uint16_t *)(q + 2) = htons(l - q); // Length
1818
1819 LOG_HEX(5, "PPPLCP", q, l - q);
1820 tunnelsend(b, (l - b), t);
1821 }
1822
1823 // Send CCP request for no compression
1824 void sendccp(tunnelidt t, sessionidt s)
1825 {
1826 uint8_t b[500], *q;
1827
1828 if (!(q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPCCP)))
1829 return;
1830
1831 LOG(4, s, t, "Sending CCP ConfigReq for no compression\n");
1832 *q = ConfigReq;
1833 *(uint8_t *)(q + 1) = (time_now % 255) + 1; // ID
1834 *(uint16_t *)(q + 2) = htons(4); // Length
1835
1836 LOG_HEX(5, "PPPCCP", q, 4);
1837 tunnelsend(b, (q - b) + 4 , t);
1838 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"