projects / l2tpns.git / blob
? search:


abd5609c0bc8b2312e035217210d131194164fcc
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.77 2005-08-29 06:17:53 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXCONTROL];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(uint8_t *)(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 // Process LCP messages
448 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
449 {
450 uint8_t b[MAXCONTROL];
451 uint8_t *q = NULL;
452 uint32_t magicno = 0;
453 uint16_t hl;
454
455 CSTAT(processlcp);
456
457 LOG_HEX(5, "LCP", p, l);
458 if (l < 4)
459 {
460 LOG(1, s, t, "Short LCP %d bytes\n", l);
461 STAT(tunnel_rx_errors);
462 return ;
463 }
464
465 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
466 {
467 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
468 STAT(tunnel_rx_errors);
469 return ;
470 }
471 l = hl;
472
473 if (session[s].die) // going down...
474 return;
475
476 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
477 if (config->debug > 3) dumplcp(p, l);
478
479 if (*p == ConfigAck)
480 {
481 int x = l - 4;
482 uint8_t *o = (p + 4);
483 int authtype = 0;
484
485 while (x > 2)
486 {
487 int type = o[0];
488 int length = o[1];
489
490 if (length == 0 || type == 0 || x < length) break;
491 switch (type)
492 {
493 case 3: // Authentication-Protocol
494 {
495 int proto = ntohs(*(uint16_t *)(o + 2));
496 if (proto == PPPPAP)
497 authtype = AUTHPAP;
498 else if (proto == PPPCHAP && *(o + 4) == 5)
499 authtype = AUTHCHAP;
500 }
501
502 break;
503 }
504 x -= length;
505 o += length;
506 }
507
508 if (!session[s].ip && authtype)
509 sess_local[s].lcp_authtype = authtype;
510
511 switch (session[s].ppp.lcp)
512 {
513 case RequestSent:
514 initialise_restart_count(s, lcp);
515 change_state(s, lcp, AckReceived);
516 break;
517
518 case AckReceived:
519 case Opened:
520 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
521 if (session[s].ppp.lcp == Opened)
522 lcp_restart(s);
523
524 sendlcp(s, t);
525 change_state(s, lcp, RequestSent);
526 break;
527
528 case AckSent:
529 lcp_open(s, t);
530 break;
531
532 default:
533 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
534 }
535 }
536 else if (*p == ConfigReq)
537 {
538 int x = l - 4;
539 uint8_t *o = (p + 4);
540 uint8_t *response = 0;
541 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
542 static uint8_t authproto[5];
543
544 while (x > 2)
545 {
546 int type = o[0];
547 int length = o[1];
548
549 if (length == 0 || type == 0 || x < length) break;
550 switch (type)
551 {
552 case 1: // Maximum-Receive-Unit
553 session[s].mru = ntohs(*(uint16_t *)(o + 2));
554 break;
555
556 case 2: // Async-Control-Character-Map
557 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
558 break;
559
560 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
561 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
562 break;
563
564 case 3: // Authentication-Protocol
565 {
566 int proto = ntohs(*(uint16_t *)(o + 2));
567 char proto_name[] = "0x0000";
568 int alen;
569
570 if (proto == PPPPAP)
571 {
572 if (config->radius_authtypes & AUTHPAP)
573 {
574 sess_local[s].lcp_authtype = AUTHPAP;
575 break;
576 }
577
578 strcpy(proto_name, "PAP");
579 }
580 else if (proto == PPPCHAP)
581 {
582 if (config->radius_authtypes & AUTHCHAP
583 && *(o + 4) == 5) // MD5
584 {
585 sess_local[s].lcp_authtype = AUTHCHAP;
586 break;
587 }
588
589 strcpy(proto_name, "CHAP");
590 }
591 else
592 sprintf(proto_name, "%#4.4x", proto);
593
594 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
595
596 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
597 if (alen < 2) break; // paranoia
598
599 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
600 if (q && *response == ConfigNak &&
601 config->radius_authtypes != config->radius_authprefer)
602 {
603 // alternate type
604 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
605 if (alen < 2) break;
606 q = ppp_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
607 }
608
609 break;
610 }
611 break;
612
613 case 5: // Magic-Number
614 magicno = ntohl(*(uint32_t *)(o + 2));
615 break;
616
617 case 4: // Quality-Protocol
618 case 7: // Protocol-Field-Compression
619 case 8: // Address-And-Control-Field-Compression
620 break;
621
622 default: // Reject any unknown options
623 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
624 q = ppp_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
625 }
626 x -= length;
627 o += length;
628 }
629
630 if (response)
631 {
632 l = q - response; // LCP packet length
633 *((uint16_t *) (response + 2)) = htons(l); // update header
634 }
635 else
636 {
637 // Send packet back as ConfigAck
638 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
639 if (!response) return;
640 *response = ConfigAck;
641 }
642
643 switch (session[s].ppp.lcp)
644 {
645 case Closed:
646 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
647 if (!response) return;
648 *response = TerminateAck;
649 *((uint16_t *) (response + 2)) = htons(l = 4);
650 break;
651
652 case Stopped:
653 initialise_restart_count(s, lcp);
654 sendlcp(s, t);
655 if (*response == ConfigAck)
656 change_state(s, lcp, AckSent);
657 else
658 change_state(s, lcp, RequestSent);
659
660 break;
661
662 case RequestSent:
663 if (*response == ConfigAck)
664 change_state(s, lcp, AckSent);
665
666 break;
667
668 case AckReceived:
669 if (*response == ConfigAck)
670 lcp_open(s, t);
671
672 break;
673
674 case Opened:
675 lcp_restart(s);
676 sendlcp(s, t);
677 /* fallthrough */
678
679 case AckSent:
680 if (*response == ConfigAck)
681 change_state(s, lcp, AckSent);
682 else
683 change_state(s, lcp, RequestSent);
684
685 break;
686
687 default:
688 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
689 return;
690 }
691
692 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
693 if (config->debug > 3) dumplcp(response, l);
694
695 tunnelsend(b, l + (response - b), t);
696 }
697 else if (*p == ConfigNak || *p == ConfigRej)
698 {
699 int x = l - 4;
700 uint8_t *o = (p + 4);
701 int authtype = -1;
702
703 while (x > 2)
704 {
705 int type = o[0];
706 int length = o[1];
707
708 if (length == 0 || type == 0 || x < length) break;
709 switch (type)
710 {
711 case 1: // Maximum-Receive-Unit
712 if (*p == ConfigNak)
713 {
714 session[s].mru = ntohs(*(uint16_t *)(o + 2));
715 LOG(3, s, t, " Remote requested MRU of %u\n", session[s].mru);
716 }
717 else
718 {
719 session[s].mru = 0;
720 LOG(3, s, t, " Remote rejected MRU negotiation\n");
721 }
722
723 break;
724
725 case 3: // Authentication-Protocol
726 if (authtype > 0)
727 break;
728
729 if (*p == ConfigNak)
730 {
731 int proto = ntohs(*(uint16_t *)(o + 2));
732 if (proto == PPPPAP)
733 {
734 authtype = config->radius_authtypes & AUTHPAP;
735 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
736 authtype ? "accept" : "reject");
737 }
738 else if (proto == PPPCHAP && *(o + 4) == 5)
739 {
740 authtype = config->radius_authtypes & AUTHCHAP;
741 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
742 authtype ? "accept" : "reject");
743 }
744 else
745 {
746 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
747 proto);
748 }
749 }
750 else
751 {
752 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
753 authtype = 0; // shutdown
754 }
755
756 break;
757
758 default:
759 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
760 break;
761 }
762 x -= length;
763 o += length;
764 }
765
766 if (!authtype)
767 {
768 sessionshutdown(s, "Unsupported authentication.", 3, 0);
769 return;
770 }
771
772 if (authtype > 0)
773 sess_local[s].lcp_authtype = authtype;
774
775 switch (session[s].ppp.lcp)
776 {
777 case Closed:
778 case Stopped:
779 {
780 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
781 if (!response) return;
782 *response = TerminateAck;
783 *((uint16_t *) (response + 2)) = htons(l = 4);
784
785 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
786 if (config->debug > 3) dumplcp(response, l);
787
788 tunnelsend(b, l + (response - b), t);
789 }
790 break;
791
792 case RequestSent:
793 case AckSent:
794 initialise_restart_count(s, lcp);
795 sendlcp(s, t);
796 break;
797
798 case AckReceived:
799 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
800 sendlcp(s, t);
801 break;
802
803 case Opened:
804 lcp_restart(s);
805 sendlcp(s, t);
806 break;
807
808 default:
809 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
810 return;
811 }
812 }
813 else if (*p == TerminateReq)
814 {
815 *p = TerminateAck; // close
816 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
817 if (!q) return;
818
819 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
820 if (config->debug > 3) dumplcp(q, l);
821
822 tunnelsend(b, l + (q - b), t); // send it
823 sessionshutdown(s, "Remote end closed connection.", 3, 0);
824 }
825 else if (*p == TerminateAck)
826 {
827 sessionshutdown(s, "Connection closed.", 3, 0);
828 }
829 else if (*p == ProtocolRej)
830 {
831 uint16_t proto = 0;
832
833 if (l > 4)
834 {
835 proto = *(p+4);
836 if (l > 5 && !(proto & 1))
837 {
838 proto <<= 8;
839 proto |= *(p+5);
840 }
841 }
842
843 if (proto == PPPIPV6CP)
844 {
845 LOG(3, s, t, "IPv6 rejected\n");
846 change_state(s, ipv6cp, Closed);
847 }
848 else
849 {
850 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
851 }
852 }
853 else if (*p == EchoReq)
854 {
855 *p = EchoReply; // reply
856 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
857 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
858 if (!q) return;
859
860 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
861 if (config->debug > 3) dumplcp(q, l);
862
863 tunnelsend(b, l + (q - b), t); // send it
864 }
865 else if (*p == EchoReply)
866 {
867 // Ignore it, last_packet time is set earlier than this.
868 }
869 else
870 {
871 int code = *p;
872 int mru = session[s].mru;
873 if (!mru)
874 mru = DEFAULT_MRU;
875
876 if (l > mru) l = mru;
877
878 *p = CodeRej;
879 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
880 if (!q) return;
881
882 LOG(2, s, t, "Unexpected LCP code %s\n", ppp_code(code));
883 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
884 if (config->debug > 3) dumplcp(q, l);
885
886 tunnelsend(b, l + (q - b), t);
887 }
888 }
889
890 static void ipcp_open(sessionidt s, tunnelidt t)
891 {
892 LOG(3, s, t, "IPCP: Opened, session is now active\n");
893
894 change_state(s, ipcp, Opened);
895
896 if (!session[s].walled_garden)
897 {
898 uint16_t r = radiusnew(s);
899 if (r)
900 radiussend(r, RADIUSSTART); // send radius start
901 }
902
903 // start IPv6 if configured and still in passive state
904 if (session[s].ppp.ipv6cp == Stopped)
905 {
906 sendipv6cp(s, t);
907 change_state(s, ipv6cp, RequestSent);
908 }
909 }
910
911 // Process IPCP messages
912 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
913 {
914 uint8_t b[MAXCONTROL];
915 uint8_t *q = 0;
916 uint16_t hl;
917
918 CSTAT(processipcp);
919
920 LOG_HEX(5, "IPCP", p, l);
921 if (l < 5)
922 {
923 LOG(1, s, t, "Short IPCP %d bytes\n", l);
924 STAT(tunnel_rx_errors);
925 return ;
926 }
927
928 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
929 {
930 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
931 STAT(tunnel_rx_errors);
932 return ;
933 }
934 l = hl;
935
936 if (session[s].ppp.phase < Network)
937 {
938 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
939 return;
940 }
941
942 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
943
944 if (*p == ConfigAck)
945 {
946 switch (session[s].ppp.ipcp)
947 {
948 case RequestSent:
949 initialise_restart_count(s, ipcp);
950 change_state(s, ipcp, AckReceived);
951 break;
952
953 case AckReceived:
954 case Opened:
955 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
956 sendipcp(s, t);
957 change_state(s, ipcp, RequestSent);
958 break;
959
960 case AckSent:
961 ipcp_open(s, t);
962 break;
963
964 default:
965 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
966 }
967 }
968 else if (*p == ConfigReq)
969 {
970 uint8_t *response = 0;
971 uint8_t *o = p + 4;
972 int length = l - 4;
973 int gotip = 0;
974 in_addr_t addr;
975
976 while (length > 2)
977 {
978 switch (*o)
979 {
980 case 3: // ip address
981 gotip++; // seen address
982 if (o[1] != 6 || o[1] > length) return;
983
984 addr = htonl(session[s].ip);
985 if (memcmp(o + 2, &addr, (sizeof addr)))
986 {
987 uint8_t *oq = q;
988 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
989 if (!q || (q != oq && *response == ConfigRej))
990 {
991 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
992 return;
993 }
994 }
995
996 break;
997
998 case 129: // primary DNS
999 if (o[1] != 6 || o[1] > length) return;
1000
1001 addr = htonl(session[s].dns1);
1002 if (memcmp(o + 2, &addr, (sizeof addr)))
1003 {
1004 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1005 if (!q) return;
1006 }
1007
1008 break;
1009
1010 case 131: // secondary DNS
1011 if (o[1] != 6 || o[1] > length) return;
1012
1013 addr = htonl(session[s].dns1);
1014 if (memcmp(o + 2, &addr, sizeof(addr)))
1015 {
1016 q = ppp_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1017 if (!q) return;
1018 }
1019
1020 break;
1021
1022 default:
1023 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1024 q = ppp_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1025 if (!q) return;
1026 }
1027
1028 length -= o[1];
1029 o += o[1];
1030 }
1031
1032 if (response)
1033 {
1034 l = q - response; // IPCP packet length
1035 *((uint16_t *) (response + 2)) = htons(l); // update header
1036 }
1037 else if (gotip)
1038 {
1039 // Send packet back as ConfigAck
1040 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1041 if (!response) return;
1042 *response = ConfigAck;
1043 }
1044 else
1045 {
1046 LOG(1, s, t, "No IP in IPCP request\n");
1047 STAT(tunnel_rx_errors);
1048 return;
1049 }
1050
1051 switch (session[s].ppp.ipcp)
1052 {
1053 case Closed:
1054 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1055 if (!response) return;
1056 *response = TerminateAck;
1057 *((uint16_t *) (response + 2)) = htons(l = 4);
1058 break;
1059
1060 case Stopped:
1061 initialise_restart_count(s, ipcp);
1062 sendipcp(s, t);
1063 if (*response == ConfigAck)
1064 change_state(s, ipcp, AckSent);
1065 else
1066 change_state(s, ipcp, RequestSent);
1067
1068 break;
1069
1070 case RequestSent:
1071 if (*response == ConfigAck)
1072 change_state(s, ipcp, AckSent);
1073
1074 break;
1075
1076 case AckReceived:
1077 if (*response == ConfigAck)
1078 ipcp_open(s, t);
1079
1080 break;
1081
1082 case Opened:
1083 initialise_restart_count(s, ipcp);
1084 sendipcp(s, t);
1085 /* fallthrough */
1086
1087 case AckSent:
1088 if (*response == ConfigAck)
1089 change_state(s, ipcp, AckSent);
1090 else
1091 change_state(s, ipcp, RequestSent);
1092
1093 break;
1094
1095 default:
1096 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1097 return;
1098 }
1099
1100 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1101 tunnelsend(b, l + (response - b), t);
1102 }
1103 else if (*p == TerminateReq)
1104 {
1105 *p = TerminateAck;
1106 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1107 if (!q) return;
1108 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1109 tunnelsend(b, l + (q - b), t);
1110 change_state(s, ipcp, Stopped);
1111 }
1112 else
1113 {
1114 int code = *p;
1115 int mru = session[s].mru;
1116 if (!mru)
1117 mru = DEFAULT_MRU;
1118
1119 if (l > mru) l = mru;
1120
1121 *p = CodeRej;
1122 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1123 if (!q) return;
1124
1125 LOG(2, s, t, "Unexpected IPCP code %s\n", ppp_code(code));
1126 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1127 tunnelsend(b, l + (q - b), t);
1128 }
1129 }
1130
1131 static void ipv6cp_open(sessionidt s, tunnelidt t)
1132 {
1133 LOG(3, s, t, "IPV6CP: Opened\n");
1134
1135 change_state(s, ipv6cp, Opened);
1136 if (session[s].ipv6prefixlen)
1137 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1138
1139 // Send an initial RA (TODO: Should we send these regularly?)
1140 send_ipv6_ra(s, t, NULL);
1141 }
1142
1143 // Process IPV6CP messages
1144 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1145 {
1146 uint8_t b[MAXCONTROL];
1147 uint8_t *q = 0;
1148 uint16_t hl;
1149
1150 CSTAT(processipv6cp);
1151
1152 LOG_HEX(5, "IPV6CP", p, l);
1153 if (l < 4)
1154 {
1155 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1156 STAT(tunnel_rx_errors);
1157 return ;
1158 }
1159
1160 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1161 {
1162 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1163 STAT(tunnel_rx_errors);
1164 return ;
1165 }
1166 l = hl;
1167
1168 if (session[s].ppp.phase < Network)
1169 {
1170 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1171 return;
1172 }
1173
1174 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1175
1176 if (!config->ipv6_prefix.s6_addr[0])
1177 {
1178 LOG(2, s, t, "IPV6CP: %s rejected (not configured)\n", ppp_code(*p));
1179 *p = ProtocolRej;
1180 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1181 if (!q) return;
1182 tunnelsend(b, l + (q - b), t);
1183 return;
1184 }
1185
1186 if (!session[s].ip)
1187 {
1188 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1189 return; // need IPCP to complete...
1190 }
1191
1192 if (*p == ConfigAck)
1193 {
1194 switch (session[s].ppp.ipv6cp)
1195 {
1196 case RequestSent:
1197 initialise_restart_count(s, ipv6cp);
1198 change_state(s, ipv6cp, AckReceived);
1199 break;
1200
1201 case AckReceived:
1202 case Opened:
1203 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1204 sendipv6cp(s, t);
1205 change_state(s, ipv6cp, RequestSent);
1206 break;
1207
1208 case AckSent:
1209 ipv6cp_open(s, t);
1210 break;
1211
1212 default:
1213 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1214 }
1215 }
1216 else if (*p == ConfigReq)
1217 {
1218 uint8_t *response = 0;
1219 uint8_t *o = p + 4;
1220 int length = l - 4;
1221 int gotip = 0;
1222 uint8_t ident[8];
1223
1224 while (length > 2)
1225 {
1226 switch (*o)
1227 {
1228 case 1: // interface identifier
1229 gotip++; // seen address
1230 if (o[1] != 10 || o[1] > length) return;
1231
1232 *(uint32_t *) ident = htonl(session[s].ip);
1233 *(uint32_t *) (ident + 4) = 0;
1234
1235 if (memcmp(o + 2, ident, sizeof(ident)))
1236 {
1237 q = ppp_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1238 if (!q) return;
1239 }
1240
1241 break;
1242
1243 default:
1244 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1245 q = ppp_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1246 if (!q) return;
1247 }
1248
1249 length -= o[1];
1250 o += o[1];
1251 }
1252
1253 if (response)
1254 {
1255 l = q - response; // IPV6CP packet length
1256 *((uint16_t *) (response + 2)) = htons(l); // update header
1257 }
1258 else if (gotip)
1259 {
1260 // Send packet back as ConfigAck
1261 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1262 if (!response) return;
1263 *response = ConfigAck;
1264 }
1265 else
1266 {
1267 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1268 STAT(tunnel_rx_errors);
1269 return;
1270 }
1271
1272 switch (session[s].ppp.ipv6cp)
1273 {
1274 case Closed:
1275 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1276 if (!response) return;
1277 *response = TerminateAck;
1278 *((uint16_t *) (response + 2)) = htons(l = 4);
1279 break;
1280
1281 case Stopped:
1282 initialise_restart_count(s, ipv6cp);
1283 sendipv6cp(s, t);
1284 if (*response == ConfigAck)
1285 change_state(s, ipv6cp, AckSent);
1286 else
1287 change_state(s, ipv6cp, RequestSent);
1288
1289 break;
1290
1291 case RequestSent:
1292 if (*response == ConfigAck)
1293 change_state(s, ipv6cp, AckSent);
1294
1295 break;
1296
1297 case AckReceived:
1298 if (*response == ConfigAck)
1299 ipv6cp_open(s, t);
1300
1301 break;
1302
1303 case Opened:
1304 initialise_restart_count(s, ipv6cp);
1305 sendipv6cp(s, t);
1306 /* fallthrough */
1307
1308 case AckSent:
1309 if (*response == ConfigAck)
1310 change_state(s, ipv6cp, AckSent);
1311 else
1312 change_state(s, ipv6cp, RequestSent);
1313
1314 break;
1315
1316 default:
1317 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1318 return;
1319 }
1320
1321 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1322 tunnelsend(b, l + (response - b), t);
1323 }
1324 else if (*p == TerminateReq)
1325 {
1326 *p = TerminateAck;
1327 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1328 if (!q) return;
1329 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1330 tunnelsend(b, l + (q - b), t);
1331 change_state(s, ipv6cp, Stopped);
1332 }
1333 else
1334 {
1335 int code = *p;
1336 int mru = session[s].mru;
1337 if (!mru)
1338 mru = DEFAULT_MRU;
1339
1340 if (l > mru) l = mru;
1341
1342 *p = CodeRej;
1343 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1344 if (!q) return;
1345
1346 LOG(2, s, t, "Unexpected IPV6CP code %s\n", ppp_code(code));
1347 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1348 tunnelsend(b, l + (q - b), t);
1349 }
1350 }
1351
1352 // process IP packet received
1353 //
1354 // This MUST be called with at least 4 byte behind 'p'.
1355 // (i.e. this routine writes to p[-4]).
1356 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1357 {
1358 in_addr_t ip;
1359
1360 CSTAT(processipin);
1361
1362 LOG_HEX(5, "IP", p, l);
1363
1364 ip = ntohl(*(uint32_t *)(p + 12));
1365
1366 if (l > MAXETHER)
1367 {
1368 LOG(1, s, t, "IP packet too long %d\n", l);
1369 STAT(tunnel_rx_errors);
1370 return ;
1371 }
1372
1373 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1374 return;
1375
1376 // no spoof (do sessionbyip to handled statically routed subnets)
1377 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1378 {
1379 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1380 return;
1381 }
1382
1383 // run access-list if any
1384 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1385 return;
1386
1387 // Add on the tun header
1388 p -= 4;
1389 *(uint32_t *) p = htonl(PKTIP);
1390 l += 4;
1391
1392 // Are we throttled and a slave?
1393 if (session[s].tbf_in && !config->cluster_iam_master) {
1394 // Pass it to the master for handling.
1395 master_throttle_packet(session[s].tbf_in, p, l);
1396 return;
1397 }
1398
1399 // Are we throttled and a master??
1400 if (session[s].tbf_in && config->cluster_iam_master) {
1401 // Actually handle the throttled packets.
1402 tbf_queue_packet(session[s].tbf_in, p, l);
1403 return;
1404 }
1405
1406 // send to ethernet
1407 if (tun_write(p, l) < 0)
1408 {
1409 STAT(tun_tx_errors);
1410 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1411 l, strerror(errno), tunfd, p);
1412
1413 return;
1414 }
1415
1416 p += 4;
1417 l -= 4;
1418
1419 if (session[s].snoop_ip && session[s].snoop_port)
1420 {
1421 // Snooping this session
1422 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1423 }
1424
1425 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1426 session[s].cin_delta += l;
1427 session[s].pin++;
1428
1429 sess_local[s].cin += l;
1430 sess_local[s].pin++;
1431
1432 eth_tx += l;
1433
1434 STAT(tun_tx_packets);
1435 INC_STAT(tun_tx_bytes, l);
1436 }
1437
1438 // process IPv6 packet received
1439 //
1440 // This MUST be called with at least 4 byte behind 'p'.
1441 // (i.e. this routine writes to p[-4]).
1442 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1443 {
1444 struct in6_addr ip;
1445 in_addr_t ipv4;
1446
1447 CSTAT(processipv6in);
1448
1449 LOG_HEX(5, "IPv6", p, l);
1450
1451 ip = *(struct in6_addr *) (p + 8);
1452 ipv4 = ntohl(*(uint32_t *)(p + 16));
1453
1454 if (l > MAXETHER)
1455 {
1456 LOG(1, s, t, "IP packet too long %d\n", l);
1457 STAT(tunnel_rx_errors);
1458 return ;
1459 }
1460
1461 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1462 return;
1463
1464 // no spoof
1465 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1466 {
1467 char str[INET6_ADDRSTRLEN];
1468 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1469 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1470 return;
1471 }
1472
1473 // Check if it's a Router Solicition message.
1474 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1475 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1476 *(uint32_t *)(p + 34) == 0 &&
1477 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1478 LOG(3, s, t, "Got IPv6 RS\n");
1479 send_ipv6_ra(s, t, &ip);
1480 return;
1481 }
1482
1483 // Add on the tun header
1484 p -= 4;
1485 *(uint32_t *) p = htonl(PKTIPV6);
1486 l += 4;
1487
1488 // Are we throttled and a slave?
1489 if (session[s].tbf_in && !config->cluster_iam_master) {
1490 // Pass it to the master for handling.
1491 master_throttle_packet(session[s].tbf_in, p, l);
1492 return;
1493 }
1494
1495 // Are we throttled and a master??
1496 if (session[s].tbf_in && config->cluster_iam_master) {
1497 // Actually handle the throttled packets.
1498 tbf_queue_packet(session[s].tbf_in, p, l);
1499 return;
1500 }
1501
1502 // send to ethernet
1503 if (tun_write(p, l) < 0)
1504 {
1505 STAT(tun_tx_errors);
1506 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1507 l, strerror(errno), tunfd, p);
1508
1509 return;
1510 }
1511
1512 p += 4;
1513 l -= 4;
1514
1515 if (session[s].snoop_ip && session[s].snoop_port)
1516 {
1517 // Snooping this session
1518 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1519 }
1520
1521 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1522 session[s].cin_delta += l;
1523 session[s].pin++;
1524
1525 sess_local[s].cin += l;
1526 sess_local[s].pin++;
1527
1528 eth_tx += l;
1529
1530 STAT(tun_tx_packets);
1531 INC_STAT(tun_tx_bytes, l);
1532 }
1533
1534 //
1535 // Helper routine for the TBF filters.
1536 // Used to send queued data in from the user.
1537 //
1538 void send_ipin(sessionidt s, uint8_t *buf, int len)
1539 {
1540 LOG_HEX(5, "IP in throttled", buf, len);
1541
1542 if (write(tunfd, buf, len) < 0)
1543 {
1544 STAT(tun_tx_errors);
1545 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1546 len, strerror(errno), tunfd, buf);
1547
1548 return;
1549 }
1550
1551 buf += 4;
1552 len -= 4;
1553
1554 if (session[s].snoop_ip && session[s].snoop_port)
1555 {
1556 // Snooping this session
1557 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1558 }
1559
1560 // Increment packet counters
1561 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1562 session[s].cin_delta += len;
1563 session[s].pin++;
1564
1565 sess_local[s].cin += len;
1566 sess_local[s].pin++;
1567
1568 eth_tx += len;
1569
1570 STAT(tun_tx_packets);
1571 INC_STAT(tun_tx_bytes, len - 4);
1572 }
1573
1574
1575 // Process CCP messages
1576 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1577 {
1578 uint8_t b[MAXCONTROL];
1579 uint8_t *q;
1580
1581 CSTAT(processccp);
1582
1583 LOG_HEX(5, "CCP", p, l);
1584
1585 if (session[s].ppp.phase < Network)
1586 {
1587 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1588 return;
1589 }
1590
1591 if (l < 1)
1592 {
1593 LOG(1, s, t, "Short CCP packet\n");
1594 STAT(tunnel_rx_errors);
1595 }
1596
1597 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1598 if (*p == ConfigAck)
1599 {
1600 switch (session[s].ppp.ccp)
1601 {
1602 case RequestSent:
1603 initialise_restart_count(s, ccp);
1604 change_state(s, ccp, AckReceived);
1605 break;
1606
1607 case AckReceived:
1608 case Opened:
1609 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1610 sendccp(s, t);
1611 change_state(s, ccp, RequestSent);
1612 break;
1613
1614 case AckSent:
1615 LOG(3, s, t, "CCP: Opened\n");
1616 change_state(s, ccp, Opened);
1617 break;
1618
1619 default:
1620 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1621 }
1622 }
1623 else if (*p == ConfigReq)
1624 {
1625 if (l < 6) // accept no compression
1626 *p = ConfigAck;
1627 else // compression requested--reject
1628 *p = ConfigRej;
1629
1630 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1631 if (!q) return;
1632
1633 switch (session[s].ppp.ccp)
1634 {
1635 case Closed:
1636 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1637 if (!q) return;
1638 *q = TerminateAck;
1639 *((uint16_t *) (q + 2)) = htons(l = 4);
1640 break;
1641
1642 case Stopped:
1643 initialise_restart_count(s, ccp);
1644 sendccp(s, t);
1645 if (*q == ConfigAck)
1646 change_state(s, ccp, AckSent);
1647 else
1648 change_state(s, ccp, RequestSent);
1649
1650 break;
1651
1652 case RequestSent:
1653 if (*q == ConfigAck)
1654 change_state(s, ccp, AckSent);
1655
1656 break;
1657
1658 case AckReceived:
1659 if (*q == ConfigAck)
1660 change_state(s, ccp, Opened);
1661
1662 break;
1663
1664 case Opened:
1665 initialise_restart_count(s, ccp);
1666 sendccp(s, t);
1667 /* fallthrough */
1668
1669 case AckSent:
1670 if (*q == ConfigAck)
1671 change_state(s, ccp, AckSent);
1672 else
1673 change_state(s, ccp, RequestSent);
1674
1675 break;
1676
1677 default:
1678 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1679 return;
1680 }
1681
1682 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1683 tunnelsend(b, l + (q - b), t);
1684 }
1685 else if (*p == TerminateReq)
1686 {
1687 *p = TerminateAck;
1688 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1689 if (!q) return;
1690 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1691 tunnelsend(b, l + (q - b), t);
1692 change_state(s, ccp, Stopped);
1693 }
1694 else
1695 {
1696 int code = *p;
1697 int mru = session[s].mru;
1698 if (!mru)
1699 mru = DEFAULT_MRU;
1700
1701 if (l > mru) l = mru;
1702
1703 *p = CodeRej;
1704 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1705 if (!q) return;
1706
1707 LOG(2, s, t, "Unexpected CCP code %s\n", ppp_code(code));
1708 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1709 tunnelsend(b, l + (q - b), t);
1710 }
1711 }
1712
1713 // send a CHAP challenge
1714 void sendchap(sessionidt s, tunnelidt t)
1715 {
1716 uint8_t b[MAXCONTROL];
1717 uint16_t r;
1718 uint8_t *q;
1719
1720 CSTAT(sendchap);
1721
1722 r = radiusnew(s);
1723 if (!r)
1724 {
1725 LOG(1, s, t, "No RADIUS to send challenge\n");
1726 STAT(tunnel_tx_errors);
1727 return;
1728 }
1729
1730 LOG(1, s, t, "Send CHAP challenge\n");
1731
1732 radius[r].chap = 1; // CHAP not PAP
1733 radius[r].id++;
1734 if (radius[r].state != RADIUSCHAP)
1735 radius[r].try = 0;
1736
1737 radius[r].state = RADIUSCHAP;
1738 radius[r].retry = backoff(radius[r].try++);
1739 if (radius[r].try > 5)
1740 {
1741 sessionshutdown(s, "CHAP timeout.", 3, 0);
1742 STAT(tunnel_tx_errors);
1743 return ;
1744 }
1745 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1746 if (!q) return;
1747
1748 *q = 1; // challenge
1749 q[1] = radius[r].id; // ID
1750 q[4] = 16; // value size (size of challenge)
1751 memcpy(q + 5, radius[r].auth, 16); // challenge
1752 strcpy((char *) q + 21, hostname); // our name
1753 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1754 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1755 }
1756
1757 // fill in a L2TP message with a PPP frame,
1758 // copies existing PPP message and changes magic number if seen
1759 // returns start of PPP frame
1760 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1761 {
1762 if (size < 12) // Need more space than this!!
1763 {
1764 static int backtrace_count = 0;
1765 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1766 log_backtrace(backtrace_count, 5)
1767 return NULL;
1768 }
1769
1770 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1771 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1772 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1773 b += 6;
1774 if (mtype == PPPLCP || !(session[s].l2tp_flags & SESSIONACFC))
1775 {
1776 *(uint16_t *) b = htons(0xFF03); // HDLC header
1777 b += 2;
1778 }
1779 if (mtype < 0x100 && session[s].l2tp_flags & SESSIONPFC)
1780 *b++ = mtype;
1781 else
1782 {
1783 *(uint16_t *) b = htons(mtype);
1784 b += 2;
1785 }
1786
1787 if (l + 12 > size)
1788 {
1789 static int backtrace_count = 0;
1790 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1791 log_backtrace(backtrace_count, 5)
1792 return NULL;
1793 }
1794
1795 if (p && l)
1796 memcpy(b, p, l);
1797
1798 return b;
1799 }
1800
1801 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1802 {
1803 int len = 0;
1804 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1805 return 0;
1806
1807 *b++ = 3; // Authentication-Protocol
1808 if (authtype == AUTHCHAP)
1809 {
1810 len = *b++ = 5; // length
1811 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1812 *b++ = 5; // MD5
1813 }
1814 else if (authtype == AUTHPAP)
1815 {
1816 len = *b++ = 4; // length
1817 *(uint16_t *) b = htons(PPPPAP); b += 2;
1818 }
1819 else
1820 {
1821 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1822 }
1823
1824 return len;
1825 }
1826
1827 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1828 void sendlcp(sessionidt s, tunnelidt t)
1829 {
1830 uint8_t b[500], *q, *l;
1831 int authtype = sess_local[s].lcp_authtype;
1832
1833 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1834 return;
1835
1836 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1837 authtype ? " (" : "",
1838 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1839 authtype ? ")" : "");
1840
1841 l = q;
1842 *l++ = ConfigReq;
1843 *l++ = (time_now % 255) + 1; // ID
1844
1845 l += 2; //Save space for length
1846
1847 if (session[s].mru)
1848 {
1849 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1850 *(uint16_t *) l = htons(session[s].mru); l += 2;
1851 }
1852
1853 if (authtype)
1854 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1855
1856 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1857 *(uint32_t *) l = htonl(session[s].magic);
1858 l += 4;
1859
1860 *(uint16_t *)(q + 2) = htons(l - q); // Length
1861
1862 LOG_HEX(5, "PPPLCP", q, l - q);
1863 if (config->debug > 3) dumplcp(q, l - q);
1864
1865 tunnelsend(b, (l - b), t);
1866 }
1867
1868 // Send CCP request for no compression
1869 void sendccp(sessionidt s, tunnelidt t)
1870 {
1871 uint8_t b[500], *q;
1872
1873 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1874 return;
1875
1876 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1877
1878 *q = ConfigReq;
1879 *(uint8_t *)(q + 1) = (time_now % 255) + 1; // ID
1880 *(uint16_t *)(q + 2) = htons(4); // Length
1881
1882 LOG_HEX(5, "PPPCCP", q, 4);
1883 tunnelsend(b, (q - b) + 4 , t);
1884 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"