projects / l2tpns.git / blob
? search:


d2411a6e2b1c615c16ffd17bedb72ca74488695b
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.85 2005/11/04 14:41:50 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", 3, 0);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", 3, 0);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", 3, 0);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", 4, 0);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", 3, 0);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", 3, 0);
173 return;
174 }
175
176 r = sess_local[s].radius;
177 if (!r)
178 {
179 LOG(3, s, t, "Unexpected CHAP message\n");
180 return;
181 }
182
183 if (session[s].ppp.phase != Authenticate)
184 {
185 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
186 return;
187 }
188
189 if (p[1] != radius[r].id)
190 {
191 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
192 STAT(tunnel_rx_errors);
193 sessionshutdown(s, "Unexpected CHAP response ID.", 3, 0);
194 return;
195 }
196
197 if (l < 5 || p[4] != 16)
198 {
199 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Bad CHAP response length.", 3, 0);
202 return;
203 }
204
205 l -= 5;
206 p += 5;
207 if (l < 16 || l - 16 >= sizeof(session[s].user))
208 {
209 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
210 STAT(tunnel_rx_errors);
211 sessionshutdown(s, "CHAP username too long.", 3, 0);
212 return;
213 }
214
215 // Run PRE_AUTH plugins
216 {
217 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
218
219 packet.password = calloc(17, 1);
220 memcpy(packet.password, p, 16);
221
222 p += 16;
223 l -= 16;
224
225 packet.username = calloc(l + 1, 1);
226 memcpy(packet.username, p, l);
227
228 run_plugins(PLUGIN_PRE_AUTH, &packet);
229 if (!packet.continue_auth)
230 {
231 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
232 if (packet.username) free(packet.username);
233 if (packet.password) free(packet.password);
234 return;
235 }
236
237 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
238 memcpy(radius[r].pass, packet.password, 16);
239
240 free(packet.username);
241 free(packet.password);
242 }
243
244 radius[r].chap = 1;
245 LOG(3, s, t, "CHAP login %s\n", session[s].user);
246 radiussend(r, RADIUSAUTH);
247 }
248
249 static void dumplcp(uint8_t *p, int l)
250 {
251 int x = l - 4;
252 uint8_t *o = (p + 4);
253
254 LOG_HEX(5, "PPP LCP Packet", p, l);
255 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
256 LOG(4, 0, 0, "Length: %d\n", l);
257 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
258 return;
259
260 while (x > 2)
261 {
262 int type = o[0];
263 int length = o[1];
264 if (length < 2)
265 {
266 LOG(4, 0, 0, " Option length is %d...\n", length);
267 break;
268 }
269 if (type == 0)
270 {
271 LOG(4, 0, 0, " Option type is 0...\n");
272 x -= length;
273 o += length;
274 continue;
275 }
276 switch (type)
277 {
278 case 1: // Maximum-Receive-Unit
279 if (length == 4)
280 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
281 else
282 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
283 break;
284 case 2: // Async-Control-Character-Map
285 if (length == 6)
286 {
287 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
288 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
289 }
290 else
291 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
292 break;
293 case 3: // Authentication-Protocol
294 if (length == 4)
295 {
296 int proto = ntohs(*(uint16_t *)(o + 2));
297 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
298 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
299 }
300 else if (length == 5)
301 {
302 int proto = ntohs(*(uint16_t *)(o + 2));
303 int algo = *(o + 4);
304 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
305 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
306 }
307 else
308 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
309 break;
310 case 4: // Quality-Protocol
311 {
312 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
313 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
314 }
315 break;
316 case 5: // Magic-Number
317 if (length == 6)
318 {
319 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
320 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
321 }
322 else
323 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
324 break;
325 case 7: // Protocol-Field-Compression
326 case 8: // Address-And-Control-Field-Compression
327 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
328 break;
329 default:
330 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
331 break;
332 }
333 x -= length;
334 o += length;
335 }
336 }
337
338 void lcp_open(sessionidt s, tunnelidt t)
339 {
340 // transition to Authentication or Network phase:
341 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
342
343 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
344
345 // LCP now Opened
346 change_state(s, lcp, Opened);
347
348 if (session[s].ppp.phase == Authenticate)
349 {
350 if (sess_local[s].lcp_authtype == AUTHCHAP)
351 sendchap(s, t);
352 }
353 else
354 {
355 // This-Layer-Up
356 sendipcp(s, t);
357 change_state(s, ipcp, RequestSent);
358 // move to passive state for IPv6 (if configured), CCP
359 if (config->ipv6_prefix.s6_addr[0])
360 change_state(s, ipv6cp, Stopped);
361 else
362 change_state(s, ipv6cp, Closed);
363
364 change_state(s, ccp, Stopped);
365 }
366 }
367
368 static void lcp_restart(sessionidt s)
369 {
370 session[s].ppp.phase = Establish;
371 // This-Layer-Down
372 change_state(s, ipcp, Dead);
373 change_state(s, ipv6cp, Dead);
374 change_state(s, ccp, Dead);
375 }
376
377 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
378 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
379 {
380 if (!*response || **response != ConfigRej)
381 {
382 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
383 if (!queued)
384 return 0;
385
386 *queued = ConfigRej;
387 queued += 4;
388 }
389
390 if ((queued - buf + option[1]) > blen)
391 {
392 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
393 return 0;
394 }
395
396 memcpy(queued, option, option[1]);
397 return queued + option[1];
398 }
399
400 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
401 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
402 uint8_t *value, size_t vlen)
403 {
404 int *nak_sent;
405 switch (mtype)
406 {
407 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
408 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
409 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
410 default: return 0; // ?
411 }
412
413 if (*response && **response != ConfigNak)
414 {
415 if (*nak_sent < config->ppp_max_failure) // reject queued
416 return queued;
417
418 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
419 }
420
421 if (!*response)
422 {
423 if (*nak_sent >= config->ppp_max_failure)
424 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
425
426 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
427 if (!queued)
428 return 0;
429
430 (*nak_sent)++;
431 *queued = ConfigNak;
432 queued += 4;
433 }
434
435 if ((queued - buf + vlen + 2) > blen)
436 {
437 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
438 return 0;
439 }
440
441 *queued++ = *option;
442 *queued++ = vlen + 2;
443 memcpy(queued, value, vlen);
444 return queued + vlen;
445 }
446
447 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
448 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
449 {
450 uint8_t *q;
451 int mru = session[s].mru;
452 if (mru > size) mru = size;
453
454 l += 4;
455 if (l > mru) l = mru;
456
457 q = makeppp(buf, size, 0, 0, s, t, proto);
458 if (!q) return;
459
460 *q = CodeRej;
461 *(q + 1) = ++sess_local[s].lcp_ident;
462 *(uint16_t *)(q + 2) = htons(l);
463 memcpy(q + 4, p, l - 4);
464
465 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
466 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
467 if (config->debug > 3) dumplcp(q, l);
468
469 tunnelsend(buf, l + (q - buf), t);
470 }
471
472 // Process LCP messages
473 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
474 {
475 uint8_t b[MAXETHER];
476 uint8_t *q = NULL;
477 uint32_t magicno = 0;
478 uint16_t hl;
479
480 CSTAT(processlcp);
481
482 LOG_HEX(5, "LCP", p, l);
483 if (l < 4)
484 {
485 LOG(1, s, t, "Short LCP %d bytes\n", l);
486 STAT(tunnel_rx_errors);
487 return ;
488 }
489
490 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
491 {
492 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
493 STAT(tunnel_rx_errors);
494 return ;
495 }
496 l = hl;
497
498 if (session[s].die) // going down...
499 return;
500
501 LOG(*p == EchoReq ? 4 : 3, s, t, "LCP: recv %s\n", ppp_code(*p));
502 if (config->debug > 3) dumplcp(p, l);
503
504 if (*p == ConfigAck)
505 {
506 int x = l - 4;
507 uint8_t *o = (p + 4);
508 int authtype = 0;
509
510 while (x > 2)
511 {
512 int type = o[0];
513 int length = o[1];
514
515 if (length == 0 || type == 0 || x < length) break;
516 switch (type)
517 {
518 case 3: // Authentication-Protocol
519 {
520 int proto = ntohs(*(uint16_t *)(o + 2));
521 if (proto == PPPPAP)
522 authtype = AUTHPAP;
523 else if (proto == PPPCHAP && *(o + 4) == 5)
524 authtype = AUTHCHAP;
525 }
526
527 break;
528 }
529 x -= length;
530 o += length;
531 }
532
533 if (!session[s].ip && authtype)
534 sess_local[s].lcp_authtype = authtype;
535
536 switch (session[s].ppp.lcp)
537 {
538 case RequestSent:
539 initialise_restart_count(s, lcp);
540 change_state(s, lcp, AckReceived);
541 break;
542
543 case AckReceived:
544 case Opened:
545 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
546 if (session[s].ppp.lcp == Opened)
547 lcp_restart(s);
548
549 sendlcp(s, t);
550 change_state(s, lcp, RequestSent);
551 break;
552
553 case AckSent:
554 lcp_open(s, t);
555 break;
556
557 default:
558 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
559 }
560 }
561 else if (*p == ConfigReq)
562 {
563 int x = l - 4;
564 uint8_t *o = (p + 4);
565 uint8_t *response = 0;
566 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
567 static uint8_t authproto[5];
568
569 while (x > 2)
570 {
571 int type = o[0];
572 int length = o[1];
573
574 if (length == 0 || type == 0 || x < length) break;
575 switch (type)
576 {
577 case 1: // Maximum-Receive-Unit
578 session[s].mru = ntohs(*(uint16_t *)(o + 2));
579 break;
580
581 case 2: // Async-Control-Character-Map
582 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
583 break;
584
585 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
586 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
587 break;
588
589 case 3: // Authentication-Protocol
590 {
591 int proto = ntohs(*(uint16_t *)(o + 2));
592 char proto_name[] = "0x0000";
593 int alen;
594
595 if (proto == PPPPAP)
596 {
597 if (config->radius_authtypes & AUTHPAP)
598 {
599 sess_local[s].lcp_authtype = AUTHPAP;
600 break;
601 }
602
603 strcpy(proto_name, "PAP");
604 }
605 else if (proto == PPPCHAP)
606 {
607 if (config->radius_authtypes & AUTHCHAP
608 && *(o + 4) == 5) // MD5
609 {
610 sess_local[s].lcp_authtype = AUTHCHAP;
611 break;
612 }
613
614 strcpy(proto_name, "CHAP");
615 }
616 else
617 sprintf(proto_name, "%#4.4x", proto);
618
619 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
620
621 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
622 if (alen < 2) break; // paranoia
623
624 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
625 if (q && *response == ConfigNak &&
626 config->radius_authtypes != config->radius_authprefer)
627 {
628 // alternate type
629 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
630 if (alen < 2) break;
631 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
632 }
633
634 break;
635 }
636 break;
637
638 case 5: // Magic-Number
639 magicno = ntohl(*(uint32_t *)(o + 2));
640 break;
641
642 case 4: // Quality-Protocol
643 case 7: // Protocol-Field-Compression
644 case 8: // Address-And-Control-Field-Compression
645 break;
646
647 default: // Reject any unknown options
648 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
649 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
650 }
651 x -= length;
652 o += length;
653 }
654
655 if (response)
656 {
657 l = q - response; // LCP packet length
658 *((uint16_t *) (response + 2)) = htons(l); // update header
659 }
660 else
661 {
662 // Send packet back as ConfigAck
663 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
664 if (!response) return;
665 *response = ConfigAck;
666 }
667
668 switch (session[s].ppp.lcp)
669 {
670 case Closed:
671 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
672 if (!response) return;
673 *response = TerminateAck;
674 *((uint16_t *) (response + 2)) = htons(l = 4);
675 break;
676
677 case Stopped:
678 initialise_restart_count(s, lcp);
679 sendlcp(s, t);
680 if (*response == ConfigAck)
681 change_state(s, lcp, AckSent);
682 else
683 change_state(s, lcp, RequestSent);
684
685 break;
686
687 case RequestSent:
688 if (*response == ConfigAck)
689 change_state(s, lcp, AckSent);
690
691 break;
692
693 case AckReceived:
694 if (*response == ConfigAck)
695 lcp_open(s, t);
696
697 break;
698
699 case Opened:
700 lcp_restart(s);
701 sendlcp(s, t);
702 /* fallthrough */
703
704 case AckSent:
705 if (*response == ConfigAck)
706 change_state(s, lcp, AckSent);
707 else
708 change_state(s, lcp, RequestSent);
709
710 break;
711
712 default:
713 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
714 return;
715 }
716
717 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
718 if (config->debug > 3) dumplcp(response, l);
719
720 tunnelsend(b, l + (response - b), t);
721 }
722 else if (*p == ConfigNak || *p == ConfigRej)
723 {
724 int x = l - 4;
725 uint8_t *o = (p + 4);
726 int authtype = -1;
727
728 while (x > 2)
729 {
730 int type = o[0];
731 int length = o[1];
732
733 if (length == 0 || type == 0 || x < length) break;
734 switch (type)
735 {
736 case 1: // Maximum-Receive-Unit
737 if (*p == ConfigNak)
738 {
739 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
740 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
741 }
742 else
743 {
744 sess_local[s].ppp_mru = 0;
745 LOG(3, s, t, " Remote rejected MRU negotiation\n");
746 }
747
748 break;
749
750 case 3: // Authentication-Protocol
751 if (authtype > 0)
752 break;
753
754 if (*p == ConfigNak)
755 {
756 int proto = ntohs(*(uint16_t *)(o + 2));
757 if (proto == PPPPAP)
758 {
759 authtype = config->radius_authtypes & AUTHPAP;
760 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
761 authtype ? "accept" : "reject");
762 }
763 else if (proto == PPPCHAP && *(o + 4) == 5)
764 {
765 authtype = config->radius_authtypes & AUTHCHAP;
766 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
767 authtype ? "accept" : "reject");
768 }
769 else
770 {
771 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
772 proto);
773 }
774 }
775 else
776 {
777 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
778 authtype = 0; // shutdown
779 }
780
781 break;
782
783 default:
784 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
785 break;
786 }
787 x -= length;
788 o += length;
789 }
790
791 if (!authtype)
792 {
793 sessionshutdown(s, "Unsupported authentication.", 3, 0);
794 return;
795 }
796
797 if (authtype > 0)
798 sess_local[s].lcp_authtype = authtype;
799
800 switch (session[s].ppp.lcp)
801 {
802 case Closed:
803 case Stopped:
804 {
805 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
806 if (!response) return;
807 *response = TerminateAck;
808 *((uint16_t *) (response + 2)) = htons(l = 4);
809
810 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
811 if (config->debug > 3) dumplcp(response, l);
812
813 tunnelsend(b, l + (response - b), t);
814 }
815 break;
816
817 case RequestSent:
818 case AckSent:
819 initialise_restart_count(s, lcp);
820 sendlcp(s, t);
821 break;
822
823 case AckReceived:
824 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
825 sendlcp(s, t);
826 break;
827
828 case Opened:
829 lcp_restart(s);
830 sendlcp(s, t);
831 break;
832
833 default:
834 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
835 return;
836 }
837 }
838 else if (*p == TerminateReq)
839 {
840 *p = TerminateAck; // close
841 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
842 if (!q) return;
843
844 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
845 if (config->debug > 3) dumplcp(q, l);
846
847 tunnelsend(b, l + (q - b), t); // send it
848 sessionshutdown(s, "Remote end closed connection.", 3, 0);
849 }
850 else if (*p == TerminateAck)
851 {
852 sessionshutdown(s, "Connection closed.", 3, 0);
853 }
854 else if (*p == ProtocolRej)
855 {
856 uint16_t proto = 0;
857
858 if (l > 4)
859 {
860 proto = *(p+4);
861 if (l > 5 && !(proto & 1))
862 {
863 proto <<= 8;
864 proto |= *(p+5);
865 }
866 }
867
868 if (proto == PPPIPV6CP)
869 {
870 LOG(3, s, t, "IPv6 rejected\n");
871 change_state(s, ipv6cp, Closed);
872 }
873 else
874 {
875 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
876 }
877 }
878 else if (*p == EchoReq)
879 {
880 *p = EchoReply; // reply
881 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
882 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
883 if (!q) return;
884
885 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
886 if (config->debug > 3) dumplcp(q, l);
887
888 tunnelsend(b, l + (q - b), t); // send it
889 }
890 else if (*p == EchoReply)
891 {
892 // Ignore it, last_packet time is set earlier than this.
893 }
894 else if (*p != CodeRej)
895 {
896 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
897 }
898 }
899
900 static void ipcp_open(sessionidt s, tunnelidt t)
901 {
902 LOG(3, s, t, "IPCP: Opened, session is now active\n");
903
904 change_state(s, ipcp, Opened);
905
906 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
907 {
908 uint16_t r = radiusnew(s);
909 if (r)
910 {
911 radiussend(r, RADIUSSTART); // send radius start
912
913 // don't send further Start records if IPCP is restarted
914 session[s].flags |= SESSION_STARTED;
915 cluster_send_session(s);
916 }
917 }
918
919 // start IPv6 if configured and still in passive state
920 if (session[s].ppp.ipv6cp == Stopped)
921 {
922 sendipv6cp(s, t);
923 change_state(s, ipv6cp, RequestSent);
924 }
925 }
926
927 // Process IPCP messages
928 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
929 {
930 uint8_t b[MAXETHER];
931 uint8_t *q = 0;
932 uint16_t hl;
933
934 CSTAT(processipcp);
935
936 LOG_HEX(5, "IPCP", p, l);
937 if (l < 5)
938 {
939 LOG(1, s, t, "Short IPCP %d bytes\n", l);
940 STAT(tunnel_rx_errors);
941 return ;
942 }
943
944 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
945 {
946 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
947 STAT(tunnel_rx_errors);
948 return ;
949 }
950 l = hl;
951
952 if (session[s].ppp.phase < Network)
953 {
954 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
955 return;
956 }
957
958 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
959
960 if (*p == ConfigAck)
961 {
962 switch (session[s].ppp.ipcp)
963 {
964 case RequestSent:
965 initialise_restart_count(s, ipcp);
966 change_state(s, ipcp, AckReceived);
967 break;
968
969 case AckReceived:
970 case Opened:
971 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
972 sendipcp(s, t);
973 change_state(s, ipcp, RequestSent);
974 break;
975
976 case AckSent:
977 ipcp_open(s, t);
978 break;
979
980 default:
981 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
982 }
983 }
984 else if (*p == ConfigReq)
985 {
986 uint8_t *response = 0;
987 uint8_t *o = p + 4;
988 int length = l - 4;
989 int gotip = 0;
990 in_addr_t addr;
991
992 while (length > 2)
993 {
994 switch (*o)
995 {
996 case 3: // ip address
997 gotip++; // seen address
998 if (o[1] != 6 || o[1] > length) return;
999
1000 addr = htonl(session[s].ip);
1001 if (memcmp(o + 2, &addr, (sizeof addr)))
1002 {
1003 uint8_t *oq = q;
1004 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1005 if (!q || (q != oq && *response == ConfigRej))
1006 {
1007 sessionshutdown(s, "Can't negotiate IPCP.", 3, 0);
1008 return;
1009 }
1010 }
1011
1012 break;
1013
1014 case 129: // primary DNS
1015 if (o[1] != 6 || o[1] > length) return;
1016
1017 addr = htonl(session[s].dns1);
1018 if (memcmp(o + 2, &addr, (sizeof addr)))
1019 {
1020 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1021 if (!q) return;
1022 }
1023
1024 break;
1025
1026 case 131: // secondary DNS
1027 if (o[1] != 6 || o[1] > length) return;
1028
1029 addr = htonl(session[s].dns1);
1030 if (memcmp(o + 2, &addr, sizeof(addr)))
1031 {
1032 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1033 if (!q) return;
1034 }
1035
1036 break;
1037
1038 default:
1039 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1040 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1041 if (!q) return;
1042 }
1043
1044 length -= o[1];
1045 o += o[1];
1046 }
1047
1048 if (response)
1049 {
1050 l = q - response; // IPCP packet length
1051 *((uint16_t *) (response + 2)) = htons(l); // update header
1052 }
1053 else if (gotip)
1054 {
1055 // Send packet back as ConfigAck
1056 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1057 if (!response) return;
1058 *response = ConfigAck;
1059 }
1060 else
1061 {
1062 LOG(1, s, t, "No IP in IPCP request\n");
1063 STAT(tunnel_rx_errors);
1064 return;
1065 }
1066
1067 switch (session[s].ppp.ipcp)
1068 {
1069 case Closed:
1070 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1071 if (!response) return;
1072 *response = TerminateAck;
1073 *((uint16_t *) (response + 2)) = htons(l = 4);
1074 break;
1075
1076 case Stopped:
1077 initialise_restart_count(s, ipcp);
1078 sendipcp(s, t);
1079 if (*response == ConfigAck)
1080 change_state(s, ipcp, AckSent);
1081 else
1082 change_state(s, ipcp, RequestSent);
1083
1084 break;
1085
1086 case RequestSent:
1087 if (*response == ConfigAck)
1088 change_state(s, ipcp, AckSent);
1089
1090 break;
1091
1092 case AckReceived:
1093 if (*response == ConfigAck)
1094 ipcp_open(s, t);
1095
1096 break;
1097
1098 case Opened:
1099 initialise_restart_count(s, ipcp);
1100 sendipcp(s, t);
1101 /* fallthrough */
1102
1103 case AckSent:
1104 if (*response == ConfigAck)
1105 change_state(s, ipcp, AckSent);
1106 else
1107 change_state(s, ipcp, RequestSent);
1108
1109 break;
1110
1111 default:
1112 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1113 return;
1114 }
1115
1116 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1117 tunnelsend(b, l + (response - b), t);
1118 }
1119 else if (*p == TerminateReq)
1120 {
1121 *p = TerminateAck;
1122 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1123 if (!q) return;
1124 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1125 tunnelsend(b, l + (q - b), t);
1126 change_state(s, ipcp, Stopped);
1127 }
1128 else if (*p != CodeRej)
1129 {
1130 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1131 }
1132 }
1133
1134 static void ipv6cp_open(sessionidt s, tunnelidt t)
1135 {
1136 LOG(3, s, t, "IPV6CP: Opened\n");
1137
1138 change_state(s, ipv6cp, Opened);
1139 if (session[s].ipv6prefixlen)
1140 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1141
1142 // Send an initial RA (TODO: Should we send these regularly?)
1143 send_ipv6_ra(s, t, NULL);
1144 }
1145
1146 // Process IPV6CP messages
1147 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1148 {
1149 uint8_t b[MAXETHER];
1150 uint8_t *q = 0;
1151 uint16_t hl;
1152
1153 CSTAT(processipv6cp);
1154
1155 LOG_HEX(5, "IPV6CP", p, l);
1156 if (l < 4)
1157 {
1158 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1159 STAT(tunnel_rx_errors);
1160 return ;
1161 }
1162
1163 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1164 {
1165 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1166 STAT(tunnel_rx_errors);
1167 return ;
1168 }
1169 l = hl;
1170
1171 if (session[s].ppp.phase < Network)
1172 {
1173 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1174 return;
1175 }
1176
1177 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1178
1179 if (!session[s].ip)
1180 {
1181 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1182 return; // need IPCP to complete...
1183 }
1184
1185 if (*p == ConfigAck)
1186 {
1187 switch (session[s].ppp.ipv6cp)
1188 {
1189 case RequestSent:
1190 initialise_restart_count(s, ipv6cp);
1191 change_state(s, ipv6cp, AckReceived);
1192 break;
1193
1194 case AckReceived:
1195 case Opened:
1196 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1197 sendipv6cp(s, t);
1198 change_state(s, ipv6cp, RequestSent);
1199 break;
1200
1201 case AckSent:
1202 ipv6cp_open(s, t);
1203 break;
1204
1205 default:
1206 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1207 }
1208 }
1209 else if (*p == ConfigReq)
1210 {
1211 uint8_t *response = 0;
1212 uint8_t *o = p + 4;
1213 int length = l - 4;
1214 int gotip = 0;
1215 uint8_t ident[8];
1216
1217 while (length > 2)
1218 {
1219 switch (*o)
1220 {
1221 case 1: // interface identifier
1222 gotip++; // seen address
1223 if (o[1] != 10 || o[1] > length) return;
1224
1225 *(uint32_t *) ident = htonl(session[s].ip);
1226 *(uint32_t *) (ident + 4) = 0;
1227
1228 if (memcmp(o + 2, ident, sizeof(ident)))
1229 {
1230 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1231 if (!q) return;
1232 }
1233
1234 break;
1235
1236 default:
1237 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1238 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1239 if (!q) return;
1240 }
1241
1242 length -= o[1];
1243 o += o[1];
1244 }
1245
1246 if (response)
1247 {
1248 l = q - response; // IPV6CP packet length
1249 *((uint16_t *) (response + 2)) = htons(l); // update header
1250 }
1251 else if (gotip)
1252 {
1253 // Send packet back as ConfigAck
1254 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1255 if (!response) return;
1256 *response = ConfigAck;
1257 }
1258 else
1259 {
1260 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1261 STAT(tunnel_rx_errors);
1262 return;
1263 }
1264
1265 switch (session[s].ppp.ipv6cp)
1266 {
1267 case Closed:
1268 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1269 if (!response) return;
1270 *response = TerminateAck;
1271 *((uint16_t *) (response + 2)) = htons(l = 4);
1272 break;
1273
1274 case Stopped:
1275 initialise_restart_count(s, ipv6cp);
1276 sendipv6cp(s, t);
1277 if (*response == ConfigAck)
1278 change_state(s, ipv6cp, AckSent);
1279 else
1280 change_state(s, ipv6cp, RequestSent);
1281
1282 break;
1283
1284 case RequestSent:
1285 if (*response == ConfigAck)
1286 change_state(s, ipv6cp, AckSent);
1287
1288 break;
1289
1290 case AckReceived:
1291 if (*response == ConfigAck)
1292 ipv6cp_open(s, t);
1293
1294 break;
1295
1296 case Opened:
1297 initialise_restart_count(s, ipv6cp);
1298 sendipv6cp(s, t);
1299 /* fallthrough */
1300
1301 case AckSent:
1302 if (*response == ConfigAck)
1303 change_state(s, ipv6cp, AckSent);
1304 else
1305 change_state(s, ipv6cp, RequestSent);
1306
1307 break;
1308
1309 default:
1310 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1311 return;
1312 }
1313
1314 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1315 tunnelsend(b, l + (response - b), t);
1316 }
1317 else if (*p == TerminateReq)
1318 {
1319 *p = TerminateAck;
1320 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1321 if (!q) return;
1322 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1323 tunnelsend(b, l + (q - b), t);
1324 change_state(s, ipv6cp, Stopped);
1325 }
1326 else if (*p != CodeRej)
1327 {
1328 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1329 }
1330 }
1331
1332 // process IP packet received
1333 //
1334 // This MUST be called with at least 4 byte behind 'p'.
1335 // (i.e. this routine writes to p[-4]).
1336 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1337 {
1338 in_addr_t ip;
1339
1340 CSTAT(processipin);
1341
1342 LOG_HEX(5, "IP", p, l);
1343
1344 if (l < 20)
1345 {
1346 LOG(1, s, t, "IP packet too short %d\n", l);
1347 STAT(tunnel_rx_errors);
1348 return ;
1349 }
1350
1351 ip = ntohl(*(uint32_t *)(p + 12));
1352
1353 if (l > MAXETHER)
1354 {
1355 LOG(1, s, t, "IP packet too long %d\n", l);
1356 STAT(tunnel_rx_errors);
1357 return ;
1358 }
1359
1360 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1361 return;
1362
1363 // no spoof (do sessionbyip to handled statically routed subnets)
1364 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1365 {
1366 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1367 return;
1368 }
1369
1370 // run access-list if any
1371 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1372 return;
1373
1374 // adjust MSS on SYN and SYN,ACK packets with options
1375 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1376 {
1377 int ihl = (p[0] & 0xf) * 4; // length of IP header
1378 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1379 adjust_tcp_mss(s, t, p, l, p + ihl);
1380 }
1381
1382 // Add on the tun header
1383 p -= 4;
1384 *(uint32_t *) p = htonl(PKTIP);
1385 l += 4;
1386
1387 // Are we throttled and a slave?
1388 if (session[s].tbf_in && !config->cluster_iam_master) {
1389 // Pass it to the master for handling.
1390 master_throttle_packet(session[s].tbf_in, p, l);
1391 return;
1392 }
1393
1394 // Are we throttled and a master??
1395 if (session[s].tbf_in && config->cluster_iam_master) {
1396 // Actually handle the throttled packets.
1397 tbf_queue_packet(session[s].tbf_in, p, l);
1398 return;
1399 }
1400
1401 // send to ethernet
1402 if (tun_write(p, l) < 0)
1403 {
1404 STAT(tun_tx_errors);
1405 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1406 l, strerror(errno), tunfd, p);
1407
1408 return;
1409 }
1410
1411 p += 4;
1412 l -= 4;
1413
1414 if (session[s].snoop_ip && session[s].snoop_port)
1415 {
1416 // Snooping this session
1417 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1418 }
1419
1420 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1421 session[s].cin_delta += l;
1422 session[s].pin++;
1423
1424 sess_local[s].cin += l;
1425 sess_local[s].pin++;
1426
1427 eth_tx += l;
1428
1429 STAT(tun_tx_packets);
1430 INC_STAT(tun_tx_bytes, l);
1431 }
1432
1433 // process IPv6 packet received
1434 //
1435 // This MUST be called with at least 4 byte behind 'p'.
1436 // (i.e. this routine writes to p[-4]).
1437 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1438 {
1439 struct in6_addr ip;
1440 in_addr_t ipv4;
1441
1442 CSTAT(processipv6in);
1443
1444 LOG_HEX(5, "IPv6", p, l);
1445
1446 ip = *(struct in6_addr *) (p + 8);
1447 ipv4 = ntohl(*(uint32_t *)(p + 16));
1448
1449 if (l > MAXETHER)
1450 {
1451 LOG(1, s, t, "IP packet too long %d\n", l);
1452 STAT(tunnel_rx_errors);
1453 return ;
1454 }
1455
1456 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1457 return;
1458
1459 // no spoof
1460 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1461 {
1462 char str[INET6_ADDRSTRLEN];
1463 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1464 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1465 return;
1466 }
1467
1468 // Check if it's a Router Solicition message.
1469 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1470 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1471 *(uint32_t *)(p + 34) == 0 &&
1472 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1473 LOG(3, s, t, "Got IPv6 RS\n");
1474 send_ipv6_ra(s, t, &ip);
1475 return;
1476 }
1477
1478 // Add on the tun header
1479 p -= 4;
1480 *(uint32_t *) p = htonl(PKTIPV6);
1481 l += 4;
1482
1483 // Are we throttled and a slave?
1484 if (session[s].tbf_in && !config->cluster_iam_master) {
1485 // Pass it to the master for handling.
1486 master_throttle_packet(session[s].tbf_in, p, l);
1487 return;
1488 }
1489
1490 // Are we throttled and a master??
1491 if (session[s].tbf_in && config->cluster_iam_master) {
1492 // Actually handle the throttled packets.
1493 tbf_queue_packet(session[s].tbf_in, p, l);
1494 return;
1495 }
1496
1497 // send to ethernet
1498 if (tun_write(p, l) < 0)
1499 {
1500 STAT(tun_tx_errors);
1501 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1502 l, strerror(errno), tunfd, p);
1503
1504 return;
1505 }
1506
1507 p += 4;
1508 l -= 4;
1509
1510 if (session[s].snoop_ip && session[s].snoop_port)
1511 {
1512 // Snooping this session
1513 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1514 }
1515
1516 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1517 session[s].cin_delta += l;
1518 session[s].pin++;
1519
1520 sess_local[s].cin += l;
1521 sess_local[s].pin++;
1522
1523 eth_tx += l;
1524
1525 STAT(tun_tx_packets);
1526 INC_STAT(tun_tx_bytes, l);
1527 }
1528
1529 //
1530 // Helper routine for the TBF filters.
1531 // Used to send queued data in from the user.
1532 //
1533 void send_ipin(sessionidt s, uint8_t *buf, int len)
1534 {
1535 LOG_HEX(5, "IP in throttled", buf, len);
1536
1537 if (write(tunfd, buf, len) < 0)
1538 {
1539 STAT(tun_tx_errors);
1540 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1541 len, strerror(errno), tunfd, buf);
1542
1543 return;
1544 }
1545
1546 buf += 4;
1547 len -= 4;
1548
1549 if (session[s].snoop_ip && session[s].snoop_port)
1550 {
1551 // Snooping this session
1552 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1553 }
1554
1555 // Increment packet counters
1556 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1557 session[s].cin_delta += len;
1558 session[s].pin++;
1559
1560 sess_local[s].cin += len;
1561 sess_local[s].pin++;
1562
1563 eth_tx += len;
1564
1565 STAT(tun_tx_packets);
1566 INC_STAT(tun_tx_bytes, len - 4);
1567 }
1568
1569
1570 // Process CCP messages
1571 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1572 {
1573 uint8_t b[MAXETHER];
1574 uint8_t *q;
1575
1576 CSTAT(processccp);
1577
1578 LOG_HEX(5, "CCP", p, l);
1579
1580 if (session[s].ppp.phase < Network)
1581 {
1582 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1583 return;
1584 }
1585
1586 if (l < 1)
1587 {
1588 LOG(1, s, t, "Short CCP packet\n");
1589 STAT(tunnel_rx_errors);
1590 }
1591
1592 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1593 if (*p == ConfigAck)
1594 {
1595 switch (session[s].ppp.ccp)
1596 {
1597 case RequestSent:
1598 initialise_restart_count(s, ccp);
1599 change_state(s, ccp, AckReceived);
1600 break;
1601
1602 case AckReceived:
1603 case Opened:
1604 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1605 sendccp(s, t);
1606 change_state(s, ccp, RequestSent);
1607 break;
1608
1609 case AckSent:
1610 LOG(3, s, t, "CCP: Opened\n");
1611 change_state(s, ccp, Opened);
1612 break;
1613
1614 default:
1615 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1616 }
1617 }
1618 else if (*p == ConfigReq)
1619 {
1620 if (l < 6) // accept no compression
1621 *p = ConfigAck;
1622 else // compression requested--reject
1623 *p = ConfigRej;
1624
1625 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1626 if (!q) return;
1627
1628 switch (session[s].ppp.ccp)
1629 {
1630 case Closed:
1631 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1632 if (!q) return;
1633 *q = TerminateAck;
1634 *((uint16_t *) (q + 2)) = htons(l = 4);
1635 break;
1636
1637 case Stopped:
1638 initialise_restart_count(s, ccp);
1639 sendccp(s, t);
1640 if (*q == ConfigAck)
1641 change_state(s, ccp, AckSent);
1642 else
1643 change_state(s, ccp, RequestSent);
1644
1645 break;
1646
1647 case RequestSent:
1648 if (*q == ConfigAck)
1649 change_state(s, ccp, AckSent);
1650
1651 break;
1652
1653 case AckReceived:
1654 if (*q == ConfigAck)
1655 change_state(s, ccp, Opened);
1656
1657 break;
1658
1659 case Opened:
1660 initialise_restart_count(s, ccp);
1661 sendccp(s, t);
1662 /* fallthrough */
1663
1664 case AckSent:
1665 if (*q == ConfigAck)
1666 change_state(s, ccp, AckSent);
1667 else
1668 change_state(s, ccp, RequestSent);
1669
1670 break;
1671
1672 default:
1673 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1674 return;
1675 }
1676
1677 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1678 tunnelsend(b, l + (q - b), t);
1679 }
1680 else if (*p == TerminateReq)
1681 {
1682 *p = TerminateAck;
1683 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1684 if (!q) return;
1685 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1686 tunnelsend(b, l + (q - b), t);
1687 change_state(s, ccp, Stopped);
1688 }
1689 else if (*p != CodeRej)
1690 {
1691 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1692 }
1693 }
1694
1695 // send a CHAP challenge
1696 void sendchap(sessionidt s, tunnelidt t)
1697 {
1698 uint8_t b[MAXETHER];
1699 uint16_t r;
1700 uint8_t *q;
1701
1702 CSTAT(sendchap);
1703
1704 r = radiusnew(s);
1705 if (!r)
1706 {
1707 LOG(1, s, t, "No RADIUS to send challenge\n");
1708 STAT(tunnel_tx_errors);
1709 return;
1710 }
1711
1712 LOG(1, s, t, "Send CHAP challenge\n");
1713
1714 radius[r].chap = 1; // CHAP not PAP
1715 radius[r].id++;
1716 if (radius[r].state != RADIUSCHAP)
1717 radius[r].try = 0;
1718
1719 radius[r].state = RADIUSCHAP;
1720 radius[r].retry = backoff(radius[r].try++);
1721 if (radius[r].try > 5)
1722 {
1723 sessionshutdown(s, "CHAP timeout.", 3, 0);
1724 STAT(tunnel_tx_errors);
1725 return ;
1726 }
1727 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1728 if (!q) return;
1729
1730 *q = 1; // challenge
1731 q[1] = radius[r].id; // ID
1732 q[4] = 16; // value size (size of challenge)
1733 memcpy(q + 5, radius[r].auth, 16); // challenge
1734 strcpy((char *) q + 21, hostname); // our name
1735 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1736 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1737 }
1738
1739 // fill in a L2TP message with a PPP frame,
1740 // copies existing PPP message and changes magic number if seen
1741 // returns start of PPP frame
1742 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1743 {
1744 if (size < 12) // Need more space than this!!
1745 {
1746 static int backtrace_count = 0;
1747 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1748 log_backtrace(backtrace_count, 5)
1749 return NULL;
1750 }
1751
1752 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1753 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1754 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1755 b += 6;
1756 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1757 {
1758 *(uint16_t *) b = htons(0xFF03); // HDLC header
1759 b += 2;
1760 }
1761 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1762 *b++ = mtype;
1763 else
1764 {
1765 *(uint16_t *) b = htons(mtype);
1766 b += 2;
1767 }
1768
1769 if (l + 12 > size)
1770 {
1771 static int backtrace_count = 0;
1772 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1773 log_backtrace(backtrace_count, 5)
1774 return NULL;
1775 }
1776
1777 if (p && l)
1778 memcpy(b, p, l);
1779
1780 return b;
1781 }
1782
1783 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1784 {
1785 int len = 0;
1786 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1787 return 0;
1788
1789 *b++ = 3; // Authentication-Protocol
1790 if (authtype == AUTHCHAP)
1791 {
1792 len = *b++ = 5; // length
1793 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1794 *b++ = 5; // MD5
1795 }
1796 else if (authtype == AUTHPAP)
1797 {
1798 len = *b++ = 4; // length
1799 *(uint16_t *) b = htons(PPPPAP); b += 2;
1800 }
1801 else
1802 {
1803 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1804 }
1805
1806 return len;
1807 }
1808
1809 // Send initial LCP ConfigReq for MRU, authentication type and magic no
1810 void sendlcp(sessionidt s, tunnelidt t)
1811 {
1812 uint8_t b[500], *q, *l;
1813 int authtype = sess_local[s].lcp_authtype;
1814
1815 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1816 return;
1817
1818 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1819 authtype ? " (" : "",
1820 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1821 authtype ? ")" : "");
1822
1823 l = q;
1824 *l++ = ConfigReq;
1825 *l++ = ++sess_local[s].lcp_ident; // ID
1826
1827 l += 2; //Save space for length
1828
1829 if (sess_local[s].ppp_mru)
1830 {
1831 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1832 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1833 }
1834
1835 if (authtype)
1836 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1837
1838 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1839 *(uint32_t *) l = htonl(session[s].magic);
1840 l += 4;
1841
1842 *(uint16_t *)(q + 2) = htons(l - q); // Length
1843
1844 LOG_HEX(5, "PPPLCP", q, l - q);
1845 if (config->debug > 3) dumplcp(q, l - q);
1846
1847 tunnelsend(b, (l - b), t);
1848 restart_timer(s, lcp);
1849 }
1850
1851 // Send CCP request for no compression
1852 void sendccp(sessionidt s, tunnelidt t)
1853 {
1854 uint8_t b[500], *q;
1855
1856 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1857 return;
1858
1859 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1860
1861 *q = ConfigReq;
1862 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1863 *(uint16_t *)(q + 2) = htons(4); // Length
1864
1865 LOG_HEX(5, "PPPCCP", q, 4);
1866 tunnelsend(b, (q - b) + 4 , t);
1867 restart_timer(s, ccp);
1868 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"