d4bb9ca03630bfda2c71a4d882467a75af833241
[l2tpns.git] / l2tpns.c
1 // L2TP Network Server
2 // Adrian Kennard 2002
3 // Copyright (c) 2003, 2004, 2005, 2006 Optus Internet Engineering
4 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
5 // vim: sw=8 ts=8
6
7 #include <arpa/inet.h>
8 #include <assert.h>
9 #include <errno.h>
10 #include <fcntl.h>
11 #include <linux/if_tun.h>
12 #define SYSLOG_NAMES
13 #include <syslog.h>
14 #include <malloc.h>
15 #include <net/route.h>
16 #include <sys/mman.h>
17 #include <netdb.h>
18 #include <netinet/in.h>
19 #include <netinet/ip6.h>
20 #include <stdarg.h>
21 #include <stdlib.h>
22 #include <stdio.h>
23 #include <string.h>
24 #include <ctype.h>
25 #include <sys/ioctl.h>
26 #include <sys/socket.h>
27 #include <sys/stat.h>
28 #include <sys/time.h>
29 #include <sys/resource.h>
30 #include <sys/wait.h>
31 #include <net/if.h>
32 #include <stddef.h>
33 #include <time.h>
34 #include <dlfcn.h>
35 #include <unistd.h>
36 #include <sched.h>
37 #include <sys/sysinfo.h>
38 #include <libcli.h>
39 #include <linux/netlink.h>
40 #include <linux/rtnetlink.h>
41
42 #include "md5.h"
43 #include "l2tpns.h"
44 #include "cluster.h"
45 #include "plugin.h"
46 #include "ll.h"
47 #include "constants.h"
48 #include "control.h"
49 #include "util.h"
50 #include "tbf.h"
51
52 #ifdef BGP
53 #include "bgp.h"
54 #endif
55
56 #ifdef LAC
57 #include "l2tplac.h"
58 #endif
59
60 #ifdef LAC
61 char * Vendor_name = "Linux L2TPNS";
62 uint32_t call_serial_number = 0;
63 #endif
64
65 // Globals
66 configt *config = NULL; // all configuration
67 int nlfd = -1; // netlink socket
68 int tunfd = -1; // tun interface file handle. (network device)
69 int udpfd = -1; // UDP file handle
70 int controlfd = -1; // Control signal handle
71 int clifd = -1; // Socket listening for CLI connections.
72 int daefd = -1; // Socket listening for DAE connections.
73 int snoopfd = -1; // UDP file handle for sending out intercept data
74 int *radfds = NULL; // RADIUS requests file handles
75 int rand_fd = -1; // Random data source
76 int cluster_sockfd = -1; // Intra-cluster communications socket.
77 int epollfd = -1; // event polling
78 time_t basetime = 0; // base clock
79 char hostname[MAXHOSTNAME] = ""; // us.
80 static int tunidx; // ifr_ifindex of tun device
81 int nlseqnum = 0; // netlink sequence number
82 int min_initok_nlseqnum = 0; // minimun seq number for messages after init is ok
83 static int syslog_log = 0; // are we logging to syslog
84 static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog).
85 uint32_t last_id = 0; // Unique ID for radius accounting
86 // Guest change
87 char guest_users[10][32]; // Array of guest users
88 int guest_accounts_num = 0; // Number of guest users
89
90 // calculated from config->l2tp_mtu
91 uint16_t MRU = 0; // PPP MRU
92 uint16_t MSS = 0; // TCP MSS
93
94 struct cli_session_actions *cli_session_actions = NULL; // Pending session changes requested by CLI
95 struct cli_tunnel_actions *cli_tunnel_actions = NULL; // Pending tunnel changes required by CLI
96
97 union iphash {
98 sessionidt sess;
99 union iphash *idx;
100 } ip_hash[256]; // Mapping from IP address to session structures.
101
102 struct ipv6radix {
103 sessionidt sess;
104 struct ipv6radix *branch;
105 } ipv6_hash[256]; // Mapping from IPv6 address to session structures.
106
107 // Traffic counters.
108 static uint32_t udp_rx = 0, udp_rx_pkt = 0, udp_tx = 0;
109 static uint32_t eth_rx = 0, eth_rx_pkt = 0;
110 uint32_t eth_tx = 0;
111
112 static uint32_t ip_pool_size = 1; // Size of the pool of addresses used for dynamic address allocation.
113 time_t time_now = 0; // Current time in seconds since epoch.
114 uint64_t time_now_ms = 0; // Current time in milliseconds since epoch.
115 static char time_now_string[64] = {0}; // Current time as a string.
116 static int time_changed = 0; // time_now changed
117 char main_quit = 0; // True if we're in the process of exiting.
118 static char main_reload = 0; // Re-load pending
119 linked_list *loaded_plugins;
120 linked_list *plugins[MAX_PLUGIN_TYPES];
121
122 #define membersize(STRUCT, MEMBER) sizeof(((STRUCT *)0)->MEMBER)
123 #define CONFIG(NAME, MEMBER, TYPE) { NAME, offsetof(configt, MEMBER), membersize(configt, MEMBER), TYPE }
124
125 config_descriptt config_values[] = {
126 CONFIG("debug", debug, INT),
127 CONFIG("log_file", log_filename, STRING),
128 CONFIG("pid_file", pid_file, STRING),
129 CONFIG("random_device", random_device, STRING),
130 CONFIG("l2tp_secret", l2tp_secret, STRING),
131 CONFIG("l2tp_mtu", l2tp_mtu, INT),
132 CONFIG("ppp_restart_time", ppp_restart_time, INT),
133 CONFIG("ppp_max_configure", ppp_max_configure, INT),
134 CONFIG("ppp_max_failure", ppp_max_failure, INT),
135 CONFIG("primary_dns", default_dns1, IPv4),
136 CONFIG("secondary_dns", default_dns2, IPv4),
137 CONFIG("primary_radius", radiusserver[0], IPv4),
138 CONFIG("secondary_radius", radiusserver[1], IPv4),
139 CONFIG("primary_radius_port", radiusport[0], SHORT),
140 CONFIG("secondary_radius_port", radiusport[1], SHORT),
141 CONFIG("radius_accounting", radius_accounting, BOOL),
142 CONFIG("radius_interim", radius_interim, INT),
143 CONFIG("radius_secret", radiussecret, STRING),
144 CONFIG("radius_authtypes", radius_authtypes_s, STRING),
145 CONFIG("radius_dae_port", radius_dae_port, SHORT),
146 CONFIG("radius_bind_min", radius_bind_min, SHORT),
147 CONFIG("radius_bind_max", radius_bind_max, SHORT),
148 CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL),
149 CONFIG("kill_timedout_sessions", kill_timedout_sessions, BOOL),
150 CONFIG("guest_account", guest_user, STRING),
151 CONFIG("bind_address", bind_address, IPv4),
152 CONFIG("peer_address", peer_address, IPv4),
153 CONFIG("send_garp", send_garp, BOOL),
154 CONFIG("throttle_speed", rl_rate, UNSIGNED_LONG),
155 CONFIG("throttle_buckets", num_tbfs, INT),
156 CONFIG("accounting_dir", accounting_dir, STRING),
157 CONFIG("dump_speed", dump_speed, BOOL),
158 CONFIG("multi_read_count", multi_read_count, INT),
159 CONFIG("scheduler_fifo", scheduler_fifo, BOOL),
160 CONFIG("lock_pages", lock_pages, BOOL),
161 CONFIG("icmp_rate", icmp_rate, INT),
162 CONFIG("packet_limit", max_packets, INT),
163 CONFIG("cluster_address", cluster_address, IPv4),
164 CONFIG("cluster_interface", cluster_interface, STRING),
165 CONFIG("cluster_mcast_ttl", cluster_mcast_ttl, INT),
166 CONFIG("cluster_hb_interval", cluster_hb_interval, INT),
167 CONFIG("cluster_hb_timeout", cluster_hb_timeout, INT),
168 CONFIG("cluster_master_min_adv", cluster_master_min_adv, INT),
169 CONFIG("ipv6_prefix", ipv6_prefix, IPv6),
170 CONFIG("cli_bind_address", cli_bind_address, IPv4),
171 CONFIG("hostname", hostname, STRING),
172 #ifdef BGP
173 CONFIG("nexthop_address", nexthop_address, IPv4),
174 CONFIG("nexthop6_address", nexthop6_address, IPv6),
175 #endif
176 CONFIG("echo_timeout", echo_timeout, INT),
177 CONFIG("idle_echo_timeout", idle_echo_timeout, INT),
178 { NULL, 0, 0, 0 },
179 };
180
181 static char *plugin_functions[] = {
182 NULL,
183 "plugin_pre_auth",
184 "plugin_post_auth",
185 "plugin_timer",
186 "plugin_new_session",
187 "plugin_kill_session",
188 "plugin_control",
189 "plugin_radius_response",
190 "plugin_radius_reset",
191 "plugin_radius_account",
192 "plugin_become_master",
193 "plugin_new_session_master",
194 };
195
196 #define max_plugin_functions (sizeof(plugin_functions) / sizeof(char *))
197
198 // Counters for shutdown sessions
199 static sessiont shut_acct[8192];
200 static sessionidt shut_acct_n = 0;
201
202 tunnelt *tunnel = NULL; // Array of tunnel structures.
203 bundlet *bundle = NULL; // Array of bundle structures.
204 fragmentationt *frag = NULL; // Array of fragmentation structures.
205 sessiont *session = NULL; // Array of session structures.
206 sessionlocalt *sess_local = NULL; // Array of local per-session counters.
207 radiust *radius = NULL; // Array of radius structures.
208 ippoolt *ip_address_pool = NULL; // Array of dynamic IP addresses.
209 ip_filtert *ip_filters = NULL; // Array of named filters.
210 static controlt *controlfree = 0;
211 struct Tstats *_statistics = NULL;
212 #ifdef RINGBUFFER
213 struct Tringbuffer *ringbuffer = NULL;
214 #endif
215
216 static ssize_t netlink_send(struct nlmsghdr *nh);
217 static void netlink_addattr(struct nlmsghdr *nh, int type, const void *data, int alen);
218 static void cache_ipmap(in_addr_t ip, sessionidt s);
219 static void uncache_ipmap(in_addr_t ip);
220 static void cache_ipv6map(struct in6_addr ip, int prefixlen, sessionidt s);
221 static void free_ip_address(sessionidt s);
222 static void dump_acct_info(int all);
223 static void sighup_handler(int sig);
224 static void shutdown_handler(int sig);
225 static void sigchild_handler(int sig);
226 static void build_chap_response(uint8_t *challenge, uint8_t id, uint16_t challenge_length, uint8_t **challenge_response);
227 static void update_config(void);
228 static void read_config_file(void);
229 static void initplugins(void);
230 static int add_plugin(char *plugin_name);
231 static int remove_plugin(char *plugin_name);
232 static void plugins_done(void);
233 static void processcontrol(uint8_t *buf, int len, struct sockaddr_in *addr, int alen, struct in_addr *local);
234 static tunnelidt new_tunnel(void);
235 static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len);
236 static void bundleclear(bundleidt b);
237
238 // return internal time (10ths since process startup), set f if given
239 // as a side-effect sets time_now, and time_changed
240 static clockt now(double *f)
241 {
242 struct timeval t;
243 gettimeofday(&t, 0);
244 if (f) *f = t.tv_sec + t.tv_usec / 1000000.0;
245 if (t.tv_sec != time_now)
246 {
247 time_now = t.tv_sec;
248 time_changed++;
249 }
250
251 // Time in milliseconds
252 time_now_ms = (t.tv_sec * 1000) + (t.tv_usec/1000);
253
254 return (t.tv_sec - basetime) * 10 + t.tv_usec / 100000 + 1;
255 }
256
257 // work out a retry time based on try number
258 // This is a straight bounded exponential backoff.
259 // Maximum re-try time is 32 seconds. (2^5).
260 clockt backoff(uint8_t try)
261 {
262 if (try > 5) try = 5; // max backoff
263 return now(NULL) + 10 * (1 << try);
264 }
265
266
267 //
268 // Log a debug message. Typically called via the LOG macro
269 //
270 void _log(int level, sessionidt s, tunnelidt t, const char *format, ...)
271 {
272 static char message[65536] = {0};
273 va_list ap;
274
275 #ifdef RINGBUFFER
276 if (ringbuffer)
277 {
278 if (++ringbuffer->tail >= RINGBUFFER_SIZE)
279 ringbuffer->tail = 0;
280 if (ringbuffer->tail == ringbuffer->head)
281 if (++ringbuffer->head >= RINGBUFFER_SIZE)
282 ringbuffer->head = 0;
283
284 ringbuffer->buffer[ringbuffer->tail].level = level;
285 ringbuffer->buffer[ringbuffer->tail].session = s;
286 ringbuffer->buffer[ringbuffer->tail].tunnel = t;
287 va_start(ap, format);
288 vsnprintf(ringbuffer->buffer[ringbuffer->tail].message, 4095, format, ap);
289 va_end(ap);
290 }
291 #endif
292
293 if (config->debug < level) return;
294
295 va_start(ap, format);
296 vsnprintf(message, sizeof(message), format, ap);
297
298 if (log_stream)
299 fprintf(log_stream, "%s %02d/%02d %s", time_now_string, t, s, message);
300 else if (syslog_log)
301 syslog(level + 2, "%02d/%02d %s", t, s, message); // We don't need LOG_EMERG or LOG_ALERT
302
303 va_end(ap);
304 }
305
306 void _log_hex(int level, const char *title, const uint8_t *data, int maxsize)
307 {
308 int i, j;
309 const uint8_t *d = data;
310
311 if (config->debug < level) return;
312
313 // No support for _log_hex to syslog
314 if (log_stream)
315 {
316 _log(level, 0, 0, "%s (%d bytes):\n", title, maxsize);
317 setvbuf(log_stream, NULL, _IOFBF, 16384);
318
319 for (i = 0; i < maxsize; )
320 {
321 fprintf(log_stream, "%4X: ", i);
322 for (j = i; j < maxsize && j < (i + 16); j++)
323 {
324 fprintf(log_stream, "%02X ", d[j]);
325 if (j == i + 7)
326 fputs(": ", log_stream);
327 }
328
329 for (; j < i + 16; j++)
330 {
331 fputs(" ", log_stream);
332 if (j == i + 7)
333 fputs(": ", log_stream);
334 }
335
336 fputs(" ", log_stream);
337 for (j = i; j < maxsize && j < (i + 16); j++)
338 {
339 if (d[j] >= 0x20 && d[j] < 0x7f && d[j] != 0x20)
340 fputc(d[j], log_stream);
341 else
342 fputc('.', log_stream);
343
344 if (j == i + 7)
345 fputs(" ", log_stream);
346 }
347
348 i = j;
349 fputs("\n", log_stream);
350 }
351
352 fflush(log_stream);
353 setbuf(log_stream, NULL);
354 }
355 }
356
357 // update a counter, accumulating 2^32 wraps
358 void increment_counter(uint32_t *counter, uint32_t *wrap, uint32_t delta)
359 {
360 uint32_t new = *counter + delta;
361 if (new < *counter)
362 (*wrap)++;
363
364 *counter = new;
365 }
366
367 // initialise the random generator
368 static void initrandom(char *source)
369 {
370 static char path[sizeof(config->random_device)] = "*undefined*";
371
372 // reinitialise only if we are forced to do so or if the config has changed
373 if (source && !strncmp(path, source, sizeof(path)))
374 return;
375
376 // close previous source, if any
377 if (rand_fd >= 0)
378 close(rand_fd);
379
380 rand_fd = -1;
381
382 if (source)
383 {
384 // register changes
385 snprintf(path, sizeof(path), "%s", source);
386
387 if (*path == '/')
388 {
389 rand_fd = open(path, O_RDONLY|O_NONBLOCK);
390 if (rand_fd < 0)
391 LOG(0, 0, 0, "Error opening the random device %s: %s\n",
392 path, strerror(errno));
393 }
394 }
395 }
396
397 // fill buffer with random data
398 void random_data(uint8_t *buf, int len)
399 {
400 int n = 0;
401
402 CSTAT(random_data);
403 if (rand_fd >= 0)
404 {
405 n = read(rand_fd, buf, len);
406 if (n >= len) return;
407 if (n < 0)
408 {
409 if (errno != EAGAIN)
410 {
411 LOG(0, 0, 0, "Error reading from random source: %s\n",
412 strerror(errno));
413
414 // fall back to rand()
415 initrandom(NULL);
416 }
417
418 n = 0;
419 }
420 }
421
422 // append missing data
423 while (n < len)
424 // not using the low order bits from the prng stream
425 buf[n++] = (rand() >> 4) & 0xff;
426 }
427
428 // Add a route
429 //
430 // This adds it to the routing table, advertises it
431 // via BGP if enabled, and stuffs it into the
432 // 'sessionbyip' cache.
433 //
434 // 'ip' must be in _host_ order.
435 //
436 static void routeset(sessionidt s, in_addr_t ip, int prefixlen, in_addr_t gw, int add)
437 {
438 struct {
439 struct nlmsghdr nh;
440 struct rtmsg rt;
441 char buf[32];
442 } req;
443 int i;
444 in_addr_t n_ip;
445
446 if (!prefixlen) prefixlen = 32;
447
448 ip &= 0xffffffff << (32 - prefixlen);; // Force the ip to be the first one in the route.
449
450 memset(&req, 0, sizeof(req));
451
452 if (add)
453 {
454 req.nh.nlmsg_type = RTM_NEWROUTE;
455 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_REPLACE;
456 }
457 else
458 {
459 req.nh.nlmsg_type = RTM_DELROUTE;
460 req.nh.nlmsg_flags = NLM_F_REQUEST;
461 }
462
463 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.rt));
464
465 req.rt.rtm_family = AF_INET;
466 req.rt.rtm_dst_len = prefixlen;
467 req.rt.rtm_table = RT_TABLE_MAIN;
468 req.rt.rtm_protocol = 42;
469 req.rt.rtm_scope = RT_SCOPE_LINK;
470 req.rt.rtm_type = RTN_UNICAST;
471
472 netlink_addattr(&req.nh, RTA_OIF, &tunidx, sizeof(int));
473 n_ip = htonl(ip);
474 netlink_addattr(&req.nh, RTA_DST, &n_ip, sizeof(n_ip));
475 if (gw)
476 {
477 n_ip = htonl(gw);
478 netlink_addattr(&req.nh, RTA_GATEWAY, &n_ip, sizeof(n_ip));
479 }
480
481 LOG(1, s, session[s].tunnel, "Route %s %s/%d%s%s\n", add ? "add" : "del",
482 fmtaddr(htonl(ip), 0), prefixlen,
483 gw ? " via" : "", gw ? fmtaddr(htonl(gw), 2) : "");
484
485 if (netlink_send(&req.nh) < 0)
486 LOG(0, 0, 0, "routeset() error in sending netlink message: %s\n", strerror(errno));
487
488 #ifdef BGP
489 if (add)
490 bgp_add_route(htonl(ip), prefixlen);
491 else
492 bgp_del_route(htonl(ip), prefixlen);
493 #endif /* BGP */
494
495 // Add/Remove the IPs to the 'sessionbyip' cache.
496 // Note that we add the zero address in the case of
497 // a network route. Roll on CIDR.
498
499 // Note that 's == 0' implies this is the address pool.
500 // We still cache it here, because it will pre-fill
501 // the malloc'ed tree.
502
503 if (s)
504 {
505 if (!add) // Are we deleting a route?
506 s = 0; // Caching the session as '0' is the same as uncaching.
507
508 for (i = ip; i < ip+(1<<(32-prefixlen)) ; ++i)
509 cache_ipmap(i, s);
510 }
511 }
512
513 void route6set(sessionidt s, struct in6_addr ip, int prefixlen, int add)
514 {
515 struct {
516 struct nlmsghdr nh;
517 struct rtmsg rt;
518 char buf[64];
519 } req;
520 int metric;
521 char ipv6addr[INET6_ADDRSTRLEN];
522
523 if (!config->ipv6_prefix.s6_addr[0])
524 {
525 LOG(0, 0, 0, "Asked to set IPv6 route, but IPv6 not setup.\n");
526 return;
527 }
528
529 memset(&req, 0, sizeof(req));
530
531 if (add)
532 {
533 req.nh.nlmsg_type = RTM_NEWROUTE;
534 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_REPLACE;
535 }
536 else
537 {
538 req.nh.nlmsg_type = RTM_DELROUTE;
539 req.nh.nlmsg_flags = NLM_F_REQUEST;
540 }
541
542 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.rt));
543
544 req.rt.rtm_family = AF_INET6;
545 req.rt.rtm_dst_len = prefixlen;
546 req.rt.rtm_table = RT_TABLE_MAIN;
547 req.rt.rtm_protocol = 42;
548 req.rt.rtm_scope = RT_SCOPE_LINK;
549 req.rt.rtm_type = RTN_UNICAST;
550
551 netlink_addattr(&req.nh, RTA_OIF, &tunidx, sizeof(int));
552 netlink_addattr(&req.nh, RTA_DST, &ip, sizeof(ip));
553 metric = 1;
554 netlink_addattr(&req.nh, RTA_METRICS, &metric, sizeof(metric));
555
556 LOG(1, s, session[s].tunnel, "Route %s %s/%d\n",
557 add ? "add" : "del",
558 inet_ntop(AF_INET6, &ip, ipv6addr, INET6_ADDRSTRLEN),
559 prefixlen);
560
561 if (netlink_send(&req.nh) < 0)
562 LOG(0, 0, 0, "route6set() error in sending netlink message: %s\n", strerror(errno));
563
564 #ifdef BGP
565 if (add)
566 bgp_add_route6(ip, prefixlen);
567 else
568 bgp_del_route6(ip, prefixlen);
569 #endif /* BGP */
570
571 if (s)
572 {
573 if (!add) // Are we deleting a route?
574 s = 0; // Caching the session as '0' is the same as uncaching.
575
576 cache_ipv6map(ip, prefixlen, s);
577 }
578
579 return;
580 }
581
582 //
583 // Set up netlink socket
584 static void initnetlink(void)
585 {
586 struct sockaddr_nl nladdr;
587
588 nlfd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
589 if (nlfd < 0)
590 {
591 LOG(0, 0, 0, "Can't create netlink socket: %s\n", strerror(errno));
592 exit(1);
593 }
594
595 memset(&nladdr, 0, sizeof(nladdr));
596 nladdr.nl_family = AF_NETLINK;
597 nladdr.nl_pid = getpid();
598
599 if (bind(nlfd, (struct sockaddr *)&nladdr, sizeof(nladdr)) < 0)
600 {
601 LOG(0, 0, 0, "Can't bind netlink socket: %s\n", strerror(errno));
602 exit(1);
603 }
604 }
605
606 static ssize_t netlink_send(struct nlmsghdr *nh)
607 {
608 struct sockaddr_nl nladdr;
609 struct iovec iov;
610 struct msghdr msg;
611
612 nh->nlmsg_pid = getpid();
613 nh->nlmsg_seq = ++nlseqnum;
614
615 // set kernel address
616 memset(&nladdr, 0, sizeof(nladdr));
617 nladdr.nl_family = AF_NETLINK;
618
619 iov = (struct iovec){ (void *)nh, nh->nlmsg_len };
620 msg = (struct msghdr){ (void *)&nladdr, sizeof(nladdr), &iov, 1, NULL, 0, 0 };
621
622 return sendmsg(nlfd, &msg, 0);
623 }
624
625 static ssize_t netlink_recv(void *buf, ssize_t len)
626 {
627 struct sockaddr_nl nladdr;
628 struct iovec iov;
629 struct msghdr msg;
630
631 // set kernel address
632 memset(&nladdr, 0, sizeof(nladdr));
633 nladdr.nl_family = AF_NETLINK;
634
635 iov = (struct iovec){ buf, len };
636 msg = (struct msghdr){ (void *)&nladdr, sizeof(nladdr), &iov, 1, NULL, 0, 0 };
637
638 return recvmsg(nlfd, &msg, 0);
639 }
640
641 /* adapted from iproute2 */
642 static void netlink_addattr(struct nlmsghdr *nh, int type, const void *data, int alen)
643 {
644 int len = RTA_LENGTH(alen);
645 struct rtattr *rta;
646
647 rta = (struct rtattr *)(((void *)nh) + NLMSG_ALIGN(nh->nlmsg_len));
648 rta->rta_type = type;
649 rta->rta_len = len;
650 memcpy(RTA_DATA(rta), data, alen);
651 nh->nlmsg_len = NLMSG_ALIGN(nh->nlmsg_len) + RTA_ALIGN(len);
652 }
653
654 // messages corresponding to different phases seq number
655 static char *tun_nl_phase_msg[] = {
656 "initialized",
657 "getting tun interface index",
658 "setting tun interface parameters",
659 "setting tun IPv4 address",
660 "setting tun LL IPv6 address",
661 "setting tun global IPv6 address",
662 };
663
664 //
665 // Set up TUN interface
666 static void inittun(void)
667 {
668 struct ifreq ifr;
669
670 memset(&ifr, 0, sizeof(ifr));
671 ifr.ifr_flags = IFF_TUN;
672
673 tunfd = open(TUNDEVICE, O_RDWR);
674 if (tunfd < 0)
675 { // fatal
676 LOG(0, 0, 0, "Can't open %s: %s\n", TUNDEVICE, strerror(errno));
677 exit(1);
678 }
679 {
680 int flags = fcntl(tunfd, F_GETFL, 0);
681 fcntl(tunfd, F_SETFL, flags | O_NONBLOCK);
682 }
683 if (ioctl(tunfd, TUNSETIFF, (void *) &ifr) < 0)
684 {
685 LOG(0, 0, 0, "Can't set tun interface: %s\n", strerror(errno));
686 exit(1);
687 }
688 assert(strlen(ifr.ifr_name) < sizeof(config->tundevice) - 1);
689 strncpy(config->tundevice, ifr.ifr_name, sizeof(config->tundevice));
690
691 tunidx = if_nametoindex(config->tundevice);
692 if (tunidx == 0)
693 {
694 LOG(0, 0, 0, "Can't get tun interface index\n");
695 exit(1);
696 }
697
698 {
699 struct {
700 // interface setting
701 struct nlmsghdr nh;
702 union {
703 struct ifinfomsg ifinfo;
704 struct ifaddrmsg ifaddr;
705 } ifmsg;
706 char rtdata[32]; // 32 should be enough
707 } req;
708 uint32_t txqlen, mtu;
709 in_addr_t ip;
710
711 memset(&req, 0, sizeof(req));
712
713 req.nh.nlmsg_type = RTM_NEWLINK;
714 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_MULTI;
715 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifmsg.ifinfo));
716
717 req.ifmsg.ifinfo.ifi_family = AF_UNSPEC;
718 req.ifmsg.ifinfo.ifi_index = tunidx;
719 req.ifmsg.ifinfo.ifi_flags |= IFF_UP; // set interface up
720 req.ifmsg.ifinfo.ifi_change = IFF_UP; // only change this flag
721
722 /* Bump up the qlen to deal with bursts from the network */
723 txqlen = 1000;
724 netlink_addattr(&req.nh, IFLA_TXQLEN, &txqlen, sizeof(txqlen));
725 /* set MTU to modem MRU */
726 mtu = MRU;
727 netlink_addattr(&req.nh, IFLA_MTU, &mtu, sizeof(mtu));
728
729 if (netlink_send(&req.nh) < 0)
730 goto senderror;
731
732 memset(&req, 0, sizeof(req));
733
734 req.nh.nlmsg_type = RTM_NEWADDR;
735 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_REPLACE | NLM_F_MULTI;
736 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifmsg.ifaddr));
737
738 req.ifmsg.ifaddr.ifa_family = AF_INET;
739 req.ifmsg.ifaddr.ifa_prefixlen = 32;
740 req.ifmsg.ifaddr.ifa_scope = RT_SCOPE_UNIVERSE;
741 req.ifmsg.ifaddr.ifa_index = tunidx;
742
743 if (config->bind_address)
744 ip = config->bind_address;
745 else
746 ip = 0x01010101; // 1.1.1.1
747 netlink_addattr(&req.nh, IFA_LOCAL, &ip, sizeof(ip));
748
749 if (netlink_send(&req.nh) < 0)
750 goto senderror;
751
752 // Only setup IPv6 on the tun device if we have a configured prefix
753 if (config->ipv6_prefix.s6_addr[0]) {
754 struct in6_addr ip6;
755
756 memset(&req, 0, sizeof(req));
757
758 req.nh.nlmsg_type = RTM_NEWADDR;
759 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_REPLACE | NLM_F_MULTI;
760 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifmsg.ifaddr));
761
762 req.ifmsg.ifaddr.ifa_family = AF_INET6;
763 req.ifmsg.ifaddr.ifa_prefixlen = 64;
764 req.ifmsg.ifaddr.ifa_scope = RT_SCOPE_LINK;
765 req.ifmsg.ifaddr.ifa_index = tunidx;
766
767 // Link local address is FE80::1
768 memset(&ip6, 0, sizeof(ip6));
769 ip6.s6_addr[0] = 0xFE;
770 ip6.s6_addr[1] = 0x80;
771 ip6.s6_addr[15] = 1;
772 netlink_addattr(&req.nh, IFA_LOCAL, &ip6, sizeof(ip6));
773
774 if (netlink_send(&req.nh) < 0)
775 goto senderror;
776
777 memset(&req, 0, sizeof(req));
778
779 req.nh.nlmsg_type = RTM_NEWADDR;
780 req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_REPLACE | NLM_F_MULTI;
781 req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifmsg.ifaddr));
782
783 req.ifmsg.ifaddr.ifa_family = AF_INET6;
784 req.ifmsg.ifaddr.ifa_prefixlen = 64;
785 req.ifmsg.ifaddr.ifa_scope = RT_SCOPE_UNIVERSE;
786 req.ifmsg.ifaddr.ifa_index = tunidx;
787
788 // Global address is prefix::1
789 ip6 = config->ipv6_prefix;
790 ip6.s6_addr[15] = 1;
791 netlink_addattr(&req.nh, IFA_LOCAL, &ip6, sizeof(ip6));
792
793 if (netlink_send(&req.nh) < 0)
794 goto senderror;
795 }
796
797 memset(&req, 0, sizeof(req));
798
799 req.nh.nlmsg_type = NLMSG_DONE;
800 req.nh.nlmsg_len = NLMSG_LENGTH(0);
801
802 if (netlink_send(&req.nh) < 0)
803 goto senderror;
804
805 // if we get an error for seqnum < min_initok_nlseqnum,
806 // we must exit as initialization went wrong
807 if (config->ipv6_prefix.s6_addr[0])
808 min_initok_nlseqnum = 5 + 1; // idx + if + addr + 2*addr6
809 else
810 min_initok_nlseqnum = 3 + 1; // idx + if + addr
811 }
812
813 return;
814
815 senderror:
816 LOG(0, 0, 0, "Error while setting up tun device: %s\n", strerror(errno));
817 exit(1);
818 }
819
820 // set up UDP ports
821 static void initudp(void)
822 {
823 int on = 1;
824 struct sockaddr_in addr;
825
826 // Tunnel
827 memset(&addr, 0, sizeof(addr));
828 addr.sin_family = AF_INET;
829 addr.sin_port = htons(L2TPPORT);
830 addr.sin_addr.s_addr = config->bind_address;
831 udpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
832 setsockopt(udpfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
833 {
834 int flags = fcntl(udpfd, F_GETFL, 0);
835 fcntl(udpfd, F_SETFL, flags | O_NONBLOCK);
836 }
837 if (bind(udpfd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
838 {
839 LOG(0, 0, 0, "Error in UDP bind: %s\n", strerror(errno));
840 exit(1);
841 }
842
843 // Control
844 memset(&addr, 0, sizeof(addr));
845 addr.sin_family = AF_INET;
846 addr.sin_port = htons(NSCTL_PORT);
847 controlfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
848 setsockopt(controlfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
849 setsockopt(controlfd, SOL_IP, IP_PKTINFO, &on, sizeof(on)); // recvfromto
850 if (bind(controlfd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
851 {
852 LOG(0, 0, 0, "Error in control bind: %s\n", strerror(errno));
853 exit(1);
854 }
855
856 // Dynamic Authorization Extensions to RADIUS
857 memset(&addr, 0, sizeof(addr));
858 addr.sin_family = AF_INET;
859 addr.sin_port = htons(config->radius_dae_port);
860 daefd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
861 setsockopt(daefd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
862 setsockopt(daefd, SOL_IP, IP_PKTINFO, &on, sizeof(on)); // recvfromto
863 if (bind(daefd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
864 {
865 LOG(0, 0, 0, "Error in DAE bind: %s\n", strerror(errno));
866 exit(1);
867 }
868
869 // Intercept
870 snoopfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
871 }
872
873 //
874 // Find session by IP, < 1 for not found
875 //
876 // Confusingly enough, this 'ip' must be
877 // in _network_ order. This being the common
878 // case when looking it up from IP packet headers.
879 //
880 // We actually use this cache for two things.
881 // #1. For used IP addresses, this maps to the
882 // session ID that it's used by.
883 // #2. For un-used IP addresses, this maps to the
884 // index into the pool table that contains that
885 // IP address.
886 //
887
888 static sessionidt lookup_ipmap(in_addr_t ip)
889 {
890 uint8_t *a = (uint8_t *) &ip;
891 union iphash *h = ip_hash;
892
893 if (!(h = h[*a++].idx)) return 0;
894 if (!(h = h[*a++].idx)) return 0;
895 if (!(h = h[*a++].idx)) return 0;
896
897 return h[*a].sess;
898 }
899
900 static sessionidt lookup_ipv6map(struct in6_addr ip)
901 {
902 struct ipv6radix *curnode;
903 int i;
904 int s;
905 char ipv6addr[INET6_ADDRSTRLEN];
906
907 curnode = &ipv6_hash[ip.s6_addr[0]];
908 i = 1;
909 s = curnode->sess;
910
911 while (s == 0 && i < 15 && curnode->branch != NULL)
912 {
913 curnode = &curnode->branch[ip.s6_addr[i]];
914 s = curnode->sess;
915 i++;
916 }
917
918 LOG(4, s, session[s].tunnel, "Looking up address %s and got %d\n",
919 inet_ntop(AF_INET6, &ip, ipv6addr,
920 INET6_ADDRSTRLEN),
921 s);
922
923 return s;
924 }
925
926 sessionidt sessionbyip(in_addr_t ip)
927 {
928 sessionidt s = lookup_ipmap(ip);
929 CSTAT(sessionbyip);
930
931 if (s > 0 && s < MAXSESSION && session[s].opened)
932 return s;
933
934 return 0;
935 }
936
937 sessionidt sessionbyipv6(struct in6_addr ip)
938 {
939 sessionidt s;
940 CSTAT(sessionbyipv6);
941
942 if (!memcmp(&config->ipv6_prefix, &ip, 8) ||
943 (ip.s6_addr[0] == 0xFE &&
944 ip.s6_addr[1] == 0x80 &&
945 ip.s6_addr16[1] == 0 &&
946 ip.s6_addr16[2] == 0 &&
947 ip.s6_addr16[3] == 0)) {
948 s = lookup_ipmap(*(in_addr_t *) &ip.s6_addr[8]);
949 } else {
950 s = lookup_ipv6map(ip);
951 }
952
953 if (s > 0 && s < MAXSESSION && session[s].opened)
954 return s;
955
956 return 0;
957 }
958
959 //
960 // Take an IP address in HOST byte order and
961 // add it to the sessionid by IP cache.
962 //
963 // (It's actually cached in network order)
964 //
965 static void cache_ipmap(in_addr_t ip, sessionidt s)
966 {
967 in_addr_t nip = htonl(ip); // MUST be in network order. I.e. MSB must in be ((char *) (&ip))[0]
968 uint8_t *a = (uint8_t *) &nip;
969 union iphash *h = ip_hash;
970 int i;
971
972 for (i = 0; i < 3; i++)
973 {
974 if (!(h[a[i]].idx || (h[a[i]].idx = calloc(256, sizeof(union iphash)))))
975 return;
976
977 h = h[a[i]].idx;
978 }
979
980 h[a[3]].sess = s;
981
982 if (s > 0)
983 LOG(4, s, session[s].tunnel, "Caching ip address %s\n", fmtaddr(nip, 0));
984
985 else if (s == 0)
986 LOG(4, 0, 0, "Un-caching ip address %s\n", fmtaddr(nip, 0));
987 // else a map to an ip pool index.
988 }
989
990 static void uncache_ipmap(in_addr_t ip)
991 {
992 cache_ipmap(ip, 0); // Assign it to the NULL session.
993 }
994
995 static void cache_ipv6map(struct in6_addr ip, int prefixlen, sessionidt s)
996 {
997 int i;
998 int bytes;
999 struct ipv6radix *curnode;
1000 char ipv6addr[INET6_ADDRSTRLEN];
1001
1002 curnode = &ipv6_hash[ip.s6_addr[0]];
1003
1004 bytes = prefixlen >> 3;
1005 i = 1;
1006 while (i < bytes) {
1007 if (curnode->branch == NULL)
1008 {
1009 if (!(curnode->branch = calloc(256,
1010 sizeof (struct ipv6radix))))
1011 return;
1012 }
1013 curnode = &curnode->branch[ip.s6_addr[i]];
1014 i++;
1015 }
1016
1017 curnode->sess = s;
1018
1019 if (s > 0)
1020 LOG(4, s, session[s].tunnel, "Caching ip address %s/%d\n",
1021 inet_ntop(AF_INET6, &ip, ipv6addr,
1022 INET6_ADDRSTRLEN),
1023 prefixlen);
1024 else if (s == 0)
1025 LOG(4, 0, 0, "Un-caching ip address %s/%d\n",
1026 inet_ntop(AF_INET6, &ip, ipv6addr,
1027 INET6_ADDRSTRLEN),
1028 prefixlen);
1029 }
1030
1031 //
1032 // CLI list to dump current ipcache.
1033 //
1034 int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc)
1035 {
1036 union iphash *d = ip_hash, *e, *f, *g;
1037 int i, j, k, l;
1038 int count = 0;
1039
1040 if (CLI_HELP_REQUESTED)
1041 return CLI_HELP_NO_ARGS;
1042
1043 cli_print(cli, "%7s %s", "Sess#", "IP Address");
1044
1045 for (i = 0; i < 256; ++i)
1046 {
1047 if (!d[i].idx)
1048 continue;
1049
1050 e = d[i].idx;
1051 for (j = 0; j < 256; ++j)
1052 {
1053 if (!e[j].idx)
1054 continue;
1055
1056 f = e[j].idx;
1057 for (k = 0; k < 256; ++k)
1058 {
1059 if (!f[k].idx)
1060 continue;
1061
1062 g = f[k].idx;
1063 for (l = 0; l < 256; ++l)
1064 {
1065 if (!g[l].sess)
1066 continue;
1067
1068 cli_print(cli, "%7d %d.%d.%d.%d", g[l].sess, i, j, k, l);
1069 ++count;
1070 }
1071 }
1072 }
1073 }
1074 cli_print(cli, "%d entries in cache", count);
1075 return CLI_OK;
1076 }
1077
1078
1079 // Find session by username, 0 for not found
1080 // walled garden users aren't authenticated, so the username is
1081 // reasonably useless. Ignore them to avoid incorrect actions
1082 //
1083 // This is VERY inefficent. Don't call it often. :)
1084 //
1085 sessionidt sessionbyuser(char *username)
1086 {
1087 int s;
1088 CSTAT(sessionbyuser);
1089
1090 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
1091 {
1092 if (!session[s].opened)
1093 continue;
1094
1095 if (session[s].walled_garden)
1096 continue; // Skip walled garden users.
1097
1098 if (!strncmp(session[s].user, username, 128))
1099 return s;
1100
1101 }
1102 return 0; // Not found.
1103 }
1104
1105 void send_garp(in_addr_t ip)
1106 {
1107 int s;
1108 struct ifreq ifr;
1109 uint8_t mac[6];
1110
1111 s = socket(PF_INET, SOCK_DGRAM, 0);
1112 if (s < 0)
1113 {
1114 LOG(0, 0, 0, "Error creating socket for GARP: %s\n", strerror(errno));
1115 return;
1116 }
1117 memset(&ifr, 0, sizeof(ifr));
1118 strncpy(ifr.ifr_name, "eth0", sizeof(ifr.ifr_name) - 1);
1119 if (ioctl(s, SIOCGIFHWADDR, &ifr) < 0)
1120 {
1121 LOG(0, 0, 0, "Error getting eth0 hardware address for GARP: %s\n", strerror(errno));
1122 close(s);
1123 return;
1124 }
1125 memcpy(mac, &ifr.ifr_hwaddr.sa_data, 6*sizeof(char));
1126 if (ioctl(s, SIOCGIFINDEX, &ifr) < 0)
1127 {
1128 LOG(0, 0, 0, "Error getting eth0 interface index for GARP: %s\n", strerror(errno));
1129 close(s);
1130 return;
1131 }
1132 close(s);
1133 sendarp(ifr.ifr_ifindex, mac, ip);
1134 }
1135
1136 static sessiont *sessiontbysessionidt(sessionidt s)
1137 {
1138 if (!s || s >= MAXSESSION) return NULL;
1139 return &session[s];
1140 }
1141
1142 static sessionidt sessionidtbysessiont(sessiont *s)
1143 {
1144 sessionidt val = s-session;
1145 if (s < session || val >= MAXSESSION) return 0;
1146 return val;
1147 }
1148
1149 // actually send a control message for a specific tunnel
1150 void tunnelsend(uint8_t * buf, uint16_t l, tunnelidt t)
1151 {
1152 struct sockaddr_in addr;
1153
1154 CSTAT(tunnelsend);
1155
1156 if (!t)
1157 {
1158 LOG(0, 0, t, "tunnelsend called with 0 as tunnel id\n");
1159 STAT(tunnel_tx_errors);
1160 return;
1161 }
1162
1163 if (!tunnel[t].ip)
1164 {
1165 LOG(1, 0, t, "Error sending data out tunnel: no remote endpoint (tunnel not set up)\n");
1166 STAT(tunnel_tx_errors);
1167 return;
1168 }
1169
1170 memset(&addr, 0, sizeof(addr));
1171 addr.sin_family = AF_INET;
1172 *(uint32_t *) & addr.sin_addr = htonl(tunnel[t].ip);
1173 addr.sin_port = htons(tunnel[t].port);
1174
1175 // sequence expected, if sequence in message
1176 if (*buf & 0x08) *(uint16_t *) (buf + ((*buf & 0x40) ? 10 : 8)) = htons(tunnel[t].nr);
1177
1178 // If this is a control message, deal with retries
1179 if (*buf & 0x80)
1180 {
1181 tunnel[t].last = time_now; // control message sent
1182 tunnel[t].retry = backoff(tunnel[t].try); // when to resend
1183 if (tunnel[t].try)
1184 {
1185 STAT(tunnel_retries);
1186 LOG(3, 0, t, "Control message resend try %d\n", tunnel[t].try);
1187 }
1188 }
1189
1190 if (sendto(udpfd, buf, l, 0, (void *) &addr, sizeof(addr)) < 0)
1191 {
1192 LOG(0, ntohs((*(uint16_t *) (buf + 6))), t, "Error sending data out tunnel: %s (udpfd=%d, buf=%p, len=%d, dest=%s)\n",
1193 strerror(errno), udpfd, buf, l, inet_ntoa(addr.sin_addr));
1194 STAT(tunnel_tx_errors);
1195 return;
1196 }
1197
1198 LOG_HEX(5, "Send Tunnel Data", buf, l);
1199 STAT(tunnel_tx_packets);
1200 INC_STAT(tunnel_tx_bytes, l);
1201 }
1202
1203 //
1204 // Tiny helper function to write data to
1205 // the 'tun' device.
1206 //
1207 int tun_write(uint8_t * data, int size)
1208 {
1209 return write(tunfd, data, size);
1210 }
1211
1212 // adjust tcp mss to avoid fragmentation (called only for tcp packets with syn set)
1213 void adjust_tcp_mss(sessionidt s, tunnelidt t, uint8_t *buf, int len, uint8_t *tcp)
1214 {
1215 int d = (tcp[12] >> 4) * 4;
1216 uint8_t *mss = 0;
1217 uint8_t *opts;
1218 uint8_t *data;
1219 uint16_t orig;
1220 uint32_t sum;
1221
1222 if ((tcp[13] & 0x3f) & ~(TCP_FLAG_SYN|TCP_FLAG_ACK)) // only want SYN and SYN,ACK
1223 return;
1224
1225 if (tcp + d > buf + len) // short?
1226 return;
1227
1228 opts = tcp + 20;
1229 data = tcp + d;
1230
1231 while (opts < data)
1232 {
1233 if (*opts == 2 && opts[1] == 4) // mss option (2), length 4
1234 {
1235 mss = opts + 2;
1236 if (mss + 2 > data) return; // short?
1237 break;
1238 }
1239
1240 if (*opts == 0) return; // end of options
1241 if (*opts == 1 || !opts[1]) // no op (one byte), or no length (prevent loop)
1242 opts++;
1243 else
1244 opts += opts[1]; // skip over option
1245 }
1246
1247 if (!mss) return; // not found
1248 orig = ntohs(*(uint16_t *) mss);
1249
1250 if (orig <= MSS) return; // mss OK
1251
1252 LOG(5, s, t, "TCP: %s:%u -> %s:%u SYN%s: adjusted mss from %u to %u\n",
1253 fmtaddr(*(in_addr_t *) (buf + 12), 0), ntohs(*(uint16_t *) tcp),
1254 fmtaddr(*(in_addr_t *) (buf + 16), 1), ntohs(*(uint16_t *) (tcp + 2)),
1255 (tcp[13] & TCP_FLAG_ACK) ? ",ACK" : "", orig, MSS);
1256
1257 // set mss
1258 *(int16_t *) mss = htons(MSS);
1259
1260 // adjust checksum (see rfc1141)
1261 sum = orig + (~MSS & 0xffff);
1262 sum += ntohs(*(uint16_t *) (tcp + 16));
1263 sum = (sum & 0xffff) + (sum >> 16);
1264 *(uint16_t *) (tcp + 16) = htons(sum + (sum >> 16));
1265 }
1266
1267 void processmpframe(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint8_t extra)
1268 {
1269 uint16_t proto;
1270 if (extra) {
1271 // Skip the four extra bytes
1272 p += 4;
1273 l -= 4;
1274 }
1275
1276 if (*p & 1)
1277 {
1278 proto = *p++;
1279 l--;
1280 }
1281 else
1282 {
1283 proto = ntohs(*(uint16_t *) p);
1284 p += 2;
1285 l -= 2;
1286 }
1287 if (proto == PPPIP)
1288 {
1289 if (session[s].die)
1290 {
1291 LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
1292 return; // closing session, PPP not processed
1293 }
1294 session[s].last_packet = session[s].last_data = time_now;
1295 processipin(s, t, p, l);
1296 }
1297 else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
1298 {
1299 if (session[s].die)
1300 {
1301 LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
1302 return; // closing session, PPP not processed
1303 }
1304
1305 session[s].last_packet = session[s].last_data = time_now;
1306 processipv6in(s, t, p, l);
1307 }
1308 else if (proto == PPPIPCP)
1309 {
1310 session[s].last_packet = session[s].last_data = time_now;
1311 processipcp(s, t, p, l);
1312 }
1313 else if (proto == PPPCCP)
1314 {
1315 session[s].last_packet = session[s].last_data = time_now;
1316 processccp(s, t, p, l);
1317 }
1318 else
1319 {
1320 LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
1321 }
1322 }
1323
1324 static void update_session_out_stat(sessionidt s, sessiont *sp, int len)
1325 {
1326 increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
1327 sp->cout_delta += len;
1328 sp->pout++;
1329 sp->last_data = time_now;
1330
1331 sess_local[s].cout += len; // To send to master..
1332 sess_local[s].pout++;
1333 }
1334
1335 // process outgoing (to tunnel) IP
1336 //
1337 // (i.e. this routine writes to data[-8]).
1338 void processipout(uint8_t *buf, int len)
1339 {
1340 sessionidt s;
1341 sessiont *sp;
1342 tunnelidt t;
1343 in_addr_t ip;
1344
1345 uint8_t *data = buf; // Keep a copy of the originals.
1346 int size = len;
1347
1348 uint8_t fragbuf[MAXETHER + 20];
1349
1350 CSTAT(processipout);
1351
1352 if (len < MIN_IP_SIZE)
1353 {
1354 LOG(1, 0, 0, "Short IP, %d bytes\n", len);
1355 STAT(tun_rx_errors);
1356 return;
1357 }
1358 if (len >= MAXETHER)
1359 {
1360 LOG(1, 0, 0, "Oversize IP packet %d bytes\n", len);
1361 STAT(tun_rx_errors);
1362 return;
1363 }
1364
1365 // Skip the tun header
1366 buf += 4;
1367 len -= 4;
1368
1369 // Got an IP header now
1370 if (*(uint8_t *)(buf) >> 4 != 4)
1371 {
1372 LOG(1, 0, 0, "IP: Don't understand anything except IPv4\n");
1373 return;
1374 }
1375
1376 ip = *(uint32_t *)(buf + 16);
1377 if (!(s = sessionbyip(ip)))
1378 {
1379 // Is this a packet for a session that doesn't exist?
1380 static int rate = 0; // Number of ICMP packets we've sent this second.
1381 static int last = 0; // Last time we reset the ICMP packet counter 'rate'.
1382
1383 if (last != time_now)
1384 {
1385 last = time_now;
1386 rate = 0;
1387 }
1388
1389 if (rate++ < config->icmp_rate) // Only send a max of icmp_rate per second.
1390 {
1391 LOG(4, 0, 0, "IP: Sending ICMP host unreachable to %s\n", fmtaddr(*(in_addr_t *)(buf + 12), 0));
1392 host_unreachable(*(in_addr_t *)(buf + 12), *(uint16_t *)(buf + 4),
1393 config->bind_address ? config->bind_address : my_address, buf, len);
1394 }
1395 return;
1396 }
1397
1398 t = session[s].tunnel;
1399 if (len > session[s].mru || (session[s].mrru && len > session[s].mrru))
1400 {
1401 LOG(3, s, t, "Packet size more than session MRU\n");
1402 return;
1403 }
1404
1405 sp = &session[s];
1406
1407 // DoS prevention: enforce a maximum number of packets per 0.1s for a session
1408 if (config->max_packets > 0)
1409 {
1410 if (sess_local[s].last_packet_out == TIME)
1411 {
1412 int max = config->max_packets;
1413
1414 // All packets for throttled sessions are handled by the
1415 // master, so further limit by using the throttle rate.
1416 // A bit of a kludge, since throttle rate is in kbps,
1417 // but should still be generous given our average DSL
1418 // packet size is 200 bytes: a limit of 28kbps equates
1419 // to around 180 packets per second.
1420 if (!config->cluster_iam_master && sp->throttle_out && sp->throttle_out < max)
1421 max = sp->throttle_out;
1422
1423 if (++sess_local[s].packets_out > max)
1424 {
1425 sess_local[s].packets_dropped++;
1426 return;
1427 }
1428 }
1429 else
1430 {
1431 if (sess_local[s].packets_dropped)
1432 {
1433 INC_STAT(tun_rx_dropped, sess_local[s].packets_dropped);
1434 LOG(3, s, t, "Dropped %u/%u packets to %s for %suser %s\n",
1435 sess_local[s].packets_dropped, sess_local[s].packets_out,
1436 fmtaddr(ip, 0), sp->throttle_out ? "throttled " : "",
1437 sp->user);
1438 }
1439
1440 sess_local[s].last_packet_out = TIME;
1441 sess_local[s].packets_out = 1;
1442 sess_local[s].packets_dropped = 0;
1443 }
1444 }
1445
1446 // run access-list if any
1447 if (session[s].filter_out && !ip_filter(buf, len, session[s].filter_out - 1))
1448 return;
1449
1450 // adjust MSS on SYN and SYN,ACK packets with options
1451 if ((ntohs(*(uint16_t *) (buf + 6)) & 0x1fff) == 0 && buf[9] == IPPROTO_TCP) // first tcp fragment
1452 {
1453 int ihl = (buf[0] & 0xf) * 4; // length of IP header
1454 if (len >= ihl + 20 && (buf[ihl + 13] & TCP_FLAG_SYN) && ((buf[ihl + 12] >> 4) > 5))
1455 adjust_tcp_mss(s, t, buf, len, buf + ihl);
1456 }
1457
1458 if (sp->tbf_out)
1459 {
1460 // Are we throttling this session?
1461 if (config->cluster_iam_master)
1462 tbf_queue_packet(sp->tbf_out, data, size);
1463 else
1464 master_throttle_packet(sp->tbf_out, data, size);
1465 return;
1466 }
1467
1468 if (sp->walled_garden && !config->cluster_iam_master)
1469 {
1470 // We are walled-gardening this
1471 master_garden_packet(s, data, size);
1472 return;
1473 }
1474
1475 if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1)
1476 {
1477
1478 if (!config->cluster_iam_master)
1479 {
1480 // The MPPP packets must be managed by the Master.
1481 master_forward_mppp_packet(s, data, size);
1482 return;
1483 }
1484
1485 // Add on L2TP header
1486 sessionidt members[MAXBUNDLESES];
1487 bundleidt bid = session[s].bundle;
1488 bundlet *b = &bundle[bid];
1489 uint32_t num_of_links, nb_opened;
1490 int i;
1491
1492 num_of_links = b->num_of_links;
1493 nb_opened = 0;
1494 for (i = 0;i < num_of_links;i++)
1495 {
1496 s = b->members[i];
1497 if (session[s].ppp.lcp == Opened)
1498 {
1499 members[nb_opened] = s;
1500 nb_opened++;
1501 }
1502 }
1503
1504 if (nb_opened < 1)
1505 {
1506 LOG(3, s, t, "MPPP: PROCESSIPOUT ERROR, no session opened in bundle:%d\n", bid);
1507 return;
1508 }
1509
1510 num_of_links = nb_opened;
1511 b->current_ses = (b->current_ses + 1) % num_of_links;
1512 s = members[b->current_ses];
1513 t = session[s].tunnel;
1514 sp = &session[s];
1515 LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s);
1516
1517 if (num_of_links > 1)
1518 {
1519 if(len > MINFRAGLEN)
1520 {
1521 //for rotate traffic among the member links
1522 uint32_t divisor = num_of_links;
1523 if (divisor > 2)
1524 divisor = divisor/2 + (divisor & 1);
1525
1526 // Partition the packet to "num_of_links" fragments
1527 uint32_t fraglen = len / divisor;
1528 uint32_t last_fraglen = fraglen + len % divisor;
1529 uint32_t remain = len;
1530
1531 // send the first packet
1532 uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
1533 if (!p) return;
1534 tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
1535
1536 // statistics
1537 update_session_out_stat(s, sp, fraglen);
1538
1539 remain -= fraglen;
1540 while (remain > last_fraglen)
1541 {
1542 b->current_ses = (b->current_ses + 1) % num_of_links;
1543 s = members[b->current_ses];
1544 t = session[s].tunnel;
1545 sp = &session[s];
1546 LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
1547 p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
1548 if (!p) return;
1549 tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
1550 update_session_out_stat(s, sp, fraglen);
1551 remain -= fraglen;
1552 }
1553 // send the last fragment
1554 b->current_ses = (b->current_ses + 1) % num_of_links;
1555 s = members[b->current_ses];
1556 t = session[s].tunnel;
1557 sp = &session[s];
1558 LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
1559 p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
1560 if (!p) return;
1561 tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
1562 update_session_out_stat(s, sp, remain);
1563 if (remain != last_fraglen)
1564 LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
1565 }
1566 else
1567 {
1568 // Send it as one frame
1569 uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
1570 if (!p) return;
1571 tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
1572 LOG(4, s, t, "MPPP: packet sent as one frame\n");
1573 update_session_out_stat(s, sp, len);
1574 }
1575 }
1576 else
1577 {
1578 // Send it as one frame (NO MPPP Frame)
1579 uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
1580 if (!p) return;
1581 tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
1582 update_session_out_stat(s, sp, len);
1583 }
1584 }
1585 else
1586 {
1587 uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
1588 if (!p) return;
1589 tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
1590 update_session_out_stat(s, sp, len);
1591 }
1592
1593 // Snooping this session, send it to intercept box
1594 if (sp->snoop_ip && sp->snoop_port)
1595 snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
1596
1597 udp_tx += len;
1598 }
1599
1600 // process outgoing (to tunnel) IPv6
1601 //
1602 static void processipv6out(uint8_t * buf, int len)
1603 {
1604 sessionidt s;
1605 sessiont *sp;
1606 tunnelidt t;
1607 in_addr_t ip;
1608 struct in6_addr ip6;
1609
1610 uint8_t *data = buf; // Keep a copy of the originals.
1611 int size = len;
1612
1613 uint8_t b[MAXETHER + 20];
1614
1615 CSTAT(processipv6out);
1616
1617 if (len < MIN_IP_SIZE)
1618 {
1619 LOG(1, 0, 0, "Short IPv6, %d bytes\n", len);
1620 STAT(tunnel_tx_errors);
1621 return;
1622 }
1623 if (len >= MAXETHER)
1624 {
1625 LOG(1, 0, 0, "Oversize IPv6 packet %d bytes\n", len);
1626 STAT(tunnel_tx_errors);
1627 return;
1628 }
1629
1630 // Skip the tun header
1631 buf += 4;
1632 len -= 4;
1633
1634 // Got an IP header now
1635 if (*(uint8_t *)(buf) >> 4 != 6)
1636 {
1637 LOG(1, 0, 0, "IP: Don't understand anything except IPv6\n");
1638 return;
1639 }
1640
1641 ip6 = *(struct in6_addr *)(buf+24);
1642 s = sessionbyipv6(ip6);
1643
1644 if (s == 0)
1645 {
1646 ip = *(uint32_t *)(buf + 32);
1647 s = sessionbyip(ip);
1648 }
1649
1650 if (s == 0)
1651 {
1652 // Is this a packet for a session that doesn't exist?
1653 static int rate = 0; // Number of ICMP packets we've sent this second.
1654 static int last = 0; // Last time we reset the ICMP packet counter 'rate'.
1655
1656 if (last != time_now)
1657 {
1658 last = time_now;
1659 rate = 0;
1660 }
1661
1662 if (rate++ < config->icmp_rate) // Only send a max of icmp_rate per second.
1663 {
1664 // FIXME: Should send icmp6 host unreachable
1665 }
1666 return;
1667 }
1668 if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1)
1669 {
1670 bundleidt bid = session[s].bundle;
1671 bundlet *b = &bundle[bid];
1672
1673 b->current_ses = (b->current_ses + 1) % b->num_of_links;
1674 s = b->members[b->current_ses];
1675 LOG(3, s, session[s].tunnel, "MPPP: Session number becomes: %u\n", s);
1676 }
1677 t = session[s].tunnel;
1678 sp = &session[s];
1679 sp->last_data = time_now;
1680
1681 // FIXME: add DoS prevention/filters?
1682
1683 if (sp->tbf_out)
1684 {
1685 // Are we throttling this session?
1686 if (config->cluster_iam_master)
1687 tbf_queue_packet(sp->tbf_out, data, size);
1688 else
1689 master_throttle_packet(sp->tbf_out, data, size);
1690 return;
1691 }
1692 else if (sp->walled_garden && !config->cluster_iam_master)
1693 {
1694 // We are walled-gardening this
1695 master_garden_packet(s, data, size);
1696 return;
1697 }
1698
1699 LOG(5, s, t, "Ethernet -> Tunnel (%d bytes)\n", len);
1700
1701 // Add on L2TP header
1702 {
1703 uint8_t *p = makeppp(b, sizeof(b), buf, len, s, t, PPPIPV6, 0, 0, 0);
1704 if (!p) return;
1705 tunnelsend(b, len + (p-b), t); // send it...
1706 }
1707
1708 // Snooping this session, send it to intercept box
1709 if (sp->snoop_ip && sp->snoop_port)
1710 snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
1711
1712 increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
1713 sp->cout_delta += len;
1714 sp->pout++;
1715 udp_tx += len;
1716
1717 sess_local[s].cout += len; // To send to master..
1718 sess_local[s].pout++;
1719 }
1720
1721 //
1722 // Helper routine for the TBF filters.
1723 // Used to send queued data in to the user!
1724 //
1725 static void send_ipout(sessionidt s, uint8_t *buf, int len)
1726 {
1727 sessiont *sp;
1728 tunnelidt t;
1729
1730 uint8_t b[MAXETHER + 20];
1731
1732 if (len < 0 || len > MAXETHER)
1733 {
1734 LOG(1, 0, 0, "Odd size IP packet: %d bytes\n", len);
1735 return;
1736 }
1737
1738 // Skip the tun header
1739 buf += 4;
1740 len -= 4;
1741
1742 if (!session[s].ip)
1743 return;
1744
1745 t = session[s].tunnel;
1746 sp = &session[s];
1747
1748 LOG(5, s, t, "Ethernet -> Tunnel (%d bytes)\n", len);
1749
1750 // Add on L2TP header
1751 {
1752 uint8_t *p = makeppp(b, sizeof(b), buf, len, s, t, PPPIP, 0, 0, 0);
1753 if (!p) return;
1754 tunnelsend(b, len + (p-b), t); // send it...
1755 }
1756
1757 // Snooping this session.
1758 if (sp->snoop_ip && sp->snoop_port)
1759 snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
1760
1761 increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
1762 sp->cout_delta += len;
1763 sp->pout++;
1764 udp_tx += len;
1765
1766 sess_local[s].cout += len; // To send to master..
1767 sess_local[s].pout++;
1768 }
1769
1770 // add an AVP (16 bit)
1771 static void control16(controlt * c, uint16_t avp, uint16_t val, uint8_t m)
1772 {
1773 uint16_t l = (m ? 0x8008 : 0x0008);
1774 c->buf16[c->length/2 + 0] = htons(l);
1775 c->buf16[c->length/2 + 1] = htons(0);
1776 c->buf16[c->length/2 + 2] = htons(avp);
1777 c->buf16[c->length/2 + 3] = htons(val);
1778 c->length += 8;
1779 }
1780
1781 // add an AVP (32 bit)
1782 static void control32(controlt * c, uint16_t avp, uint32_t val, uint8_t m)
1783 {
1784 uint16_t l = (m ? 0x800A : 0x000A);
1785 c->buf16[c->length/2 + 0] = htons(l);
1786 c->buf16[c->length/2 + 1] = htons(0);
1787 c->buf16[c->length/2 + 2] = htons(avp);
1788 *(uint32_t *) &c->buf[c->length + 6] = htonl(val);
1789 c->length += 10;
1790 }
1791
1792 // add an AVP (string)
1793 static void controls(controlt * c, uint16_t avp, char *val, uint8_t m)
1794 {
1795 uint16_t l = ((m ? 0x8000 : 0) + strlen(val) + 6);
1796 c->buf16[c->length/2 + 0] = htons(l);
1797 c->buf16[c->length/2 + 1] = htons(0);
1798 c->buf16[c->length/2 + 2] = htons(avp);
1799 memcpy(&c->buf[c->length + 6], val, strlen(val));
1800 c->length += 6 + strlen(val);
1801 }
1802
1803 // add a binary AVP
1804 static void controlb(controlt * c, uint16_t avp, uint8_t *val, unsigned int len, uint8_t m)
1805 {
1806 uint16_t l = ((m ? 0x8000 : 0) + len + 6);
1807 c->buf16[c->length/2 + 0] = htons(l);
1808 c->buf16[c->length/2 + 1] = htons(0);
1809 c->buf16[c->length/2 + 2] = htons(avp);
1810 memcpy(&c->buf[c->length + 6], val, len);
1811 c->length += 6 + len;
1812 }
1813
1814 // new control connection
1815 static controlt *controlnew(uint16_t mtype)
1816 {
1817 controlt *c;
1818 if (!controlfree)
1819 c = malloc(sizeof(controlt));
1820 else
1821 {
1822 c = controlfree;
1823 controlfree = c->next;
1824 }
1825 assert(c);
1826 c->next = 0;
1827 c->buf16[0] = htons(0xC802); // flags/ver
1828 c->length = 12;
1829 control16(c, 0, mtype, 1);
1830 return c;
1831 }
1832
1833 // send zero block if nothing is waiting
1834 // (ZLB send).
1835 static void controlnull(tunnelidt t)
1836 {
1837 uint16_t buf[6];
1838 if (tunnel[t].controlc) // Messages queued; They will carry the ack.
1839 return;
1840
1841 buf[0] = htons(0xC802); // flags/ver
1842 buf[1] = htons(12); // length
1843 buf[2] = htons(tunnel[t].far); // tunnel
1844 buf[3] = htons(0); // session
1845 buf[4] = htons(tunnel[t].ns); // sequence
1846 buf[5] = htons(tunnel[t].nr); // sequence
1847 tunnelsend((uint8_t *)buf, 12, t);
1848 }
1849
1850 // add a control message to a tunnel, and send if within window
1851 static void controladd(controlt *c, sessionidt far, tunnelidt t)
1852 {
1853 c->buf16[1] = htons(c->length); // length
1854 c->buf16[2] = htons(tunnel[t].far); // tunnel
1855 c->buf16[3] = htons(far); // session
1856 c->buf16[4] = htons(tunnel[t].ns); // sequence
1857 tunnel[t].ns++; // advance sequence
1858 // link in message in to queue
1859 if (tunnel[t].controlc)
1860 tunnel[t].controle->next = c;
1861 else
1862 tunnel[t].controls = c;
1863
1864 tunnel[t].controle = c;
1865 tunnel[t].controlc++;
1866
1867 // send now if space in window
1868 if (tunnel[t].controlc <= tunnel[t].window)
1869 {
1870 tunnel[t].try = 0; // first send
1871 tunnelsend(c->buf, c->length, t);
1872 }
1873 }
1874
1875 //
1876 // Throttle or Unthrottle a session
1877 //
1878 // Throttle the data from/to through a session to no more than
1879 // 'rate_in' kbit/sec in (from user) or 'rate_out' kbit/sec out (to
1880 // user).
1881 //
1882 // If either value is -1, the current value is retained for that
1883 // direction.
1884 //
1885 void throttle_session(sessionidt s, int rate_in, int rate_out)
1886 {
1887 if (!session[s].opened)
1888 return; // No-one home.
1889
1890 if (!*session[s].user)
1891 return; // User not logged in
1892
1893 if (rate_in >= 0)
1894 {
1895 int bytes = rate_in * 1024 / 8; // kbits to bytes
1896 if (session[s].tbf_in)
1897 free_tbf(session[s].tbf_in);
1898
1899 if (rate_in > 0)
1900 session[s].tbf_in = new_tbf(s, bytes * 2, bytes, send_ipin);
1901 else
1902 session[s].tbf_in = 0;
1903
1904 session[s].throttle_in = rate_in;
1905 }
1906
1907 if (rate_out >= 0)
1908 {
1909 int bytes = rate_out * 1024 / 8;
1910 if (session[s].tbf_out)
1911 free_tbf(session[s].tbf_out);
1912
1913 if (rate_out > 0)
1914 session[s].tbf_out = new_tbf(s, bytes * 2, bytes, send_ipout);
1915 else
1916 session[s].tbf_out = 0;
1917
1918 session[s].throttle_out = rate_out;
1919 }
1920 }
1921
1922 // add/remove filters from session (-1 = no change)
1923 void filter_session(sessionidt s, int filter_in, int filter_out)
1924 {
1925 if (!session[s].opened)
1926 return; // No-one home.
1927
1928 if (!*session[s].user)
1929 return; // User not logged in
1930
1931 // paranoia
1932 if (filter_in > MAXFILTER) filter_in = -1;
1933 if (filter_out > MAXFILTER) filter_out = -1;
1934 if (session[s].filter_in > MAXFILTER) session[s].filter_in = 0;
1935 if (session[s].filter_out > MAXFILTER) session[s].filter_out = 0;
1936
1937 if (filter_in >= 0)
1938 {
1939 if (session[s].filter_in)
1940 ip_filters[session[s].filter_in - 1].used--;
1941
1942 if (filter_in > 0)
1943 ip_filters[filter_in - 1].used++;
1944
1945 session[s].filter_in = filter_in;
1946 }
1947
1948 if (filter_out >= 0)
1949 {
1950 if (session[s].filter_out)
1951 ip_filters[session[s].filter_out - 1].used--;
1952
1953 if (filter_out > 0)
1954 ip_filters[filter_out - 1].used++;
1955
1956 session[s].filter_out = filter_out;
1957 }
1958 }
1959
1960 // start tidy shutdown of session
1961 void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause)
1962 {
1963 int walled_garden = session[s].walled_garden;
1964 bundleidt b = session[s].bundle;
1965 //delete routes only for last session in bundle (in case of MPPP)
1966 int del_routes = !b || (bundle[b].num_of_links == 1);
1967
1968 CSTAT(sessionshutdown);
1969
1970 if (!session[s].opened)
1971 {
1972 LOG(3, s, session[s].tunnel, "Called sessionshutdown on an unopened session.\n");
1973 return; // not a live session
1974 }
1975
1976 if (!session[s].die)
1977 {
1978 struct param_kill_session data = { &tunnel[session[s].tunnel], &session[s] };
1979 LOG(2, s, session[s].tunnel, "Shutting down session %u: %s\n", s, reason);
1980 run_plugins(PLUGIN_KILL_SESSION, &data);
1981 session[s].die = TIME + 150; // Clean up in 15 seconds
1982 }
1983
1984 if (session[s].ip && !walled_garden && !session[s].die)
1985 {
1986 // RADIUS Stop message
1987 uint16_t r = radiusnew(s);
1988 if (r)
1989 {
1990 // stop, if not already trying
1991 if (radius[r].state != RADIUSSTOP)
1992 {
1993 radius[r].term_cause = term_cause;
1994 radius[r].term_msg = reason;
1995 radiussend(r, RADIUSSTOP);
1996 }
1997 }
1998 else
1999 LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Stop message\n");
2000
2001 // Save counters to dump to accounting file
2002 if (*config->accounting_dir && shut_acct_n < sizeof(shut_acct) / sizeof(*shut_acct))
2003 memcpy(&shut_acct[shut_acct_n++], &session[s], sizeof(session[s]));
2004 }
2005
2006 if (session[s].ip)
2007 { // IP allocated, clear and unroute
2008 int r;
2009 int routed = 0;
2010 for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++)
2011 {
2012 if ((session[s].ip >> (32-session[s].route[r].prefixlen)) ==
2013 (session[s].route[r].ip >> (32-session[s].route[r].prefixlen)))
2014 routed++;
2015
2016 if (del_routes) routeset(s, session[s].route[r].ip, session[s].route[r].prefixlen, 0, 0);
2017 session[s].route[r].ip = 0;
2018 }
2019
2020 if (session[s].ip_pool_index == -1) // static ip
2021 {
2022 if (!routed && del_routes) routeset(s, session[s].ip, 0, 0, 0);
2023 session[s].ip = 0;
2024 }
2025 else
2026 free_ip_address(s);
2027
2028 // unroute IPv6, if setup
2029 if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes)
2030 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);
2031
2032 if (b)
2033 {
2034 // This session was part of a bundle
2035 bundle[b].num_of_links--;
2036 LOG(3, s, session[s].tunnel, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
2037 if(bundle[b].num_of_links == 0)
2038 {
2039 bundleclear(b);
2040 LOG(3, s, session[s].tunnel, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
2041 }
2042 else
2043 {
2044 // Adjust the members array to accomodate the new change
2045 uint8_t mem_num = 0;
2046 // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
2047 if(bundle[b].members[bundle[b].num_of_links] != s)
2048 {
2049 uint8_t ml;
2050 for(ml = 0; ml<bundle[b].num_of_links; ml++)
2051 if(bundle[b].members[ml] == s)
2052 {
2053 mem_num = ml;
2054 break;
2055 }
2056 bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
2057 LOG(3, s, session[s].tunnel, "MPPP: Adjusted member links array\n");
2058
2059 // If the killed session is the first of the bundle,
2060 // the new first session must be stored in the cache_ipmap
2061 // else the function sessionbyip return 0 and the sending not work any more (processipout).
2062 if (mem_num == 0)
2063 {
2064 sessionidt new_s = bundle[b].members[0];
2065
2066 routed = 0;
2067 // Add the route for this session.
2068 for (r = 0; r < MAXROUTE && session[new_s].route[r].ip; r++)
2069 {
2070 int i, prefixlen;
2071 in_addr_t ip;
2072
2073 prefixlen = session[new_s].route[r].prefixlen;
2074 ip = session[new_s].route[r].ip;
2075
2076 if (!prefixlen) prefixlen = 32;
2077 ip &= 0xffffffff << (32 - prefixlen); // Force the ip to be the first one in the route.
2078
2079 for (i = ip; i < ip+(1<<(32-prefixlen)) ; ++i)
2080 cache_ipmap(i, new_s);
2081 }
2082 cache_ipmap(session[new_s].ip, new_s);
2083
2084 // IPV6 route
2085 if (session[new_s].ipv6prefixlen)
2086 cache_ipv6map(session[new_s].ipv6route, session[new_s].ipv6prefixlen, new_s);
2087 }
2088 }
2089 }
2090
2091 cluster_send_bundle(b);
2092 }
2093 }
2094
2095 if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
2096 throttle_session(s, 0, 0);
2097
2098 if (cdn_result)
2099 { // Send CDN
2100 controlt *c = controlnew(14); // sending CDN
2101 if (cdn_error)
2102 {
2103 uint16_t buf[2];
2104 buf[0] = htons(cdn_result);
2105 buf[1] = htons(cdn_error);
2106 controlb(c, 1, (uint8_t *)buf, 4, 1);
2107 }
2108 else
2109 control16(c, 1, cdn_result, 1);
2110
2111 control16(c, 14, s, 1); // assigned session (our end)
2112 controladd(c, session[s].far, session[s].tunnel); // send the message
2113 }
2114
2115 // update filter refcounts
2116 if (session[s].filter_in) ip_filters[session[s].filter_in - 1].used--;
2117 if (session[s].filter_out) ip_filters[session[s].filter_out - 1].used--;
2118
2119 // clear PPP state
2120 memset(&session[s].ppp, 0, sizeof(session[s].ppp));
2121 sess_local[s].lcp.restart = 0;
2122 sess_local[s].ipcp.restart = 0;
2123 sess_local[s].ipv6cp.restart = 0;
2124 sess_local[s].ccp.restart = 0;
2125
2126 cluster_send_session(s);
2127 }
2128
2129 void sendipcp(sessionidt s, tunnelidt t)
2130 {
2131 uint8_t buf[MAXETHER];
2132 uint8_t *q;
2133
2134 CSTAT(sendipcp);
2135 LOG(3, s, t, "IPCP: send ConfigReq\n");
2136
2137 if (!session[s].unique_id)
2138 {
2139 if (!++last_id) ++last_id; // skip zero
2140 session[s].unique_id = last_id;
2141 }
2142
2143 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPIPCP, 0, 0, 0);
2144 if (!q) return;
2145
2146 *q = ConfigReq;
2147 q[1] = session[s].unique_id & 0xf; // ID, dont care, we only send one type of request
2148 *(uint16_t *) (q + 2) = htons(10); // packet length
2149 q[4] = 3; // ip address option
2150 q[5] = 6; // option length
2151 *(in_addr_t *) (q + 6) = config->peer_address ? config->peer_address :
2152 config->bind_address ? config->bind_address :
2153 my_address; // send my IP
2154
2155 tunnelsend(buf, 10 + (q - buf), t); // send it
2156 restart_timer(s, ipcp);
2157 }
2158
2159 void sendipv6cp(sessionidt s, tunnelidt t)
2160 {
2161 uint8_t buf[MAXETHER];
2162 uint8_t *q;
2163
2164 CSTAT(sendipv6cp);
2165 LOG(3, s, t, "IPV6CP: send ConfigReq\n");
2166
2167 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPIPV6CP, 0, 0, 0);
2168 if (!q) return;
2169
2170 *q = ConfigReq;
2171 q[1] = session[s].unique_id & 0xf; // ID, don't care, we
2172 // only send one type
2173 // of request
2174 *(uint16_t *) (q + 2) = htons(14);
2175 q[4] = 1; // interface identifier option
2176 q[5] = 10; // option length
2177 *(uint32_t *) (q + 6) = 0; // We'll be prefix::1
2178 *(uint32_t *) (q + 10) = 0;
2179 q[13] = 1;
2180
2181 tunnelsend(buf, 14 + (q - buf), t); // send it
2182 restart_timer(s, ipv6cp);
2183 }
2184
2185 static void sessionclear(sessionidt s)
2186 {
2187 memset(&session[s], 0, sizeof(session[s]));
2188 memset(&sess_local[s], 0, sizeof(sess_local[s]));
2189 memset(&cli_session_actions[s], 0, sizeof(cli_session_actions[s]));
2190
2191 session[s].tunnel = T_FREE; // Mark it as free.
2192 session[s].next = sessionfree;
2193 sessionfree = s;
2194 }
2195
2196 // kill a session now
2197 void sessionkill(sessionidt s, char *reason)
2198 {
2199 CSTAT(sessionkill);
2200
2201 if (!session[s].opened) // not alive
2202 return;
2203
2204 if (session[s].next)
2205 {
2206 LOG(0, s, session[s].tunnel, "Tried to kill a session with next pointer set (%u)\n", session[s].next);
2207 return;
2208 }
2209
2210 if (!session[s].die)
2211 sessionshutdown(s, reason, CDN_ADMIN_DISC, TERM_ADMIN_RESET); // close radius/routes, etc.
2212
2213 if (sess_local[s].radius)
2214 radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
2215
2216 LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
2217 sessionclear(s);
2218 cluster_send_session(s);
2219 }
2220
2221 static void tunnelclear(tunnelidt t)
2222 {
2223 if (!t) return;
2224 memset(&tunnel[t], 0, sizeof(tunnel[t]));
2225 tunnel[t].state = TUNNELFREE;
2226 }
2227
2228 static void bundleclear(bundleidt b)
2229 {
2230 if (!b) return;
2231 memset(&bundle[b], 0, sizeof(bundle[b]));
2232 bundle[b].state = BUNDLEFREE;
2233 }
2234
2235 // kill a tunnel now
2236 static void tunnelkill(tunnelidt t, char *reason)
2237 {
2238 sessionidt s;
2239 controlt *c;
2240
2241 CSTAT(tunnelkill);
2242
2243 tunnel[t].state = TUNNELDIE;
2244
2245 // free control messages
2246 while ((c = tunnel[t].controls))
2247 {
2248 controlt * n = c->next;
2249 tunnel[t].controls = n;
2250 tunnel[t].controlc--;
2251 c->next = controlfree;
2252 controlfree = c;
2253 }
2254 // kill sessions
2255 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
2256 if (session[s].tunnel == t)
2257 sessionkill(s, reason);
2258
2259 // free tunnel
2260 tunnelclear(t);
2261 LOG(1, 0, t, "Kill tunnel %u: %s\n", t, reason);
2262 cli_tunnel_actions[t].action = 0;
2263 cluster_send_tunnel(t);
2264 }
2265
2266 // shut down a tunnel cleanly
2267 static void tunnelshutdown(tunnelidt t, char *reason, int result, int error, char *msg)
2268 {
2269 sessionidt s;
2270
2271 CSTAT(tunnelshutdown);
2272
2273 if (!tunnel[t].last || !tunnel[t].far || tunnel[t].state == TUNNELFREE)
2274 {
2275 // never set up, can immediately kill
2276 tunnelkill(t, reason);
2277 return;
2278 }
2279 LOG(1, 0, t, "Shutting down tunnel %u (%s)\n", t, reason);
2280
2281 // close session
2282 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
2283 if (session[s].tunnel == t)
2284 sessionshutdown(s, reason, CDN_NONE, TERM_ADMIN_RESET);
2285
2286 tunnel[t].state = TUNNELDIE;
2287 tunnel[t].die = TIME + 700; // Clean up in 70 seconds
2288 cluster_send_tunnel(t);
2289 // TBA - should we wait for sessions to stop?
2290 if (result)
2291 {
2292 controlt *c = controlnew(4); // sending StopCCN
2293 if (error)
2294 {
2295 uint16_t buf[32];
2296 int l = 4;
2297 buf[0] = htons(result);
2298 buf[1] = htons(error);
2299 if (msg)
2300 {
2301 int m = strlen(msg);
2302 if (m + 4 > sizeof(buf))
2303 m = sizeof(buf) - 4;
2304
2305 memcpy(buf+2, msg, m);
2306 l += m;
2307 }
2308
2309 controlb(c, 1, (uint8_t *)buf, l, 1);
2310 }
2311 else
2312 control16(c, 1, result, 1);
2313
2314 control16(c, 9, t, 1); // assigned tunnel (our end)
2315 controladd(c, 0, t); // send the message
2316 }
2317 }
2318
2319 // read and process packet on tunnel (UDP)
2320 void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
2321 {
2322 uint8_t *chapresponse = NULL;
2323 uint16_t l = len, t = 0, s = 0, ns = 0, nr = 0;
2324 uint8_t *p = buf + 2;
2325
2326
2327 CSTAT(processudp);
2328
2329 udp_rx += len;
2330 udp_rx_pkt++;
2331 LOG_HEX(5, "UDP Data", buf, len);
2332 STAT(tunnel_rx_packets);
2333 INC_STAT(tunnel_rx_bytes, len);
2334 if (len < 6)
2335 {
2336 LOG(1, 0, 0, "Short UDP, %d bytes\n", len);
2337 STAT(tunnel_rx_errors);
2338 return;
2339 }
2340 if ((buf[1] & 0x0F) != 2)
2341 {
2342 LOG(1, 0, 0, "Bad L2TP ver %d\n", buf[1] & 0x0F);
2343 STAT(tunnel_rx_errors);
2344 return;
2345 }
2346 if (*buf & 0x40)
2347 { // length
2348 l = ntohs(*(uint16_t *) p);
2349 p += 2;
2350 }
2351 t = ntohs(*(uint16_t *) p);
2352 p += 2;
2353 s = ntohs(*(uint16_t *) p);
2354 p += 2;
2355 if (s >= MAXSESSION)
2356 {
2357 LOG(1, s, t, "Received UDP packet with invalid session ID\n");
2358 STAT(tunnel_rx_errors);
2359 return;
2360 }
2361 if (t >= MAXTUNNEL)
2362 {
2363 LOG(1, s, t, "Received UDP packet with invalid tunnel ID\n");
2364 STAT(tunnel_rx_errors);
2365 return;
2366 }
2367 if (*buf & 0x08)
2368 { // ns/nr
2369 ns = ntohs(*(uint16_t *) p);
2370 p += 2;
2371 nr = ntohs(*(uint16_t *) p);
2372 p += 2;
2373 }
2374 if (*buf & 0x02)
2375 { // offset
2376 uint16_t o = ntohs(*(uint16_t *) p);
2377 p += o + 2;
2378 }
2379 if ((p - buf) > l)
2380 {
2381 LOG(1, s, t, "Bad length %d>%d\n", (int) (p - buf), l);
2382 STAT(tunnel_rx_errors);
2383 return;
2384 }
2385 l -= (p - buf);
2386
2387 // used to time out old tunnels
2388 if (t && tunnel[t].state == TUNNELOPEN)
2389 tunnel[t].lastrec = time_now;
2390
2391 if (*buf & 0x80)
2392 { // control
2393 uint16_t message = 0xFFFF; // message type
2394 uint8_t fatal = 0;
2395 uint8_t mandatory = 0;
2396 uint16_t asession = 0; // assigned session
2397 uint32_t amagic = 0; // magic number
2398 uint8_t aflags = 0; // flags from last LCF
2399 uint16_t version = 0x0100; // protocol version (we handle 0.0 as well and send that back just in case)
2400 char called[MAXTEL] = ""; // called number
2401 char calling[MAXTEL] = ""; // calling number
2402
2403 if (!config->cluster_iam_master)
2404 {
2405 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
2406 return;
2407 }
2408
2409 // control messages must have bits 0x80|0x40|0x08
2410 // (type, length and sequence) set, and bits 0x02|0x01
2411 // (offset and priority) clear
2412 if ((*buf & 0xCB) != 0xC8)
2413 {
2414 LOG(1, s, t, "Bad control header %02X\n", *buf);
2415 STAT(tunnel_rx_errors);
2416 return;
2417 }
2418
2419 // check for duplicate tunnel open message
2420 if (!t && ns == 0)
2421 {
2422 int i;
2423
2424 //
2425 // Is this a duplicate of the first packet? (SCCRQ)
2426 //
2427 for (i = 1; i <= config->cluster_highest_tunnelid ; ++i)
2428 {
2429 if (tunnel[i].state != TUNNELOPENING ||
2430 tunnel[i].ip != ntohl(*(in_addr_t *) & addr->sin_addr) ||
2431 tunnel[i].port != ntohs(addr->sin_port) )
2432 continue;
2433 t = i;
2434 LOG(3, s, t, "Duplicate SCCRQ?\n");
2435 break;
2436 }
2437 }
2438
2439 LOG(3, s, t, "Control message (%d bytes): (unacked %d) l-ns %u l-nr %u r-ns %u r-nr %u\n",
2440 l, tunnel[t].controlc, tunnel[t].ns, tunnel[t].nr, ns, nr);
2441
2442 // if no tunnel specified, assign one
2443 if (!t)
2444 {
2445 if (!(t = new_tunnel()))
2446 {
2447 LOG(1, 0, 0, "No more tunnels\n");
2448 STAT(tunnel_overflow);
2449 return;
2450 }
2451 tunnelclear(t);
2452 tunnel[t].ip = ntohl(*(in_addr_t *) & addr->sin_addr);
2453 tunnel[t].port = ntohs(addr->sin_port);
2454 tunnel[t].window = 4; // default window
2455 STAT(tunnel_created);
2456 LOG(1, 0, t, " New tunnel from %s:%u ID %u\n",
2457 fmtaddr(htonl(tunnel[t].ip), 0), tunnel[t].port, t);
2458 }
2459
2460 // If the 'ns' just received is not the 'nr' we're
2461 // expecting, just send an ack and drop it.
2462 //
2463 // if 'ns' is less, then we got a retransmitted packet.
2464 // if 'ns' is greater than missed a packet. Either way
2465 // we should ignore it.
2466 if (ns != tunnel[t].nr)
2467 {
2468 // is this the sequence we were expecting?
2469 STAT(tunnel_rx_errors);
2470 LOG(1, 0, t, " Out of sequence tunnel %u, (%u is not the expected %u)\n",
2471 t, ns, tunnel[t].nr);
2472
2473 if (l) // Is this not a ZLB?
2474 controlnull(t);
2475 return;
2476 }
2477
2478 // check sequence of this message
2479 {
2480 int skip = tunnel[t].window; // track how many in-window packets are still in queue
2481 // some to clear maybe?
2482 while (tunnel[t].controlc > 0 && (((tunnel[t].ns - tunnel[t].controlc) - nr) & 0x8000))
2483 {
2484 controlt *c = tunnel[t].controls;
2485 tunnel[t].controls = c->next;
2486 tunnel[t].controlc--;
2487 c->next = controlfree;
2488 controlfree = c;
2489 skip--;
2490 tunnel[t].try = 0; // we have progress
2491 }
2492
2493 // receiver advance (do here so quoted correctly in any sends below)
2494 if (l) tunnel[t].nr = (ns + 1);
2495 if (skip < 0) skip = 0;
2496 if (skip < tunnel[t].controlc)
2497 {
2498 // some control packets can now be sent that were previous stuck out of window
2499 int tosend = tunnel[t].window - skip;
2500 controlt *c = tunnel[t].controls;
2501 while (c && skip)
2502 {
2503 c = c->next;
2504 skip--;
2505 }
2506 while (c && tosend)
2507 {
2508 tunnel[t].try = 0; // first send
2509 tunnelsend(c->buf, c->length, t);
2510 c = c->next;
2511 tosend--;
2512 }
2513 }
2514 if (!tunnel[t].controlc)
2515 tunnel[t].retry = 0; // caught up
2516 }
2517 if (l)
2518 { // if not a null message
2519 int result = 0;
2520 int error = 0;
2521 char *msg = 0;
2522
2523 // Default disconnect cause/message on receipt of CDN. Set to
2524 // more specific value from attribute 1 (result code) or 46
2525 // (disconnect cause) if present below.
2526 int disc_cause_set = 0;
2527 int disc_cause = TERM_NAS_REQUEST;
2528 char const *disc_reason = "Closed (Received CDN).";
2529
2530 // process AVPs
2531 while (l && !(fatal & 0x80)) // 0x80 = mandatory AVP
2532 {
2533 uint16_t n = (ntohs(*(uint16_t *) p) & 0x3FF);
2534 uint8_t *b = p;
2535 uint8_t flags = *p;
2536 uint16_t mtype;
2537
2538 if (n > l)
2539 {
2540 LOG(1, s, t, "Invalid length in AVP\n");
2541 STAT(tunnel_rx_errors);
2542 return;
2543 }
2544 p += n; // next
2545 l -= n;
2546 if (flags & 0x3C) // reserved bits, should be clear
2547 {
2548 LOG(1, s, t, "Unrecognised AVP flags %02X\n", *b);
2549 fatal = flags;
2550 result = 2; // general error
2551 error = 3; // reserved field non-zero
2552 msg = 0;
2553 continue; // next
2554 }
2555 b += 2;
2556 if (*(uint16_t *) (b))
2557 {
2558 LOG(2, s, t, "Unknown AVP vendor %u\n", ntohs(*(uint16_t *) (b)));
2559 fatal = flags;
2560 result = 2; // general error
2561 error = 6; // generic vendor-specific error
2562 msg = "unsupported vendor-specific";
2563 continue; // next
2564 }
2565 b += 2;
2566 mtype = ntohs(*(uint16_t *) (b));
2567 b += 2;
2568 n -= 6;
2569
2570 if (flags & 0x40)
2571 {
2572 uint16_t orig_len;
2573
2574 // handle hidden AVPs
2575 if (!*config->l2tp_secret)
2576 {
2577 LOG(1, s, t, "Hidden AVP requested, but no L2TP secret.\n");
2578 fatal = flags;
2579 result = 2; // general error
2580 error = 6; // generic vendor-specific error
2581 msg = "secret not specified";
2582 continue;
2583 }
2584 if (!session[s].random_vector_length)
2585 {
2586 LOG(1, s, t, "Hidden AVP requested, but no random vector.\n");
2587 fatal = flags;
2588 result = 2; // general error
2589 error = 6; // generic
2590 msg = "no random vector";
2591 continue;
2592 }
2593 if (n < 8)
2594 {
2595 LOG(2, s, t, "Short hidden AVP.\n");
2596 fatal = flags;
2597 result = 2; // general error
2598 error = 2; // length is wrong
2599 msg = 0;
2600 continue;
2601 }
2602
2603 // Unhide the AVP
2604 unhide_value(b, n, mtype, session[s].random_vector, session[s].random_vector_length);
2605
2606 orig_len = ntohs(*(uint16_t *) b);
2607 if (orig_len > n + 2)
2608 {
2609 LOG(1, s, t, "Original length %d too long in hidden AVP of length %d; wrong secret?\n",
2610 orig_len, n);
2611
2612 fatal = flags;
2613 result = 2; // general error
2614 error = 2; // length is wrong
2615 msg = 0;
2616 continue;
2617 }
2618
2619 b += 2;
2620 n = orig_len;
2621 }
2622
2623 LOG(4, s, t, " AVP %u (%s) len %d%s%s\n", mtype, l2tp_avp_name(mtype), n,
2624 flags & 0x40 ? ", hidden" : "", flags & 0x80 ? ", mandatory" : "");
2625
2626 switch (mtype)
2627 {
2628 case 0: // message type
2629 message = ntohs(*(uint16_t *) b);
2630 mandatory = flags & 0x80;
2631 LOG(4, s, t, " Message type = %u (%s)\n", message, l2tp_code(message));
2632 break;
2633 case 1: // result code
2634 {
2635 uint16_t rescode = ntohs(*(uint16_t *) b);
2636 char const *resdesc = "(unknown)";
2637 char const *errdesc = NULL;
2638 int cause = 0;
2639
2640 if (message == 4)
2641 { /* StopCCN */
2642 resdesc = l2tp_stopccn_result_code(rescode);
2643 cause = TERM_LOST_SERVICE;
2644 }
2645 else if (message == 14)
2646 { /* CDN */
2647 resdesc = l2tp_cdn_result_code(rescode);
2648 if (rescode == 1)
2649 cause = TERM_LOST_CARRIER;
2650 else
2651 cause = TERM_ADMIN_RESET;
2652 }
2653
2654 LOG(4, s, t, " Result Code %u: %s\n", rescode, resdesc);
2655 if (n >= 4)
2656 {
2657 uint16_t errcode = ntohs(*(uint16_t *)(b + 2));
2658 errdesc = l2tp_error_code(errcode);
2659 LOG(4, s, t, " Error Code %u: %s\n", errcode, errdesc);
2660 }
2661 if (n > 4)
2662 LOG(4, s, t, " Error String: %.*s\n", n-4, b+4);
2663
2664 if (cause && disc_cause_set < mtype) // take cause from attrib 46 in preference
2665 {
2666 disc_cause_set = mtype;
2667 disc_reason = errdesc ? errdesc : resdesc;
2668 disc_cause = cause;
2669 }
2670
2671 break;
2672 }
2673 break;
2674 case 2: // protocol version
2675 {
2676 version = ntohs(*(uint16_t *) (b));
2677 LOG(4, s, t, " Protocol version = %u\n", version);
2678 if (version && version != 0x0100)
2679 { // allow 0.0 and 1.0
2680 LOG(1, s, t, " Bad protocol version %04X\n", version);
2681 fatal = flags;
2682 result = 5; // unspported protocol version
2683 error = 0x0100; // supported version
2684 msg = 0;
2685 continue; // next
2686 }
2687 }
2688 break;
2689 case 3: // framing capabilities
2690 break;
2691 case 4: // bearer capabilities
2692 break;
2693 case 5: // tie breaker
2694 // We never open tunnels, so we don't care about tie breakers
2695 continue;
2696 case 6: // firmware revision
2697 break;
2698 case 7: // host name
2699 memset(tunnel[t].hostname, 0, sizeof(tunnel[t].hostname));
2700 memcpy(tunnel[t].hostname, b, (n < sizeof(tunnel[t].hostname)) ? n : sizeof(tunnel[t].hostname) - 1);
2701 LOG(4, s, t, " Tunnel hostname = \"%s\"\n", tunnel[t].hostname);
2702 // TBA - to send to RADIUS
2703 break;
2704 case 8: // vendor name
2705 memset(tunnel[t].vendor, 0, sizeof(tunnel[t].vendor));
2706 memcpy(tunnel[t].vendor, b, (n < sizeof(tunnel[t].vendor)) ? n : sizeof(tunnel[t].vendor) - 1);
2707 LOG(4, s, t, " Vendor name = \"%s\"\n", tunnel[t].vendor);
2708 break;
2709 case 9: // assigned tunnel
2710 tunnel[t].far = ntohs(*(uint16_t *) (b));
2711 LOG(4, s, t, " Remote tunnel id = %u\n", tunnel[t].far);
2712 break;
2713 case 10: // rx window
2714 tunnel[t].window = ntohs(*(uint16_t *) (b));
2715 if (!tunnel[t].window)
2716 tunnel[t].window = 1; // window of 0 is silly
2717 LOG(4, s, t, " rx window = %u\n", tunnel[t].window);
2718 break;
2719 case 11: // Challenge
2720 {
2721 LOG(4, s, t, " LAC requested CHAP authentication for tunnel\n");
2722 build_chap_response(b, 2, n, &chapresponse);
2723 }
2724 break;
2725 case 13: // Response
2726 #ifdef LAC
2727 if (istunneltolns(t))
2728 {
2729 chapresponse = calloc(17, 1);
2730 memcpy(chapresponse, b, (n < 17) ? n : 16);
2731 LOG(1, s, t, "received challenge response from (REMOTE LNS)\n");
2732 }
2733 else
2734 #endif /* LAC */
2735 // Why did they send a response? We never challenge.
2736 LOG(2, s, t, " received unexpected challenge response\n");
2737 break;
2738
2739 case 14: // assigned session
2740 asession = session[s].far = ntohs(*(uint16_t *) (b));
2741 LOG(4, s, t, " assigned session = %u\n", asession);
2742 break;
2743 case 15: // call serial number
2744 LOG(4, s, t, " call serial number = %u\n", ntohl(*(uint32_t *)b));
2745 break;
2746 case 18: // bearer type
2747 LOG(4, s, t, " bearer type = %u\n", ntohl(*(uint32_t *)b));
2748 // TBA - for RADIUS
2749 break;
2750 case 19: // framing type
2751 LOG(4, s, t, " framing type = %u\n", ntohl(*(uint32_t *)b));
2752 // TBA
2753 break;
2754 case 21: // called number
2755 memset(called, 0, sizeof(called));
2756 memcpy(called, b, (n < sizeof(called)) ? n : sizeof(called) - 1);
2757 LOG(4, s, t, " Called <%s>\n", called);
2758 break;
2759 case 22: // calling number
2760 memset(calling, 0, sizeof(calling));
2761 memcpy(calling, b, (n < sizeof(calling)) ? n : sizeof(calling) - 1);
2762 LOG(4, s, t, " Calling <%s>\n", calling);
2763 break;
2764 case 23: // subtype
2765 break;
2766 case 24: // tx connect speed
2767 if (n == 4)
2768 {
2769 session[s].tx_connect_speed = ntohl(*(uint32_t *)b);
2770 }
2771 else
2772 {
2773 // AS5300s send connect speed as a string
2774 char tmp[30];
2775 memset(tmp, 0, sizeof(tmp));
2776 memcpy(tmp, b, (n < sizeof(tmp)) ? n : sizeof(tmp) - 1);
2777 session[s].tx_connect_speed = atol(tmp);
2778 }
2779 LOG(4, s, t, " TX connect speed <%u>\n", session[s].tx_connect_speed);
2780 break;
2781 case 38: // rx connect speed
2782 if (n == 4)
2783 {
2784 session[s].rx_connect_speed = ntohl(*(uint32_t *)b);
2785 }
2786 else
2787 {
2788 // AS5300s send connect speed as a string
2789 char tmp[30];
2790 memset(tmp, 0, sizeof(tmp));
2791 memcpy(tmp, b, (n < sizeof(tmp)) ? n : sizeof(tmp) - 1);
2792 session[s].rx_connect_speed = atol(tmp);
2793 }
2794 LOG(4, s, t, " RX connect speed <%u>\n", session[s].rx_connect_speed);
2795 break;
2796 case 25: // Physical Channel ID
2797 {
2798 uint32_t tmp = ntohl(*(uint32_t *) b);
2799 LOG(4, s, t, " Physical Channel ID <%X>\n", tmp);
2800 break;
2801 }
2802 case 29: // Proxy Authentication Type
2803 {
2804 uint16_t atype = ntohs(*(uint16_t *)b);
2805 LOG(4, s, t, " Proxy Auth Type %u (%s)\n", atype, ppp_auth_type(atype));
2806 break;
2807 }
2808 case 30: // Proxy Authentication Name
2809 {
2810 char authname[64];
2811 memset(authname, 0, sizeof(authname));
2812 memcpy(authname, b, (n < sizeof(authname)) ? n : sizeof(authname) - 1);
2813 LOG(4, s, t, " Proxy Auth Name (%s)\n",
2814 authname);
2815 break;
2816 }
2817 case 31: // Proxy Authentication Challenge
2818 {
2819 LOG(4, s, t, " Proxy Auth Challenge\n");
2820 break;
2821 }
2822 case 32: // Proxy Authentication ID
2823 {
2824 uint16_t authid = ntohs(*(uint16_t *)(b));
2825 LOG(4, s, t, " Proxy Auth ID (%u)\n", authid);
2826 break;
2827 }
2828 case 33: // Proxy Authentication Response
2829 LOG(4, s, t, " Proxy Auth Response\n");
2830 break;
2831 case 27: // last sent lcp
2832 { // find magic number
2833 uint8_t *p = b, *e = p + n;
2834 while (p + 1 < e && p[1] && p + p[1] <= e)
2835 {
2836 if (*p == 5 && p[1] == 6) // Magic-Number
2837 amagic = ntohl(*(uint32_t *) (p + 2));
2838 else if (*p == 7) // Protocol-Field-Compression
2839 aflags |= SESSION_PFC;
2840 else if (*p == 8) // Address-and-Control-Field-Compression
2841 aflags |= SESSION_ACFC;
2842 p += p[1];
2843 }
2844 }
2845 break;
2846 case 28: // last recv lcp confreq
2847 break;
2848 case 26: // Initial Received LCP CONFREQ
2849 break;
2850 case 39: // seq required - we control it as an LNS anyway...
2851 break;
2852 case 36: // Random Vector
2853 LOG(4, s, t, " Random Vector received. Enabled AVP Hiding.\n");
2854 memset(session[s].random_vector, 0, sizeof(session[s].random_vector));
2855 if (n > sizeof(session[s].random_vector))
2856 n = sizeof(session[s].random_vector);
2857 memcpy(session[s].random_vector, b, n);
2858 session[s].random_vector_length = n;
2859 break;
2860 case 46: // ppp disconnect cause
2861 if (n >= 5)
2862 {
2863 uint16_t code = ntohs(*(uint16_t *) b);
2864 uint16_t proto = ntohs(*(uint16_t *) (b + 2));
2865 uint8_t dir = *(b + 4);
2866
2867 LOG(4, s, t, " PPP disconnect cause "
2868 "(code=%u, proto=%04X, dir=%u, msg=\"%.*s\")\n",
2869 code, proto, dir, n - 5, b + 5);
2870
2871 disc_cause_set = mtype;
2872
2873 switch (code)
2874 {
2875 case 1: // admin disconnect
2876 disc_cause = TERM_ADMIN_RESET;
2877 disc_reason = "Administrative disconnect";
2878 break;
2879 case 3: // lcp terminate
2880 if (dir != 2) break; // 1=peer (LNS), 2=local (LAC)
2881 disc_cause = TERM_USER_REQUEST;
2882 disc_reason = "Normal disconnection";
2883 break;
2884 case 4: // compulsory encryption unavailable
2885 if (dir != 1) break; // 1=refused by peer, 2=local
2886 disc_cause = TERM_USER_ERROR;
2887 disc_reason = "Compulsory encryption refused";
2888 break;
2889 case 5: // lcp: fsm timeout
2890 disc_cause = TERM_PORT_ERROR;
2891 disc_reason = "LCP: FSM timeout";
2892 break;
2893 case 6: // lcp: no recognisable lcp packets received
2894 disc_cause = TERM_PORT_ERROR;
2895 disc_reason = "LCP: no recognisable LCP packets";
2896 break;
2897 case 7: // lcp: magic-no error (possibly looped back)
2898 disc_cause = TERM_PORT_ERROR;
2899 disc_reason = "LCP: magic-no error (possible loop)";
2900 break;
2901 case 8: // lcp: echo request timeout
2902 disc_cause = TERM_PORT_ERROR;
2903 disc_reason = "LCP: echo request timeout";
2904 break;
2905 case 13: // auth: fsm timeout
2906 disc_cause = TERM_SERVICE_UNAVAILABLE;
2907 disc_reason = "Authentication: FSM timeout";
2908 break;
2909 case 15: // auth: unacceptable auth protocol
2910 disc_cause = TERM_SERVICE_UNAVAILABLE;
2911 disc_reason = "Unacceptable authentication protocol";
2912 break;
2913 case 16: // auth: authentication failed
2914 disc_cause = TERM_SERVICE_UNAVAILABLE;
2915 disc_reason = "Authentication failed";
2916 break;
2917 case 17: // ncp: fsm timeout
2918 disc_cause = TERM_SERVICE_UNAVAILABLE;
2919 disc_reason = "NCP: FSM timeout";
2920 break;
2921 case 18: // ncp: no ncps available
2922 disc_cause = TERM_SERVICE_UNAVAILABLE;
2923 disc_reason = "NCP: no NCPs available";
2924 break;
2925 case 19: // ncp: failure to converge on acceptable address
2926 disc_cause = TERM_SERVICE_UNAVAILABLE;
2927 disc_reason = (dir == 1)
2928 ? "NCP: too many Configure-Naks received from peer"
2929 : "NCP: too many Configure-Naks sent to peer";
2930 break;
2931 case 20: // ncp: user not permitted to use any address
2932 disc_cause = TERM_SERVICE_UNAVAILABLE;
2933 disc_reason = (dir == 1)
2934 ? "NCP: local link address not acceptable to peer"
2935 : "NCP: remote link address not acceptable";
2936 break;
2937 }
2938 }
2939 break;
2940 default:
2941 {
2942 static char e[] = "unknown AVP 0xXXXX";
2943 LOG(2, s, t, " Unknown AVP type %u\n", mtype);
2944 fatal = flags;
2945 result = 2; // general error
2946 error = 8; // unknown mandatory AVP
2947 sprintf((msg = e) + 14, "%04x", mtype);
2948 continue; // next
2949 }
2950 }
2951 }
2952 // process message
2953 if (fatal & 0x80)
2954 tunnelshutdown(t, "Invalid mandatory AVP", result, error, msg);
2955 else
2956 switch (message)
2957 {
2958 case 1: // SCCRQ - Start Control Connection Request
2959 tunnel[t].state = TUNNELOPENING;
2960 if (main_quit != QUIT_SHUTDOWN)
2961 {
2962 controlt *c = controlnew(2); // sending SCCRP
2963 control16(c, 2, version, 1); // protocol version
2964 control32(c, 3, 3, 1); // framing
2965 controls(c, 7, hostname, 1); // host name
2966 if (chapresponse) controlb(c, 13, chapresponse, 16, 1); // Challenge response
2967 control16(c, 9, t, 1); // assigned tunnel
2968 controladd(c, 0, t); // send the resply
2969 }
2970 else
2971 {
2972 tunnelshutdown(t, "Shutting down", 6, 0, 0);
2973 }
2974 break;
2975 case 2: // SCCRP
2976 tunnel[t].state = TUNNELOPEN;
2977 tunnel[t].lastrec = time_now;
2978 #ifdef LAC
2979 LOG(1, s, t, "Recieved SCCRP (REMOTE LNS)\n");
2980 if (main_quit != QUIT_SHUTDOWN)
2981 {
2982 if (istunneltolns(t) && chapresponse)
2983 {
2984 hasht hash;
2985
2986 calc_lac_auth(t, 2, hash); // id = 2 (SCCRP)
2987 // check authenticator
2988 if (memcmp(hash, chapresponse, 16) == 0)
2989 {
2990 controlt *c = controlnew(3); // sending SCCCN
2991 controls(c, 7, hostname, 1); // host name
2992 controls(c, 8, Vendor_name, 1); // Vendor name
2993 control16(c, 2, version, 1); // protocol version
2994 control32(c, 3, 3, 1); // framing Capabilities
2995 control16(c, 9, t, 1); // assigned tunnel
2996 controladd(c, 0, t); // send
2997
2998 LOG(1, s, t, "sending SCCCN (REMOTE LNS)\n");
2999 }
3000 else
3001 {
3002 tunnelshutdown(t, "(REMOTE LNS) Bad chap response", 4, 0, 0);
3003 }
3004 }
3005 }
3006 else
3007 {
3008 tunnelshutdown(t, "Shutting down", 6, 0, 0);
3009 }
3010 #endif /* LAC */
3011 break;
3012 case 3: // SCCN
3013 tunnel[t].state = TUNNELOPEN;
3014 tunnel[t].lastrec = time_now;
3015 controlnull(t); // ack
3016 break;
3017 case 4: // StopCCN
3018 controlnull(t); // ack
3019 tunnelshutdown(t, "Stopped", 0, 0, 0); // Shut down cleanly
3020 break;
3021 case 6: // HELLO
3022 controlnull(t); // simply ACK
3023 break;
3024 case 7: // OCRQ
3025 // TBA
3026 break;
3027 case 8: // OCRO
3028 // TBA
3029 break;
3030 case 9: // OCCN
3031 // TBA
3032 break;
3033 case 10: // ICRQ
3034 if (sessionfree && main_quit != QUIT_SHUTDOWN)
3035 {
3036 controlt *c = controlnew(11); // ICRP
3037
3038 s = sessionfree;
3039 sessionfree = session[s].next;
3040 memset(&session[s], 0, sizeof(session[s]));
3041
3042 if (s > config->cluster_highest_sessionid)
3043 config->cluster_highest_sessionid = s;
3044
3045 session[s].opened = time_now;
3046 session[s].tunnel = t;
3047 session[s].far = asession;
3048 session[s].last_packet = session[s].last_data = time_now;
3049 LOG(3, s, t, "New session (%u/%u)\n", tunnel[t].far, session[s].far);
3050 control16(c, 14, s, 1); // assigned session
3051 controladd(c, asession, t); // send the reply
3052
3053 strncpy(session[s].called, called, sizeof(session[s].called) - 1);
3054 strncpy(session[s].calling, calling, sizeof(session[s].calling) - 1);
3055
3056 session[s].ppp.phase = Establish;
3057 session[s].ppp.lcp = Starting;
3058
3059 STAT(session_created);
3060 break;
3061 }
3062
3063 {
3064 controlt *c = controlnew(14); // CDN
3065 if (!sessionfree)
3066 {
3067 STAT(session_overflow);
3068 LOG(1, 0, t, "No free sessions\n");
3069 control16(c, 1, 4, 0); // temporary lack of resources
3070 }
3071 else
3072 control16(c, 1, 2, 7); // shutting down, try another
3073
3074 controladd(c, asession, t); // send the message
3075 }
3076 return;
3077 case 11: // ICRP
3078 #ifdef LAC
3079 LOG(1, s, t, "Recieved ICRP (REMOTE LNS)\n");
3080 if (session[s].forwardtosession)
3081 {
3082 controlt *c = controlnew(12); // ICCN
3083
3084 session[s].opened = time_now;
3085 session[s].tunnel = t;
3086 session[s].far = asession;
3087 session[s].last_packet = session[s].last_data = time_now;
3088
3089 control32(c, 19, 1, 1); // Framing Type
3090 control32(c, 24, 10000000, 1); // Tx Connect Speed
3091 controladd(c, asession, t); // send the message
3092 LOG(1, s, t, "Sending ICCN (REMOTE LNS)\n");
3093 }
3094 #endif /* LAC */
3095 break;
3096 case 12: // ICCN
3097 if (amagic == 0) amagic = time_now;
3098 session[s].magic = amagic; // set magic number
3099 session[s].flags = aflags; // set flags received
3100 session[s].mru = PPPoE_MRU; // default
3101 controlnull(t); // ack
3102
3103 // start LCP
3104 sess_local[s].lcp_authtype = config->radius_authprefer;
3105 sess_local[s].ppp_mru = MRU;
3106
3107 // Set multilink options before sending initial LCP packet
3108 sess_local[s].mp_mrru = 1614;
3109 sess_local[s].mp_epdis = ntohl(config->bind_address ? config->bind_address : my_address);
3110
3111 sendlcp(s, t);
3112 change_state(s, lcp, RequestSent);
3113 break;
3114
3115 case 14: // CDN
3116 controlnull(t); // ack
3117 #ifdef LAC
3118
3119 #endif /* LAC */
3120 sessionshutdown(s, disc_reason, CDN_NONE, disc_cause);
3121 break;
3122 case 0xFFFF:
3123 LOG(1, s, t, "Missing message type\n");
3124 break;
3125 default:
3126 STAT(tunnel_rx_errors);
3127 if (mandatory)
3128 tunnelshutdown(t, "Unknown message type", 2, 6, "unknown message type");
3129 else
3130 LOG(1, s, t, "Unknown message type %u\n", message);
3131 break;
3132 }
3133 if (chapresponse) free(chapresponse);
3134 cluster_send_tunnel(t);
3135 }
3136 else
3137 {
3138 LOG(4, s, t, " Got a ZLB ack\n");
3139 }
3140 }
3141 else
3142 { // data
3143 uint16_t proto;
3144
3145 LOG_HEX(5, "Receive Tunnel Data", p, l);
3146 if (l > 2 && p[0] == 0xFF && p[1] == 0x03)
3147 { // HDLC address header, discard
3148 p += 2;
3149 l -= 2;
3150 }
3151 if (l < 2)
3152 {
3153 LOG(1, s, t, "Short ppp length %d\n", l);
3154 STAT(tunnel_rx_errors);
3155 return;
3156 }
3157 if (*p & 1)
3158 {
3159 proto = *p++;
3160 l--;
3161 }
3162 else
3163 {
3164 proto = ntohs(*(uint16_t *) p);
3165 p += 2;
3166 l -= 2;
3167 }
3168
3169 #ifdef LAC
3170 if (session[s].forwardtosession)
3171 {
3172 LOG(4, s, t, "Forwarding data session to %u (REMOTE LNS)\n", session[s].forwardtosession);
3173 // Forward to Remote LNS
3174 session_forward_tolns(buf, len, s, proto);
3175 return;
3176 }
3177 #endif /* LAC */
3178
3179 if (s && !session[s].opened) // Is something wrong??
3180 {
3181 if (!config->cluster_iam_master)
3182 {
3183 // Pass it off to the master to deal with..
3184 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
3185 return;
3186 }
3187
3188 LOG(1, s, t, "UDP packet contains session which is not opened. Dropping packet.\n");
3189 STAT(tunnel_rx_errors);
3190 return;
3191 }
3192
3193 if (proto == PPPPAP)
3194 {
3195 session[s].last_packet = time_now;
3196 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3197 processpap(s, t, p, l);
3198 }
3199 else if (proto == PPPCHAP)
3200 {
3201 session[s].last_packet = time_now;
3202 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3203 processchap(s, t, p, l);
3204 }
3205 else if (proto == PPPLCP)
3206 {
3207 session[s].last_packet = time_now;
3208 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3209 processlcp(s, t, p, l);
3210 }
3211 else if (proto == PPPIPCP)
3212 {
3213 session[s].last_packet = time_now;
3214 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3215 processipcp(s, t, p, l);
3216 }
3217 else if (proto == PPPIPV6CP && config->ipv6_prefix.s6_addr[0])
3218 {
3219 session[s].last_packet = time_now;
3220 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3221 processipv6cp(s, t, p, l);
3222 }
3223 else if (proto == PPPCCP)
3224 {
3225 session[s].last_packet = time_now;
3226 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3227 processccp(s, t, p, l);
3228 }
3229 else if (proto == PPPIP)
3230 {
3231 if (session[s].die)
3232 {
3233 LOG(4, s, t, "Session %u is closing. Don't process PPP packets\n", s);
3234 return; // closing session, PPP not processed
3235 }
3236
3237 session[s].last_packet = session[s].last_data = time_now;
3238 if (session[s].walled_garden && !config->cluster_iam_master)
3239 {
3240 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
3241 return;
3242 }
3243
3244 processipin(s, t, p, l);
3245 }
3246 else if (proto == PPPMP)
3247 {
3248 if (session[s].die)
3249 {
3250 LOG(4, s, t, "Session %u is closing. Don't process PPP packets\n", s);
3251 return; // closing session, PPP not processed
3252 }
3253
3254 session[s].last_packet = session[s].last_data = time_now;
3255 if (!config->cluster_iam_master)
3256 {
3257 // The fragments reconstruction is managed by the Master.
3258 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
3259 return;
3260 }
3261
3262 processmpin(s, t, p, l);
3263 }
3264 else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
3265 {
3266 if (session[s].die)
3267 {
3268 LOG(4, s, t, "Session %u is closing. Don't process PPP packets\n", s);
3269 return; // closing session, PPP not processed
3270 }
3271
3272 session[s].last_packet = session[s].last_data = time_now;
3273 if (session[s].walled_garden && !config->cluster_iam_master)
3274 {
3275 master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
3276 return;
3277 }
3278
3279 processipv6in(s, t, p, l);
3280 }
3281 else if (session[s].ppp.lcp == Opened)
3282 {
3283 session[s].last_packet = time_now;
3284 if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
3285 protoreject(s, t, p, l, proto);
3286 }
3287 else
3288 {
3289 LOG(2, s, t, "Unknown PPP protocol 0x%04X received in LCP %s state\n",
3290 proto, ppp_state(session[s].ppp.lcp));
3291 }
3292 }
3293 }
3294
3295 // read and process packet on tun
3296 // (i.e. this routine writes to buf[-8]).
3297 static void processtun(uint8_t * buf, int len)
3298 {
3299 LOG_HEX(5, "Receive TUN Data", buf, len);
3300 STAT(tun_rx_packets);
3301 INC_STAT(tun_rx_bytes, len);
3302
3303 CSTAT(processtun);
3304
3305 eth_rx_pkt++;
3306 eth_rx += len;
3307 if (len < 22)
3308 {
3309 LOG(1, 0, 0, "Short tun packet %d bytes\n", len);
3310 STAT(tun_rx_errors);
3311 return;
3312 }
3313
3314 if (*(uint16_t *) (buf + 2) == htons(PKTIP)) // IPv4
3315 processipout(buf, len);
3316 else if (*(uint16_t *) (buf + 2) == htons(PKTIPV6) // IPV6
3317 && config->ipv6_prefix.s6_addr[0])
3318 processipv6out(buf, len);
3319
3320 // Else discard.
3321 }
3322
3323 // Handle retries, timeouts. Runs every 1/10th sec, want to ensure
3324 // that we look at the whole of the tunnel, radius and session tables
3325 // every second
3326 static void regular_cleanups(double period)
3327 {
3328 // Next tunnel, radius and session to check for actions on.
3329 static tunnelidt t = 0;
3330 static int r = 0;
3331 static sessionidt s = 0;
3332
3333 int t_actions = 0;
3334 int r_actions = 0;
3335 int s_actions = 0;
3336
3337 int t_slice;
3338 int r_slice;
3339 int s_slice;
3340
3341 int i;
3342 int a;
3343
3344 // divide up tables into slices based on the last run
3345 t_slice = config->cluster_highest_tunnelid * period;
3346 r_slice = (MAXRADIUS - 1) * period;
3347 s_slice = config->cluster_highest_sessionid * period;
3348
3349 if (t_slice < 1)
3350 t_slice = 1;
3351 else if (t_slice > config->cluster_highest_tunnelid)
3352 t_slice = config->cluster_highest_tunnelid;
3353
3354 if (r_slice < 1)
3355 r_slice = 1;
3356 else if (r_slice > (MAXRADIUS - 1))
3357 r_slice = MAXRADIUS - 1;
3358
3359 if (s_slice < 1)
3360 s_slice = 1;
3361 else if (s_slice > config->cluster_highest_sessionid)
3362 s_slice = config->cluster_highest_sessionid;
3363
3364 LOG(4, 0, 0, "Begin regular cleanup (last %f seconds ago)\n", period);
3365
3366 for (i = 0; i < t_slice; i++)
3367 {
3368 t++;
3369 if (t > config->cluster_highest_tunnelid)
3370 t = 1;
3371
3372 // check for expired tunnels
3373 if (tunnel[t].die && tunnel[t].die <= TIME)
3374 {
3375 STAT(tunnel_timeout);
3376 tunnelkill(t, "Expired");
3377 t_actions++;
3378 continue;
3379 }
3380 // check for message resend
3381 if (tunnel[t].retry && tunnel[t].controlc)
3382 {
3383 // resend pending messages as timeout on reply
3384 if (tunnel[t].retry <= TIME)
3385 {
3386 controlt *c = tunnel[t].controls;
3387 uint16_t w = tunnel[t].window;
3388 tunnel[t].try++; // another try
3389 if (tunnel[t].try > 5)
3390 tunnelkill(t, "Timeout on control message"); // game over
3391 else
3392 while (c && w--)
3393 {
3394 tunnelsend(c->buf, c->length, t);
3395 c = c->next;
3396 }
3397
3398 t_actions++;
3399 }
3400 }
3401 // Send hello
3402 if (tunnel[t].state == TUNNELOPEN && !tunnel[t].controlc && (time_now - tunnel[t].lastrec) > 60)
3403 {
3404 controlt *c = controlnew(6); // sending HELLO
3405 controladd(c, 0, t); // send the message
3406 LOG(3, 0, t, "Sending HELLO message\n");
3407 t_actions++;
3408 }
3409
3410 // Check for tunnel changes requested from the CLI
3411 if ((a = cli_tunnel_actions[t].action))
3412 {
3413 cli_tunnel_actions[t].action = 0;
3414 if (a & CLI_TUN_KILL)
3415 {
3416 LOG(2, 0, t, "Dropping tunnel by CLI\n");
3417 tunnelshutdown(t, "Requested by administrator", 1, 0, 0);
3418 t_actions++;
3419 }
3420 }
3421 }
3422
3423 for (i = 0; i < r_slice; i++)
3424 {
3425 r++;
3426 if (r >= MAXRADIUS)
3427 r = 1;
3428
3429 if (!radius[r].state)
3430 continue;
3431
3432 if (radius[r].retry <= TIME)
3433 {
3434 radiusretry(r);
3435 r_actions++;
3436 }
3437 }
3438
3439 for (i = 0; i < s_slice; i++)
3440 {
3441 s++;
3442 if (s > config->cluster_highest_sessionid)
3443 s = 1;
3444
3445 if (!session[s].opened) // Session isn't in use
3446 continue;
3447
3448 // check for expired sessions
3449 if (session[s].die)
3450 {
3451 if (session[s].die <= TIME)
3452 {
3453 sessionkill(s, "Expired");
3454 s_actions++;
3455 }
3456 continue;
3457 }
3458
3459 // PPP timeouts
3460 if (sess_local[s].lcp.restart <= time_now)
3461 {
3462 int next_state = session[s].ppp.lcp;
3463 switch (session[s].ppp.lcp)
3464 {
3465 case RequestSent:
3466 case AckReceived:
3467 next_state = RequestSent;
3468
3469 case AckSent:
3470 if (sess_local[s].lcp.conf_sent < config->ppp_max_configure)
3471 {
3472 LOG(3, s, session[s].tunnel, "No ACK for LCP ConfigReq... resending\n");
3473 sendlcp(s, session[s].tunnel);
3474 change_state(s, lcp, next_state);
3475 }
3476 else
3477 {
3478 sessionshutdown(s, "No response to LCP ConfigReq.", CDN_ADMIN_DISC, TERM_LOST_SERVICE);
3479 STAT(session_timeout);
3480 }
3481
3482 s_actions++;
3483 }
3484
3485 if (session[s].die)
3486 continue;
3487 }
3488
3489 if (sess_local[s].ipcp.restart <= time_now)
3490 {
3491 int next_state = session[s].ppp.ipcp;
3492 switch (session[s].ppp.ipcp)
3493 {
3494 case RequestSent:
3495 case AckReceived:
3496 next_state = RequestSent;
3497
3498 case AckSent:
3499 if (sess_local[s].ipcp.conf_sent < config->ppp_max_configure)
3500 {
3501 LOG(3, s, session[s].tunnel, "No ACK for IPCP ConfigReq... resending\n");
3502 sendipcp(s, session[s].tunnel);
3503 change_state(s, ipcp, next_state);
3504 }
3505 else
3506 {
3507 sessionshutdown(s, "No response to IPCP ConfigReq.", CDN_ADMIN_DISC, TERM_LOST_SERVICE);
3508 STAT(session_timeout);
3509 }
3510
3511 s_actions++;
3512 }
3513
3514 if (session[s].die)
3515 continue;
3516 }
3517
3518 if (sess_local[s].ipv6cp.restart <= time_now)
3519 {
3520 int next_state = session[s].ppp.ipv6cp;
3521 switch (session[s].ppp.ipv6cp)
3522 {
3523 case RequestSent:
3524 case AckReceived:
3525 next_state = RequestSent;
3526
3527 case AckSent:
3528 if (sess_local[s].ipv6cp.conf_sent < config->ppp_max_configure)
3529 {
3530 LOG(3, s, session[s].tunnel, "No ACK for IPV6CP ConfigReq... resending\n");
3531 sendipv6cp(s, session[s].tunnel);
3532 change_state(s, ipv6cp, next_state);
3533 }
3534 else
3535 {
3536 LOG(3, s, session[s].tunnel, "No ACK for IPV6CP ConfigReq\n");
3537 change_state(s, ipv6cp, Stopped);
3538 }
3539
3540 s_actions++;
3541 }
3542 }
3543
3544 if (sess_local[s].ccp.restart <= time_now)
3545 {
3546 int next_state = session[s].ppp.ccp;
3547 switch (session[s].ppp.ccp)
3548 {
3549 case RequestSent:
3550 case AckReceived:
3551 next_state = RequestSent;
3552
3553 case AckSent:
3554 if (sess_local[s].ccp.conf_sent < config->ppp_max_configure)
3555 {
3556 LOG(3, s, session[s].tunnel, "No ACK for CCP ConfigReq... resending\n");
3557 sendccp(s, session[s].tunnel);
3558 change_state(s, ccp, next_state);
3559 }
3560 else
3561 {
3562 LOG(3, s, session[s].tunnel, "No ACK for CCP ConfigReq\n");
3563 change_state(s, ccp, Stopped);
3564 }
3565
3566 s_actions++;
3567 }
3568 }
3569
3570 // Drop sessions who have not responded within IDLE_ECHO_TIMEOUT seconds
3571 if (session[s].last_packet && (time_now - session[s].last_packet >= config->idle_echo_timeout))
3572 {
3573 sessionshutdown(s, "No response to LCP ECHO requests.", CDN_ADMIN_DISC, TERM_LOST_SERVICE);
3574 STAT(session_timeout);
3575 s_actions++;
3576 continue;
3577 }
3578
3579 // No data in ECHO_TIMEOUT seconds, send LCP ECHO
3580 if (session[s].ppp.phase >= Establish && (time_now - session[s].last_packet >= config->echo_timeout) &&
3581 (time_now - sess_local[s].last_echo >= ECHO_TIMEOUT))
3582 {
3583 uint8_t b[MAXETHER];
3584
3585 uint8_t *q = makeppp(b, sizeof(b), 0, 0, s, session[s].tunnel, PPPLCP, 1, 0, 0);
3586 if (!q) continue;
3587
3588 *q = EchoReq;
3589 *(uint8_t *)(q + 1) = (time_now % 255); // ID
3590 *(uint16_t *)(q + 2) = htons(8); // Length
3591 *(uint32_t *)(q + 4) = session[s].ppp.lcp == Opened ? htonl(session[s].magic) : 0; // Magic Number
3592
3593 LOG(4, s, session[s].tunnel, "No data in %d seconds, sending LCP ECHO\n",
3594 (int)(time_now - session[s].last_packet));
3595 tunnelsend(b, 24, session[s].tunnel); // send it
3596 sess_local[s].last_echo = time_now;
3597 s_actions++;
3598 }
3599
3600 // Drop sessions who have reached session_timeout seconds
3601 if (session[s].session_timeout)
3602 {
3603 bundleidt bid = session[s].bundle;
3604 if (bid)
3605 {
3606 if (time_now - bundle[bid].last_check >= 1)
3607 {
3608 bundle[bid].online_time += (time_now - bundle[bid].last_check) * bundle[bid].num_of_links;
3609 bundle[bid].last_check = time_now;
3610 if (bundle[bid].online_time >= session[s].session_timeout)
3611 {
3612 int ses;
3613 for (ses = bundle[bid].num_of_links - 1; ses >= 0; ses--)
3614 {
3615 sessionshutdown(bundle[bid].members[ses], "Session timeout", CDN_ADMIN_DISC, TERM_SESSION_TIMEOUT);
3616 s_actions++;
3617 continue;
3618 }
3619 }
3620 }
3621 }
3622 else if (time_now - session[s].opened >= session[s].session_timeout)
3623 {
3624 sessionshutdown(s, "Session timeout", CDN_ADMIN_DISC, TERM_SESSION_TIMEOUT);
3625 s_actions++;
3626 continue;
3627 }
3628 }
3629
3630 // Drop sessions who have reached idle_timeout seconds
3631 if (session[s].last_data && session[s].idle_timeout && (time_now - session[s].last_data >= session[s].idle_timeout))
3632 {
3633 sessionshutdown(s, "Idle Timeout Reached", CDN_ADMIN_DISC, TERM_IDLE_TIMEOUT);
3634 STAT(session_timeout);
3635 s_actions++;
3636 continue;
3637 }
3638
3639 // Check for actions requested from the CLI
3640 if ((a = cli_session_actions[s].action))
3641 {
3642 int send = 0;
3643
3644 cli_session_actions[s].action = 0;
3645 if (a & CLI_SESS_KILL)
3646 {
3647 LOG(2, s, session[s].tunnel, "Dropping session by CLI\n");
3648 sessionshutdown(s, "Requested by administrator.", CDN_ADMIN_DISC, TERM_ADMIN_RESET);
3649 a = 0; // dead, no need to check for other actions
3650 s_actions++;
3651 }
3652
3653 if (a & CLI_SESS_NOSNOOP)
3654 {
3655 LOG(2, s, session[s].tunnel, "Unsnooping session by CLI\n");
3656 session[s].snoop_ip = 0;
3657 session[s].snoop_port = 0;
3658 s_actions++;
3659 send++;
3660 }
3661 else if (a & CLI_SESS_SNOOP)
3662 {
3663 LOG(2, s, session[s].tunnel, "Snooping session by CLI (to %s:%u)\n",
3664 fmtaddr(cli_session_actions[s].snoop_ip, 0),
3665 cli_session_actions[s].snoop_port);
3666
3667 session[s].snoop_ip = cli_session_actions[s].snoop_ip;
3668 session[s].snoop_port = cli_session_actions[s].snoop_port;
3669 s_actions++;
3670 send++;
3671 }
3672
3673 if (a & CLI_SESS_NOTHROTTLE)
3674 {
3675 LOG(2, s, session[s].tunnel, "Un-throttling session by CLI\n");
3676 throttle_session(s, 0, 0);
3677 s_actions++;
3678 send++;
3679 }
3680 else if (a & CLI_SESS_THROTTLE)
3681 {
3682 LOG(2, s, session[s].tunnel, "Throttling session by CLI (to %dkb/s up and %dkb/s down)\n",
3683 cli_session_actions[s].throttle_in,
3684 cli_session_actions[s].throttle_out);
3685
3686 throttle_session(s, cli_session_actions[s].throttle_in, cli_session_actions[s].throttle_out);
3687 s_actions++;
3688 send++;
3689 }
3690
3691 if (a & CLI_SESS_NOFILTER)
3692 {
3693 LOG(2, s, session[s].tunnel, "Un-filtering session by CLI\n");
3694 filter_session(s, 0, 0);
3695 s_actions++;
3696 send++;
3697 }
3698 else if (a & CLI_SESS_FILTER)
3699 {
3700 LOG(2, s, session[s].tunnel, "Filtering session by CLI (in=%d, out=%d)\n",
3701 cli_session_actions[s].filter_in,
3702 cli_session_actions[s].filter_out);
3703
3704 filter_session(s, cli_session_actions[s].filter_in, cli_session_actions[s].filter_out);
3705 s_actions++;
3706 send++;
3707 }
3708
3709 if (send)
3710 cluster_send_session(s);
3711 }
3712
3713 // RADIUS interim accounting
3714 if (config->radius_accounting && config->radius_interim > 0
3715 && session[s].ip && !session[s].walled_garden
3716 && !sess_local[s].radius // RADIUS already in progress
3717 && time_now - sess_local[s].last_interim >= config->radius_interim
3718 && session[s].flags & SESSION_STARTED)
3719 {
3720 int rad = radiusnew(s);
3721 if (!rad)
3722 {
3723 LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Interim message\n");
3724 STAT(radius_overflow);
3725 continue;
3726 }
3727
3728 LOG(3, s, session[s].tunnel, "Sending RADIUS Interim for %s (%u)\n",
3729 session[s].user, session[s].unique_id);
3730
3731 radiussend(rad, RADIUSINTERIM);
3732 sess_local[s].last_interim = time_now;
3733 s_actions++;
3734 }
3735 }
3736
3737 LOG(4, 0, 0, "End regular cleanup: checked %d/%d/%d tunnels/radius/sessions; %d/%d/%d actions\n",
3738 t_slice, r_slice, s_slice, t_actions, r_actions, s_actions);
3739 }
3740
3741 //
3742 // Are we in the middle of a tunnel update, or radius
3743 // requests??
3744 //
3745 static int still_busy(void)
3746 {
3747 int i;
3748 static clockt last_talked = 0;
3749 static clockt start_busy_wait = 0;
3750
3751 #ifdef BGP
3752 static time_t stopped_bgp = 0;
3753 if (bgp_configured)
3754 {
3755 if (!stopped_bgp)
3756 {
3757 LOG(1, 0, 0, "Shutting down in %d seconds, stopping BGP...\n", QUIT_DELAY);
3758
3759 for (i = 0; i < BGP_NUM_PEERS; i++)
3760 if (bgp_peers[i].state == Established)
3761 bgp_stop(&bgp_peers[i]);
3762
3763 stopped_bgp = time_now;
3764
3765 if (!config->cluster_iam_master)
3766 {
3767 // we don't want to become master
3768 cluster_send_ping(0);
3769
3770 return 1;
3771 }
3772 }
3773
3774 if (!config->cluster_iam_master && time_now < (stopped_bgp + QUIT_DELAY))
3775 return 1;
3776 }
3777 #endif /* BGP */
3778
3779 if (!config->cluster_iam_master)
3780 return 0;
3781
3782 if (main_quit == QUIT_SHUTDOWN)
3783 {
3784 static int dropped = 0;
3785 if (!dropped)
3786 {
3787 int i;
3788
3789 LOG(1, 0, 0, "Dropping sessions and tunnels\n");
3790 for (i = 1; i < MAXTUNNEL; i++)
3791 if (tunnel[i].ip || tunnel[i].state)
3792 tunnelshutdown(i, "L2TPNS Closing", 6, 0, 0);
3793
3794 dropped = 1;
3795 }
3796 }
3797
3798 if (start_busy_wait == 0)
3799 start_busy_wait = TIME;
3800
3801 for (i = config->cluster_highest_tunnelid ; i > 0 ; --i)
3802 {
3803 if (!tunnel[i].controlc)
3804 continue;
3805
3806 if (last_talked != TIME)
3807 {
3808 LOG(2, 0, 0, "Tunnel %u still has un-acked control messages.\n", i);
3809 last_talked = TIME;
3810 }
3811 return 1;
3812 }
3813
3814 // We stop waiting for radius after BUSY_WAIT_TIME 1/10th seconds
3815 if (abs(TIME - start_busy_wait) > BUSY_WAIT_TIME)
3816 {
3817 LOG(1, 0, 0, "Giving up waiting for RADIUS to be empty. Shutting down anyway.\n");
3818 return 0;
3819 }
3820
3821 for (i = 1; i < MAXRADIUS; i++)
3822 {
3823 if (radius[i].state == RADIUSNULL)
3824 continue;
3825 if (radius[i].state == RADIUSWAIT)
3826 continue;
3827
3828 if (last_talked != TIME)
3829 {
3830 LOG(2, 0, 0, "Radius session %u is still busy (sid %u)\n", i, radius[i].session);
3831 last_talked = TIME;
3832 }
3833 return 1;
3834 }
3835
3836 return 0;
3837 }
3838
3839 #ifdef HAVE_EPOLL
3840 # include <sys/epoll.h>
3841 #else
3842 # define FAKE_EPOLL_IMPLEMENTATION /* include the functions */
3843 # include "fake_epoll.h"
3844 #endif
3845
3846 // the base set of fds polled: cli, cluster, tun, udp, control, dae, netlink
3847 #define BASE_FDS 7
3848
3849 // additional polled fds
3850 #ifdef BGP
3851 # define EXTRA_FDS BGP_NUM_PEERS
3852 #else
3853 # define EXTRA_FDS 0
3854 #endif
3855
3856 // main loop - gets packets on tun or udp and processes them
3857 static void mainloop(void)
3858 {
3859 int i;
3860 uint8_t buf[65536];
3861 uint8_t *p = buf + 8; // for the hearder of the forwarded MPPP packet (see C_MPPP_FORWARD)
3862 int size_bufp = sizeof(buf) - 8;
3863 clockt next_cluster_ping = 0; // send initial ping immediately
3864 struct epoll_event events[BASE_FDS + RADIUS_FDS + EXTRA_FDS];
3865 int maxevent = sizeof(events)/sizeof(*events);
3866
3867 if ((epollfd = epoll_create(maxevent)) < 0)
3868 {
3869 LOG(0, 0, 0, "epoll_create failed: %s\n", strerror(errno));
3870 exit(1);
3871 }
3872
3873 LOG(4, 0, 0, "Beginning of main loop. clifd=%d, cluster_sockfd=%d, tunfd=%d, udpfd=%d, controlfd=%d, daefd=%d, nlfd=%d\n",
3874 clifd, cluster_sockfd, tunfd, udpfd, controlfd, daefd, nlfd);
3875
3876 /* setup our fds to poll for input */
3877 {
3878 static struct event_data d[BASE_FDS];
3879 struct epoll_event e;
3880
3881 e.events = EPOLLIN;
3882 i = 0;
3883
3884 if (clifd >= 0)
3885 {
3886 d[i].type = FD_TYPE_CLI;
3887 e.data.ptr = &d[i++];
3888 epoll_ctl(epollfd, EPOLL_CTL_ADD, clifd, &e);
3889 }
3890
3891 d[i].type = FD_TYPE_CLUSTER;
3892 e.data.ptr = &d[i++];
3893 epoll_ctl(epollfd, EPOLL_CTL_ADD, cluster_sockfd, &e);
3894
3895 d[i].type = FD_TYPE_TUN;
3896 e.data.ptr = &d[i++];
3897 epoll_ctl(epollfd, EPOLL_CTL_ADD, tunfd, &e);
3898
3899 d[i].type = FD_TYPE_UDP;
3900 e.data.ptr = &d[i++];
3901 epoll_ctl(epollfd, EPOLL_CTL_ADD, udpfd, &e);
3902
3903 d[i].type = FD_TYPE_CONTROL;
3904 e.data.ptr = &d[i++];
3905 epoll_ctl(epollfd, EPOLL_CTL_ADD, controlfd, &e);
3906
3907 d[i].type = FD_TYPE_DAE;
3908 e.data.ptr = &d[i++];
3909 epoll_ctl(epollfd, EPOLL_CTL_ADD, daefd, &e);
3910
3911 d[i].type = FD_TYPE_NETLINK;
3912 e.data.ptr = &d[i++];
3913 epoll_ctl(epollfd, EPOLL_CTL_ADD, nlfd, &e);
3914 }
3915
3916 #ifdef BGP
3917 signal(SIGPIPE, SIG_IGN);
3918 bgp_setup(config->as_number);
3919 if (config->bind_address)
3920 bgp_add_route(config->bind_address, 0xffffffff);
3921
3922 for (i = 0; i < BGP_NUM_PEERS; i++)
3923 {
3924 if (config->neighbour[i].name[0])
3925 bgp_start(&bgp_peers[i], config->neighbour[i].name,
3926 config->neighbour[i].as, config->neighbour[i].keepalive,
3927 config->neighbour[i].hold, config->neighbour[i].update_source,
3928 0); /* 0 = routing disabled */
3929 }
3930 #endif /* BGP */
3931
3932 while (!main_quit || still_busy())
3933 {
3934 int more = 0;
3935 int n;
3936
3937
3938 if (main_reload)
3939 {
3940 main_reload = 0;
3941 read_config_file();
3942 config->reload_config++;
3943 }
3944
3945 if (config->reload_config)
3946 {
3947 config->reload_config = 0;
3948 update_config();
3949 }
3950
3951 #ifdef BGP
3952 bgp_set_poll();
3953 #endif /* BGP */
3954
3955 n = epoll_wait(epollfd, events, maxevent, 100); // timeout 100ms (1/10th sec)
3956 STAT(select_called);
3957
3958 TIME = now(NULL);
3959 if (n < 0)
3960 {
3961 if (errno == EINTR ||
3962 errno == ECHILD) // EINTR was clobbered by sigchild_handler()
3963 continue;
3964
3965 LOG(0, 0, 0, "Error returned from select(): %s\n", strerror(errno));
3966 break; // exit
3967 }
3968
3969 if (n)
3970 {
3971 struct sockaddr_in addr;
3972 struct in_addr local;
3973 socklen_t alen;
3974 int c, s;
3975 int udp_ready = 0;
3976 int tun_ready = 0;
3977 int cluster_ready = 0;
3978 int udp_pkts = 0;
3979 int tun_pkts = 0;
3980 int cluster_pkts = 0;
3981 #ifdef BGP
3982 uint32_t bgp_events[BGP_NUM_PEERS];
3983 memset(bgp_events, 0, sizeof(bgp_events));
3984 #endif /* BGP */
3985
3986 for (c = n, i = 0; i < c; i++)
3987 {
3988 struct event_data *d = events[i].data.ptr;
3989
3990 switch (d->type)
3991 {
3992 case FD_TYPE_CLI: // CLI connections
3993 {
3994 int cli;
3995
3996 alen = sizeof(addr);
3997 if ((cli = accept(clifd, (struct sockaddr *)&addr, &alen)) >= 0)
3998 {
3999 cli_do(cli);
4000 close(cli);
4001 }
4002 else
4003 LOG(0, 0, 0, "accept error: %s\n", strerror(errno));
4004
4005 n--;
4006 break;
4007 }
4008
4009 // these are handled below, with multiple interleaved reads
4010 case FD_TYPE_CLUSTER: cluster_ready++; break;
4011 case FD_TYPE_TUN: tun_ready++; break;
4012 case FD_TYPE_UDP: udp_ready++; break;
4013
4014 case FD_TYPE_CONTROL: // nsctl commands
4015 alen = sizeof(addr);
4016 s = recvfromto(controlfd, buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
4017 if (s > 0) processcontrol(buf, s, &addr, alen, &local);
4018 n--;
4019 break;
4020
4021 case FD_TYPE_DAE: // DAE requests
4022 alen = sizeof(addr);
4023 s = recvfromto(daefd, buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
4024 if (s > 0) processdae(buf, s, &addr, alen, &local);
4025 n--;
4026 break;
4027
4028 case FD_TYPE_RADIUS: // RADIUS response
4029 alen = sizeof(addr);
4030 s = recvfrom(radfds[d->index], buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen);
4031 if (s >= 0 && config->cluster_iam_master)
4032 {
4033 if (addr.sin_addr.s_addr == config->radiusserver[0] ||
4034 addr.sin_addr.s_addr == config->radiusserver[1])
4035 processrad(buf, s, d->index);
4036 else
4037 LOG(3, 0, 0, "Dropping RADIUS packet from unknown source %s\n",
4038 fmtaddr(addr.sin_addr.s_addr, 0));
4039 }
4040
4041 n--;
4042 break;
4043
4044 #ifdef BGP
4045 case FD_TYPE_BGP:
4046 bgp_events[d->index] = events[i].events;
4047 n--;
4048 break;
4049 #endif /* BGP */
4050
4051 case FD_TYPE_NETLINK:
4052 {
4053 struct nlmsghdr *nh = (struct nlmsghdr *)buf;
4054 s = netlink_recv(buf, sizeof(buf));
4055 if (nh->nlmsg_type == NLMSG_ERROR)
4056 {
4057 struct nlmsgerr *errmsg = NLMSG_DATA(nh);
4058 if (errmsg->error)
4059 {
4060 if (errmsg->msg.nlmsg_seq < min_initok_nlseqnum)
4061 {
4062 LOG(0, 0, 0, "Got a fatal netlink error (while %s): %s\n", tun_nl_phase_msg[nh->nlmsg_seq], strerror(-errmsg->error));
4063 exit(1);
4064 }
4065 else
4066
4067 LOG(0, 0, 0, "Got a netlink error: %s\n", strerror(-errmsg->error));
4068 }
4069 // else it's a ack
4070 }
4071 else
4072 LOG(1, 0, 0, "Got a unknown netlink message: type %d seq %d flags %d\n", nh->nlmsg_type, nh->nlmsg_seq, nh->nlmsg_flags);
4073 n--;
4074 break;
4075 }
4076
4077 default:
4078 LOG(0, 0, 0, "Unexpected fd type returned from epoll_wait: %d\n", d->type);
4079 }
4080 }
4081
4082 #ifdef BGP
4083 bgp_process(bgp_events);
4084 #endif /* BGP */
4085
4086 for (c = 0; n && c < config->multi_read_count; c++)
4087 {
4088 // L2TP
4089 if (udp_ready)
4090 {
4091 alen = sizeof(addr);
4092 if ((s = recvfrom(udpfd, buf, sizeof(buf), 0, (void *) &addr, &alen)) > 0)
4093 {
4094 processudp(buf, s, &addr);
4095 udp_pkts++;
4096 }
4097 else
4098 {
4099 udp_ready = 0;
4100 n--;
4101 }
4102 }
4103
4104 // incoming IP
4105 if (tun_ready)
4106 {
4107 if ((s = read(tunfd, p, size_bufp)) > 0)
4108 {
4109 processtun(p, s);
4110 tun_pkts++;
4111 }
4112 else
4113 {
4114 tun_ready = 0;
4115 n--;
4116 }
4117 }
4118
4119 // cluster
4120 if (cluster_ready)
4121 {
4122 alen = sizeof(addr);
4123 if ((s = recvfrom(cluster_sockfd, buf, sizeof(buf), MSG_WAITALL, (void *) &addr, &alen)) > 0)
4124 {
4125 processcluster(buf, s, addr.sin_addr.s_addr);
4126 cluster_pkts++;
4127 }
4128 else
4129 {
4130 cluster_ready = 0;
4131 n--;
4132 }
4133 }
4134 }
4135
4136 if (udp_pkts > 1 || tun_pkts > 1 || cluster_pkts > 1)
4137 STAT(multi_read_used);
4138
4139 if (c >= config->multi_read_count)
4140 {
4141 LOG(3, 0, 0, "Reached multi_read_count (%d); processed %d udp, %d tun and %d cluster packets\n",
4142 config->multi_read_count, udp_pkts, tun_pkts, cluster_pkts);
4143
4144 STAT(multi_read_exceeded);
4145 more++;
4146 }
4147 }
4148 #ifdef BGP
4149 else
4150 /* no event received, but timers could still have expired */
4151 bgp_process_peers_timers();
4152 #endif /* BGP */
4153
4154 if (time_changed)
4155 {
4156 double Mbps = 1024.0 * 1024.0 / 8 * time_changed;
4157
4158 // Log current traffic stats
4159 snprintf(config->bandwidth, sizeof(config->bandwidth),
4160 "UDP-ETH:%1.0f/%1.0f ETH-UDP:%1.0f/%1.0f TOTAL:%0.1f IN:%u OUT:%u",
4161 (udp_rx / Mbps), (eth_tx / Mbps), (eth_rx / Mbps), (udp_tx / Mbps),
4162 ((udp_tx + udp_rx + eth_tx + eth_rx) / Mbps),
4163 udp_rx_pkt / time_changed, eth_rx_pkt / time_changed);
4164
4165 udp_tx = udp_rx = 0;
4166 udp_rx_pkt = eth_rx_pkt = 0;
4167 eth_tx = eth_rx = 0;
4168 time_changed = 0;
4169
4170 if (config->dump_speed)
4171 printf("%s\n", config->bandwidth);
4172
4173 // Update the internal time counter
4174 strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now));
4175
4176 {
4177 // Run timer hooks
4178 struct param_timer p = { time_now };
4179 run_plugins(PLUGIN_TIMER, &p);
4180 }
4181 }
4182
4183 // Runs on every machine (master and slaves).
4184 if (next_cluster_ping <= TIME)
4185 {
4186 // Check to see which of the cluster is still alive..
4187
4188 cluster_send_ping(basetime); // Only does anything if we're a slave
4189 cluster_check_master(); // ditto.
4190
4191 cluster_heartbeat(); // Only does anything if we're a master.
4192 cluster_check_slaves(); // ditto.
4193
4194 master_update_counts(); // If we're a slave, send our byte counters to our master.
4195
4196 if (config->cluster_iam_master && !config->cluster_iam_uptodate)
4197 next_cluster_ping = TIME + 1; // out-of-date slaves, do fast updates
4198 else
4199 next_cluster_ping = TIME + config->cluster_hb_interval;
4200 }
4201
4202 if (!config->cluster_iam_master)
4203 continue;
4204
4205 // Run token bucket filtering queue..
4206 // Only run it every 1/10th of a second.
4207 {
4208 static clockt last_run = 0;
4209 if (last_run != TIME)
4210 {
4211 last_run = TIME;
4212 tbf_run_timer();
4213 }
4214 }
4215
4216 // Handle timeouts, retries etc.
4217 {
4218 static double last_clean = 0;
4219 double this_clean;
4220 double diff;
4221
4222 TIME = now(&this_clean);
4223 diff = this_clean - last_clean;
4224
4225 // Run during idle time (after we've handled
4226 // all incoming packets) or every 1/10th sec
4227 if (!more || diff > 0.1)
4228 {
4229 regular_cleanups(diff);
4230 last_clean = this_clean;
4231 }
4232 }
4233
4234 if (*config->accounting_dir)
4235 {
4236 static clockt next_acct = 0;
4237 static clockt next_shut_acct = 0;
4238
4239 if (next_acct <= TIME)
4240 {
4241 // Dump accounting data
4242 next_acct = TIME + ACCT_TIME;
4243 next_shut_acct = TIME + ACCT_SHUT_TIME;
4244 dump_acct_info(1);
4245 }
4246 else if (next_shut_acct <= TIME)
4247 {
4248 // Dump accounting data for shutdown sessions
4249 next_shut_acct = TIME + ACCT_SHUT_TIME;
4250 if (shut_acct_n)
4251 dump_acct_info(0);
4252 }
4253 }
4254 }
4255
4256 // Are we the master and shutting down??
4257 if (config->cluster_iam_master)
4258 cluster_heartbeat(); // Flush any queued changes..
4259
4260 // Ok. Notify everyone we're shutting down. If we're
4261 // the master, this will force an election.
4262 cluster_send_ping(0);
4263
4264 //
4265 // Important!!! We MUST not process any packets past this point!
4266 LOG(1, 0, 0, "Shutdown complete\n");
4267 }
4268
4269 static void stripdomain(char *host)
4270 {
4271 char *p;
4272
4273 if ((p = strchr(host, '.')))
4274 {
4275 char *domain = 0;
4276 char _domain[1024];
4277
4278 // strip off domain
4279 FILE *resolv = fopen("/etc/resolv.conf", "r");
4280 if (resolv)
4281 {
4282 char buf[1024];
4283 char *b;
4284
4285 while (fgets(buf, sizeof(buf), resolv))
4286 {
4287 if (strncmp(buf, "domain", 6) && strncmp(buf, "search", 6))
4288 continue;
4289
4290 if (!isspace(buf[6]))
4291 continue;
4292
4293 b = buf + 7;
4294 while (isspace(*b)) b++;
4295
4296 if (*b)
4297 {
4298 char *d = b;
4299 while (*b && !isspace(*b)) b++;
4300 *b = 0;
4301 if (buf[0] == 'd') // domain is canonical
4302 {
4303 domain = d;
4304 break;
4305 }
4306
4307 // first search line
4308 if (!domain)
4309 {
4310 // hold, may be subsequent domain line
4311 strncpy(_domain, d, sizeof(_domain))[sizeof(_domain)-1] = 0;
4312 domain = _domain;
4313 }
4314 }
4315 }
4316
4317 fclose(resolv);
4318 }
4319
4320 if (domain)
4321 {
4322 int hl = strlen(host);
4323 int dl = strlen(domain);
4324 if (dl < hl && host[hl - dl - 1] == '.' && !strcmp(host + hl - dl, domain))
4325 host[hl -dl - 1] = 0;
4326 }
4327 else
4328 {
4329 *p = 0; // everything after first dot
4330 }
4331 }
4332 }
4333
4334 // Init data structures
4335 static void initdata(int optdebug, char *optconfig)
4336 {
4337 int i;
4338
4339 if (!(config = shared_malloc(sizeof(configt))))
4340 {
4341 fprintf(stderr, "Error doing malloc for configuration: %s\n", strerror(errno));
4342 exit(1);
4343 }
4344
4345 memset(config, 0, sizeof(configt));
4346 time(&config->start_time);
4347 strncpy(config->config_file, optconfig, strlen(optconfig));
4348 config->debug = optdebug;
4349 config->num_tbfs = MAXTBFS;
4350 config->rl_rate = 28; // 28kbps
4351 config->cluster_mcast_ttl = 1;
4352 config->cluster_master_min_adv = 1;
4353 config->ppp_restart_time = 3;
4354 config->ppp_max_configure = 10;
4355 config->ppp_max_failure = 5;
4356 config->kill_timedout_sessions = 1;
4357 strcpy(config->random_device, RANDOMDEVICE);
4358 // Set default value echo_timeout and idle_echo_timeout
4359 config->echo_timeout = ECHO_TIMEOUT;
4360 config->idle_echo_timeout = IDLE_ECHO_TIMEOUT;
4361
4362 log_stream = stderr;
4363
4364 #ifdef RINGBUFFER
4365 if (!(ringbuffer = shared_malloc(sizeof(struct Tringbuffer))))
4366 {
4367 LOG(0, 0, 0, "Error doing malloc for ringbuffer: %s\n", strerror(errno));
4368 exit(1);
4369 }
4370 memset(ringbuffer, 0, sizeof(struct Tringbuffer));
4371 #endif
4372
4373 if (!(_statistics = shared_malloc(sizeof(struct Tstats))))
4374 {
4375 LOG(0, 0, 0, "Error doing malloc for _statistics: %s\n", strerror(errno));
4376 exit(1);
4377 }
4378 if (!(tunnel = shared_malloc(sizeof(tunnelt) * MAXTUNNEL)))
4379 {
4380 LOG(0, 0, 0, "Error doing malloc for tunnels: %s\n", strerror(errno));
4381 exit(1);
4382 }
4383 if (!(bundle = shared_malloc(sizeof(bundlet) * MAXBUNDLE)))
4384 {
4385 LOG(0, 0, 0, "Error doing malloc for bundles: %s\n", strerror(errno));
4386 exit(1);
4387 }
4388 if (!(frag = shared_malloc(sizeof(fragmentationt) * MAXBUNDLE)))
4389 {
4390 LOG(0, 0, 0, "Error doing malloc for fragmentations: %s\n", strerror(errno));
4391 exit(1);
4392 }
4393 if (!(session = shared_malloc(sizeof(sessiont) * MAXSESSION)))
4394 {
4395 LOG(0, 0, 0, "Error doing malloc for sessions: %s\n", strerror(errno));
4396 exit(1);
4397 }
4398
4399 if (!(sess_local = shared_malloc(sizeof(sessionlocalt) * MAXSESSION)))
4400 {
4401 LOG(0, 0, 0, "Error doing malloc for sess_local: %s\n", strerror(errno));
4402 exit(1);
4403 }
4404
4405 if (!(radius = shared_malloc(sizeof(radiust) * MAXRADIUS)))
4406 {
4407 LOG(0, 0, 0, "Error doing malloc for radius: %s\n", strerror(errno));
4408 exit(1);
4409 }
4410
4411 if (!(ip_address_pool = shared_malloc(sizeof(ippoolt) * MAXIPPOOL)))
4412 {
4413 LOG(0, 0, 0, "Error doing malloc for ip_address_pool: %s\n", strerror(errno));
4414 exit(1);
4415 }
4416
4417 if (!(ip_filters = shared_malloc(sizeof(ip_filtert) * MAXFILTER)))
4418 {
4419 LOG(0, 0, 0, "Error doing malloc for ip_filters: %s\n", strerror(errno));
4420 exit(1);
4421 }
4422 memset(ip_filters, 0, sizeof(ip_filtert) * MAXFILTER);
4423
4424 if (!(cli_session_actions = shared_malloc(sizeof(struct cli_session_actions) * MAXSESSION)))
4425 {
4426 LOG(0, 0, 0, "Error doing malloc for cli session actions: %s\n", strerror(errno));
4427 exit(1);
4428 }
4429 memset(cli_session_actions, 0, sizeof(struct cli_session_actions) * MAXSESSION);
4430
4431 if (!(cli_tunnel_actions = shared_malloc(sizeof(struct cli_tunnel_actions) * MAXSESSION)))
4432 {
4433 LOG(0, 0, 0, "Error doing malloc for cli tunnel actions: %s\n", strerror(errno));
4434 exit(1);
4435 }
4436 memset(cli_tunnel_actions, 0, sizeof(struct cli_tunnel_actions) * MAXSESSION);
4437
4438 memset(tunnel, 0, sizeof(tunnelt) * MAXTUNNEL);
4439 memset(bundle, 0, sizeof(bundlet) * MAXBUNDLE);
4440 memset(session, 0, sizeof(sessiont) * MAXSESSION);
4441 memset(radius, 0, sizeof(radiust) * MAXRADIUS);
4442 memset(ip_address_pool, 0, sizeof(ippoolt) * MAXIPPOOL);
4443
4444 // Put all the sessions on the free list marked as undefined.
4445 for (i = 1; i < MAXSESSION; i++)
4446 {
4447 session[i].next = i + 1;
4448 session[i].tunnel = T_UNDEF; // mark it as not filled in.
4449 }
4450 session[MAXSESSION - 1].next = 0;
4451 sessionfree = 1;
4452
4453 // Mark all the tunnels as undefined (waiting to be filled in by a download).
4454 for (i = 1; i < MAXTUNNEL; i++)
4455 tunnel[i].state = TUNNELUNDEF; // mark it as not filled in.
4456
4457 for (i = 1; i < MAXBUNDLE; i++) {
4458 bundle[i].state = BUNDLEUNDEF;
4459 }
4460
4461 if (!*hostname)
4462 {
4463 // Grab my hostname unless it's been specified
4464 gethostname(hostname, sizeof(hostname));
4465 stripdomain(hostname);
4466 }
4467
4468 _statistics->start_time = _statistics->last_reset = time(NULL);
4469
4470 #ifdef BGP
4471 if (!(bgp_peers = shared_malloc(sizeof(struct bgp_peer) * BGP_NUM_PEERS)))
4472 {
4473 LOG(0, 0, 0, "Error doing malloc for bgp: %s\n", strerror(errno));
4474 exit(1);
4475 }
4476 #endif /* BGP */
4477
4478 #ifdef LAC
4479 initremotelnsdata();
4480 #endif
4481 }
4482
4483 static int assign_ip_address(sessionidt s)
4484 {
4485 uint32_t i;
4486 int best = -1;
4487 time_t best_time = time_now;
4488 char *u = session[s].user;
4489 char reuse = 0;
4490
4491
4492 CSTAT(assign_ip_address);
4493
4494 for (i = 1; i < ip_pool_size; i++)
4495 {
4496 if (!ip_address_pool[i].address || ip_address_pool[i].assigned)
4497 continue;
4498
4499 if (!session[s].walled_garden && ip_address_pool[i].user[0] && !strcmp(u, ip_address_pool[i].user))
4500 {
4501 best = i;
4502 reuse = 1;
4503 break;
4504 }
4505
4506 if (ip_address_pool[i].last < best_time)
4507 {
4508 best = i;
4509 if (!(best_time = ip_address_pool[i].last))
4510 break; // never used, grab this one
4511 }
4512 }
4513
4514 if (best < 0)
4515 {
4516 LOG(0, s, session[s].tunnel, "assign_ip_address(): out of addresses\n");
4517 return 0;
4518 }
4519
4520 session[s].ip = ip_address_pool[best].address;
4521 session[s].ip_pool_index = best;
4522 ip_address_pool[best].assigned = 1;
4523 ip_address_pool[best].last = time_now;
4524 ip_address_pool[best].session = s;
4525 if (session[s].walled_garden)
4526 /* Don't track addresses of users in walled garden (note: this
4527 means that their address isn't "sticky" even if they get
4528 un-gardened). */
4529 ip_address_pool[best].user[0] = 0;
4530 else
4531 strncpy(ip_address_pool[best].user, u, sizeof(ip_address_pool[best].user) - 1);
4532
4533 STAT(ip_allocated);
4534 LOG(4, s, session[s].tunnel, "assign_ip_address(): %s ip address %d from pool\n",
4535 reuse ? "Reusing" : "Allocating", best);
4536
4537 return 1;
4538 }
4539
4540 static void free_ip_address(sessionidt s)
4541 {
4542 int i = session[s].ip_pool_index;
4543
4544
4545 CSTAT(free_ip_address);
4546
4547 if (!session[s].ip)
4548 return; // what the?
4549
4550 if (i < 0) // Is this actually part of the ip pool?
4551 i = 0;
4552
4553 STAT(ip_freed);
4554 cache_ipmap(session[s].ip, -i); // Change the mapping to point back to the ip pool index.
4555 session[s].ip = 0;
4556 ip_address_pool[i].assigned = 0;
4557 ip_address_pool[i].session = 0;
4558 ip_address_pool[i].last = time_now;
4559 }
4560
4561 //
4562 // Fsck the address pool against the session table.
4563 // Normally only called when we become a master.
4564 //
4565 // This isn't perfect: We aren't keep tracking of which
4566 // users used to have an IP address.
4567 //
4568 void rebuild_address_pool(void)
4569 {
4570 int i;
4571
4572 //
4573 // Zero the IP pool allocation, and build
4574 // a map from IP address to pool index.
4575 for (i = 1; i < MAXIPPOOL; ++i)
4576 {
4577 ip_address_pool[i].assigned = 0;
4578 ip_address_pool[i].session = 0;
4579 if (!ip_address_pool[i].address)
4580 continue;
4581
4582 cache_ipmap(ip_address_pool[i].address, -i); // Map pool IP to pool index.
4583 }
4584
4585 for (i = 0; i < MAXSESSION; ++i)
4586 {
4587 int ipid;
4588 if (!(session[i].opened && session[i].ip))
4589 continue;
4590
4591 ipid = - lookup_ipmap(htonl(session[i].ip));
4592
4593 if (session[i].ip_pool_index < 0)
4594 {
4595 // Not allocated out of the pool.
4596 if (ipid < 1) // Not found in the pool either? good.
4597 continue;
4598
4599 LOG(0, i, 0, "Session %u has an IP address (%s) that was marked static, but is in the pool (%d)!\n",
4600 i, fmtaddr(session[i].ip, 0), ipid);
4601
4602 // Fall through and process it as part of the pool.
4603 }
4604
4605
4606 if (ipid > MAXIPPOOL || ipid < 0)
4607 {
4608 LOG(0, i, 0, "Session %u has a pool IP that's not found in the pool! (%d)\n", i, ipid);
4609 ipid = -1;
4610 session[i].ip_pool_index = ipid;
4611 continue;
4612 }
4613
4614 ip_address_pool[ipid].assigned = 1;
4615 ip_address_pool[ipid].session = i;
4616 ip_address_pool[ipid].last = time_now;
4617 strncpy(ip_address_pool[ipid].user, session[i].user, sizeof(ip_address_pool[ipid].user) - 1);
4618 session[i].ip_pool_index = ipid;
4619 cache_ipmap(session[i].ip, i); // Fix the ip map.
4620 }
4621 }
4622
4623 //
4624 // Fix the address pool to match a changed session.
4625 // (usually when the master sends us an update).
4626 static void fix_address_pool(int sid)
4627 {
4628 int ipid;
4629
4630 ipid = session[sid].ip_pool_index;
4631
4632 if (ipid > ip_pool_size)
4633 return; // Ignore it. rebuild_address_pool will fix it up.
4634
4635 if (ip_address_pool[ipid].address != session[sid].ip)
4636 return; // Just ignore it. rebuild_address_pool will take care of it.
4637
4638 ip_address_pool[ipid].assigned = 1;
4639 ip_address_pool[ipid].session = sid;
4640 ip_address_pool[ipid].last = time_now;
4641 strncpy(ip_address_pool[ipid].user, session[sid].user, sizeof(ip_address_pool[ipid].user) - 1);
4642 }
4643
4644 //
4645 // Add a block of addresses to the IP pool to hand out.
4646 //
4647 static void add_to_ip_pool(in_addr_t addr, int prefixlen)
4648 {
4649 int i;
4650 if (prefixlen == 0)
4651 prefixlen = 32; // Host route only.
4652
4653 addr &= 0xffffffff << (32 - prefixlen);
4654
4655 if (ip_pool_size >= MAXIPPOOL) // Pool is full!
4656 return ;
4657
4658 for (i = addr ; i < addr+(1<<(32-prefixlen)); ++i)
4659 {
4660 if ((i & 0xff) == 0 || (i&0xff) == 255)
4661 continue; // Skip 0 and broadcast addresses.
4662
4663 ip_address_pool[ip_pool_size].address = i;
4664 ip_address_pool[ip_pool_size].assigned = 0;
4665 ++ip_pool_size;
4666 if (ip_pool_size >= MAXIPPOOL)
4667 {
4668 LOG(0, 0, 0, "Overflowed IP pool adding %s\n", fmtaddr(htonl(addr), 0));
4669 return;
4670 }
4671 }
4672 }
4673
4674 // Initialize the IP address pool
4675 static void initippool()
4676 {
4677 FILE *f;
4678 char *p;
4679 char buf[4096];
4680 memset(ip_address_pool, 0, sizeof(ip_address_pool));
4681
4682 if (!(f = fopen(IPPOOLFILE, "r")))
4683 {
4684 LOG(0, 0, 0, "Can't load pool file " IPPOOLFILE ": %s\n", strerror(errno));
4685 exit(1);
4686 }
4687
4688 while (ip_pool_size < MAXIPPOOL && fgets(buf, 4096, f))
4689 {
4690 char *pool = buf;
4691 buf[4095] = 0; // Force it to be zero terminated/
4692
4693 if (*buf == '#' || *buf == '\n')
4694 continue; // Skip comments / blank lines
4695 if ((p = (char *)strrchr(buf, '\n'))) *p = 0;
4696 if ((p = (char *)strchr(buf, ':')))
4697 {
4698 in_addr_t src;
4699 *p = '\0';
4700 src = inet_addr(buf);
4701 if (src == INADDR_NONE)
4702 {
4703 LOG(0, 0, 0, "Invalid address pool IP %s\n", buf);
4704 exit(1);
4705 }
4706 // This entry is for a specific IP only
4707 if (src != config->bind_address)
4708 continue;
4709 *p = ':';
4710 pool = p+1;
4711 }
4712 if ((p = (char *)strchr(pool, '/')))
4713 {
4714 // It's a range
4715 int numbits = 0;
4716 in_addr_t start = 0;
4717
4718 LOG(2, 0, 0, "Adding IP address range %s\n", buf);
4719 *p++ = 0;
4720 if (!*p || !(numbits = atoi(p)))
4721 {
4722 LOG(0, 0, 0, "Invalid pool range %s\n", buf);
4723 continue;
4724 }
4725 start = ntohl(inet_addr(pool));
4726
4727 // Add a static route for this pool
4728 LOG(5, 0, 0, "Adding route for address pool %s/%d\n",
4729 fmtaddr(htonl(start), 0), numbits);
4730
4731 routeset(0, start, numbits, 0, 1);
4732
4733 add_to_ip_pool(start, numbits);
4734 }
4735 else
4736 {
4737 // It's a single ip address
4738 add_to_ip_pool(ntohl(inet_addr(pool)), 0);
4739 }
4740 }
4741 fclose(f);
4742 LOG(1, 0, 0, "IP address pool is %d addresses\n", ip_pool_size - 1);
4743 }
4744
4745 void snoop_send_packet(uint8_t *packet, uint16_t size, in_addr_t destination, uint16_t port)
4746 {
4747 struct sockaddr_in snoop_addr = {0};
4748 if (!destination || !port || snoopfd <= 0 || size <= 0 || !packet)
4749 return;
4750
4751 snoop_addr.sin_family = AF_INET;
4752 snoop_addr.sin_addr.s_addr = destination;
4753 snoop_addr.sin_port = ntohs(port);
4754
4755 LOG(5, 0, 0, "Snooping %d byte packet to %s:%u\n", size,
4756 fmtaddr(snoop_addr.sin_addr.s_addr, 0),
4757 htons(snoop_addr.sin_port));
4758
4759 if (sendto(snoopfd, packet, size, MSG_DONTWAIT | MSG_NOSIGNAL, (void *) &snoop_addr, sizeof(snoop_addr)) < 0)
4760 LOG(0, 0, 0, "Error sending intercept packet: %s\n", strerror(errno));
4761
4762 STAT(packets_snooped);
4763 }
4764
4765 static int dump_session(FILE **f, sessiont *s)
4766 {
4767 if (!s->opened || !s->ip || !(s->cin_delta || s->cout_delta) || !*s->user || s->walled_garden)
4768 return 1;
4769
4770 if (!*f)
4771 {
4772 char filename[1024];
4773 char timestr[64];
4774 time_t now = time(NULL);
4775
4776 strftime(timestr, sizeof(timestr), "%Y%m%d%H%M%S", localtime(&now));
4777 snprintf(filename, sizeof(filename), "%s/%s", config->accounting_dir, timestr);
4778
4779 if (!(*f = fopen(filename, "w")))
4780 {
4781 LOG(0, 0, 0, "Can't write accounting info to %s: %s\n", filename, strerror(errno));
4782 return 0;
4783 }
4784
4785 LOG(3, 0, 0, "Dumping accounting information to %s\n", filename);
4786 fprintf(*f, "# dslwatch.pl dump file V1.01\n"
4787 "# host: %s\n"
4788 "# endpoint: %s\n"
4789 "# time: %ld\n"
4790 "# uptime: %ld\n"
4791 "# format: username ip qos uptxoctets downrxoctets\n",
4792 hostname,
4793 fmtaddr(config->bind_address ? config->bind_address : my_address, 0),
4794 now,
4795 now - basetime);
4796 }
4797
4798 LOG(4, 0, 0, "Dumping accounting information for %s\n", s->user);
4799 fprintf(*f, "%s %s %d %u %u\n",
4800 s->user, // username
4801 fmtaddr(htonl(s->ip), 0), // ip
4802 (s->throttle_in || s->throttle_out) ? 2 : 1, // qos
4803 (uint32_t) s->cin_delta, // uptxoctets
4804 (uint32_t) s->cout_delta); // downrxoctets
4805
4806 s->cin_delta = s->cout_delta = 0;
4807
4808 return 1;
4809 }
4810
4811 static void dump_acct_info(int all)
4812 {
4813 int i;
4814 FILE *f = NULL;
4815
4816
4817 CSTAT(dump_acct_info);
4818
4819 if (shut_acct_n)
4820 {
4821 for (i = 0; i < shut_acct_n; i++)
4822 dump_session(&f, &shut_acct[i]);
4823
4824 shut_acct_n = 0;
4825 }
4826
4827 if (all)
4828 for (i = 1; i <= config->cluster_highest_sessionid; i++)
4829 dump_session(&f, &session[i]);
4830
4831 if (f)
4832 fclose(f);
4833 }
4834
4835 // Main program
4836 int main(int argc, char *argv[])
4837 {
4838 int i;
4839 int optdebug = 0;
4840 char *optconfig = CONFIGFILE;
4841
4842 time(&basetime); // start clock
4843
4844 // scan args
4845 while ((i = getopt(argc, argv, "dvc:h:")) >= 0)
4846 {
4847 switch (i)
4848 {
4849 case 'd':
4850 if (fork()) exit(0);
4851 setsid();
4852 freopen("/dev/null", "r", stdin);
4853 freopen("/dev/null", "w", stdout);
4854 freopen("/dev/null", "w", stderr);
4855 break;
4856 case 'v':
4857 optdebug++;
4858 break;
4859 case 'c':
4860 optconfig = optarg;
4861 break;
4862 case 'h':
4863 snprintf(hostname, sizeof(hostname), "%s", optarg);
4864 break;
4865 default:
4866 printf("Args are:\n"
4867 "\t-d\t\tDetach from terminal\n"
4868 "\t-c <file>\tConfig file\n"
4869 "\t-h <hostname>\tForce hostname\n"
4870 "\t-v\t\tDebug\n");
4871
4872 return (0);
4873 break;
4874 }
4875 }
4876
4877 // Start the timer routine off
4878 time(&time_now);
4879 strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now));
4880
4881 initplugins();
4882 initdata(optdebug, optconfig);
4883
4884 init_cli();
4885 read_config_file();
4886 /* set hostname /after/ having read the config file */
4887 if (*config->hostname)
4888 strcpy(hostname, config->hostname);
4889 cli_init_complete(hostname);
4890 update_config();
4891 init_tbf(config->num_tbfs);
4892
4893 LOG(0, 0, 0, "L2TPNS version " VERSION "\n");
4894 LOG(0, 0, 0, "Copyright (c) 2003, 2004, 2005, 2006 Optus Internet Engineering\n");
4895 LOG(0, 0, 0, "Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n");
4896 {
4897 struct rlimit rlim;
4898 rlim.rlim_cur = RLIM_INFINITY;
4899 rlim.rlim_max = RLIM_INFINITY;
4900 // Remove the maximum core size
4901 if (setrlimit(RLIMIT_CORE, &rlim) < 0)
4902 LOG(0, 0, 0, "Can't set ulimit: %s\n", strerror(errno));
4903
4904 // Make core dumps go to /tmp
4905 chdir("/tmp");
4906 }
4907
4908 if (config->scheduler_fifo)
4909 {
4910 int ret;
4911 struct sched_param params = {0};
4912 params.sched_priority = 1;
4913
4914 if (get_nprocs() < 2)
4915 {
4916 LOG(0, 0, 0, "Not using FIFO scheduler, there is only 1 processor in the system.\n");
4917 config->scheduler_fifo = 0;
4918 }
4919 else
4920 {
4921 if ((ret = sched_setscheduler(0, SCHED_FIFO, &params)) == 0)
4922 {
4923 LOG(1, 0, 0, "Using FIFO scheduler. Say goodbye to any other processes running\n");
4924 }
4925 else
4926 {
4927 LOG(0, 0, 0, "Error setting scheduler to FIFO: %s\n", strerror(errno));
4928 config->scheduler_fifo = 0;
4929 }
4930 }
4931 }
4932
4933 initnetlink();
4934
4935 /* Set up the cluster communications port. */
4936 if (cluster_init() < 0)
4937 exit(1);
4938
4939 inittun();
4940 LOG(1, 0, 0, "Set up on interface %s\n", config->tundevice);
4941
4942 initudp();
4943 initrad();
4944 initippool();
4945
4946 // seed prng
4947 {
4948 unsigned seed = time_now ^ getpid();
4949 LOG(4, 0, 0, "Seeding the pseudo random generator: %u\n", seed);
4950 srand(seed);
4951 }
4952
4953 signal(SIGHUP, sighup_handler);
4954 signal(SIGCHLD, sigchild_handler);
4955 signal(SIGTERM, shutdown_handler);
4956 signal(SIGINT, shutdown_handler);
4957 signal(SIGQUIT, shutdown_handler);
4958
4959 // Prevent us from getting paged out
4960 if (config->lock_pages)
4961 {
4962 if (!mlockall(MCL_CURRENT))
4963 LOG(1, 0, 0, "Locking pages into memory\n");
4964 else
4965 LOG(0, 0, 0, "Can't lock pages: %s\n", strerror(errno));
4966 }
4967
4968 mainloop();
4969
4970 /* remove plugins (so cleanup code gets run) */
4971 plugins_done();
4972
4973 // Remove the PID file if we wrote it
4974 if (config->wrote_pid && *config->pid_file == '/')
4975 unlink(config->pid_file);
4976
4977 /* kill CLI children */
4978 signal(SIGTERM, SIG_IGN);
4979 kill(0, SIGTERM);
4980 return 0;
4981 }
4982
4983 static void sighup_handler(int sig)
4984 {
4985 main_reload++;
4986 }
4987
4988 static void shutdown_handler(int sig)
4989 {
4990 main_quit = (sig == SIGQUIT) ? QUIT_SHUTDOWN : QUIT_FAILOVER;
4991 }
4992
4993 static void sigchild_handler(int sig)
4994 {
4995 while (waitpid(-1, NULL, WNOHANG) > 0)
4996 ;
4997 }
4998
4999 static void build_chap_response(uint8_t *challenge, uint8_t id, uint16_t challenge_length, uint8_t **challenge_response)
5000 {
5001 MD5_CTX ctx;
5002 *challenge_response = NULL;
5003
5004 if (!*config->l2tp_secret)
5005 {
5006 LOG(0, 0, 0, "LNS requested CHAP authentication, but no l2tp secret is defined\n");
5007 return;
5008 }
5009
5010 LOG(4, 0, 0, " Building challenge response for CHAP request\n");
5011
5012 *challenge_response = calloc(17, 1);
5013
5014 MD5_Init(&ctx);
5015 MD5_Update(&ctx, &id, 1);
5016 MD5_Update(&ctx, config->l2tp_secret, strlen(config->l2tp_secret));
5017 MD5_Update(&ctx, challenge, challenge_length);
5018 MD5_Final(*challenge_response, &ctx);
5019
5020 return;
5021 }
5022
5023 static int facility_value(char *name)
5024 {
5025 int i;
5026 for (i = 0; facilitynames[i].c_name; i++)
5027 {
5028 if (strcmp(facilitynames[i].c_name, name) == 0)
5029 return facilitynames[i].c_val;
5030 }
5031 return 0;
5032 }
5033
5034 static void update_config()
5035 {
5036 int i;
5037 char *p;
5038 static int timeout = 0;
5039 static int interval = 0;
5040
5041 // Update logging
5042 closelog();
5043 syslog_log = 0;
5044 if (log_stream)
5045 {
5046 if (log_stream != stderr)
5047 fclose(log_stream);
5048
5049 log_stream = NULL;
5050 }
5051
5052 if (*config->log_filename)
5053 {
5054 if (strstr(config->log_filename, "syslog:") == config->log_filename)
5055 {
5056 char *p = config->log_filename + 7;
5057 if (*p)
5058 {
5059 openlog("l2tpns", LOG_PID, facility_value(p));
5060 syslog_log = 1;
5061 }
5062 }
5063 else if (strchr(config->log_filename, '/') == config->log_filename)
5064 {
5065 if ((log_stream = fopen((char *)(config->log_filename), "a")))
5066 {
5067 fseek(log_stream, 0, SEEK_END);
5068 setbuf(log_stream, NULL);
5069 }
5070 else
5071 {
5072 log_stream = stderr;
5073 setbuf(log_stream, NULL);
5074 }
5075 }
5076 }
5077 else
5078 {
5079 log_stream = stderr;
5080 setbuf(log_stream, NULL);
5081 }
5082
5083 #define L2TP_HDRS (20+8+6+4) // L2TP data encaptulation: ip + udp + l2tp (data) + ppp (inc hdlc)
5084 #define TCP_HDRS (20+20) // TCP encapsulation: ip + tcp
5085
5086 if (config->l2tp_mtu <= 0) config->l2tp_mtu = 1500; // ethernet default
5087 else if (config->l2tp_mtu < MINMTU) config->l2tp_mtu = MINMTU;
5088 else if (config->l2tp_mtu > MAXMTU) config->l2tp_mtu = MAXMTU;
5089
5090 // reset MRU/MSS globals
5091 MRU = config->l2tp_mtu - L2TP_HDRS;
5092 if (MRU > PPPoE_MRU)
5093 MRU = PPPoE_MRU;
5094
5095 MSS = MRU - TCP_HDRS;
5096
5097 // Update radius
5098 config->numradiusservers = 0;
5099 for (i = 0; i < MAXRADSERVER; i++)
5100 if (config->radiusserver[i])
5101 {
5102 config->numradiusservers++;
5103 // Set radius port: if not set, take the port from the
5104 // first radius server. For the first radius server,
5105 // take the #defined default value from l2tpns.h
5106
5107 // test twice, In case someone works with
5108 // a secondary radius server without defining
5109 // a primary one, this will work even then.
5110 if (i > 0 && !config->radiusport[i])
5111 config->radiusport[i] = config->radiusport[i-1];
5112 if (!config->radiusport[i])
5113 config->radiusport[i] = RADPORT;
5114 }
5115
5116 if (!config->numradiusservers)
5117 LOG(0, 0, 0, "No RADIUS servers defined!\n");
5118
5119 // parse radius_authtypes_s
5120 config->radius_authtypes = config->radius_authprefer = 0;
5121 p = config->radius_authtypes_s;
5122 while (p && *p)
5123 {
5124 char *s = strpbrk(p, " \t,");
5125 int type = 0;
5126
5127 if (s)
5128 {
5129 *s++ = 0;
5130 while (*s == ' ' || *s == '\t')
5131 s++;
5132
5133 if (!*s)
5134 s = 0;
5135 }
5136
5137 if (!strncasecmp("chap", p, strlen(p)))
5138 type = AUTHCHAP;
5139 else if (!strncasecmp("pap", p, strlen(p)))
5140 type = AUTHPAP;
5141 else
5142 LOG(0, 0, 0, "Invalid RADIUS authentication type \"%s\"\n", p);
5143
5144 config->radius_authtypes |= type;
5145 if (!config->radius_authprefer)
5146 config->radius_authprefer = type;
5147
5148 p = s;
5149 }
5150
5151 if (!config->radius_authtypes)
5152 {
5153 LOG(0, 0, 0, "Defaulting to PAP authentication\n");
5154 config->radius_authtypes = config->radius_authprefer = AUTHPAP;
5155 }
5156
5157 // normalise radius_authtypes_s
5158 if (config->radius_authprefer == AUTHPAP)
5159 {
5160 strcpy(config->radius_authtypes_s, "pap");
5161 if (config->radius_authtypes & AUTHCHAP)
5162 strcat(config->radius_authtypes_s, ", chap");
5163 }
5164 else
5165 {
5166 strcpy(config->radius_authtypes_s, "chap");
5167 if (config->radius_authtypes & AUTHPAP)
5168 strcat(config->radius_authtypes_s, ", pap");
5169 }
5170
5171 if (!config->radius_dae_port)
5172 config->radius_dae_port = DAEPORT;
5173
5174 // re-initialise the random number source
5175 initrandom(config->random_device);
5176
5177 // Update plugins
5178 for (i = 0; i < MAXPLUGINS; i++)
5179 {
5180 if (strcmp(config->plugins[i], config->old_plugins[i]) == 0)
5181 continue;
5182
5183 if (*config->plugins[i])
5184 {
5185 // Plugin added
5186 add_plugin(config->plugins[i]);
5187 }
5188 else if (*config->old_plugins[i])
5189 {
5190 // Plugin removed
5191 remove_plugin(config->old_plugins[i]);
5192 }
5193 }
5194
5195 // Guest change
5196 guest_accounts_num = 0;
5197 char *p2 = config->guest_user;
5198 while (p2 && *p2)
5199 {
5200 char *s = strpbrk(p2, " \t,");
5201 if (s)
5202 {
5203 *s++ = 0;
5204 while (*s == ' ' || *s == '\t')
5205 s++;
5206
5207 if (!*s)
5208 s = 0;
5209 }
5210
5211 strcpy(guest_users[guest_accounts_num], p2);
5212 LOG(1, 0, 0, "Guest account[%d]: %s\n", guest_accounts_num, guest_users[guest_accounts_num]);
5213 guest_accounts_num++;
5214 p2 = s;
5215 }
5216 // Rebuild the guest_user array
5217 strcpy(config->guest_user, "");
5218 int ui = 0;
5219 for (ui=0; ui<guest_accounts_num; ui++)
5220 {
5221 strcat(config->guest_user, guest_users[ui]);
5222 if (ui<guest_accounts_num-1)
5223 {
5224 strcat(config->guest_user, ",");
5225 }
5226 }
5227
5228
5229 memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
5230 if (!config->multi_read_count) config->multi_read_count = 10;
5231 if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);
5232 if (!*config->cluster_interface)
5233 strncpy(config->cluster_interface, DEFAULT_MCAST_INTERFACE, sizeof(config->cluster_interface) - 1);
5234
5235 if (!config->cluster_hb_interval)
5236 config->cluster_hb_interval = PING_INTERVAL; // Heartbeat every 0.5 seconds.
5237
5238 if (!config->cluster_hb_timeout)
5239 config->cluster_hb_timeout = HB_TIMEOUT; // 10 missed heartbeat triggers an election.
5240
5241 if (interval != config->cluster_hb_interval || timeout != config->cluster_hb_timeout)
5242 {
5243 // Paranoia: cluster_check_master() treats 2 x interval + 1 sec as
5244 // late, ensure we're sufficiently larger than that
5245 int t = 4 * config->cluster_hb_interval + 11;
5246
5247 if (config->cluster_hb_timeout < t)
5248 {
5249 LOG(0, 0, 0, "Heartbeat timeout %d too low, adjusting to %d\n", config->cluster_hb_timeout, t);
5250 config->cluster_hb_timeout = t;
5251 }
5252
5253 // Push timing changes to the slaves immediately if we're the master
5254 if (config->cluster_iam_master)
5255 cluster_heartbeat();
5256
5257 interval = config->cluster_hb_interval;
5258 timeout = config->cluster_hb_timeout;
5259 }
5260
5261 // Write PID file
5262 if (*config->pid_file == '/' && !config->wrote_pid)
5263 {
5264 FILE *f;
5265 if ((f = fopen(config->pid_file, "w")))
5266 {
5267 fprintf(f, "%d\n", getpid());
5268 fclose(f);
5269 config->wrote_pid = 1;
5270 }
5271 else
5272 {
5273 LOG(0, 0, 0, "Can't write to PID file %s: %s\n", config->pid_file, strerror(errno));
5274 }
5275 }
5276 }
5277
5278 static void read_config_file()
5279 {
5280 FILE *f;
5281
5282 if (!config->config_file) return;
5283 if (!(f = fopen(config->config_file, "r")))
5284 {
5285 fprintf(stderr, "Can't open config file %s: %s\n", config->config_file, strerror(errno));
5286 return;
5287 }
5288
5289 LOG(3, 0, 0, "Reading config file %s\n", config->config_file);
5290 cli_do_file(f);
5291 LOG(3, 0, 0, "Done reading config file\n");
5292 fclose(f);
5293 }
5294
5295 int sessionsetup(sessionidt s, tunnelidt t)
5296 {
5297 // A session now exists, set it up
5298 in_addr_t ip;
5299 char *user;
5300 sessionidt i;
5301 int r;
5302
5303 CSTAT(sessionsetup);
5304
5305 LOG(3, s, t, "Doing session setup for session\n");
5306
5307 // Join a bundle if the MRRU option is accepted
5308 if(session[s].mrru > 0 && session[s].bundle == 0)
5309 {
5310 LOG(3, s, t, "This session can be part of multilink bundle\n");
5311 if (join_bundle(s) > 0)
5312 cluster_send_bundle(session[s].bundle);
5313 else
5314 {
5315 LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n");
5316 sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE);
5317 return 0;
5318 }
5319 }
5320
5321 if (!session[s].ip)
5322 {
5323 assign_ip_address(s);
5324 if (!session[s].ip)
5325 {
5326 LOG(0, s, t, " No IP allocated. The IP address pool is FULL!\n");
5327 sessionshutdown(s, "No IP addresses available.", CDN_TRY_ANOTHER, TERM_SERVICE_UNAVAILABLE);
5328 return 0;
5329 }
5330 LOG(3, s, t, " No IP allocated. Assigned %s from pool\n",
5331 fmtaddr(htonl(session[s].ip), 0));
5332 }
5333
5334 // Make sure this is right
5335 session[s].tunnel = t;
5336
5337 // zap old sessions with same IP and/or username
5338 // Don't kill gardened sessions - doing so leads to a DoS
5339 // from someone who doesn't need to know the password
5340 {
5341 ip = session[s].ip;
5342 user = session[s].user;
5343 for (i = 1; i <= config->cluster_highest_sessionid; i++)
5344 {
5345 if (i == s) continue;
5346 if (!session[s].opened) break;
5347 // Allow duplicate sessions for multilink ones of the same bundle.
5348 if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle) continue;
5349
5350 if (ip == session[i].ip)
5351 {
5352 sessionkill(i, "Duplicate IP address");
5353 cluster_listinvert_session(s, i);
5354 continue;
5355 }
5356
5357 if (config->allow_duplicate_users) continue;
5358 if (session[s].walled_garden || session[i].walled_garden) continue;
5359 // Guest change
5360 int found = 0;
5361 int gu;
5362 for (gu = 0; gu < guest_accounts_num; gu++)
5363 {
5364 if (!strcasecmp(user, guest_users[gu]))
5365 {
5366 found = 1;
5367 break;
5368 }
5369 }
5370 if (found) continue;
5371
5372 // Drop the new session in case of duplicate sessionss, not the old one.
5373 if (!strcasecmp(user, session[i].user))
5374 sessionkill(i, "Duplicate session for users");
5375 }
5376 }
5377
5378 // no need to set a route for the same IP address of the bundle
5379 if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1))
5380 {
5381 int routed = 0;
5382
5383 // Add the route for this session.
5384 for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++)
5385 {
5386 if ((session[s].ip >> (32-session[s].route[r].prefixlen)) ==
5387 (session[s].route[r].ip >> (32-session[s].route[r].prefixlen)))
5388 routed++;
5389
5390 routeset(s, session[s].route[r].ip, session[s].route[r].prefixlen, 0, 1);
5391 }
5392
5393 // Static IPs need to be routed if not already
5394 // convered by a Framed-Route. Anything else is part
5395 // of the IP address pool and is already routed, it
5396 // just needs to be added to the IP cache.
5397 // IPv6 route setup is done in ppp.c, when IPV6CP is acked.
5398 if (session[s].ip_pool_index == -1) // static ip
5399 {
5400 if (!routed) routeset(s, session[s].ip, 0, 0, 1);
5401 }
5402 else
5403 cache_ipmap(session[s].ip, s);
5404 }
5405
5406 sess_local[s].lcp_authtype = 0; // RADIUS authentication complete
5407 lcp_open(s, t); // transition to Network phase and send initial IPCP
5408
5409 // Run the plugin's against this new session.
5410 {
5411 struct param_new_session data = { &tunnel[t], &session[s] };
5412 run_plugins(PLUGIN_NEW_SESSION, &data);
5413 }
5414
5415 // Allocate TBFs if throttled
5416 if (session[s].throttle_in || session[s].throttle_out)
5417 throttle_session(s, session[s].throttle_in, session[s].throttle_out);
5418
5419 session[s].last_packet = session[s].last_data = time_now;
5420
5421 LOG(2, s, t, "Login by %s at %s from %s (%s)\n", session[s].user,
5422 fmtaddr(htonl(session[s].ip), 0),
5423 fmtaddr(htonl(tunnel[t].ip), 1), tunnel[t].hostname);
5424
5425 cluster_send_session(s); // Mark it as dirty, and needing to the flooded to the cluster.
5426
5427 return 1; // RADIUS OK and IP allocated, done...
5428 }
5429
5430 //
5431 // This session just got dropped on us by the master or something.
5432 // Make sure our tables up up to date...
5433 //
5434 int load_session(sessionidt s, sessiont *new)
5435 {
5436 int i;
5437 int newip = 0;
5438
5439 // Sanity checks.
5440 if (new->ip_pool_index >= MAXIPPOOL ||
5441 new->tunnel >= MAXTUNNEL)
5442 {
5443 LOG(0, s, 0, "Strange session update received!\n");
5444 // FIXME! What to do here?
5445 return 0;
5446 }
5447
5448 //
5449 // Ok. All sanity checks passed. Now we're committed to
5450 // loading the new session.
5451 //
5452
5453 session[s].tunnel = new->tunnel; // For logging in cache_ipmap
5454
5455 // See if routes/ip cache need updating
5456 if (new->ip != session[s].ip)
5457 newip++;
5458
5459 for (i = 0; !newip && i < MAXROUTE && (session[s].route[i].ip || new->route[i].ip); i++)
5460 if (new->route[i].ip != session[s].route[i].ip ||
5461 new->route[i].prefixlen != session[s].route[i].prefixlen)
5462 newip++;
5463
5464 // needs update
5465 if (newip)
5466 {
5467 int routed = 0;
5468
5469 // remove old routes...
5470 for (i = 0; i < MAXROUTE && session[s].route[i].ip; i++)
5471 {
5472 if ((session[s].ip >> (32-session[s].route[i].prefixlen)) ==
5473 (session[s].route[i].ip >> (32-session[s].route[i].prefixlen)))
5474 routed++;
5475
5476 routeset(s, session[s].route[i].ip, session[s].route[i].prefixlen, 0, 0);
5477 }
5478
5479 // ...ip
5480 if (session[s].ip)
5481 {
5482 if (session[s].ip_pool_index == -1) // static IP
5483 {
5484 if (!routed) routeset(s, session[s].ip, 0, 0, 0);
5485 }
5486 else // It's part of the IP pool, remove it manually.
5487 uncache_ipmap(session[s].ip);
5488 }
5489
5490 routed = 0;
5491
5492 // add new routes...
5493 for (i = 0; i < MAXROUTE && new->route[i].ip; i++)
5494 {
5495 if ((new->ip >> (32-new->route[i].prefixlen)) ==
5496 (new->route[i].ip >> (32-new->route[i].prefixlen)))
5497 routed++;
5498
5499 routeset(s, new->route[i].ip, new->route[i].prefixlen, 0, 1);
5500 }
5501
5502 // ...ip
5503 if (new->ip)
5504 {
5505 // If there's a new one, add it.
5506 if (new->ip_pool_index == -1)
5507 {
5508 if (!routed) routeset(s, new->ip, 0, 0, 1);
5509 }
5510 else
5511 cache_ipmap(new->ip, s);
5512 }
5513 }
5514
5515 // check v6 routing
5516 if (new->ipv6prefixlen && new->ppp.ipv6cp == Opened && session[s].ppp.ipv6cp != Opened)
5517 route6set(s, new->ipv6route, new->ipv6prefixlen, 1);
5518
5519 // check filters
5520 if (new->filter_in && (new->filter_in > MAXFILTER || !ip_filters[new->filter_in - 1].name[0]))
5521 {
5522 LOG(2, s, session[s].tunnel, "Dropping invalid input filter %u\n", (int) new->filter_in);
5523 new->filter_in = 0;
5524 }
5525
5526 if (new->filter_out && (new->filter_out > MAXFILTER || !ip_filters[new->filter_out - 1].name[0]))
5527 {
5528 LOG(2, s, session[s].tunnel, "Dropping invalid output filter %u\n", (int) new->filter_out);
5529 new->filter_out = 0;
5530 }
5531
5532 if (new->filter_in != session[s].filter_in)
5533 {
5534 if (session[s].filter_in) ip_filters[session[s].filter_in - 1].used--;
5535 if (new->filter_in) ip_filters[new->filter_in - 1].used++;
5536 }
5537
5538 if (new->filter_out != session[s].filter_out)
5539 {
5540 if (session[s].filter_out) ip_filters[session[s].filter_out - 1].used--;
5541 if (new->filter_out) ip_filters[new->filter_out - 1].used++;
5542 }
5543
5544 if (new->tunnel && s > config->cluster_highest_sessionid) // Maintain this in the slave. It's used
5545 // for walking the sessions to forward byte counts to the master.
5546 config->cluster_highest_sessionid = s;
5547
5548 memcpy(&session[s], new, sizeof(session[s])); // Copy over..
5549
5550 // Do fixups into address pool.
5551 if (new->ip_pool_index != -1)
5552 fix_address_pool(s);
5553
5554 return 1;
5555 }
5556
5557 static void initplugins()
5558 {
5559 int i;
5560
5561 loaded_plugins = ll_init();
5562 // Initialize the plugins to nothing
5563 for (i = 0; i < MAX_PLUGIN_TYPES; i++)
5564 plugins[i] = ll_init();
5565 }
5566
5567 static void *open_plugin(char *plugin_name, int load)
5568 {
5569 char path[256] = "";
5570
5571 snprintf(path, 256, PLUGINDIR "/%s.so", plugin_name);
5572 LOG(2, 0, 0, "%soading plugin from %s\n", load ? "L" : "Un-l", path);
5573 return dlopen(path, RTLD_NOW);
5574 }
5575
5576 // plugin callback to get a config value
5577 static void *getconfig(char *key, enum config_typet type)
5578 {
5579 int i;
5580
5581 for (i = 0; config_values[i].key; i++)
5582 {
5583 if (!strcmp(config_values[i].key, key))
5584 {
5585 if (config_values[i].type == type)
5586 return ((void *) config) + config_values[i].offset;
5587
5588 LOG(1, 0, 0, "plugin requested config item \"%s\" expecting type %d, have type %d\n",
5589 key, type, config_values[i].type);
5590
5591 return 0;
5592 }
5593 }
5594
5595 LOG(1, 0, 0, "plugin requested unknown config item \"%s\"\n", key);
5596 return 0;
5597 }
5598
5599 static int add_plugin(char *plugin_name)
5600 {
5601 static struct pluginfuncs funcs = {
5602 _log,
5603 _log_hex,
5604 fmtaddr,
5605 sessionbyuser,
5606 sessiontbysessionidt,
5607 sessionidtbysessiont,
5608 radiusnew,
5609 radiussend,
5610 getconfig,
5611 sessionshutdown,
5612 sessionkill,
5613 throttle_session,
5614 cluster_send_session,
5615 };
5616
5617 void *p = open_plugin(plugin_name, 1);
5618 int (*initfunc)(struct pluginfuncs *);
5619 int i;
5620
5621 if (!p)
5622 {
5623 LOG(1, 0, 0, " Plugin load failed: %s\n", dlerror());
5624 return -1;
5625 }
5626
5627 if (ll_contains(loaded_plugins, p))
5628 {
5629 dlclose(p);
5630 return 0; // already loaded
5631 }
5632
5633 {
5634 int *v = dlsym(p, "plugin_api_version");
5635 if (!v || *v != PLUGIN_API_VERSION)
5636 {
5637 LOG(1, 0, 0, " Plugin load failed: API version mismatch: %s\n", dlerror());
5638 dlclose(p);
5639 return -1;
5640 }
5641 }
5642
5643 if ((initfunc = dlsym(p, "plugin_init")))
5644 {
5645 if (!initfunc(&funcs))
5646 {
5647 LOG(1, 0, 0, " Plugin load failed: plugin_init() returned FALSE: %s\n", dlerror());
5648 dlclose(p);
5649 return -1;
5650 }
5651 }
5652
5653 ll_push(loaded_plugins, p);
5654
5655 for (i = 0; i < max_plugin_functions; i++)
5656 {
5657 void *x;
5658 if (plugin_functions[i] && (x = dlsym(p, plugin_functions[i])))
5659 {
5660 LOG(3, 0, 0, " Supports function \"%s\"\n", plugin_functions[i]);
5661 ll_push(plugins[i], x);
5662 }
5663 }
5664
5665 LOG(2, 0, 0, " Loaded plugin %s\n", plugin_name);
5666 return 1;
5667 }
5668
5669 static void run_plugin_done(void *plugin)
5670 {
5671 int (*donefunc)(void) = dlsym(plugin, "plugin_done");
5672
5673 if (donefunc)
5674 donefunc();
5675 }
5676
5677 static int remove_plugin(char *plugin_name)
5678 {
5679 void *p = open_plugin(plugin_name, 0);
5680 int loaded = 0;
5681
5682 if (!p)
5683 return -1;
5684
5685 if (ll_contains(loaded_plugins, p))
5686 {
5687 int i;
5688 for (i = 0; i < max_plugin_functions; i++)
5689 {
5690 void *x;
5691 if (plugin_functions[i] && (x = dlsym(p, plugin_functions[i])))
5692 ll_delete(plugins[i], x);
5693 }
5694
5695 ll_delete(loaded_plugins, p);
5696 run_plugin_done(p);
5697 loaded = 1;
5698 }
5699
5700 dlclose(p);
5701 LOG(2, 0, 0, "Removed plugin %s\n", plugin_name);
5702 return loaded;
5703 }
5704
5705 int run_plugins(int plugin_type, void *data)
5706 {
5707 int (*func)(void *data);
5708
5709 if (!plugins[plugin_type] || plugin_type > max_plugin_functions)
5710 return PLUGIN_RET_ERROR;
5711
5712 ll_reset(plugins[plugin_type]);
5713 while ((func = ll_next(plugins[plugin_type])))
5714 {
5715 int r = func(data);
5716
5717 if (r != PLUGIN_RET_OK)
5718 return r; // stop here
5719 }
5720
5721 return PLUGIN_RET_OK;
5722 }
5723
5724 static void plugins_done()
5725 {
5726 void *p;
5727
5728 ll_reset(loaded_plugins);
5729 while ((p = ll_next(loaded_plugins)))
5730 run_plugin_done(p);
5731 }
5732
5733 static void processcontrol(uint8_t *buf, int len, struct sockaddr_in *addr, int alen, struct in_addr *local)
5734 {
5735 struct nsctl request;
5736 struct nsctl response;
5737 int type = unpack_control(&request, buf, len);
5738 int r;
5739 void *p;
5740
5741 if (log_stream && config->debug >= 4)
5742 {
5743 if (type < 0)
5744 {
5745 LOG(4, 0, 0, "Bogus control message from %s (%d)\n",
5746 fmtaddr(addr->sin_addr.s_addr, 0), type);
5747 }
5748 else
5749 {
5750 LOG(4, 0, 0, "Received [%s] ", fmtaddr(addr->sin_addr.s_addr, 0));
5751 dump_control(&request, log_stream);
5752 }
5753 }
5754
5755 switch (type)
5756 {
5757 case NSCTL_REQ_LOAD:
5758 if (request.argc != 1)
5759 {
5760 response.type = NSCTL_RES_ERR;
5761 response.argc = 1;
5762 response.argv[0] = "name of plugin required";
5763 }
5764 else if ((r = add_plugin(request.argv[0])) < 1)
5765 {
5766 response.type = NSCTL_RES_ERR;
5767 response.argc = 1;
5768 response.argv[0] = !r
5769 ? "plugin already loaded"
5770 : "error loading plugin";
5771 }
5772 else
5773 {
5774 response.type = NSCTL_RES_OK;
5775 response.argc = 0;
5776 }
5777
5778 break;
5779
5780 case NSCTL_REQ_UNLOAD:
5781 if (request.argc != 1)
5782 {
5783 response.type = NSCTL_RES_ERR;
5784 response.argc = 1;
5785 response.argv[0] = "name of plugin required";
5786 }
5787 else if ((r = remove_plugin(request.argv[0])) < 1)
5788 {
5789 response.type = NSCTL_RES_ERR;
5790 response.argc = 1;
5791 response.argv[0] = !r
5792 ? "plugin not loaded"
5793 : "plugin not found";
5794 }
5795 else
5796 {
5797 response.type = NSCTL_RES_OK;
5798 response.argc = 0;
5799 }
5800
5801 break;
5802
5803 case NSCTL_REQ_HELP:
5804 response.type = NSCTL_RES_OK;
5805 response.argc = 0;
5806
5807 ll_reset(loaded_plugins);
5808 while ((p = ll_next(loaded_plugins)))
5809 {
5810 char **help = dlsym(p, "plugin_control_help");
5811 while (response.argc < 0xff && help && *help)
5812 response.argv[response.argc++] = *help++;
5813 }
5814
5815 break;
5816
5817 case NSCTL_REQ_CONTROL:
5818 {
5819 struct param_control param = {
5820 config->cluster_iam_master,
5821 request.argc,
5822 request.argv,
5823 0,
5824 NULL,
5825 };
5826
5827 int r = run_plugins(PLUGIN_CONTROL, &param);
5828
5829 if (r == PLUGIN_RET_ERROR)
5830 {
5831 response.type = NSCTL_RES_ERR;
5832 response.argc = 1;
5833 response.argv[0] = param.additional
5834 ? param.additional
5835 : "error returned by plugin";
5836 }
5837 else if (r == PLUGIN_RET_NOTMASTER)
5838 {
5839 static char msg[] = "must be run on master: 000.000.000.000";
5840
5841 response.type = NSCTL_RES_ERR;
5842 response.argc = 1;
5843 if (config->cluster_master_address)
5844 {
5845 strcpy(msg + 23, fmtaddr(config->cluster_master_address, 0));
5846 response.argv[0] = msg;
5847 }
5848 else
5849 {
5850 response.argv[0] = "must be run on master: none elected";
5851 }
5852 }
5853 else if (!(param.response & NSCTL_RESPONSE))
5854 {
5855 response.type = NSCTL_RES_ERR;
5856 response.argc = 1;
5857 response.argv[0] = param.response
5858 ? "unrecognised response value from plugin"
5859 : "unhandled action";
5860 }
5861 else
5862 {
5863 response.type = param.response;
5864 response.argc = 0;
5865 if (param.additional)
5866 {
5867 response.argc = 1;
5868 response.argv[0] = param.additional;
5869 }
5870 }
5871 }
5872
5873 break;
5874
5875 default:
5876 response.type = NSCTL_RES_ERR;
5877 response.argc = 1;
5878 response.argv[0] = "error unpacking control packet";
5879 }
5880
5881 buf = calloc(NSCTL_MAX_PKT_SZ, 1);
5882 if (!buf)
5883 {
5884 LOG(2, 0, 0, "Failed to allocate nsctl response\n");
5885 return;
5886 }
5887
5888 r = pack_control(buf, NSCTL_MAX_PKT_SZ, response.type, response.argc, response.argv);
5889 if (r > 0)
5890 {
5891 sendtofrom(controlfd, buf, r, 0, (const struct sockaddr *) addr, alen, local);
5892 if (log_stream && config->debug >= 4)
5893 {
5894 LOG(4, 0, 0, "Sent [%s] ", fmtaddr(addr->sin_addr.s_addr, 0));
5895 dump_control(&response, log_stream);
5896 }
5897 }
5898 else
5899 LOG(2, 0, 0, "Failed to pack nsctl response for %s (%d)\n",
5900 fmtaddr(addr->sin_addr.s_addr, 0), r);
5901
5902 free(buf);
5903 }
5904
5905 static tunnelidt new_tunnel()
5906 {
5907 tunnelidt i;
5908 for (i = 1; i < MAXTUNNEL; i++)
5909 {
5910 if (tunnel[i].state == TUNNELFREE)
5911 {
5912 LOG(4, 0, i, "Assigning tunnel ID %u\n", i);
5913 if (i > config->cluster_highest_tunnelid)
5914 config->cluster_highest_tunnelid = i;
5915 return i;
5916 }
5917 }
5918 LOG(0, 0, 0, "Can't find a free tunnel! There shouldn't be this many in use!\n");
5919 return 0;
5920 }
5921
5922 //
5923 // We're becoming the master. Do any required setup..
5924 //
5925 // This is principally telling all the plugins that we're
5926 // now a master, and telling them about all the sessions
5927 // that are active too..
5928 //
5929 void become_master(void)
5930 {
5931 int s, i;
5932 static struct event_data d[RADIUS_FDS];
5933 struct epoll_event e;
5934
5935 run_plugins(PLUGIN_BECOME_MASTER, NULL);
5936
5937 // running a bunch of iptables commands is slow and can cause
5938 // the master to drop tunnels on takeover--kludge around the
5939 // problem by forking for the moment (note: race)
5940 if (!fork_and_close())
5941 {
5942 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
5943 {
5944 if (!session[s].opened) // Not an in-use session.
5945 continue;
5946
5947 run_plugins(PLUGIN_NEW_SESSION_MASTER, &session[s]);
5948 }
5949 exit(0);
5950 }
5951
5952 // add radius fds
5953 e.events = EPOLLIN;
5954 for (i = 0; i < RADIUS_FDS; i++)
5955 {
5956 d[i].type = FD_TYPE_RADIUS;
5957 d[i].index = i;
5958 e.data.ptr = &d[i];
5959
5960 epoll_ctl(epollfd, EPOLL_CTL_ADD, radfds[i], &e);
5961 }
5962 }
5963
5964 int cmd_show_hist_idle(struct cli_def *cli, char *command, char **argv, int argc)
5965 {
5966 int s, i;
5967 int count = 0;
5968 int buckets[64];
5969
5970 if (CLI_HELP_REQUESTED)
5971 return CLI_HELP_NO_ARGS;
5972
5973 time(&time_now);
5974 for (i = 0; i < 64;++i) buckets[i] = 0;
5975
5976 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
5977 {
5978 int idle;
5979 if (!session[s].opened)
5980 continue;
5981
5982 idle = time_now - session[s].last_data;
5983 idle /= 5 ; // In multiples of 5 seconds.
5984 if (idle < 0)
5985 idle = 0;
5986 if (idle > 63)
5987 idle = 63;
5988
5989 ++count;
5990 ++buckets[idle];
5991 }
5992
5993 for (i = 0; i < 63; ++i)
5994 {
5995 cli_print(cli, "%3d seconds : %7.2f%% (%6d)", i * 5, (double) buckets[i] * 100.0 / count , buckets[i]);
5996 }
5997 cli_print(cli, "lots of secs : %7.2f%% (%6d)", (double) buckets[63] * 100.0 / count , buckets[i]);
5998 cli_print(cli, "%d total sessions open.", count);
5999 return CLI_OK;
6000 }
6001
6002 int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc)
6003 {
6004 int s, i;
6005 int count = 0;
6006 int buckets[64];
6007
6008 if (CLI_HELP_REQUESTED)
6009 return CLI_HELP_NO_ARGS;
6010
6011 time(&time_now);
6012 for (i = 0; i < 64;++i) buckets[i] = 0;
6013
6014 for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
6015 {
6016 int open = 0, d;
6017 if (!session[s].opened)
6018 continue;
6019
6020 d = time_now - session[s].opened;
6021 if (d < 0)
6022 d = 0;
6023 while (d > 1 && open < 32)
6024 {
6025 ++open;
6026 d >>= 1; // half.
6027 }
6028 ++count;
6029 ++buckets[open];
6030 }
6031
6032 s = 1;
6033 for (i = 0; i < 30; ++i)
6034 {
6035 cli_print(cli, " < %8d seconds : %7.2f%% (%6d)", s, (double) buckets[i] * 100.0 / count , buckets[i]);
6036 s <<= 1;
6037 }
6038 cli_print(cli, "%d total sessions open.", count);
6039 return CLI_OK;
6040 }
6041
6042 /* Unhide an avp.
6043 *
6044 * This unencodes the AVP using the L2TP secret and the previously
6045 * stored random vector. It overwrites the hidden data with the
6046 * unhidden AVP subformat.
6047 */
6048 static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len)
6049 {
6050 MD5_CTX ctx;
6051 uint8_t digest[16];
6052 uint8_t *last;
6053 size_t d = 0;
6054 uint16_t m = htons(type);
6055
6056 // Compute initial pad
6057 MD5_Init(&ctx);
6058 MD5_Update(&ctx, (unsigned char *) &m, 2);
6059 MD5_Update(&ctx, config->l2tp_secret, strlen(config->l2tp_secret));
6060 MD5_Update(&ctx, vector, vec_len);
6061 MD5_Final(digest, &ctx);
6062
6063 // pointer to last decoded 16 octets
6064 last = value;
6065
6066 while (len > 0)
6067 {
6068 // calculate a new pad based on the last decoded block
6069 if (d >= sizeof(digest))
6070 {
6071 MD5_Init(&ctx);
6072 MD5_Update(&ctx, config->l2tp_secret, strlen(config->l2tp_secret));
6073 MD5_Update(&ctx, last, sizeof(digest));
6074 MD5_Final(digest, &ctx);
6075
6076 d = 0;
6077 last = value;
6078 }
6079
6080 *value++ ^= digest[d++];
6081 len--;
6082 }
6083 }
6084
6085 int find_filter(char const *name, size_t len)
6086 {
6087 int free = -1;
6088 int i;
6089
6090 for (i = 0; i < MAXFILTER; i++)
6091 {
6092 if (!*ip_filters[i].name)
6093 {
6094 if (free < 0)
6095 free = i;
6096
6097 continue;
6098 }
6099
6100 if (strlen(ip_filters[i].name) != len)
6101 continue;
6102
6103 if (!strncmp(ip_filters[i].name, name, len))
6104 return i;
6105 }
6106
6107 return free;
6108 }
6109
6110 static int ip_filter_port(ip_filter_portt *p, uint16_t port)
6111 {
6112 switch (p->op)
6113 {
6114 case FILTER_PORT_OP_EQ: return port == p->port;
6115 case FILTER_PORT_OP_NEQ: return port != p->port;
6116 case FILTER_PORT_OP_GT: return port > p->port;
6117 case FILTER_PORT_OP_LT: return port < p->port;
6118 case FILTER_PORT_OP_RANGE: return port >= p->port && port <= p->port2;
6119 }
6120
6121 return 0;
6122 }
6123
6124 static int ip_filter_flag(uint8_t op, uint8_t sflags, uint8_t cflags, uint8_t flags)
6125 {
6126 switch (op)
6127 {
6128 case FILTER_FLAG_OP_ANY:
6129 return (flags & sflags) || (~flags & cflags);
6130
6131 case FILTER_FLAG_OP_ALL:
6132 return (flags & sflags) == sflags && (~flags & cflags) == cflags;
6133
6134 case FILTER_FLAG_OP_EST:
6135 return (flags & (TCP_FLAG_ACK|TCP_FLAG_RST)) && (~flags & TCP_FLAG_SYN);
6136 }
6137
6138 return 0;
6139 }
6140
6141 int ip_filter(uint8_t *buf, int len, uint8_t filter)
6142 {
6143 uint16_t frag_offset;
6144 uint8_t proto;
6145 in_addr_t src_ip;
6146 in_addr_t dst_ip;
6147 uint16_t src_port = 0;
6148 uint16_t dst_port = 0;
6149 uint8_t flags = 0;
6150 ip_filter_rulet *rule;
6151
6152 if (len < 20) // up to end of destination address
6153 return 0;
6154
6155 if ((*buf >> 4) != 4) // IPv4
6156 return 0;
6157
6158 frag_offset = ntohs(*(uint16_t *) (buf + 6)) & 0x1fff;
6159 proto = buf[9];
6160 src_ip = *(in_addr_t *) (buf + 12);
6161 dst_ip = *(in_addr_t *) (buf + 16);
6162
6163 if (frag_offset == 0 && (proto == IPPROTO_TCP || proto == IPPROTO_UDP))
6164 {
6165 int l = (buf[0] & 0xf) * 4; // length of IP header
6166 if (len < l + 4) // ports
6167 return 0;
6168
6169 src_port = ntohs(*(uint16_t *) (buf + l));
6170 dst_port = ntohs(*(uint16_t *) (buf + l + 2));
6171 if (proto == IPPROTO_TCP)
6172 {
6173 if (len < l + 14) // flags
6174 return 0;
6175
6176 flags = buf[l + 13] & 0x3f;
6177 }
6178 }
6179
6180 for (rule = ip_filters[filter].rules; rule->action; rule++)
6181 {
6182 if (rule->proto != IPPROTO_IP && proto != rule->proto)
6183 continue;
6184
6185 if (rule->src_wild != INADDR_BROADCAST &&
6186 (src_ip & ~rule->src_wild) != (rule->src_ip & ~rule->src_wild))
6187 continue;
6188
6189 if (rule->dst_wild != INADDR_BROADCAST &&
6190 (dst_ip & ~rule->dst_wild) != (rule->dst_ip & ~rule->dst_wild))
6191 continue;
6192
6193 if (frag_offset)
6194 {
6195 // layer 4 deny rules are skipped
6196 if (rule->action == FILTER_ACTION_DENY &&
6197 (rule->src_ports.op || rule->dst_ports.op || rule->tcp_flag_op))
6198 continue;
6199 }
6200 else
6201 {
6202 if (rule->frag)
6203 continue;
6204
6205 if (proto == IPPROTO_TCP || proto == IPPROTO_UDP)
6206 {
6207 if (rule->src_ports.op && !ip_filter_port(&rule->src_ports, src_port))
6208 continue;
6209
6210 if (rule->dst_ports.op && !ip_filter_port(&rule->dst_ports, dst_port))
6211 continue;
6212
6213 if (proto == IPPROTO_TCP && rule->tcp_flag_op &&
6214 !ip_filter_flag(rule->tcp_flag_op, rule->tcp_sflags, rule->tcp_cflags, flags))
6215 continue;
6216 }
6217 }
6218
6219 // matched
6220 rule->counter++;
6221 return rule->action == FILTER_ACTION_PERMIT;
6222 }
6223
6224 // default deny
6225 return 0;
6226 }
6227
6228 #ifdef LAC
6229
6230 tunnelidt lac_new_tunnel()
6231 {
6232 return new_tunnel();
6233 }
6234
6235 void lac_tunnelclear(tunnelidt t)
6236 {
6237 tunnelclear(t);
6238 }
6239
6240 void lac_send_SCCRQ(tunnelidt t, uint8_t * auth, unsigned int auth_len)
6241 {
6242 uint16_t version = 0x0100; // protocol version
6243
6244 tunnel[t].state = TUNNELOPENING;
6245
6246 // Sent SCCRQ - Start Control Connection Request
6247 controlt *c = controlnew(1); // sending SCCRQ
6248 controls(c, 7, hostname, 1); // host name
6249 controls(c, 8, Vendor_name, 1); // Vendor name
6250 control16(c, 2, version, 1); // protocol version
6251 control32(c, 3, 3, 1); // framing Capabilities
6252 control16(c, 9, t, 1); // assigned tunnel
6253 controlb(c, 11, (uint8_t *) auth, auth_len, 1); // CHAP Challenge
6254 LOG(1, 0, t, "Sent SCCRQ tunnel (REMOTE LNS)\n");
6255 controladd(c, 0, t); // send
6256 }
6257
6258 void lac_send_ICRQ(tunnelidt t, sessionidt s)
6259 {
6260 // Sent ICRQ Incoming-call-request
6261 controlt *c = controlnew(10); // ICRQ
6262
6263 control16(c, 14, s, 1); // assigned sesion
6264 call_serial_number++;
6265 control32(c, 15, call_serial_number, 1); // call serial number
6266 LOG(1, s, t, "Sent ICRQ (REMOTE LNS) (tunnel far ID %u)\n", tunnel[t].far);
6267 controladd(c, 0, t); // send
6268 }
6269
6270 void lac_tunnelshutdown(tunnelidt t, char *reason, int result, int error, char *msg)
6271 {
6272 tunnelshutdown(t, reason, result, error, msg);
6273 }
6274
6275 #endif