projects / l2tpns.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Imported Upstream version 2.1.21
[l2tpns.git] / ppp.c
1 // L2TPNS PPP Stuff
2
3 char const *cvs_id_ppp = "$Id: ppp.c,v 1.99.2.1 2006/05/26 07:33:52 bodea Exp $";
4
5 #include <stdio.h>
6 #include <string.h>
7 #include <unistd.h>
8 #include <errno.h>
9 #include <stdlib.h>
10 #include "l2tpns.h"
11 #include "constants.h"
12 #include "plugin.h"
13 #include "util.h"
14 #include "tbf.h"
15 #include "cluster.h"
16
17 extern tunnelt *tunnel;
18 extern sessiont *session;
19 extern radiust *radius;
20 extern int tunfd;
21 extern char hostname[];
22 extern uint32_t eth_tx;
23 extern time_t time_now;
24 extern configt *config;
25
26 static int add_lcp_auth(uint8_t *b, int size, int authtype);
27
28 // Process PAP messages
29 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
30 {
31 char user[MAXUSER];
32 char pass[MAXPASS];
33 uint16_t hl;
34 uint16_t r;
35
36 CSTAT(processpap);
37
38 LOG_HEX(5, "PAP", p, l);
39 if (l < 4)
40 {
41 LOG(1, s, t, "Short PAP %u bytes\n", l);
42 STAT(tunnel_rx_errors);
43 sessionshutdown(s, "Short PAP packet.", CDN_ADMIN_DISC, TERM_USER_ERROR);
44 return;
45 }
46
47 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
48 {
49 LOG(1, s, t, "Length mismatch PAP %u/%u\n", hl, l);
50 STAT(tunnel_rx_errors);
51 sessionshutdown(s, "PAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
52 return;
53 }
54 l = hl;
55
56 if (*p != 1)
57 {
58 LOG(1, s, t, "Unexpected PAP code %d\n", *p);
59 STAT(tunnel_rx_errors);
60 sessionshutdown(s, "Unexpected PAP code.", CDN_ADMIN_DISC, TERM_USER_ERROR);
61 return;
62 }
63
64 if (session[s].ppp.phase != Authenticate)
65 {
66 LOG(2, s, t, "PAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
67 return;
68 }
69
70 {
71 uint8_t *b = p;
72 b += 4;
73 user[0] = pass[0] = 0;
74 if (*b && *b < sizeof(user))
75 {
76 memcpy(user, b + 1, *b);
77 user[*b] = 0;
78 b += 1 + *b;
79 if (*b && *b < sizeof(pass))
80 {
81 memcpy(pass, b + 1, *b);
82 pass[*b] = 0;
83 }
84 }
85 LOG(3, s, t, "PAP login %s/%s\n", user, pass);
86 }
87
88 if (session[s].ip || !(r = radiusnew(s)))
89 {
90 // respond now, either no RADIUS available or already authenticated
91 uint8_t b[MAXETHER];
92 uint8_t id = p[1];
93 uint8_t *p = makeppp(b, sizeof(b), 0, 0, s, t, PPPPAP);
94 if (!p) return;
95
96 if (session[s].ip)
97 *p = 2; // ACK
98 else
99 *p = 3; // cant authorise
100 p[1] = id;
101 *(uint16_t *) (p + 2) = htons(5); // length
102 p[4] = 0; // no message
103 tunnelsend(b, 5 + (p - b), t); // send it
104
105 if (session[s].ip)
106 {
107 LOG(3, s, t, "Already an IP allocated: %s (%d)\n",
108 fmtaddr(htonl(session[s].ip), 0), session[s].ip_pool_index);
109 }
110 else
111 {
112 LOG(1, s, t, "No RADIUS session available to authenticate session...\n");
113 sessionshutdown(s, "No free RADIUS sessions.", CDN_UNAVAILABLE, TERM_SERVICE_UNAVAILABLE);
114 }
115 }
116 else
117 {
118 // Run PRE_AUTH plugins
119 struct param_pre_auth packet = { &tunnel[t], &session[s], strdup(user), strdup(pass), PPPPAP, 1 };
120 run_plugins(PLUGIN_PRE_AUTH, &packet);
121 if (!packet.continue_auth)
122 {
123 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
124 if (packet.username) free(packet.username);
125 if (packet.password) free(packet.password);
126 return;
127 }
128
129 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
130 strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
131
132 free(packet.username);
133 free(packet.password);
134
135 radius[r].id = p[1];
136 LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
137 radiussend(r, RADIUSAUTH);
138 }
139 }
140
141 // Process CHAP messages
142 void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
143 {
144 uint16_t r;
145 uint16_t hl;
146
147 CSTAT(processchap);
148
149 LOG_HEX(5, "CHAP", p, l);
150
151 if (l < 4)
152 {
153 LOG(1, s, t, "Short CHAP %u bytes\n", l);
154 STAT(tunnel_rx_errors);
155 sessionshutdown(s, "Short CHAP packet.", CDN_ADMIN_DISC, TERM_USER_ERROR);
156 return;
157 }
158
159 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
160 {
161 LOG(1, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
162 STAT(tunnel_rx_errors);
163 sessionshutdown(s, "CHAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
164 return;
165 }
166 l = hl;
167
168 if (*p != 2)
169 {
170 LOG(1, s, t, "Unexpected CHAP response code %d\n", *p);
171 STAT(tunnel_rx_errors);
172 sessionshutdown(s, "CHAP length mismatch.", CDN_ADMIN_DISC, TERM_USER_ERROR);
173 return;
174 }
175
176 if (session[s].ppp.phase != Authenticate)
177 {
178 LOG(2, s, t, "CHAP ignored in %s phase\n", ppp_phase(session[s].ppp.phase));
179 return;
180 }
181
182 r = sess_local[s].radius;
183 if (!r)
184 {
185 LOG(3, s, t, "Unexpected CHAP message\n");
186
187 // Some modems (Netgear DM602, possibly others) persist in using CHAP even
188 // after ACKing our ConfigReq for PAP.
189 if (sess_local[s].lcp_authtype == AUTHPAP && config->radius_authtypes & AUTHCHAP)
190 {
191 sess_local[s].lcp_authtype = AUTHCHAP;
192 sendchap(s, t);
193 }
194 return;
195 }
196
197 if (p[1] != radius[r].id)
198 {
199 LOG(1, s, t, "Wrong CHAP response ID %d (should be %d) (%d)\n", p[1], radius[r].id, r);
200 STAT(tunnel_rx_errors);
201 sessionshutdown(s, "Unexpected CHAP response ID.", CDN_ADMIN_DISC, TERM_USER_ERROR);
202 return;
203 }
204
205 if (l < 5 || p[4] != 16)
206 {
207 LOG(1, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
208 STAT(tunnel_rx_errors);
209 sessionshutdown(s, "Bad CHAP response length.", CDN_ADMIN_DISC, TERM_USER_ERROR);
210 return;
211 }
212
213 l -= 5;
214 p += 5;
215 if (l < 16 || l - 16 >= sizeof(session[s].user))
216 {
217 LOG(1, s, t, "CHAP user too long %d\n", l - 16);
218 STAT(tunnel_rx_errors);
219 sessionshutdown(s, "CHAP username too long.", CDN_ADMIN_DISC, TERM_USER_ERROR);
220 return;
221 }
222
223 // Run PRE_AUTH plugins
224 {
225 struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
226
227 packet.password = calloc(17, 1);
228 memcpy(packet.password, p, 16);
229
230 p += 16;
231 l -= 16;
232
233 packet.username = calloc(l + 1, 1);
234 memcpy(packet.username, p, l);
235
236 run_plugins(PLUGIN_PRE_AUTH, &packet);
237 if (!packet.continue_auth)
238 {
239 LOG(3, s, t, "A plugin rejected PRE_AUTH\n");
240 if (packet.username) free(packet.username);
241 if (packet.password) free(packet.password);
242 return;
243 }
244
245 strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
246 memcpy(radius[r].pass, packet.password, 16);
247
248 free(packet.username);
249 free(packet.password);
250 }
251
252 radius[r].chap = 1;
253 LOG(3, s, t, "CHAP login %s\n", session[s].user);
254 radiussend(r, RADIUSAUTH);
255 }
256
257 static void dumplcp(uint8_t *p, int l)
258 {
259 int x = l - 4;
260 uint8_t *o = (p + 4);
261
262 LOG_HEX(5, "PPP LCP Packet", p, l);
263 LOG(4, 0, 0, "PPP LCP Packet type %d (%s len %d)\n", *p, ppp_code((int)*p), ntohs( ((uint16_t *) p)[1]) );
264 LOG(4, 0, 0, "Length: %d\n", l);
265 if (*p != ConfigReq && *p != ConfigRej && *p != ConfigAck)
266 return;
267
268 while (x > 2)
269 {
270 int type = o[0];
271 int length = o[1];
272 if (length < 2)
273 {
274 LOG(4, 0, 0, " Option length is %d...\n", length);
275 break;
276 }
277 if (type == 0)
278 {
279 LOG(4, 0, 0, " Option type is 0...\n");
280 x -= length;
281 o += length;
282 continue;
283 }
284 switch (type)
285 {
286 case 1: // Maximum-Receive-Unit
287 if (length == 4)
288 LOG(4, 0, 0, " %s %d\n", ppp_lcp_option(type), ntohs(*(uint16_t *)(o + 2)));
289 else
290 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
291 break;
292 case 2: // Async-Control-Character-Map
293 if (length == 6)
294 {
295 uint32_t asyncmap = ntohl(*(uint32_t *)(o + 2));
296 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), asyncmap);
297 }
298 else
299 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
300 break;
301 case 3: // Authentication-Protocol
302 if (length == 4)
303 {
304 int proto = ntohs(*(uint16_t *)(o + 2));
305 LOG(4, 0, 0, " %s 0x%x (%s)\n", ppp_lcp_option(type), proto,
306 proto == PPPPAP ? "PAP" : "UNSUPPORTED");
307 }
308 else if (length == 5)
309 {
310 int proto = ntohs(*(uint16_t *)(o + 2));
311 int algo = *(o + 4);
312 LOG(4, 0, 0, " %s 0x%x 0x%x (%s)\n", ppp_lcp_option(type), proto, algo,
313 (proto == PPPCHAP && algo == 5) ? "CHAP MD5" : "UNSUPPORTED");
314 }
315 else
316 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
317 break;
318 case 4: // Quality-Protocol
319 {
320 uint32_t qp = ntohl(*(uint32_t *)(o + 2));
321 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), qp);
322 }
323 break;
324 case 5: // Magic-Number
325 if (length == 6)
326 {
327 uint32_t magicno = ntohl(*(uint32_t *)(o + 2));
328 LOG(4, 0, 0, " %s %x\n", ppp_lcp_option(type), magicno);
329 }
330 else
331 LOG(4, 0, 0, " %s odd length %d\n", ppp_lcp_option(type), length);
332 break;
333 case 7: // Protocol-Field-Compression
334 case 8: // Address-And-Control-Field-Compression
335 LOG(4, 0, 0, " %s\n", ppp_lcp_option(type));
336 break;
337 default:
338 LOG(2, 0, 0, " Unknown PPP LCP Option type %d\n", type);
339 break;
340 }
341 x -= length;
342 o += length;
343 }
344 }
345
346 void lcp_open(sessionidt s, tunnelidt t)
347 {
348 // transition to Authentication or Network phase:
349 session[s].ppp.phase = sess_local[s].lcp_authtype ? Authenticate : Network;
350
351 LOG(3, s, t, "LCP: Opened, phase %s\n", ppp_phase(session[s].ppp.phase));
352
353 // LCP now Opened
354 change_state(s, lcp, Opened);
355
356 if (session[s].ppp.phase == Authenticate)
357 {
358 if (sess_local[s].lcp_authtype == AUTHCHAP)
359 sendchap(s, t);
360 }
361 else
362 {
363 // This-Layer-Up
364 sendipcp(s, t);
365 change_state(s, ipcp, RequestSent);
366 // move to passive state for IPv6 (if configured), CCP
367 if (config->ipv6_prefix.s6_addr[0])
368 change_state(s, ipv6cp, Stopped);
369 else
370 change_state(s, ipv6cp, Closed);
371
372 change_state(s, ccp, Stopped);
373 }
374 }
375
376 static void lcp_restart(sessionidt s)
377 {
378 session[s].ppp.phase = Establish;
379 // This-Layer-Down
380 change_state(s, ipcp, Dead);
381 change_state(s, ipv6cp, Dead);
382 change_state(s, ccp, Dead);
383 }
384
385 static uint8_t *ppp_conf_rej(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
386 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option)
387 {
388 if (!*response || **response != ConfigRej)
389 {
390 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
391 if (!queued)
392 return 0;
393
394 *queued = ConfigRej;
395 queued += 4;
396 }
397
398 if ((queued - buf + option[1]) > blen)
399 {
400 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigRej (proto %u, option %u).\n", mtype, *option);
401 return 0;
402 }
403
404 memcpy(queued, option, option[1]);
405 return queued + option[1];
406 }
407
408 static uint8_t *ppp_conf_nak(sessionidt s, uint8_t *buf, size_t blen, uint16_t mtype,
409 uint8_t **response, uint8_t *queued, uint8_t *packet, uint8_t *option,
410 uint8_t *value, size_t vlen)
411 {
412 int *nak_sent;
413 switch (mtype)
414 {
415 case PPPLCP: nak_sent = &sess_local[s].lcp.nak_sent; break;
416 case PPPIPCP: nak_sent = &sess_local[s].ipcp.nak_sent; break;
417 case PPPIPV6CP: nak_sent = &sess_local[s].ipv6cp.nak_sent; break;
418 default: return 0; // ?
419 }
420
421 if (*response && **response != ConfigNak)
422 {
423 if (*nak_sent < config->ppp_max_failure) // reject queued
424 return queued;
425
426 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
427 }
428
429 if (!*response)
430 {
431 if (*nak_sent >= config->ppp_max_failure)
432 return ppp_conf_rej(s, buf, blen, mtype, response, 0, packet, option);
433
434 queued = *response = makeppp(buf, blen, packet, 2, s, session[s].tunnel, mtype);
435 if (!queued)
436 return 0;
437
438 (*nak_sent)++;
439 *queued = ConfigNak;
440 queued += 4;
441 }
442
443 if ((queued - buf + vlen + 2) > blen)
444 {
445 LOG(2, s, session[s].tunnel, "PPP overflow for ConfigNak (proto %u, option %u).\n", mtype, *option);
446 return 0;
447 }
448
449 *queued++ = *option;
450 *queued++ = vlen + 2;
451 memcpy(queued, value, vlen);
452 return queued + vlen;
453 }
454
455 static void ppp_code_rej(sessionidt s, tunnelidt t, uint16_t proto,
456 char *pname, uint8_t *p, uint16_t l, uint8_t *buf, size_t size)
457 {
458 uint8_t *q;
459 int mru = session[s].mru;
460 if (mru < MINMTU) mru = MINMTU;
461 if (mru > size) mru = size;
462
463 l += 4;
464 if (l > mru) l = mru;
465
466 q = makeppp(buf, size, 0, 0, s, t, proto);
467 if (!q) return;
468
469 *q = CodeRej;
470 *(q + 1) = ++sess_local[s].lcp_ident;
471 *(uint16_t *)(q + 2) = htons(l);
472 memcpy(q + 4, p, l - 4);
473
474 LOG(2, s, t, "Unexpected %s code %s\n", pname, ppp_code(*p));
475 LOG(3, s, t, "%s: send %s\n", pname, ppp_code(*q));
476 if (config->debug > 3) dumplcp(q, l);
477
478 tunnelsend(buf, l + (q - buf), t);
479 }
480
481 // Process LCP messages
482 void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
483 {
484 uint8_t b[MAXETHER];
485 uint8_t *q = NULL;
486 uint16_t hl;
487
488 CSTAT(processlcp);
489
490 LOG_HEX(5, "LCP", p, l);
491 if (l < 4)
492 {
493 LOG(1, s, t, "Short LCP %d bytes\n", l);
494 STAT(tunnel_rx_errors);
495 return ;
496 }
497
498 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
499 {
500 LOG(1, s, t, "Length mismatch LCP %u/%u\n", hl, l);
501 STAT(tunnel_rx_errors);
502 return ;
503 }
504 l = hl;
505
506 if (session[s].die) // going down...
507 return;
508
509 LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
510 "LCP: recv %s\n", ppp_code(*p));
511
512 if (config->debug > 3) dumplcp(p, l);
513
514 if (*p == ConfigAck)
515 {
516 int x = l - 4;
517 uint8_t *o = (p + 4);
518 int authtype = 0;
519
520 while (x > 2)
521 {
522 int type = o[0];
523 int length = o[1];
524
525 if (length == 0 || type == 0 || x < length) break;
526 switch (type)
527 {
528 case 3: // Authentication-Protocol
529 {
530 int proto = ntohs(*(uint16_t *)(o + 2));
531 if (proto == PPPPAP)
532 authtype = AUTHPAP;
533 else if (proto == PPPCHAP && *(o + 4) == 5)
534 authtype = AUTHCHAP;
535 }
536
537 break;
538 }
539 x -= length;
540 o += length;
541 }
542
543 if (!session[s].ip && authtype)
544 sess_local[s].lcp_authtype = authtype;
545
546 switch (session[s].ppp.lcp)
547 {
548 case RequestSent:
549 initialise_restart_count(s, lcp);
550 change_state(s, lcp, AckReceived);
551 break;
552
553 case AckReceived:
554 case Opened:
555 LOG(2, s, t, "LCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
556 if (session[s].ppp.lcp == Opened)
557 lcp_restart(s);
558
559 sendlcp(s, t);
560 change_state(s, lcp, RequestSent);
561 break;
562
563 case AckSent:
564 lcp_open(s, t);
565 break;
566
567 default:
568 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
569 }
570 }
571 else if (*p == ConfigReq)
572 {
573 int x = l - 4;
574 uint8_t *o = (p + 4);
575 uint8_t *response = 0;
576 static uint8_t asyncmap[4] = { 0, 0, 0, 0 }; // all zero
577 static uint8_t authproto[5];
578
579 while (x > 2)
580 {
581 int type = o[0];
582 int length = o[1];
583
584 if (length == 0 || type == 0 || x < length) break;
585 switch (type)
586 {
587 case 1: // Maximum-Receive-Unit
588 {
589 uint16_t mru = ntohs(*(uint16_t *)(o + 2));
590 if (mru >= MINMTU)
591 {
592 session[s].mru = mru;
593 cluster_send_session(s);
594 break;
595 }
596
597 LOG(3, s, t, " Remote requesting MRU of %u. Rejecting.\n", mru);
598 mru = htons(MRU);
599 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, (uint8_t *) &mru, sizeof(mru));
600 }
601 break;
602
603 case 2: // Async-Control-Character-Map
604 if (!ntohl(*(uint32_t *)(o + 2))) // all bits zero is OK
605 break;
606
607 LOG(3, s, t, " Remote requesting asyncmap. Rejecting.\n");
608 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, asyncmap, sizeof(asyncmap));
609 break;
610
611 case 3: // Authentication-Protocol
612 {
613 int proto = ntohs(*(uint16_t *)(o + 2));
614 char proto_name[] = "0x0000";
615 int alen;
616
617 if (proto == PPPPAP)
618 {
619 if (config->radius_authtypes & AUTHPAP)
620 {
621 sess_local[s].lcp_authtype = AUTHPAP;
622 break;
623 }
624
625 strcpy(proto_name, "PAP");
626 }
627 else if (proto == PPPCHAP)
628 {
629 if (config->radius_authtypes & AUTHCHAP
630 && *(o + 4) == 5) // MD5
631 {
632 sess_local[s].lcp_authtype = AUTHCHAP;
633 break;
634 }
635
636 strcpy(proto_name, "CHAP");
637 }
638 else
639 sprintf(proto_name, "%#4.4x", proto);
640
641 LOG(3, s, t, " Remote requesting %s authentication. Rejecting.\n", proto_name);
642
643 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authprefer);
644 if (alen < 2) break; // paranoia
645
646 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
647 if (q && *response == ConfigNak &&
648 config->radius_authtypes != config->radius_authprefer)
649 {
650 // alternate type
651 alen = add_lcp_auth(authproto, sizeof(authproto), config->radius_authtypes & ~config->radius_authprefer);
652 if (alen < 2) break;
653 q = ppp_conf_nak(s, b, sizeof(b), PPPLCP, &response, q, p, o, authproto + 2, alen - 2);
654 }
655
656 break;
657 }
658 break;
659
660 case 4: // Quality-Protocol
661 case 5: // Magic-Number
662 case 7: // Protocol-Field-Compression
663 case 8: // Address-And-Control-Field-Compression
664 break;
665
666 default: // Reject any unknown options
667 LOG(3, s, t, " Rejecting unknown PPP LCP option %d\n", type);
668 q = ppp_conf_rej(s, b, sizeof(b), PPPLCP, &response, q, p, o);
669 }
670 x -= length;
671 o += length;
672 }
673
674 if (response)
675 {
676 l = q - response; // LCP packet length
677 *((uint16_t *) (response + 2)) = htons(l); // update header
678 }
679 else
680 {
681 // Send packet back as ConfigAck
682 response = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
683 if (!response) return;
684 *response = ConfigAck;
685 }
686
687 switch (session[s].ppp.lcp)
688 {
689 case Closed:
690 response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
691 if (!response) return;
692 *response = TerminateAck;
693 *((uint16_t *) (response + 2)) = htons(l = 4);
694 break;
695
696 case Stopped:
697 initialise_restart_count(s, lcp);
698 sendlcp(s, t);
699 if (*response == ConfigAck)
700 change_state(s, lcp, AckSent);
701 else
702 change_state(s, lcp, RequestSent);
703
704 break;
705
706 case RequestSent:
707 if (*response == ConfigAck)
708 change_state(s, lcp, AckSent);
709
710 break;
711
712 case AckReceived:
713 if (*response == ConfigAck)
714 lcp_open(s, t);
715
716 break;
717
718 case Opened:
719 lcp_restart(s);
720 sendlcp(s, t);
721 /* fallthrough */
722
723 case AckSent:
724 if (*response == ConfigAck)
725 change_state(s, lcp, AckSent);
726 else
727 change_state(s, lcp, RequestSent);
728
729 break;
730
731 default:
732 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
733 return;
734 }
735
736 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
737 if (config->debug > 3) dumplcp(response, l);
738
739 tunnelsend(b, l + (response - b), t);
740 }
741 else if (*p == ConfigNak || *p == ConfigRej)
742 {
743 int x = l - 4;
744 uint8_t *o = (p + 4);
745 int authtype = -1;
746
747 while (x > 2)
748 {
749 int type = o[0];
750 int length = o[1];
751
752 if (length == 0 || type == 0 || x < length) break;
753 switch (type)
754 {
755 case 1: // Maximum-Receive-Unit
756 if (*p == ConfigNak)
757 {
758 if (length < 4) break;
759 sess_local[s].ppp_mru = ntohs(*(uint16_t *)(o + 2));
760 LOG(3, s, t, " Remote requested MRU of %u\n", sess_local[s].ppp_mru);
761 }
762 else
763 {
764 sess_local[s].ppp_mru = 0;
765 LOG(3, s, t, " Remote rejected MRU negotiation\n");
766 }
767
768 break;
769
770 case 3: // Authentication-Protocol
771 if (authtype > 0)
772 break;
773
774 if (*p == ConfigNak)
775 {
776 int proto;
777
778 if (length < 4) break;
779 proto = ntohs(*(uint16_t *)(o + 2));
780
781 if (proto == PPPPAP)
782 {
783 authtype = config->radius_authtypes & AUTHPAP;
784 LOG(3, s, t, " Remote requested PAP authentication...%sing\n",
785 authtype ? "accept" : "reject");
786 }
787 else if (proto == PPPCHAP && length > 4 && *(o + 4) == 5)
788 {
789 authtype = config->radius_authtypes & AUTHCHAP;
790 LOG(3, s, t, " Remote requested CHAP authentication...%sing\n",
791 authtype ? "accept" : "reject");
792 }
793 else
794 {
795 LOG(3, s, t, " Rejecting unsupported authentication %#4x\n",
796 proto);
797 }
798 }
799 else
800 {
801 LOG(2, s, t, "LCP: remote rejected auth negotiation\n");
802 authtype = 0; // shutdown
803 }
804
805 break;
806
807 case 5: // Magic-Number
808 session[s].magic = 0;
809 if (*p == ConfigNak)
810 {
811 if (length < 6) break;
812 session[s].magic = ntohl(*(uint32_t *)(o + 2));
813 }
814
815 if (session[s].magic)
816 LOG(3, s, t, " Remote requested magic-no %x\n", session[s].magic);
817 else
818 LOG(3, s, t, " Remote rejected magic-no\n");
819
820 cluster_send_session(s);
821 break;
822
823 default:
824 LOG(2, s, t, "LCP: remote sent %s for type %u?\n", ppp_code(*p), type);
825 sessionshutdown(s, "Unable to negotiate LCP.", CDN_ADMIN_DISC, TERM_USER_ERROR);
826 return;
827 }
828 x -= length;
829 o += length;
830 }
831
832 if (!authtype)
833 {
834 sessionshutdown(s, "Unsupported authentication.", CDN_ADMIN_DISC, TERM_USER_ERROR);
835 return;
836 }
837
838 if (authtype > 0)
839 sess_local[s].lcp_authtype = authtype;
840
841 switch (session[s].ppp.lcp)
842 {
843 case Closed:
844 case Stopped:
845 {
846 uint8_t *response = makeppp(b, sizeof(b), p, 2, s, t, PPPLCP);
847 if (!response) return;
848 *response = TerminateAck;
849 *((uint16_t *) (response + 2)) = htons(l = 4);
850
851 LOG(3, s, t, "LCP: send %s\n", ppp_code(*response));
852 if (config->debug > 3) dumplcp(response, l);
853
854 tunnelsend(b, l + (response - b), t);
855 }
856 break;
857
858 case RequestSent:
859 case AckSent:
860 initialise_restart_count(s, lcp);
861 sendlcp(s, t);
862 break;
863
864 case AckReceived:
865 LOG(2, s, t, "LCP: ConfigNak in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.lcp));
866 sendlcp(s, t);
867 break;
868
869 case Opened:
870 lcp_restart(s);
871 sendlcp(s, t);
872 break;
873
874 default:
875 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
876 return;
877 }
878 }
879 else if (*p == TerminateReq)
880 {
881 switch (session[s].ppp.lcp)
882 {
883 case Closed:
884 case Stopped:
885 case Closing:
886 case Stopping:
887 case RequestSent:
888 case AckReceived:
889 case AckSent:
890 break;
891
892 case Opened:
893 lcp_restart(s);
894 zero_restart_count(s, lcp);
895 change_state(s, lcp, Closing);
896 break;
897
898 default:
899 LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
900 return;
901 }
902
903 *p = TerminateAck; // send ack
904 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
905 if (!q) return;
906
907 LOG(3, s, t, "LCP: send %s\n", ppp_code(*q));
908 if (config->debug > 3) dumplcp(q, l);
909
910 tunnelsend(b, l + (q - b), t); // send it
911 }
912 else if (*p == ProtocolRej)
913 {
914 uint16_t proto = 0;
915
916 if (l > 4)
917 {
918 proto = *(p+4);
919 if (l > 5 && !(proto & 1))
920 {
921 proto <<= 8;
922 proto |= *(p+5);
923 }
924 }
925
926 if (proto == PPPIPV6CP)
927 {
928 LOG(3, s, t, "IPv6 rejected\n");
929 change_state(s, ipv6cp, Closed);
930 }
931 else
932 {
933 LOG(3, s, t, "LCP protocol reject: 0x%04X\n", proto);
934 }
935 }
936 else if (*p == EchoReq)
937 {
938 *p = EchoReply; // reply
939 *(uint32_t *) (p + 4) = htonl(session[s].magic); // our magic number
940 q = makeppp(b, sizeof(b), p, l, s, t, PPPLCP);
941 if (!q) return;
942
943 LOG(4, s, t, "LCP: send %s\n", ppp_code(*q));
944 if (config->debug > 3) dumplcp(q, l);
945
946 tunnelsend(b, l + (q - b), t); // send it
947 }
948 else if (*p == EchoReply)
949 {
950 // Ignore it, last_packet time is set earlier than this.
951 }
952 else if (*p != CodeRej)
953 {
954 ppp_code_rej(s, t, PPPLCP, "LCP", p, l, b, sizeof(b));
955 }
956 }
957
958 static void ipcp_open(sessionidt s, tunnelidt t)
959 {
960 LOG(3, s, t, "IPCP: Opened, session is now active\n");
961
962 change_state(s, ipcp, Opened);
963
964 if (!(session[s].walled_garden || session[s].flags & SESSION_STARTED))
965 {
966 uint16_t r = radiusnew(s);
967 if (r)
968 {
969 radiussend(r, RADIUSSTART); // send radius start
970
971 // don't send further Start records if IPCP is restarted
972 session[s].flags |= SESSION_STARTED;
973 cluster_send_session(s);
974 }
975 }
976
977 // start IPv6 if configured and still in passive state
978 if (session[s].ppp.ipv6cp == Stopped)
979 {
980 sendipv6cp(s, t);
981 change_state(s, ipv6cp, RequestSent);
982 }
983 }
984
985 // Process IPCP messages
986 void processipcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
987 {
988 uint8_t b[MAXETHER];
989 uint8_t *q = 0;
990 uint16_t hl;
991
992 CSTAT(processipcp);
993
994 LOG_HEX(5, "IPCP", p, l);
995 if (l < 4)
996 {
997 LOG(1, s, t, "Short IPCP %d bytes\n", l);
998 STAT(tunnel_rx_errors);
999 return ;
1000 }
1001
1002 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1003 {
1004 LOG(1, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
1005 STAT(tunnel_rx_errors);
1006 return ;
1007 }
1008 l = hl;
1009
1010 if (session[s].ppp.phase < Network)
1011 {
1012 LOG(2, s, t, "IPCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1013 return;
1014 }
1015
1016 LOG(3, s, t, "IPCP: recv %s\n", ppp_code(*p));
1017
1018 if (*p == ConfigAck)
1019 {
1020 switch (session[s].ppp.ipcp)
1021 {
1022 case RequestSent:
1023 initialise_restart_count(s, ipcp);
1024 change_state(s, ipcp, AckReceived);
1025 break;
1026
1027 case AckReceived:
1028 case Opened:
1029 LOG(2, s, t, "IPCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipcp));
1030 sendipcp(s, t);
1031 change_state(s, ipcp, RequestSent);
1032 break;
1033
1034 case AckSent:
1035 ipcp_open(s, t);
1036 break;
1037
1038 default:
1039 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1040 }
1041 }
1042 else if (*p == ConfigReq)
1043 {
1044 uint8_t *response = 0;
1045 uint8_t *o = p + 4;
1046 int length = l - 4;
1047 int gotip = 0;
1048 in_addr_t addr;
1049
1050 while (length > 2)
1051 {
1052 if (!o[1] || o[1] > length) return;
1053
1054 switch (*o)
1055 {
1056 case 3: // ip address
1057 gotip++; // seen address
1058 if (o[1] != 6) return;
1059
1060 addr = htonl(session[s].ip);
1061 if (memcmp(o + 2, &addr, (sizeof addr)))
1062 {
1063 uint8_t *oq = q;
1064 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1065 if (!q || (q != oq && *response == ConfigRej))
1066 {
1067 sessionshutdown(s, "Can't negotiate IPCP.", CDN_ADMIN_DISC, TERM_USER_ERROR);
1068 return;
1069 }
1070 }
1071
1072 break;
1073
1074 case 129: // primary DNS
1075 if (o[1] != 6) return;
1076
1077 addr = htonl(session[s].dns1);
1078 if (memcmp(o + 2, &addr, (sizeof addr)))
1079 {
1080 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1081 if (!q) return;
1082 }
1083
1084 break;
1085
1086 case 131: // secondary DNS
1087 if (o[1] != 6) return;
1088
1089 addr = htonl(session[s].dns2);
1090 if (memcmp(o + 2, &addr, sizeof(addr)))
1091 {
1092 q = ppp_conf_nak(s, b, sizeof(b), PPPIPCP, &response, q, p, o, (uint8_t *) &addr, sizeof(addr));
1093 if (!q) return;
1094 }
1095
1096 break;
1097
1098 default:
1099 LOG(2, s, t, " Rejecting PPP IPCP Option type %d\n", *o);
1100 q = ppp_conf_rej(s, b, sizeof(b), PPPIPCP, &response, q, p, o);
1101 if (!q) return;
1102 }
1103
1104 length -= o[1];
1105 o += o[1];
1106 }
1107
1108 if (response)
1109 {
1110 l = q - response; // IPCP packet length
1111 *((uint16_t *) (response + 2)) = htons(l); // update header
1112 }
1113 else if (gotip)
1114 {
1115 // Send packet back as ConfigAck
1116 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1117 if (!response) return;
1118 *response = ConfigAck;
1119 }
1120 else
1121 {
1122 LOG(1, s, t, "No IP in IPCP request\n");
1123 STAT(tunnel_rx_errors);
1124 return;
1125 }
1126
1127 switch (session[s].ppp.ipcp)
1128 {
1129 case Closed:
1130 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPCP);
1131 if (!response) return;
1132 *response = TerminateAck;
1133 *((uint16_t *) (response + 2)) = htons(l = 4);
1134 break;
1135
1136 case Stopped:
1137 initialise_restart_count(s, ipcp);
1138 sendipcp(s, t);
1139 if (*response == ConfigAck)
1140 change_state(s, ipcp, AckSent);
1141 else
1142 change_state(s, ipcp, RequestSent);
1143
1144 break;
1145
1146 case RequestSent:
1147 if (*response == ConfigAck)
1148 change_state(s, ipcp, AckSent);
1149
1150 break;
1151
1152 case AckReceived:
1153 if (*response == ConfigAck)
1154 ipcp_open(s, t);
1155
1156 break;
1157
1158 case Opened:
1159 initialise_restart_count(s, ipcp);
1160 sendipcp(s, t);
1161 /* fallthrough */
1162
1163 case AckSent:
1164 if (*response == ConfigAck)
1165 change_state(s, ipcp, AckSent);
1166 else
1167 change_state(s, ipcp, RequestSent);
1168
1169 break;
1170
1171 default:
1172 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1173 return;
1174 }
1175
1176 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*response));
1177 tunnelsend(b, l + (response - b), t);
1178 }
1179 else if (*p == TerminateReq)
1180 {
1181 switch (session[s].ppp.ipcp)
1182 {
1183 case Closed:
1184 case Stopped:
1185 case Closing:
1186 case Stopping:
1187 case RequestSent:
1188 case AckReceived:
1189 case AckSent:
1190 break;
1191
1192 case Opened:
1193 zero_restart_count(s, ipcp);
1194 change_state(s, ipcp, Closing);
1195 break;
1196
1197 default:
1198 LOG(2, s, t, "IPCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipcp));
1199 return;
1200 }
1201
1202 *p = TerminateAck; // send ack
1203 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPCP);
1204 if (!q) return;
1205
1206 LOG(3, s, t, "IPCP: send %s\n", ppp_code(*q));
1207 tunnelsend(b, l + (q - b), t); // send it
1208 }
1209 else if (*p != CodeRej)
1210 {
1211 ppp_code_rej(s, t, PPPIPCP, "IPCP", p, l, b, sizeof(b));
1212 }
1213 }
1214
1215 static void ipv6cp_open(sessionidt s, tunnelidt t)
1216 {
1217 LOG(3, s, t, "IPV6CP: Opened\n");
1218
1219 change_state(s, ipv6cp, Opened);
1220 if (session[s].ipv6prefixlen)
1221 route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 1);
1222
1223 // Send an initial RA (TODO: Should we send these regularly?)
1224 send_ipv6_ra(s, t, NULL);
1225 }
1226
1227 // Process IPV6CP messages
1228 void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1229 {
1230 uint8_t b[MAXETHER];
1231 uint8_t *q = 0;
1232 uint16_t hl;
1233
1234 CSTAT(processipv6cp);
1235
1236 LOG_HEX(5, "IPV6CP", p, l);
1237 if (l < 4)
1238 {
1239 LOG(1, s, t, "Short IPV6CP %d bytes\n", l);
1240 STAT(tunnel_rx_errors);
1241 return ;
1242 }
1243
1244 if ((hl = ntohs(*(uint16_t *) (p + 2))) > l)
1245 {
1246 LOG(1, s, t, "Length mismatch IPV6CP %u/%u\n", hl, l);
1247 STAT(tunnel_rx_errors);
1248 return ;
1249 }
1250 l = hl;
1251
1252 if (session[s].ppp.phase < Network)
1253 {
1254 LOG(2, s, t, "IPV6CP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1255 return;
1256 }
1257
1258 LOG(3, s, t, "IPV6CP: recv %s\n", ppp_code(*p));
1259
1260 if (!session[s].ip)
1261 {
1262 LOG(3, s, t, "IPV6CP: no IPv4 address (IPCP in state %s)\n", ppp_state(session[s].ppp.ipcp));
1263 return; // need IPCP to complete...
1264 }
1265
1266 if (*p == ConfigAck)
1267 {
1268 switch (session[s].ppp.ipv6cp)
1269 {
1270 case RequestSent:
1271 initialise_restart_count(s, ipv6cp);
1272 change_state(s, ipv6cp, AckReceived);
1273 break;
1274
1275 case AckReceived:
1276 case Opened:
1277 LOG(2, s, t, "IPV6CP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ipv6cp));
1278 sendipv6cp(s, t);
1279 change_state(s, ipv6cp, RequestSent);
1280 break;
1281
1282 case AckSent:
1283 ipv6cp_open(s, t);
1284 break;
1285
1286 default:
1287 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1288 }
1289 }
1290 else if (*p == ConfigReq)
1291 {
1292 uint8_t *response = 0;
1293 uint8_t *o = p + 4;
1294 int length = l - 4;
1295 int gotip = 0;
1296 uint8_t ident[8];
1297
1298 while (length > 2)
1299 {
1300 if (!o[1] || o[1] > length) return;
1301
1302 switch (*o)
1303 {
1304 case 1: // interface identifier
1305 gotip++; // seen address
1306 if (o[1] != 10) return;
1307
1308 *(uint32_t *) ident = htonl(session[s].ip);
1309 *(uint32_t *) (ident + 4) = 0;
1310
1311 if (memcmp(o + 2, ident, sizeof(ident)))
1312 {
1313 q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
1314 if (!q) return;
1315 }
1316
1317 break;
1318
1319 default:
1320 LOG(2, s, t, " Rejecting PPP IPV6CP Option type %d\n", *o);
1321 q = ppp_conf_rej(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o);
1322 if (!q) return;
1323 }
1324
1325 length -= o[1];
1326 o += o[1];
1327 }
1328
1329 if (response)
1330 {
1331 l = q - response; // IPV6CP packet length
1332 *((uint16_t *) (response + 2)) = htons(l); // update header
1333 }
1334 else if (gotip)
1335 {
1336 // Send packet back as ConfigAck
1337 response = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1338 if (!response) return;
1339 *response = ConfigAck;
1340 }
1341 else
1342 {
1343 LOG(1, s, t, "No interface identifier in IPV6CP request\n");
1344 STAT(tunnel_rx_errors);
1345 return;
1346 }
1347
1348 switch (session[s].ppp.ipv6cp)
1349 {
1350 case Closed:
1351 response = makeppp(b, sizeof(b), p, 2, s, t, PPPIPV6CP);
1352 if (!response) return;
1353 *response = TerminateAck;
1354 *((uint16_t *) (response + 2)) = htons(l = 4);
1355 break;
1356
1357 case Stopped:
1358 initialise_restart_count(s, ipv6cp);
1359 sendipv6cp(s, t);
1360 if (*response == ConfigAck)
1361 change_state(s, ipv6cp, AckSent);
1362 else
1363 change_state(s, ipv6cp, RequestSent);
1364
1365 break;
1366
1367 case RequestSent:
1368 if (*response == ConfigAck)
1369 change_state(s, ipv6cp, AckSent);
1370
1371 break;
1372
1373 case AckReceived:
1374 if (*response == ConfigAck)
1375 ipv6cp_open(s, t);
1376
1377 break;
1378
1379 case Opened:
1380 initialise_restart_count(s, ipv6cp);
1381 sendipv6cp(s, t);
1382 /* fallthrough */
1383
1384 case AckSent:
1385 if (*response == ConfigAck)
1386 change_state(s, ipv6cp, AckSent);
1387 else
1388 change_state(s, ipv6cp, RequestSent);
1389
1390 break;
1391
1392 default:
1393 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1394 return;
1395 }
1396
1397 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*response));
1398 tunnelsend(b, l + (response - b), t);
1399 }
1400 else if (*p == TerminateReq)
1401 {
1402 switch (session[s].ppp.ipv6cp)
1403 {
1404 case Closed:
1405 case Stopped:
1406 case Closing:
1407 case Stopping:
1408 case RequestSent:
1409 case AckReceived:
1410 case AckSent:
1411 break;
1412
1413 case Opened:
1414 zero_restart_count(s, ipv6cp);
1415 change_state(s, ipv6cp, Closing);
1416 break;
1417
1418 default:
1419 LOG(2, s, t, "IPV6CP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ipv6cp));
1420 return;
1421 }
1422
1423 *p = TerminateAck; // send ack
1424 q = makeppp(b, sizeof(b), p, l, s, t, PPPIPV6CP);
1425 if (!q) return;
1426
1427 LOG(3, s, t, "IPV6CP: send %s\n", ppp_code(*q));
1428 tunnelsend(b, l + (q - b), t); // send it
1429 }
1430 else if (*p != CodeRej)
1431 {
1432 ppp_code_rej(s, t, PPPIPV6CP, "IPV6CP", p, l, b, sizeof(b));
1433 }
1434 }
1435
1436 // process IP packet received
1437 //
1438 // This MUST be called with at least 4 byte behind 'p'.
1439 // (i.e. this routine writes to p[-4]).
1440 void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1441 {
1442 in_addr_t ip;
1443
1444 CSTAT(processipin);
1445
1446 LOG_HEX(5, "IP", p, l);
1447
1448 if (l < 20)
1449 {
1450 LOG(1, s, t, "IP packet too short %d\n", l);
1451 STAT(tunnel_rx_errors);
1452 return ;
1453 }
1454
1455 ip = ntohl(*(uint32_t *)(p + 12));
1456
1457 if (l > MAXETHER)
1458 {
1459 LOG(1, s, t, "IP packet too long %d\n", l);
1460 STAT(tunnel_rx_errors);
1461 return ;
1462 }
1463
1464 if (session[s].ppp.phase != Network || session[s].ppp.ipcp != Opened)
1465 return;
1466
1467 // no spoof (do sessionbyip to handled statically routed subnets)
1468 if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
1469 {
1470 LOG(5, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
1471 return;
1472 }
1473
1474 // run access-list if any
1475 if (session[s].filter_in && !ip_filter(p, l, session[s].filter_in - 1))
1476 return;
1477
1478 // adjust MSS on SYN and SYN,ACK packets with options
1479 if ((ntohs(*(uint16_t *) (p + 6)) & 0x1fff) == 0 && p[9] == IPPROTO_TCP) // first tcp fragment
1480 {
1481 int ihl = (p[0] & 0xf) * 4; // length of IP header
1482 if (l >= ihl + 20 && (p[ihl + 13] & TCP_FLAG_SYN) && ((p[ihl + 12] >> 4) > 5))
1483 adjust_tcp_mss(s, t, p, l, p + ihl);
1484 }
1485
1486 // Add on the tun header
1487 p -= 4;
1488 *(uint32_t *) p = htonl(PKTIP);
1489 l += 4;
1490
1491 // Are we throttled and a slave?
1492 if (session[s].tbf_in && !config->cluster_iam_master) {
1493 // Pass it to the master for handling.
1494 master_throttle_packet(session[s].tbf_in, p, l);
1495 return;
1496 }
1497
1498 // Are we throttled and a master??
1499 if (session[s].tbf_in && config->cluster_iam_master) {
1500 // Actually handle the throttled packets.
1501 tbf_queue_packet(session[s].tbf_in, p, l);
1502 return;
1503 }
1504
1505 // send to ethernet
1506 if (tun_write(p, l) < 0)
1507 {
1508 STAT(tun_tx_errors);
1509 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1510 l, strerror(errno), tunfd, p);
1511
1512 return;
1513 }
1514
1515 p += 4;
1516 l -= 4;
1517
1518 if (session[s].snoop_ip && session[s].snoop_port)
1519 {
1520 // Snooping this session
1521 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1522 }
1523
1524 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1525 session[s].cin_delta += l;
1526 session[s].pin++;
1527
1528 sess_local[s].cin += l;
1529 sess_local[s].pin++;
1530
1531 eth_tx += l;
1532
1533 STAT(tun_tx_packets);
1534 INC_STAT(tun_tx_bytes, l);
1535 }
1536
1537 // process IPv6 packet received
1538 //
1539 // This MUST be called with at least 4 byte behind 'p'.
1540 // (i.e. this routine writes to p[-4]).
1541 void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1542 {
1543 struct in6_addr ip;
1544 in_addr_t ipv4;
1545
1546 CSTAT(processipv6in);
1547
1548 LOG_HEX(5, "IPv6", p, l);
1549
1550 ip = *(struct in6_addr *) (p + 8);
1551 ipv4 = ntohl(*(uint32_t *)(p + 16));
1552
1553 if (l > MAXETHER)
1554 {
1555 LOG(1, s, t, "IP packet too long %d\n", l);
1556 STAT(tunnel_rx_errors);
1557 return ;
1558 }
1559
1560 if (session[s].ppp.phase != Network || session[s].ppp.ipv6cp != Opened)
1561 return;
1562
1563 // no spoof
1564 if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
1565 {
1566 char str[INET6_ADDRSTRLEN];
1567 LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
1568 inet_ntop(AF_INET6, &ip, str, INET6_ADDRSTRLEN));
1569 return;
1570 }
1571
1572 // Check if it's a Router Solicition message.
1573 if (*(p + 6) == 58 && *(p + 7) == 255 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
1574 *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
1575 *(uint32_t *)(p + 34) == 0 &&
1576 *(p + 38) == 0 && *(p + 39) == 2 && *(p + 40) == 133) {
1577 LOG(3, s, t, "Got IPv6 RS\n");
1578 send_ipv6_ra(s, t, &ip);
1579 return;
1580 }
1581
1582 // Add on the tun header
1583 p -= 4;
1584 *(uint32_t *) p = htonl(PKTIPV6);
1585 l += 4;
1586
1587 // Are we throttled and a slave?
1588 if (session[s].tbf_in && !config->cluster_iam_master) {
1589 // Pass it to the master for handling.
1590 master_throttle_packet(session[s].tbf_in, p, l);
1591 return;
1592 }
1593
1594 // Are we throttled and a master??
1595 if (session[s].tbf_in && config->cluster_iam_master) {
1596 // Actually handle the throttled packets.
1597 tbf_queue_packet(session[s].tbf_in, p, l);
1598 return;
1599 }
1600
1601 // send to ethernet
1602 if (tun_write(p, l) < 0)
1603 {
1604 STAT(tun_tx_errors);
1605 LOG(0, s, t, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1606 l, strerror(errno), tunfd, p);
1607
1608 return;
1609 }
1610
1611 p += 4;
1612 l -= 4;
1613
1614 if (session[s].snoop_ip && session[s].snoop_port)
1615 {
1616 // Snooping this session
1617 snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
1618 }
1619
1620 increment_counter(&session[s].cin, &session[s].cin_wrap, l);
1621 session[s].cin_delta += l;
1622 session[s].pin++;
1623
1624 sess_local[s].cin += l;
1625 sess_local[s].pin++;
1626
1627 eth_tx += l;
1628
1629 STAT(tun_tx_packets);
1630 INC_STAT(tun_tx_bytes, l);
1631 }
1632
1633 //
1634 // Helper routine for the TBF filters.
1635 // Used to send queued data in from the user.
1636 //
1637 void send_ipin(sessionidt s, uint8_t *buf, int len)
1638 {
1639 LOG_HEX(5, "IP in throttled", buf, len);
1640
1641 if (write(tunfd, buf, len) < 0)
1642 {
1643 STAT(tun_tx_errors);
1644 LOG(0, 0, 0, "Error writing %d bytes to TUN device: %s (tunfd=%d, p=%p)\n",
1645 len, strerror(errno), tunfd, buf);
1646
1647 return;
1648 }
1649
1650 buf += 4;
1651 len -= 4;
1652
1653 if (session[s].snoop_ip && session[s].snoop_port)
1654 {
1655 // Snooping this session
1656 snoop_send_packet(buf, len, session[s].snoop_ip, session[s].snoop_port);
1657 }
1658
1659 // Increment packet counters
1660 increment_counter(&session[s].cin, &session[s].cin_wrap, len);
1661 session[s].cin_delta += len;
1662 session[s].pin++;
1663
1664 sess_local[s].cin += len;
1665 sess_local[s].pin++;
1666
1667 eth_tx += len;
1668
1669 STAT(tun_tx_packets);
1670 INC_STAT(tun_tx_bytes, len - 4);
1671 }
1672
1673
1674 // Process CCP messages
1675 void processccp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
1676 {
1677 uint8_t b[MAXETHER];
1678 uint8_t *q;
1679
1680 CSTAT(processccp);
1681
1682 LOG_HEX(5, "CCP", p, l);
1683
1684 if (session[s].ppp.phase < Network)
1685 {
1686 LOG(2, s, t, "CCP %s ignored in %s phase\n", ppp_code(*p), ppp_phase(session[s].ppp.phase));
1687 return;
1688 }
1689
1690 if (l < 1)
1691 {
1692 LOG(1, s, t, "Short CCP packet\n");
1693 STAT(tunnel_rx_errors);
1694 }
1695
1696 LOG(3, s, t, "CCP: recv %s\n", ppp_code(*p));
1697 if (*p == ConfigAck)
1698 {
1699 switch (session[s].ppp.ccp)
1700 {
1701 case RequestSent:
1702 initialise_restart_count(s, ccp);
1703 change_state(s, ccp, AckReceived);
1704 break;
1705
1706 case AckReceived:
1707 case Opened:
1708 LOG(2, s, t, "CCP: ConfigAck in state %s? Sending ConfigReq\n", ppp_state(session[s].ppp.ccp));
1709 sendccp(s, t);
1710 change_state(s, ccp, RequestSent);
1711 break;
1712
1713 case AckSent:
1714 LOG(3, s, t, "CCP: Opened\n");
1715 change_state(s, ccp, Opened);
1716 break;
1717
1718 default:
1719 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1720 }
1721 }
1722 else if (*p == ConfigReq)
1723 {
1724 if (l < 6) // accept no compression
1725 *p = ConfigAck;
1726 else // compression requested--reject
1727 *p = ConfigRej;
1728
1729 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1730 if (!q) return;
1731
1732 switch (session[s].ppp.ccp)
1733 {
1734 case Closed:
1735 q = makeppp(b, sizeof(b), p, 2, s, t, PPPCCP);
1736 if (!q) return;
1737 *q = TerminateAck;
1738 *((uint16_t *) (q + 2)) = htons(l = 4);
1739 break;
1740
1741 case Stopped:
1742 initialise_restart_count(s, ccp);
1743 sendccp(s, t);
1744 if (*q == ConfigAck)
1745 change_state(s, ccp, AckSent);
1746 else
1747 change_state(s, ccp, RequestSent);
1748
1749 break;
1750
1751 case RequestSent:
1752 if (*q == ConfigAck)
1753 change_state(s, ccp, AckSent);
1754
1755 break;
1756
1757 case AckReceived:
1758 if (*q == ConfigAck)
1759 change_state(s, ccp, Opened);
1760
1761 break;
1762
1763 case Opened:
1764 initialise_restart_count(s, ccp);
1765 sendccp(s, t);
1766 /* fallthrough */
1767
1768 case AckSent:
1769 if (*q == ConfigAck)
1770 change_state(s, ccp, AckSent);
1771 else
1772 change_state(s, ccp, RequestSent);
1773
1774 break;
1775
1776 default:
1777 LOG(2, s, t, "CCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.ccp));
1778 return;
1779 }
1780
1781 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1782 tunnelsend(b, l + (q - b), t);
1783 }
1784 else if (*p == TerminateReq)
1785 {
1786 *p = TerminateAck;
1787 q = makeppp(b, sizeof(b), p, l, s, t, PPPCCP);
1788 if (!q) return;
1789 LOG(3, s, t, "CCP: send %s\n", ppp_code(*q));
1790 tunnelsend(b, l + (q - b), t);
1791 change_state(s, ccp, Stopped);
1792 }
1793 else if (*p != CodeRej)
1794 {
1795 ppp_code_rej(s, t, PPPCCP, "CCP", p, l, b, sizeof(b));
1796 }
1797 }
1798
1799 // send a CHAP challenge
1800 void sendchap(sessionidt s, tunnelidt t)
1801 {
1802 uint8_t b[MAXETHER];
1803 uint16_t r;
1804 uint8_t *q;
1805
1806 CSTAT(sendchap);
1807
1808 r = radiusnew(s);
1809 if (!r)
1810 {
1811 LOG(1, s, t, "No RADIUS to send challenge\n");
1812 STAT(tunnel_tx_errors);
1813 return;
1814 }
1815
1816 LOG(1, s, t, "Send CHAP challenge\n");
1817
1818 radius[r].chap = 1; // CHAP not PAP
1819 radius[r].id++;
1820 if (radius[r].state != RADIUSCHAP)
1821 radius[r].try = 0;
1822
1823 radius[r].state = RADIUSCHAP;
1824 radius[r].retry = backoff(radius[r].try++);
1825 if (radius[r].try > 5)
1826 {
1827 sessionshutdown(s, "CHAP timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
1828 STAT(tunnel_tx_errors);
1829 return ;
1830 }
1831 q = makeppp(b, sizeof(b), 0, 0, s, t, PPPCHAP);
1832 if (!q) return;
1833
1834 *q = 1; // challenge
1835 q[1] = radius[r].id; // ID
1836 q[4] = 16; // value size (size of challenge)
1837 memcpy(q + 5, radius[r].auth, 16); // challenge
1838 strcpy((char *) q + 21, hostname); // our name
1839 *(uint16_t *) (q + 2) = htons(strlen(hostname) + 21); // length
1840 tunnelsend(b, strlen(hostname) + 21 + (q - b), t); // send it
1841 }
1842
1843 // fill in a L2TP message with a PPP frame,
1844 // returns start of PPP frame
1845 uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype)
1846 {
1847 if (size < 12) // Need more space than this!!
1848 {
1849 LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
1850 return NULL;
1851 }
1852
1853 *(uint16_t *) (b + 0) = htons(0x0002); // L2TP with no options
1854 *(uint16_t *) (b + 2) = htons(tunnel[t].far); // tunnel
1855 *(uint16_t *) (b + 4) = htons(session[s].far); // session
1856 b += 6;
1857 if (mtype == PPPLCP || !(session[s].flags & SESSION_ACFC))
1858 {
1859 *(uint16_t *) b = htons(0xFF03); // HDLC header
1860 b += 2;
1861 }
1862 if (mtype < 0x100 && session[s].flags & SESSION_PFC)
1863 *b++ = mtype;
1864 else
1865 {
1866 *(uint16_t *) b = htons(mtype);
1867 b += 2;
1868 }
1869
1870 if (l + 12 > size)
1871 {
1872 LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
1873 return NULL;
1874 }
1875
1876 if (p && l)
1877 memcpy(b, p, l);
1878
1879 return b;
1880 }
1881
1882 static int add_lcp_auth(uint8_t *b, int size, int authtype)
1883 {
1884 int len = 0;
1885 if ((authtype == AUTHCHAP && size < 5) || size < 4)
1886 return 0;
1887
1888 *b++ = 3; // Authentication-Protocol
1889 if (authtype == AUTHCHAP)
1890 {
1891 len = *b++ = 5; // length
1892 *(uint16_t *) b = htons(PPPCHAP); b += 2;
1893 *b++ = 5; // MD5
1894 }
1895 else if (authtype == AUTHPAP)
1896 {
1897 len = *b++ = 4; // length
1898 *(uint16_t *) b = htons(PPPPAP); b += 2;
1899 }
1900 else
1901 {
1902 LOG(0, 0, 0, "add_lcp_auth called with unsupported auth type %d\n", authtype);
1903 }
1904
1905 return len;
1906 }
1907
1908 // Send LCP ConfigReq for MRU, authentication type and magic no
1909 void sendlcp(sessionidt s, tunnelidt t)
1910 {
1911 uint8_t b[500], *q, *l;
1912 int authtype = sess_local[s].lcp_authtype;
1913
1914 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPLCP)))
1915 return;
1916
1917 LOG(3, s, t, "LCP: send ConfigReq%s%s%s\n",
1918 authtype ? " (" : "",
1919 authtype ? (authtype == AUTHCHAP ? "CHAP" : "PAP") : "",
1920 authtype ? ")" : "");
1921
1922 l = q;
1923 *l++ = ConfigReq;
1924 *l++ = ++sess_local[s].lcp_ident; // ID
1925
1926 l += 2; //Save space for length
1927
1928 if (sess_local[s].ppp_mru)
1929 {
1930 *l++ = 1; *l++ = 4; // Maximum-Receive-Unit (length 4)
1931 *(uint16_t *) l = htons(sess_local[s].ppp_mru); l += 2;
1932 }
1933
1934 if (authtype)
1935 l += add_lcp_auth(l, sizeof(b) - (l - b), authtype);
1936
1937 if (session[s].magic)
1938 {
1939 *l++ = 5; *l++ = 6; // Magic-Number (length 6)
1940 *(uint32_t *) l = htonl(session[s].magic);
1941 l += 4;
1942 }
1943
1944 *(uint16_t *)(q + 2) = htons(l - q); // Length
1945
1946 LOG_HEX(5, "PPPLCP", q, l - q);
1947 if (config->debug > 3) dumplcp(q, l - q);
1948
1949 tunnelsend(b, (l - b), t);
1950 restart_timer(s, lcp);
1951 }
1952
1953 // Send CCP request for no compression
1954 void sendccp(sessionidt s, tunnelidt t)
1955 {
1956 uint8_t b[500], *q;
1957
1958 if (!(q = makeppp(b, sizeof(b), NULL, 0, s, t, PPPCCP)))
1959 return;
1960
1961 LOG(3, s, t, "CCP: send ConfigReq (no compression)\n");
1962
1963 *q = ConfigReq;
1964 *(q + 1) = ++sess_local[s].lcp_ident; // ID
1965 *(uint16_t *)(q + 2) = htons(4); // Length
1966
1967 LOG_HEX(5, "PPPCCP", q, 4);
1968 tunnelsend(b, (q - b) + 4 , t);
1969 restart_timer(s, ccp);
1970 }
1971
1972 // Reject unknown/unconfigured protocols
1973 void protoreject(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint16_t proto)
1974 {
1975
1976 uint8_t buf[MAXETHER];
1977 uint8_t *q;
1978 int mru = session[s].mru;
1979 if (mru < MINMTU) mru = MINMTU;
1980 if (mru > sizeof(buf)) mru = sizeof(buf);
1981
1982 l += 6;
1983 if (l > mru) l = mru;
1984
1985 q = makeppp(buf, sizeof(buf), 0, 0, s, t, PPPLCP);
1986 if (!q) return;
1987
1988 *q = ProtocolRej;
1989 *(q + 1) = ++sess_local[s].lcp_ident;
1990 *(uint16_t *)(q + 2) = htons(l);
1991 *(uint16_t *)(q + 4) = htons(proto);
1992 memcpy(q + 6, p, l - 6);
1993
1994 if (proto == PPPIPV6CP)
1995 LOG(3, s, t, "LCP: send ProtocolRej (IPV6CP: not configured)\n");
1996 else
1997 LOG(2, s, t, "LCP: sent ProtocolRej (0x%04X: unsupported)\n", proto);
1998
1999 tunnelsend(buf, l + (q - buf), t);
2000 }
for cloning use: "git clone git://git.sameswireless.fr/l2tpns.git" ; For add to your sources.list: "deb http://package.sameswifi.fr/ jessie main"