Add of the ppp_keepalive option.
[l2tpns.git] / l2tpns.c
index b2b0513..1c50a3e 100644 (file)
--- a/l2tpns.c
+++ b/l2tpns.c
@@ -4,14 +4,13 @@
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.176 2011/01/20 12:48:40 bodea Exp $";
-
 #include <arpa/inet.h>
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/if_tun.h>
 #define SYSLOG_NAMES
+#include <stdio.h>
 #include <syslog.h>
 #include <malloc.h>
 #include <net/route.h>
@@ -21,7 +20,6 @@ char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.176 2011/01/20 12:48:40 bodea Exp
 #include <netinet/ip6.h>
 #include <stdarg.h>
 #include <stdlib.h>
-#include <stdio.h>
 #include <string.h>
 #include <ctype.h>
 #include <sys/ioctl.h>
@@ -42,6 +40,7 @@ char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.176 2011/01/20 12:48:40 bodea Exp
 #include <linux/rtnetlink.h>
 
 #include "md5.h"
+#include "dhcp6.h"
 #include "l2tpns.h"
 #include "cluster.h"
 #include "plugin.h"
@@ -55,11 +54,19 @@ char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.176 2011/01/20 12:48:40 bodea Exp
 #include "bgp.h"
 #endif
 
+#include "l2tplac.h"
+#include "pppoe.h"
+#include "dhcp6.h"
+
+char * Vendor_name = "Linux L2TPNS";
+uint32_t call_serial_number = 0;
+
 // Globals
 configt *config = NULL;                // all configuration
 int nlfd = -1;                 // netlink socket
 int tunfd = -1;                        // tun interface file handle. (network device)
-int udpfd = -1;                        // UDP file handle
+int udpfd[MAX_UDPFD + 1] = INIT_TABUDPFD;              // array UDP file handle + 1 for lac udp
+int udplacfd = -1;             // UDP LAC file handle
 int controlfd = -1;            // Control signal handle
 int clifd = -1;                        // Socket listening for CLI connections.
 int daefd = -1;                        // Socket listening for DAE connections.
@@ -95,7 +102,7 @@ union iphash {
 struct ipv6radix {
        sessionidt sess;
        struct ipv6radix *branch;
-} ipv6_hash[256];              // Mapping from IPv6 address to session structures.
+} ipv6_hash[16];               // Mapping from IPv6 address to session structures.
 
 // Traffic counters.
 static uint32_t udp_rx = 0, udp_rx_pkt = 0, udp_tx = 0;
@@ -104,6 +111,7 @@ uint32_t eth_tx = 0;
 
 static uint32_t ip_pool_size = 1;      // Size of the pool of addresses used for dynamic address allocation.
 time_t time_now = 0;                   // Current time in seconds since epoch.
+uint64_t time_now_ms = 0;              // Current time in milliseconds since epoch.
 static char time_now_string[64] = {0}; // Current time as a string.
 static int time_changed = 0;           // time_now changed
 char main_quit = 0;                    // True if we're in the process of exiting.
@@ -124,6 +132,7 @@ config_descriptt config_values[] = {
        CONFIG("ppp_restart_time", ppp_restart_time, INT),
        CONFIG("ppp_max_configure", ppp_max_configure, INT),
        CONFIG("ppp_max_failure", ppp_max_failure, INT),
+       CONFIG("ppp_keepalive", ppp_keepalive, BOOL),
        CONFIG("primary_dns", default_dns1, IPv4),
        CONFIG("secondary_dns", default_dns2, IPv4),
        CONFIG("primary_radius", radiusserver[0], IPv4),
@@ -146,6 +155,7 @@ config_descriptt config_values[] = {
        CONFIG("throttle_speed", rl_rate, UNSIGNED_LONG),
        CONFIG("throttle_buckets", num_tbfs, INT),
        CONFIG("accounting_dir", accounting_dir, STRING),
+       CONFIG("account_all_origin", account_all_origin, BOOL),
        CONFIG("dump_speed", dump_speed, BOOL),
        CONFIG("multi_read_count", multi_read_count, INT),
        CONFIG("scheduler_fifo", scheduler_fifo, BOOL),
@@ -161,9 +171,35 @@ config_descriptt config_values[] = {
        CONFIG("ipv6_prefix", ipv6_prefix, IPv6),
        CONFIG("cli_bind_address", cli_bind_address, IPv4),
        CONFIG("hostname", hostname, STRING),
+#ifdef BGP
        CONFIG("nexthop_address", nexthop_address, IPv4),
        CONFIG("nexthop6_address", nexthop6_address, IPv6),
-       { NULL, 0, 0, 0 },
+#endif
+       CONFIG("echo_timeout", echo_timeout, INT),
+       CONFIG("idle_echo_timeout", idle_echo_timeout, INT),
+       CONFIG("iftun_address", iftun_address, IPv4),
+       CONFIG("tundevicename", tundevicename, STRING),
+       CONFIG("disable_lac_func", disable_lac_func, BOOL),
+       CONFIG("auth_tunnel_change_addr_src", auth_tunnel_change_addr_src, BOOL),
+       CONFIG("bind_address_remotelns", bind_address_remotelns, IPv4),
+       CONFIG("bind_portremotelns", bind_portremotelns, SHORT),
+       CONFIG("pppoe_if_to_bind", pppoe_if_to_bind, STRING),
+       CONFIG("pppoe_service_name", pppoe_service_name, STRING),
+       CONFIG("pppoe_ac_name", pppoe_ac_name, STRING),
+       CONFIG("disable_sending_hello", disable_sending_hello, BOOL),
+       CONFIG("disable_no_spoof", disable_no_spoof, BOOL),
+       CONFIG("bind_multi_address", bind_multi_address, STRING),
+       CONFIG("pppoe_only_equal_svc_name", pppoe_only_equal_svc_name, BOOL),
+       CONFIG("multi_hostname", multi_hostname, STRING),
+       CONFIG("no_throttle_local_IP", no_throttle_local_IP, BOOL),
+       CONFIG("dhcp6_preferred_lifetime", dhcp6_preferred_lifetime, INT),
+       CONFIG("dhcp6_valid_lifetime", dhcp6_valid_lifetime, INT),
+       CONFIG("dhcp6_server_duid", dhcp6_server_duid, INT),
+       CONFIG("dns6_lifetime", dns6_lifetime, INT),
+       CONFIG("primary_ipv6_dns", default_ipv6_dns1, IPv6),
+       CONFIG("secondary_ipv6_dns", default_ipv6_dns2, IPv6),
+       CONFIG("default_ipv6_domain_list", default_ipv6_domain_list, STRING),
+       { NULL, 0, 0, 0 }
 };
 
 static char *plugin_functions[] = {
@@ -223,13 +259,6 @@ static tunnelidt new_tunnel(void);
 static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len);
 static void bundleclear(bundleidt b);
 
-// on slaves, alow BGP to withdraw cleanly before exiting
-#define QUIT_DELAY     5
-
-// quit actions (master)
-#define QUIT_FAILOVER  1 // SIGTERM: exit when all control messages have been acked (for cluster failover)
-#define QUIT_SHUTDOWN  2 // SIGQUIT: shutdown sessions/tunnels, reject new connections
-
 // return internal time (10ths since process startup), set f if given
 // as a side-effect sets time_now, and time_changed
 static clockt now(double *f)
@@ -242,6 +271,11 @@ static clockt now(double *f)
            time_now = t.tv_sec;
            time_changed++;
        }
+
+       // Time in milliseconds
+       // TODO FOR MLPPP DEV
+       //time_now_ms = (t.tv_sec * 1000) + (t.tv_usec/1000);
+
        return (t.tv_sec - basetime) * 10 + t.tv_usec / 100000 + 1;
 }
 
@@ -276,7 +310,7 @@ void _log(int level, sessionidt s, tunnelidt t, const char *format, ...)
                ringbuffer->buffer[ringbuffer->tail].session = s;
                ringbuffer->buffer[ringbuffer->tail].tunnel = t;
                va_start(ap, format);
-               vsnprintf(ringbuffer->buffer[ringbuffer->tail].message, 4095, format, ap);
+               vsnprintf(ringbuffer->buffer[ringbuffer->tail].message, MAX_LOG_LENGTH, format, ap);
                va_end(ap);
        }
 #endif
@@ -671,15 +705,19 @@ static void inittun(void)
                int flags = fcntl(tunfd, F_GETFL, 0);
                fcntl(tunfd, F_SETFL, flags | O_NONBLOCK);
        }
+
+   if (*config->tundevicename)
+               strncpy(ifr.ifr_name, config->tundevicename, IFNAMSIZ);
+
        if (ioctl(tunfd, TUNSETIFF, (void *) &ifr) < 0)
        {
                LOG(0, 0, 0, "Can't set tun interface: %s\n", strerror(errno));
                exit(1);
        }
-       assert(strlen(ifr.ifr_name) < sizeof(config->tundevice) - 1);
-       strncpy(config->tundevice, ifr.ifr_name, sizeof(config->tundevice));
+       assert(strlen(ifr.ifr_name) < sizeof(config->tundevicename) - 1);
+       strncpy(config->tundevicename, ifr.ifr_name, sizeof(config->tundevicename));
 
-       tunidx = if_nametoindex(config->tundevice);
+       tunidx = if_nametoindex(config->tundevicename);
        if (tunidx == 0)
        {
                LOG(0, 0, 0, "Can't get tun interface index\n");
@@ -731,14 +769,30 @@ static void inittun(void)
                req.ifmsg.ifaddr.ifa_scope = RT_SCOPE_UNIVERSE;
                req.ifmsg.ifaddr.ifa_index = tunidx;
 
-               if (config->bind_address)
-                       ip = config->bind_address;
+               if (config->nbmultiaddress > 1)
+               {
+                       int i;
+                       for (i = 0; i < config->nbmultiaddress ; i++)
+                       {
+                               ip = config->iftun_n_address[i];
+                               netlink_addattr(&req.nh, IFA_LOCAL, &ip, sizeof(ip));
+                               if (netlink_send(&req.nh) < 0)
+                                       goto senderror;
+                       }
+               }
                else
-                       ip = 0x01010101; // 1.1.1.1
-               netlink_addattr(&req.nh, IFA_LOCAL, &ip, sizeof(ip));
+               {
+                       if (config->iftun_address)
+                               ip = config->iftun_address;
+                       else
+                               ip = 0x01010101; // 1.1.1.1
+                       netlink_addattr(&req.nh, IFA_LOCAL, &ip, sizeof(ip));
+
+                       if (netlink_send(&req.nh) < 0)
+                               goto senderror;
+               }
+
 
-               if (netlink_send(&req.nh) < 0)
-                       goto senderror;
 
                // Only setup IPv6 on the tun device if we have a configured prefix
                if (config->ipv6_prefix.s6_addr[0]) {
@@ -808,28 +862,35 @@ senderror:
        exit(1);
 }
 
-// set up UDP ports
-static void initudp(void)
+// set up LAC UDP ports
+static void initlacudp(void)
 {
        int on = 1;
        struct sockaddr_in addr;
 
-       // Tunnel
+       // Tunnel to Remote LNS
        memset(&addr, 0, sizeof(addr));
        addr.sin_family = AF_INET;
-       addr.sin_port = htons(L2TPPORT);
-       addr.sin_addr.s_addr = config->bind_address;
-       udpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-       setsockopt(udpfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+       addr.sin_port = htons(config->bind_portremotelns);
+       addr.sin_addr.s_addr = config->bind_address_remotelns;
+       udplacfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+       setsockopt(udplacfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
        {
-               int flags = fcntl(udpfd, F_GETFL, 0);
-               fcntl(udpfd, F_SETFL, flags | O_NONBLOCK);
+               int flags = fcntl(udplacfd, F_GETFL, 0);
+               fcntl(udplacfd, F_SETFL, flags | O_NONBLOCK);
        }
-       if (bind(udpfd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
+       if (bind(udplacfd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
        {
-               LOG(0, 0, 0, "Error in UDP bind: %s\n", strerror(errno));
+               LOG(0, 0, 0, "Error in UDP REMOTE LNS bind: %s\n", strerror(errno));
                exit(1);
        }
+}
+
+// set up control ports
+static void initcontrol(void)
+{
+       int on = 1;
+       struct sockaddr_in addr;
 
        // Control
        memset(&addr, 0, sizeof(addr));
@@ -843,6 +904,13 @@ static void initudp(void)
                LOG(0, 0, 0, "Error in control bind: %s\n", strerror(errno));
                exit(1);
        }
+}
+
+// set up Dynamic Authorization Extensions to RADIUS port
+static void initdae(void)
+{
+       int on = 1;
+       struct sockaddr_in addr;
 
        // Dynamic Authorization Extensions to RADIUS
        memset(&addr, 0, sizeof(addr));
@@ -856,9 +924,30 @@ static void initudp(void)
                LOG(0, 0, 0, "Error in DAE bind: %s\n", strerror(errno));
                exit(1);
        }
+}
 
-       // Intercept
-       snoopfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+// set up UDP ports
+static void initudp(int * pudpfd, in_addr_t ip_bind)
+{
+       int on = 1;
+       struct sockaddr_in addr;
+
+       // Tunnel
+       memset(&addr, 0, sizeof(addr));
+       addr.sin_family = AF_INET;
+       addr.sin_port = htons(L2TPPORT);
+       addr.sin_addr.s_addr = ip_bind;
+       (*pudpfd) = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+       setsockopt((*pudpfd), SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+       {
+               int flags = fcntl((*pudpfd), F_GETFL, 0);
+               fcntl((*pudpfd), F_SETFL, flags | O_NONBLOCK);
+       }
+       if (bind((*pudpfd), (struct sockaddr *) &addr, sizeof(addr)) < 0)
+       {
+               LOG(0, 0, 0, "Error in UDP bind: %s\n", strerror(errno));
+               exit(1);
+       }
 }
 
 //
@@ -895,20 +984,24 @@ static sessionidt lookup_ipv6map(struct in6_addr ip)
        int s;
        char ipv6addr[INET6_ADDRSTRLEN];
 
-       curnode = &ipv6_hash[ip.s6_addr[0]];
+       curnode = &ipv6_hash[((ip.s6_addr[0]) & 0xF0)>>4];
        i = 1;
        s = curnode->sess;
 
-       while (s == 0 && i < 15 && curnode->branch != NULL)
+       while (s == 0 && i < 32 && curnode->branch != NULL)
        {
-               curnode = &curnode->branch[ip.s6_addr[i]];
+               if (i & 1)
+                       curnode = &curnode->branch[ip.s6_addr[i>>1] & 0x0F];
+               else
+                       curnode = &curnode->branch[(ip.s6_addr[i>>1] & 0xF0)>>4];
+
                s = curnode->sess;
                i++;
        }
 
        LOG(4, s, session[s].tunnel, "Looking up address %s and got %d\n",
-                       inet_ntop(AF_INET6, &ip, ipv6addr,
-                               INET6_ADDRSTRLEN),
+                       inet_ntop(AF_INET6, &ip, ipv6addr,
+                       INET6_ADDRSTRLEN),
                        s);
 
        return s;
@@ -935,8 +1028,10 @@ sessionidt sessionbyipv6(struct in6_addr ip)
                 ip.s6_addr[1] == 0x80 &&
                 ip.s6_addr16[1] == 0 &&
                 ip.s6_addr16[2] == 0 &&
-                ip.s6_addr16[3] == 0)) {
-               s = lookup_ipmap(*(in_addr_t *) &ip.s6_addr[8]);
+                ip.s6_addr16[3] == 0))
+       {
+               in_addr_t *pipv4 = (in_addr_t *) &ip.s6_addr[8];
+               s = lookup_ipmap(*pipv4);
        } else {
                s = lookup_ipv6map(ip);
        }
@@ -947,6 +1042,19 @@ sessionidt sessionbyipv6(struct in6_addr ip)
        return 0;
 }
 
+sessionidt sessionbyipv6new(struct in6_addr ip)
+{
+       sessionidt s;
+       CSTAT(sessionbyipv6new);
+
+       s = lookup_ipv6map(ip);
+
+       if (s > 0 && s < MAXSESSION && session[s].opened)
+               return s;
+
+       return 0;
+}
+
 //
 // Take an IP address in HOST byte order and
 // add it to the sessionid by IP cache.
@@ -986,22 +1094,28 @@ static void uncache_ipmap(in_addr_t ip)
 static void cache_ipv6map(struct in6_addr ip, int prefixlen, sessionidt s)
 {
        int i;
-       int bytes;
+       int niblles;
        struct ipv6radix *curnode;
        char ipv6addr[INET6_ADDRSTRLEN];
 
-       curnode = &ipv6_hash[ip.s6_addr[0]];
+       curnode = &ipv6_hash[((ip.s6_addr[0]) & 0xF0)>>4];
 
-       bytes = prefixlen >> 3;
+       niblles = prefixlen >> 2;
        i = 1;
-       while (i < bytes) {
+
+       while (i < niblles)
+       {
                if (curnode->branch == NULL)
                {
-                       if (!(curnode->branch = calloc(256,
-                                       sizeof (struct ipv6radix))))
+                       if (!(curnode->branch = calloc(16, sizeof (struct ipv6radix))))
                                return;
                }
-               curnode = &curnode->branch[ip.s6_addr[i]];
+
+               if (i & 1)
+                       curnode = &curnode->branch[ip.s6_addr[i>>1] & 0x0F];
+               else
+                       curnode = &curnode->branch[(ip.s6_addr[i>>1] & 0xF0)>>4];
+
                i++;
        }
 
@@ -1009,20 +1123,20 @@ static void cache_ipv6map(struct in6_addr ip, int prefixlen, sessionidt s)
 
        if (s > 0)
                LOG(4, s, session[s].tunnel, "Caching ip address %s/%d\n",
-                               inet_ntop(AF_INET6, &ip, ipv6addr, 
-                                       INET6_ADDRSTRLEN),
+                               inet_ntop(AF_INET6, &ip, ipv6addr,
+                               INET6_ADDRSTRLEN),
                                prefixlen);
        else if (s == 0)
                LOG(4, 0, 0, "Un-caching ip address %s/%d\n",
-                               inet_ntop(AF_INET6, &ip, ipv6addr, 
-                                       INET6_ADDRSTRLEN),
+                               inet_ntop(AF_INET6, &ip, ipv6addr,
+                               INET6_ADDRSTRLEN),
                                prefixlen);
 }
 
 //
 // CLI list to dump current ipcache.
 //
-int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc)
+int cmd_show_ipcache(struct cli_def *cli, const char *command, char **argv, int argc)
 {
        union iphash *d = ip_hash, *e, *f, *g;
        int i, j, k, l;
@@ -1066,7 +1180,6 @@ int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc)
        return CLI_OK;
 }
 
-
 // Find session by username, 0 for not found
 // walled garden users aren't authenticated, so the username is
 // reasonably useless. Ignore them to avoid incorrect actions
@@ -1151,6 +1264,12 @@ void tunnelsend(uint8_t * buf, uint16_t l, tunnelidt t)
                return;
        }
 
+       if (t == TUNNEL_ID_PPPOE)
+       {
+               pppoe_sess_send(buf, l, t);
+               return;
+       }
+
        if (!tunnel[t].ip)
        {
                LOG(1, 0, t, "Error sending data out tunnel: no remote endpoint (tunnel not set up)\n");
@@ -1178,10 +1297,10 @@ void tunnelsend(uint8_t * buf, uint16_t l, tunnelidt t)
                }
        }
 
-       if (sendto(udpfd, buf, l, 0, (void *) &addr, sizeof(addr)) < 0)
+       if (sendto(udpfd[tunnel[t].indexudp], buf, l, 0, (void *) &addr, sizeof(addr)) < 0)
        {
                LOG(0, ntohs((*(uint16_t *) (buf + 6))), t, "Error sending data out tunnel: %s (udpfd=%d, buf=%p, len=%d, dest=%s)\n",
-                               strerror(errno), udpfd, buf, l, inet_ntoa(addr.sin_addr));
+                               strerror(errno), udpfd[tunnel[t].indexudp], buf, l, inet_ntoa(addr.sin_addr));
                STAT(tunnel_tx_errors);
                return;
        }
@@ -1325,12 +1444,13 @@ static void update_session_out_stat(sessionidt s, sessiont *sp, int len)
 
 // process outgoing (to tunnel) IP
 //
-static void processipout(uint8_t *buf, int len)
+// (i.e. this routine writes to data[-8]).
+void processipout(uint8_t *buf, int len)
 {
        sessionidt s;
        sessiont *sp;
        tunnelidt t;
-       in_addr_t ip;
+       in_addr_t ip, ip_src;
 
        uint8_t *data = buf;    // Keep a copy of the originals.
        int size = len;
@@ -1363,6 +1483,7 @@ static void processipout(uint8_t *buf, int len)
                return;
        }
 
+       ip_src = *(uint32_t *)(buf + 12);
        ip = *(uint32_t *)(buf + 16);
        if (!(s = sessionbyip(ip)))
        {
@@ -1447,12 +1568,15 @@ static void processipout(uint8_t *buf, int len)
 
        if (sp->tbf_out)
        {
-               // Are we throttling this session?
-               if (config->cluster_iam_master)
-                       tbf_queue_packet(sp->tbf_out, data, size);
-               else
-                       master_throttle_packet(sp->tbf_out, data, size);
-               return;
+               if (!config->no_throttle_local_IP || !sessionbyip(ip_src))
+               {
+                       // Are we throttling this session?
+                       if (config->cluster_iam_master)
+                               tbf_queue_packet(sp->tbf_out, data, size);
+                       else
+                               master_throttle_packet(sp->tbf_out, data, size);
+                       return;
+               }
        }
 
        if (sp->walled_garden && !config->cluster_iam_master)
@@ -1464,72 +1588,117 @@ static void processipout(uint8_t *buf, int len)
 
        if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1)
        {
+
+               if (!config->cluster_iam_master)
+               {
+                       // The MPPP packets must be managed by the Master.
+                       master_forward_mppp_packet(s, data, size);
+                       return;
+               }
+
                // Add on L2TP header
+               sessionidt members[MAXBUNDLESES];
                bundleidt bid = session[s].bundle;
                bundlet *b = &bundle[bid];
+               uint32_t num_of_links, nb_opened;
+               int i;
 
-               b->current_ses = (b->current_ses + 1) % b->num_of_links;
-               s = b->members[b->current_ses];
+               num_of_links = b->num_of_links;
+               nb_opened = 0;
+               for (i = 0;i < num_of_links;i++)
+               {
+                       s = b->members[i];
+                       if (session[s].ppp.lcp == Opened)
+                       {
+                               members[nb_opened] = s;
+                               nb_opened++;
+                       }
+               }
+
+               if (nb_opened < 1)
+               {
+                       LOG(3, s, t, "MPPP: PROCESSIPOUT ERROR, no session opened in bundle:%d\n", bid);
+                       return;
+               }
+
+               num_of_links = nb_opened;
+               b->current_ses = (b->current_ses + 1) % num_of_links;
+               s = members[b->current_ses];
                t = session[s].tunnel;
                sp = &session[s];
                LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s);
-               if(len > MINFRAGLEN)
-               {
-                       // Partition the packet to "bundle[b].num_of_links" fragments
-                       uint32_t num_of_links = b->num_of_links;
-                       uint32_t fraglen = len / num_of_links;
-                       fraglen = (fraglen > session[s].mru ? session[s].mru : fraglen);
-                       uint32_t last_fraglen = fraglen + len % num_of_links;
-                       last_fraglen = (last_fraglen > session[s].mru ? len % num_of_links : last_fraglen);
-                       uint32_t remain = len;
-
-                       // send the first packet
-                       uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
-                       if (!p) return;
-                       tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
-                       // statistics
-                       update_session_out_stat(s, sp, fraglen);
-                       remain -= fraglen;
-                       while (remain > last_fraglen)
-                       { 
+
+               if (num_of_links > 1)
+               {
+                       if(len > MINFRAGLEN)
+                       {
+                               //for rotate traffic among the member links
+                               uint32_t divisor = num_of_links;
+                               if (divisor > 2)
+                                       divisor = divisor/2 + (divisor & 1);
+
+                               // Partition the packet to "num_of_links" fragments
+                               uint32_t fraglen = len / divisor;
+                               uint32_t last_fraglen = fraglen + len % divisor;
+                               uint32_t remain = len;
+
+                               // send the first packet
+                               uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
+                               if (!p) return;
+                               tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+
+                               // statistics
+                               update_session_out_stat(s, sp, fraglen);
+
+                               remain -= fraglen;
+                               while (remain > last_fraglen)
+                               {
+                                       b->current_ses = (b->current_ses + 1) % num_of_links;
+                                       s = members[b->current_ses];
+                                       t = session[s].tunnel;
+                                       sp = &session[s];
+                                       LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
+                                       p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
+                                       if (!p) return;
+                                       tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+                                       update_session_out_stat(s, sp, fraglen);
+                                       remain -= fraglen;
+                               }
+                               // send the last fragment
                                b->current_ses = (b->current_ses + 1) % num_of_links;
-                               s = b->members[b->current_ses];
+                               s = members[b->current_ses];
                                t = session[s].tunnel;
                                sp = &session[s];
                                LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
-                               p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
+                               p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
                                if (!p) return;
-                               tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
-                               update_session_out_stat(s, sp, fraglen);
-                               remain -= fraglen;
+                               tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
+                               update_session_out_stat(s, sp, remain);
+                               if (remain != last_fraglen)
+                                       LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
                        }
-                       // send the last fragment
-                       b->current_ses = (b->current_ses + 1) % num_of_links;
-                       s = b->members[b->current_ses];
-                       t = session[s].tunnel;
-                       sp = &session[s];
-                       LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
-                       p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
-                       if (!p) return;
-                       tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
-                       update_session_out_stat(s, sp, remain);
-                       if (remain != last_fraglen)
-                               LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
-               }
-               else {
-                       // Send it as one frame
-                       uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
-                       if (!p) return;
-                       tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
-                       LOG(4, s, t, "MPPP: packet sent as one frame\n");
+                       else
+                       {
+                               // Send it as one frame
+                               uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
+                               if (!p) return;
+                               tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+                               LOG(4, s, t, "MPPP: packet sent as one frame\n");
+                               update_session_out_stat(s, sp, len);
+                       }
+               }
+               else
+               {
+                       // Send it as one frame (NO MPPP Frame)
+                       uint8_t *p = opt_makeppp(buf, len, s, t, PPPIP, 0, 0, 0);
+                       tunnelsend(p, len + (buf-p), t); // send it...
                        update_session_out_stat(s, sp, len);
                }
        }
        else
        {
-               uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
-               if (!p) return;
-               tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+               uint8_t *p = opt_makeppp(buf, len, s, t, PPPIP, 0, 0, 0);
+               tunnelsend(p, len + (buf-p), t); // send it...
                update_session_out_stat(s, sp, len);
        }
 
@@ -1547,7 +1716,6 @@ static void processipv6out(uint8_t * buf, int len)
        sessionidt s;
        sessiont *sp;
        tunnelidt t;
-       in_addr_t ip;
        struct in6_addr ip6;
 
        uint8_t *data = buf;    // Keep a copy of the originals.
@@ -1586,10 +1754,9 @@ static void processipv6out(uint8_t * buf, int len)
 
        if (s == 0)
        {
-               ip = *(uint32_t *)(buf + 32);
-               s = sessionbyip(ip);
+               s = sessionbyipv6new(ip6);
        }
-       
+
        if (s == 0)
        {
                // Is this a packet for a session that doesn't exist?
@@ -1669,6 +1836,8 @@ static void send_ipout(sessionidt s, uint8_t *buf, int len)
 {
        sessiont *sp;
        tunnelidt t;
+       uint8_t *p;
+       uint8_t *data = buf;    // Keep a copy of the originals.
 
        uint8_t b[MAXETHER + 20];
 
@@ -1691,11 +1860,14 @@ static void send_ipout(sessionidt s, uint8_t *buf, int len)
        LOG(5, s, t, "Ethernet -> Tunnel (%d bytes)\n", len);
 
        // Add on L2TP header
-       {
-               uint8_t *p = makeppp(b, sizeof(b), buf, len, s, t, PPPIP, 0, 0, 0);
-               if (!p) return;
-               tunnelsend(b, len + (p-b), t); // send it...
-       }
+       if (*(uint16_t *) (data + 2) == htons(PKTIPV6))
+               p = makeppp(b, sizeof(b), buf, len, s, t, PPPIPV6, 0, 0, 0); // IPV6
+       else
+               p = makeppp(b, sizeof(b), buf, len, s, t, PPPIP, 0, 0, 0); // IPV4
+
+       if (!p) return;
+
+       tunnelsend(b, len + (p-b), t); // send it...
 
        // Snooping this session.
        if (sp->snoop_ip && sp->snoop_port)
@@ -1714,10 +1886,11 @@ static void send_ipout(sessionidt s, uint8_t *buf, int len)
 static void control16(controlt * c, uint16_t avp, uint16_t val, uint8_t m)
 {
        uint16_t l = (m ? 0x8008 : 0x0008);
-       c->buf16[c->length/2 + 0] = htons(l);
-       c->buf16[c->length/2 + 1] = htons(0);
-       c->buf16[c->length/2 + 2] = htons(avp);
-       c->buf16[c->length/2 + 3] = htons(val);
+       uint16_t *pint16 = (uint16_t *) (c->buf + c->length + 0);
+       pint16[0] = htons(l);
+       pint16[1] = htons(0);
+       pint16[2] = htons(avp);
+       pint16[3] = htons(val);
        c->length += 8;
 }
 
@@ -1725,10 +1898,12 @@ static void control16(controlt * c, uint16_t avp, uint16_t val, uint8_t m)
 static void control32(controlt * c, uint16_t avp, uint32_t val, uint8_t m)
 {
        uint16_t l = (m ? 0x800A : 0x000A);
-       c->buf16[c->length/2 + 0] = htons(l);
-       c->buf16[c->length/2 + 1] = htons(0);
-       c->buf16[c->length/2 + 2] = htons(avp);
-       *(uint32_t *) &c->buf[c->length + 6] = htonl(val);
+       uint16_t *pint16 = (uint16_t *) (c->buf + c->length + 0);
+       uint32_t *pint32 = (uint32_t *) (c->buf + c->length + 6);
+       pint16[0] = htons(l);
+       pint16[1] = htons(0);
+       pint16[2] = htons(avp);
+       pint32[0] = htonl(val);
        c->length += 10;
 }
 
@@ -1736,10 +1911,11 @@ static void control32(controlt * c, uint16_t avp, uint32_t val, uint8_t m)
 static void controls(controlt * c, uint16_t avp, char *val, uint8_t m)
 {
        uint16_t l = ((m ? 0x8000 : 0) + strlen(val) + 6);
-       c->buf16[c->length/2 + 0] = htons(l);
-       c->buf16[c->length/2 + 1] = htons(0);
-       c->buf16[c->length/2 + 2] = htons(avp);
-       memcpy(&c->buf[c->length + 6], val, strlen(val));
+       uint16_t *pint16 = (uint16_t *) (c->buf + c->length + 0);
+       pint16[0] = htons(l);
+       pint16[1] = htons(0);
+       pint16[2] = htons(avp);
+       memcpy(c->buf + c->length + 6, val, strlen(val));
        c->length += 6 + strlen(val);
 }
 
@@ -1747,10 +1923,11 @@ static void controls(controlt * c, uint16_t avp, char *val, uint8_t m)
 static void controlb(controlt * c, uint16_t avp, uint8_t *val, unsigned int len, uint8_t m)
 {
        uint16_t l = ((m ? 0x8000 : 0) + len + 6);
-       c->buf16[c->length/2 + 0] = htons(l);
-       c->buf16[c->length/2 + 1] = htons(0);
-       c->buf16[c->length/2 + 2] = htons(avp);
-       memcpy(&c->buf[c->length + 6], val, len);
+       uint16_t *pint16 = (uint16_t *) (c->buf + c->length + 0);
+       pint16[0] = htons(l);
+       pint16[1] = htons(0);
+       pint16[2] = htons(avp);
+       memcpy(c->buf + c->length + 6, val, len);
        c->length += 6 + len;
 }
 
@@ -1767,7 +1944,8 @@ static controlt *controlnew(uint16_t mtype)
        }
        assert(c);
        c->next = 0;
-       c->buf16[0] = htons(0xC802); // flags/ver
+       c->buf[0] = 0xC8; // flags
+       c->buf[1] = 0x02; // ver
        c->length = 12;
        control16(c, 0, mtype, 1);
        return c;
@@ -1793,10 +1971,11 @@ static void controlnull(tunnelidt t)
 // add a control message to a tunnel, and send if within window
 static void controladd(controlt *c, sessionidt far, tunnelidt t)
 {
-       c->buf16[1] = htons(c->length); // length
-       c->buf16[2] = htons(tunnel[t].far); // tunnel
-       c->buf16[3] = htons(far); // session
-       c->buf16[4] = htons(tunnel[t].ns); // sequence
+       uint16_t *pint16 = (uint16_t *) (c->buf + 2);
+       pint16[0] = htons(c->length); // length
+       pint16[1] = htons(tunnel[t].far); // tunnel
+       pint16[2] = htons(far); // session
+       pint16[3] = htons(tunnel[t].ns); // sequence
        tunnel[t].ns++;              // advance sequence
        // link in message in to queue
        if (tunnel[t].controlc)
@@ -1921,7 +2100,6 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e
                struct param_kill_session data = { &tunnel[session[s].tunnel], &session[s] };
                LOG(2, s, session[s].tunnel, "Shutting down session %u: %s\n", s, reason);
                run_plugins(PLUGIN_KILL_SESSION, &data);
-               session[s].die = TIME + 150; // Clean up in 15 seconds
        }
 
        if (session[s].ip && !walled_garden && !session[s].die)
@@ -1946,6 +2124,9 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e
                        memcpy(&shut_acct[shut_acct_n++], &session[s], sizeof(session[s]));
        }
 
+       if (!session[s].die)
+               session[s].die = TIME + 150; // Clean up in 15 seconds
+
        if (session[s].ip)
        {                          // IP allocated, clear and unroute
                int r;
@@ -1969,59 +2150,113 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e
                        free_ip_address(s);
 
                // unroute IPv6, if setup
-               if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes)
-                       route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);
-               
-               if (b) 
-               {
-                       // This session was part of a bundle
-                       bundle[b].num_of_links--;
-                       LOG(3, s, 0, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
-                       if(bundle[b].num_of_links == 0) 
+               for (r = 0; r < MAXROUTE6 && session[s].route6[r].ipv6route.s6_addr[0] && session[s].route6[r].ipv6prefixlen; r++)
+               {
+                       if (del_routes) route6set(s, session[s].route6[r].ipv6route, session[s].route6[r].ipv6prefixlen, 0);
+                       memset(&session[s].route6[r], 0, sizeof(session[s].route6[r]));
+               }
+
+               if (session[s].ipv6address.s6_addr[0] && del_routes)
+               {
+                       route6set(s, session[s].ipv6address, 128, 0);
+               }
+
+               if (b)
+               {
+                       // This session was part of a bundle
+                       bundle[b].num_of_links--;
+                       LOG(3, s, session[s].tunnel, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
+                       if(bundle[b].num_of_links == 0)
                        {
-                               bundleclear(b);
-                               LOG(3, s, 0, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
-                       }
-                       else 
+                               bundleclear(b);
+                               LOG(3, s, session[s].tunnel, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
+                       }
+                       else 
                        {
-                               // Adjust the members array to accomodate the new change
-                               uint8_t mem_num = 0;
-                               // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
-                               if(bundle[b].members[bundle[b].num_of_links] != s) 
+                               // Adjust the members array to accomodate the new change
+                               uint8_t mem_num = 0;
+                               // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
+                               if(bundle[b].members[bundle[b].num_of_links] != s)
                                {
-                                       uint8_t ml;
-                                       for(ml = 0; ml<bundle[b].num_of_links; ml++)
-                                               if(bundle[b].members[ml] == s)
-                                               {
-                                                       mem_num = ml;
-                                                       break;
-                                               }
-                                       bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
-                                       LOG(3, s, 0, "MPPP: Adjusted member links array\n");
-                               }
-                       }
-                       cluster_send_bundle(b);
-               }
+                                       uint8_t ml;
+                                       for(ml = 0; ml<bundle[b].num_of_links; ml++)
+                                       if(bundle[b].members[ml] == s)
+                                       {
+                                                       mem_num = ml;
+                                                       break;
+                                       }
+                                       bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
+                                       LOG(3, s, session[s].tunnel, "MPPP: Adjusted member links array\n");
+
+                                       // If the killed session is the first of the bundle,
+                                       // the new first session must be stored in the cache_ipmap
+                                       // else the function sessionbyip return 0 and the sending not work any more (processipout).
+                                       if (mem_num == 0)
+                                       {
+                                               sessionidt new_s = bundle[b].members[0];
+
+                                               routed = 0;
+                                               // Add the route for this session.
+                                               for (r = 0; r < MAXROUTE && session[new_s].route[r].ip; r++)
+                                               {
+                                                       int i, prefixlen;
+                                                       in_addr_t ip;
+
+                                                       prefixlen = session[new_s].route[r].prefixlen;
+                                                       ip = session[new_s].route[r].ip;
+
+                                                       if (!prefixlen) prefixlen = 32;
+                                                       ip &= 0xffffffff << (32 - prefixlen);   // Force the ip to be the first one in the route.
+
+                                                       for (i = ip; i < ip+(1<<(32-prefixlen)) ; ++i)
+                                                               cache_ipmap(i, new_s);
+                                               }
+                                               cache_ipmap(session[new_s].ip, new_s);
+
+                                               // IPV6 route
+                                               for (r = 0; r < MAXROUTE6 && session[new_s].route6[r].ipv6prefixlen; r++)
+                                               {
+                                                       cache_ipv6map(session[new_s].route6[r].ipv6route, session[new_s].route6[r].ipv6prefixlen, new_s);
+                                               }
+
+                                               if (session[new_s].ipv6address.s6_addr[0])
+                                               {
+                                                       cache_ipv6map(session[new_s].ipv6address, 128, new_s);
+                                               }
+                                       }
+                               }
+                       }
+
+                       cluster_send_bundle(b);
+        }
        }
 
        if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
                throttle_session(s, 0, 0);
 
        if (cdn_result)
-       {                            // Send CDN
-               controlt *c = controlnew(14); // sending CDN
-               if (cdn_error)
+       {
+               if (session[s].tunnel == TUNNEL_ID_PPPOE)
                {
-                       uint16_t buf[2];
-                       buf[0] = htons(cdn_result);
-                       buf[1] = htons(cdn_error);
-                       controlb(c, 1, (uint8_t *)buf, 4, 1);
+                       pppoe_shutdown_session(s);
                }
                else
-                       control16(c, 1, cdn_result, 1);
+               {
+                       // Send CDN
+                       controlt *c = controlnew(14); // sending CDN
+                       if (cdn_error)
+                       {
+                               uint16_t buf[2];
+                               buf[0] = htons(cdn_result);
+                               buf[1] = htons(cdn_error);
+                               controlb(c, 1, (uint8_t *)buf, 4, 1);
+                       }
+                       else
+                               control16(c, 1, cdn_result, 1);
 
-               control16(c, 14, s, 1);   // assigned session (our end)
-               controladd(c, session[s].far, session[s].tunnel); // send the message
+                       control16(c, 14, s, 1);   // assigned session (our end)
+                       controladd(c, session[s].far, session[s].tunnel); // send the message
+               }
        }
 
        // update filter refcounts
@@ -2061,7 +2296,7 @@ void sendipcp(sessionidt s, tunnelidt t)
        q[4] = 3;                               // ip address option
        q[5] = 6;                               // option length
        *(in_addr_t *) (q + 6) = config->peer_address ? config->peer_address :
-                                config->bind_address ? config->bind_address :
+                                config->iftun_n_address[tunnel[t].indexudp] ? config->iftun_n_address[tunnel[t].indexudp] :
                                 my_address; // send my IP
 
        tunnelsend(buf, 10 + (q - buf), t); // send it
@@ -2125,6 +2360,16 @@ void sessionkill(sessionidt s, char *reason)
        if (sess_local[s].radius)
                radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
 
+       if (session[s].forwardtosession)
+       {
+               sessionidt sess = session[s].forwardtosession;
+               if (session[sess].forwardtosession == s)
+               {
+                       // Shutdown the linked session also.
+                       sessionshutdown(sess, reason, CDN_ADMIN_DISC, TERM_ADMIN_RESET);
+               }
+       }
+
        LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
        sessionclear(s);
        cluster_send_session(s);
@@ -2229,9 +2474,10 @@ static void tunnelshutdown(tunnelidt t, char *reason, int result, int error, cha
 }
 
 // read and process packet on tunnel (UDP)
-void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
+void processudp(uint8_t *buf, int len, struct sockaddr_in *addr, uint16_t indexudpfd)
 {
-       uint8_t *chapresponse = NULL;
+       uint8_t *sendchalresponse = NULL;
+       uint8_t *recvchalresponse = NULL;
        uint16_t l = len, t = 0, s = 0, ns = 0, nr = 0;
        uint8_t *p = buf + 2;
 
@@ -2276,6 +2522,12 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                STAT(tunnel_rx_errors);
                return;
        }
+       if (t == TUNNEL_ID_PPPOE)
+       {
+               LOG(1, s, t, "Received UDP packet with tunnel ID reserved for pppoe\n");
+               STAT(tunnel_rx_errors);
+               return;
+       }
        if (*buf & 0x08)
        {                          // ns/nr
                ns = ntohs(*(uint16_t *) p);
@@ -2314,7 +2566,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
 
                if (!config->cluster_iam_master)
                {
-                       master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
+                       master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
                        return;
                }
 
@@ -2364,6 +2616,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                        tunnel[t].ip = ntohl(*(in_addr_t *) & addr->sin_addr);
                        tunnel[t].port = ntohs(addr->sin_port);
                        tunnel[t].window = 4; // default window
+                       tunnel[t].indexudp = indexudpfd;
                        STAT(tunnel_created);
                        LOG(1, 0, t, "   New tunnel from %s:%u ID %u\n",
                                fmtaddr(htonl(tunnel[t].ip), 0), tunnel[t].port, t);
@@ -2540,7 +2793,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                case 0:     // message type
                                        message = ntohs(*(uint16_t *) b);
                                        mandatory = flags & 0x80;
-                                       LOG(4, s, t, "   Message type = %u (%s)\n", *b, l2tp_code(message));
+                                       LOG(4, s, t, "   Message type = %u (%s)\n", message, l2tp_code(message));
                                        break;
                                case 1:     // result code
                                        {
@@ -2628,13 +2881,23 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                                tunnel[t].window = 1; // window of 0 is silly
                                        LOG(4, s, t, "   rx window = %u\n", tunnel[t].window);
                                        break;
-                               case 11:        // Challenge
+                               case 11:        // Request Challenge
                                        {
                                                LOG(4, s, t, "   LAC requested CHAP authentication for tunnel\n");
-                                               build_chap_response(b, 2, n, &chapresponse);
+                                               if (message == 1)
+                                                       build_chap_response(b, 2, n, &sendchalresponse);
+                                               else if (message == 2)
+                                                       build_chap_response(b, 3, n, &sendchalresponse);
                                        }
                                        break;
-                               case 13:    // Response
+                               case 13:    // receive challenge Response
+                                       if (tunnel[t].isremotelns)
+                                       {
+                                               recvchalresponse = calloc(17, 1);
+                                               memcpy(recvchalresponse, b, (n < 17) ? n : 16);
+                                               LOG(3, s, t, "received challenge response from REMOTE LNS\n");
+                                       }
+                                       else
                                        // Why did they send a response? We never challenge.
                                        LOG(2, s, t, "   received unexpected challenge response\n");
                                        break;
@@ -2860,13 +3123,15 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                {
                                case 1:       // SCCRQ - Start Control Connection Request
                                        tunnel[t].state = TUNNELOPENING;
+                                       LOG(3, s, t, "Received SCCRQ\n");
                                        if (main_quit != QUIT_SHUTDOWN)
                                        {
+                                               LOG(3, s, t, "sending SCCRP\n");
                                                controlt *c = controlnew(2); // sending SCCRP
                                                control16(c, 2, version, 1); // protocol version
                                                control32(c, 3, 3, 1); // framing
-                                               controls(c, 7, hostname, 1); // host name
-                                               if (chapresponse) controlb(c, 13, chapresponse, 16, 1); // Challenge response
+                                               controls(c, 7, config->multi_n_hostname[tunnel[t].indexudp][0]?config->multi_n_hostname[tunnel[t].indexudp]:hostname, 1); // host name
+                                               if (sendchalresponse) controlb(c, 13, sendchalresponse, 16, 1); // Send Challenge response
                                                control16(c, 9, t, 1); // assigned tunnel
                                                controladd(c, 0, t); // send the resply
                                        }
@@ -2878,33 +3143,73 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                case 2:       // SCCRP
                                        tunnel[t].state = TUNNELOPEN;
                                        tunnel[t].lastrec = time_now;
+                                       LOG(3, s, t, "Received SCCRP\n");
+                                       if (main_quit != QUIT_SHUTDOWN)
+                                       {
+                                               if (tunnel[t].isremotelns && recvchalresponse)
+                                               {
+                                                       hasht hash;
+
+                                                       lac_calc_rlns_auth(t, 2, hash); // id = 2 (SCCRP)
+                                                       // check authenticator
+                                                       if (memcmp(hash, recvchalresponse, 16) == 0)
+                                                       {
+                                                               LOG(3, s, t, "sending SCCCN to REMOTE LNS\n");
+                                                               controlt *c = controlnew(3); // sending SCCCN
+                                                               controls(c, 7, config->multi_n_hostname[tunnel[t].indexudp][0]?config->multi_n_hostname[tunnel[t].indexudp]:hostname, 1); // host name
+                                                               controls(c, 8, Vendor_name, 1); // Vendor name
+                                                               control16(c, 2, version, 1); // protocol version
+                                                               control32(c, 3, 3, 1); // framing Capabilities
+                                                               if (sendchalresponse) controlb(c, 13, sendchalresponse, 16, 1); // Challenge response
+                                                               control16(c, 9, t, 1); // assigned tunnel
+                                                               controladd(c, 0, t); // send
+                                                       }
+                                                       else
+                                                       {
+                                                               tunnelshutdown(t, "Bad chap response from REMOTE LNS", 4, 0, 0);
+                                                       }
+                                               }
+                                       }
+                                       else
+                                       {
+                                               tunnelshutdown(t, "Shutting down", 6, 0, 0);
+                                       }
                                        break;
                                case 3:       // SCCN
+                                       LOG(3, s, t, "Received SCCN\n");
                                        tunnel[t].state = TUNNELOPEN;
                                        tunnel[t].lastrec = time_now;
                                        controlnull(t); // ack
                                        break;
                                case 4:       // StopCCN
+                                       LOG(3, s, t, "Received StopCCN\n");
                                        controlnull(t); // ack
                                        tunnelshutdown(t, "Stopped", 0, 0, 0); // Shut down cleanly
                                        break;
                                case 6:       // HELLO
+                                       LOG(3, s, t, "Received HELLO\n");
                                        controlnull(t); // simply ACK
                                        break;
                                case 7:       // OCRQ
                                        // TBA
+                                       LOG(3, s, t, "Received OCRQ\n");
                                        break;
                                case 8:       // OCRO
                                        // TBA
+                                       LOG(3, s, t, "Received OCRO\n");
                                        break;
                                case 9:       // OCCN
                                        // TBA
+                                       LOG(3, s, t, "Received OCCN\n");
                                        break;
                                case 10:      // ICRQ
+                                       LOG(3, s, t, "Received ICRQ\n");
                                        if (sessionfree && main_quit != QUIT_SHUTDOWN)
                                        {
                                                controlt *c = controlnew(11); // ICRP
 
+                                               LOG(3, s, t, "Sending ICRP\n");
+
                                                s = sessionfree;
                                                sessionfree = session[s].next;
                                                memset(&session[s], 0, sizeof(session[s]));
@@ -2932,6 +3237,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
 
                                        {
                                                controlt *c = controlnew(14); // CDN
+                                               LOG(3, s, t, "Sending CDN\n");
                                                if (!sessionfree)
                                                {
                                                        STAT(session_overflow);
@@ -2945,9 +3251,24 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                        }
                                        return;
                                case 11:      // ICRP
-                                       // TBA
+                               LOG(3, s, t, "Received ICRP\n");
+                               if (session[s].forwardtosession)
+                               {
+                                       controlt *c = controlnew(12); // ICCN
+
+                                       session[s].opened = time_now;
+                                       session[s].tunnel = t;
+                                       session[s].far = asession;
+                                       session[s].last_packet = session[s].last_data = time_now;
+
+                                       control32(c, 19, 1, 1); // Framing Type
+                                       control32(c, 24, 10000000, 1); // Tx Connect Speed
+                                       controladd(c, asession, t); // send the message
+                                       LOG(3, s, t, "Sending ICCN\n");
+                               }
                                        break;
                                case 12:      // ICCN
+                                       LOG(3, s, t, "Received ICCN\n");
                                        if (amagic == 0) amagic = time_now;
                                        session[s].magic = amagic; // set magic number
                                        session[s].flags = aflags; // set flags received
@@ -2960,13 +3281,14 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
 
                                        // Set multilink options before sending initial LCP packet
                                        sess_local[s].mp_mrru = 1614;
-                                       sess_local[s].mp_epdis = ntohl(config->bind_address ? config->bind_address : my_address);
+                                       sess_local[s].mp_epdis = ntohl(config->iftun_address ? config->iftun_address : my_address);
 
                                        sendlcp(s, t);
                                        change_state(s, lcp, RequestSent);
                                        break;
 
                                case 14:      // CDN
+                                       LOG(3, s, t, "Received CDN\n");
                                        controlnull(t); // ack
                                        sessionshutdown(s, disc_reason, CDN_NONE, disc_cause);
                                        break;
@@ -2981,7 +3303,8 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                                                LOG(1, s, t, "Unknown message type %u\n", message);
                                        break;
                                }
-                       if (chapresponse) free(chapresponse);
+                       if (sendchalresponse) free(sendchalresponse);
+                       if (recvchalresponse) free(recvchalresponse);
                        cluster_send_tunnel(t);
                }
                else
@@ -3017,16 +3340,35 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                        l -= 2;
                }
 
+               if (session[s].forwardtosession)
+               {
+                       LOG(5, s, t, "Forwarding data session to session %u\n", session[s].forwardtosession);
+                       // Forward to LAC/BAS or Remote LNS session
+                       lac_session_forward(buf, len, s, proto, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
+                       return;
+               }
+               else if (config->auth_tunnel_change_addr_src)
+               {
+                       if (tunnel[t].ip != ntohl(addr->sin_addr.s_addr) &&
+                               tunnel[t].port == ntohs(addr->sin_port))
+                       {
+                               // The remotes BAS are a clustered l2tpns server and the source IP has changed
+                               LOG(5, s, t, "The tunnel IP source (%s) has changed by new IP (%s)\n",
+                                       fmtaddr(htonl(tunnel[t].ip), 0), fmtaddr(addr->sin_addr.s_addr, 0));
+
+                               tunnel[t].ip = ntohl(addr->sin_addr.s_addr);
+                       }
+               }
+
                if (s && !session[s].opened)    // Is something wrong??
                {
                        if (!config->cluster_iam_master)
                        {
                                // Pass it off to the master to deal with..
-                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
+                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
                                return;
                        }
 
-
                        LOG(1, s, t, "UDP packet contains session which is not opened.  Dropping packet.\n");
                        STAT(tunnel_rx_errors);
                        return;
@@ -3035,37 +3377,37 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                if (proto == PPPPAP)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processpap(s, t, p, l);
                }
                else if (proto == PPPCHAP)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processchap(s, t, p, l);
                }
                else if (proto == PPPLCP)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processlcp(s, t, p, l);
                }
                else if (proto == PPPIPCP)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processipcp(s, t, p, l);
                }
                else if (proto == PPPIPV6CP && config->ipv6_prefix.s6_addr[0])
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processipv6cp(s, t, p, l);
                }
                else if (proto == PPPCCP)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        processccp(s, t, p, l);
                }
                else if (proto == PPPIP)
@@ -3079,7 +3421,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                        session[s].last_packet = session[s].last_data = time_now;
                        if (session[s].walled_garden && !config->cluster_iam_master)
                        {
-                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
+                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
                                return;
                        }
 
@@ -3094,9 +3436,10 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                        }
 
                        session[s].last_packet = session[s].last_data = time_now;
-                       if (session[s].walled_garden && !config->cluster_iam_master)
+                       if (!config->cluster_iam_master)
                        {
-                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
+                               // The fragments reconstruction is managed by the Master.
+                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
                                return;
                        }
 
@@ -3113,16 +3456,30 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
                        session[s].last_packet = session[s].last_data = time_now;
                        if (session[s].walled_garden && !config->cluster_iam_master)
                        {
-                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port);
+                               master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
                                return;
                        }
 
+                       if (!config->cluster_iam_master)
+                       {
+                               // Check if DhcpV6, IP dst: FF02::1:2, Src Port 0x0222 (546), Dst Port 0x0223 (547)
+                               if (*(p + 6) == 17 && *(p + 24) == 0xFF && *(p + 25) == 2 &&
+                                               *(uint32_t *)(p + 26) == 0 && *(uint32_t *)(p + 30) == 0 &&
+                                               *(uint16_t *)(p + 34) == 0 && *(p + 36) == 0 && *(p + 37) == 1 && *(p + 38) == 0 && *(p + 39) == 2 &&
+                                               *(p + 40) == 2 && *(p + 41) == 0x22 && *(p + 42) == 2 && *(p + 43) == 0x23)
+                               {
+                                       // DHCPV6 must be managed by the Master.
+                                       master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd);
+                                       return;
+                               }
+                       }
+
                        processipv6in(s, t, p, l);
                }
                else if (session[s].ppp.lcp == Opened)
                {
                        session[s].last_packet = time_now;
-                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port); return; }
+                       if (!config->cluster_iam_master) { master_forward_packet(buf, len, addr->sin_addr.s_addr, addr->sin_port, indexudpfd); return; }
                        protoreject(s, t, p, l, proto);
                }
                else
@@ -3134,6 +3491,7 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr)
 }
 
 // read and process packet on tun
+// (i.e. this routine writes to buf[-8]).
 static void processtun(uint8_t * buf, int len)
 {
        LOG_HEX(5, "Receive TUN Data", buf, len);
@@ -3209,6 +3567,9 @@ static void regular_cleanups(double period)
                if (t > config->cluster_highest_tunnelid)
                        t = 1;
 
+               if (t == TUNNEL_ID_PPPOE)
+                       continue;
+
                // check for expired tunnels
                if (tunnel[t].die && tunnel[t].die <= TIME)
                {
@@ -3241,10 +3602,13 @@ static void regular_cleanups(double period)
                // Send hello
                if (tunnel[t].state == TUNNELOPEN && !tunnel[t].controlc && (time_now - tunnel[t].lastrec) > 60)
                {
-                       controlt *c = controlnew(6); // sending HELLO
-                       controladd(c, 0, t); // send the message
-                       LOG(3, 0, t, "Sending HELLO message\n");
-                       t_actions++;
+                       if (!config->disable_sending_hello)
+                       {
+                               controlt *c = controlnew(6); // sending HELLO
+                               controladd(c, 0, t); // send the message
+                               LOG(3, 0, t, "Sending HELLO message\n");
+                               t_actions++;
+                       }
                }
 
                // Check for tunnel changes requested from the CLI
@@ -3407,8 +3771,8 @@ static void regular_cleanups(double period)
                        }
                }
 
-               // Drop sessions who have not responded within IDLE_TIMEOUT seconds
-               if (session[s].last_packet && (time_now - session[s].last_packet >= IDLE_TIMEOUT))
+               // Drop sessions who have not responded within IDLE_ECHO_TIMEOUT seconds
+               if (session[s].last_packet && (time_now - session[s].last_packet >= config->idle_echo_timeout))
                {
                        sessionshutdown(s, "No response to LCP ECHO requests.", CDN_ADMIN_DISC, TERM_LOST_SERVICE);
                        STAT(session_timeout);
@@ -3417,8 +3781,10 @@ static void regular_cleanups(double period)
                }
 
                // No data in ECHO_TIMEOUT seconds, send LCP ECHO
-               if (session[s].ppp.phase >= Establish && (time_now - session[s].last_packet >= ECHO_TIMEOUT) &&
-                       (time_now - sess_local[s].last_echo >= ECHO_TIMEOUT))
+               if (session[s].ppp.phase >= Establish &&
+                    ((!config->ppp_keepalive) ||
+                     (time_now - session[s].last_packet >= config->echo_timeout)) &&
+                   (time_now - sess_local[s].last_echo >= ECHO_TIMEOUT))
                {
                        uint8_t b[MAXETHER];
 
@@ -3432,7 +3798,8 @@ static void regular_cleanups(double period)
 
                        LOG(4, s, session[s].tunnel, "No data in %d seconds, sending LCP ECHO\n",
                                        (int)(time_now - session[s].last_packet));
-                       tunnelsend(b, 24, session[s].tunnel); // send it
+
+                       tunnelsend(b, (q - b) + 8, session[s].tunnel); // send it
                        sess_local[s].last_echo = time_now;
                        s_actions++;
                }
@@ -3683,8 +4050,8 @@ static int still_busy(void)
 # include "fake_epoll.h"
 #endif
 
-// the base set of fds polled: cli, cluster, tun, udp, control, dae, netlink
-#define BASE_FDS       7
+// the base set of fds polled: cli, cluster, tun, udp (MAX_UDPFD), control, dae, netlink, udplac, pppoedisc, pppoesess
+#define BASE_FDS       (9 + MAX_UDPFD)
 
 // additional polled fds
 #ifdef BGP
@@ -3696,8 +4063,11 @@ static int still_busy(void)
 // main loop - gets packets on tun or udp and processes them
 static void mainloop(void)
 {
-       int i;
+       int i, j;
        uint8_t buf[65536];
+       uint8_t *p = buf + 32; // for the hearder of the forwarded MPPP packet (see C_MPPP_FORWARD)
+                                               // and the forwarded pppoe session
+       int size_bufp = sizeof(buf) - 32;
        clockt next_cluster_ping = 0;   // send initial ping immediately
        struct epoll_event events[BASE_FDS + RADIUS_FDS + EXTRA_FDS];
        int maxevent = sizeof(events)/sizeof(*events);
@@ -3708,8 +4078,8 @@ static void mainloop(void)
                exit(1);
        }
 
-       LOG(4, 0, 0, "Beginning of main loop.  clifd=%d, cluster_sockfd=%d, tunfd=%d, udpfd=%d, controlfd=%d, daefd=%d, nlfd=%d\n",
-               clifd, cluster_sockfd, tunfd, udpfd, controlfd, daefd, nlfd);
+       LOG(4, 0, 0, "Beginning of main loop.  clifd=%d, cluster_sockfd=%d, tunfd=%d, udpfd=%d, controlfd=%d, daefd=%d, nlfd=%d , udplacfd=%d, pppoefd=%d, pppoesessfd=%d\n",
+               clifd, cluster_sockfd, tunfd, udpfd[0], controlfd, daefd, nlfd, udplacfd, pppoediscfd, pppoesessfd);
 
        /* setup our fds to poll for input */
        {
@@ -3734,10 +4104,6 @@ static void mainloop(void)
                e.data.ptr = &d[i++];
                epoll_ctl(epollfd, EPOLL_CTL_ADD, tunfd, &e);
 
-               d[i].type = FD_TYPE_UDP;
-               e.data.ptr = &d[i++];
-               epoll_ctl(epollfd, EPOLL_CTL_ADD, udpfd, &e);
-
                d[i].type = FD_TYPE_CONTROL;
                e.data.ptr = &d[i++];
                epoll_ctl(epollfd, EPOLL_CTL_ADD, controlfd, &e);
@@ -3749,6 +4115,22 @@ static void mainloop(void)
                d[i].type = FD_TYPE_NETLINK;
                e.data.ptr = &d[i++];
                epoll_ctl(epollfd, EPOLL_CTL_ADD, nlfd, &e);
+
+               d[i].type = FD_TYPE_PPPOEDISC;
+               e.data.ptr = &d[i++];
+               epoll_ctl(epollfd, EPOLL_CTL_ADD, pppoediscfd, &e);
+
+               d[i].type = FD_TYPE_PPPOESESS;
+               e.data.ptr = &d[i++];
+               epoll_ctl(epollfd, EPOLL_CTL_ADD, pppoesessfd, &e);
+
+               for (j = 0; j < config->nbudpfd; j++)
+               {
+                       d[i].type = FD_TYPE_UDP;
+                       d[i].index = j;
+                       e.data.ptr = &d[i++];
+                       epoll_ctl(epollfd, EPOLL_CTL_ADD, udpfd[j], &e);
+               }
        }
 
 #ifdef BGP
@@ -3810,10 +4192,12 @@ static void mainloop(void)
                        struct in_addr local;
                        socklen_t alen;
                        int c, s;
-                       int udp_ready = 0;
+                       int udp_ready[MAX_UDPFD + 1] = INIT_TABUDPVAR;
+                       int pppoesess_ready = 0;
+                       int pppoesess_pkts = 0;
                        int tun_ready = 0;
                        int cluster_ready = 0;
-                       int udp_pkts = 0;
+                       int udp_pkts[MAX_UDPFD + 1] = INIT_TABUDPVAR;
                        int tun_pkts = 0;
                        int cluster_pkts = 0;
 #ifdef BGP
@@ -3847,30 +4231,37 @@ static void mainloop(void)
                                // these are handled below, with multiple interleaved reads
                                case FD_TYPE_CLUSTER:   cluster_ready++; break;
                                case FD_TYPE_TUN:       tun_ready++; break;
-                               case FD_TYPE_UDP:       udp_ready++; break;
+                               case FD_TYPE_UDP:       udp_ready[d->index]++; break;
+                               case FD_TYPE_PPPOESESS: pppoesess_ready++; break;
+
+                               case FD_TYPE_PPPOEDISC: // pppoe discovery
+                                       s = read(pppoediscfd, p, size_bufp);
+                                       if (s > 0) process_pppoe_disc(p, s);
+                                       n--;
+                                       break;
 
                                case FD_TYPE_CONTROL: // nsctl commands
                                        alen = sizeof(addr);
-                                       s = recvfromto(controlfd, buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
-                                       if (s > 0) processcontrol(buf, s, &addr, alen, &local);
+                                       s = recvfromto(controlfd, p, size_bufp, MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
+                                       if (s > 0) processcontrol(p, s, &addr, alen, &local);
                                        n--;
                                        break;
 
                                case FD_TYPE_DAE: // DAE requests
                                        alen = sizeof(addr);
-                                       s = recvfromto(daefd, buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
-                                       if (s > 0) processdae(buf, s, &addr, alen, &local);
+                                       s = recvfromto(daefd, p, size_bufp, MSG_WAITALL, (struct sockaddr *) &addr, &alen, &local);
+                                       if (s > 0) processdae(p, s, &addr, alen, &local);
                                        n--;
                                        break;
 
                                case FD_TYPE_RADIUS: // RADIUS response
                                        alen = sizeof(addr);
-                                       s = recvfrom(radfds[d->index], buf, sizeof(buf), MSG_WAITALL, (struct sockaddr *) &addr, &alen);
+                                       s = recvfrom(radfds[d->index], p, size_bufp, MSG_WAITALL, (struct sockaddr *) &addr, &alen);
                                        if (s >= 0 && config->cluster_iam_master)
                                        {
                                                if (addr.sin_addr.s_addr == config->radiusserver[0] ||
                                                    addr.sin_addr.s_addr == config->radiusserver[1])
-                                                       processrad(buf, s, d->index);
+                                                       processrad(p, s, d->index);
                                                else
                                                        LOG(3, 0, 0, "Dropping RADIUS packet from unknown source %s\n",
                                                                fmtaddr(addr.sin_addr.s_addr, 0));
@@ -3881,15 +4272,15 @@ static void mainloop(void)
 
 #ifdef BGP
                                case FD_TYPE_BGP:
-                                       bgp_events[d->index] = events[i].events;
-                                       n--;
+                                       bgp_events[d->index] = events[i].events;
+                                       n--;
                                        break;
 #endif /* BGP */
 
                                case FD_TYPE_NETLINK:
                                {
-                                       struct nlmsghdr *nh = (struct nlmsghdr *)buf;
-                                       s = netlink_recv(buf, sizeof(buf));
+                                       struct nlmsghdr *nh = (struct nlmsghdr *)p;
+                                       s = netlink_recv(p, size_bufp);
                                        if (nh->nlmsg_type == NLMSG_ERROR)
                                        {
                                                struct nlmsgerr *errmsg = NLMSG_DATA(nh);
@@ -3901,7 +4292,6 @@ static void mainloop(void)
                                                                exit(1);
                                                        }
                                                        else
-
                                                                LOG(0, 0, 0, "Got a netlink error: %s\n", strerror(-errmsg->error));
                                                }
                                                // else it's a ack
@@ -3913,7 +4303,7 @@ static void mainloop(void)
                                }
 
                                default:
-                                       LOG(0, 0, 0, "Unexpected fd type returned from epoll_wait: %d\n", d->type);
+                                       LOG(0, 0, 0, "Unexpected fd type returned from epoll_wait: %d\n", d->type);
                                }
                        }
 
@@ -3923,33 +4313,51 @@ static void mainloop(void)
 
                        for (c = 0; n && c < config->multi_read_count; c++)
                        {
-                               // L2TP
-                               if (udp_ready)
+                               for (j = 0; j < config->nbudpfd; j++)
                                {
-                                       alen = sizeof(addr);
-                                       if ((s = recvfrom(udpfd, buf, sizeof(buf), 0, (void *) &addr, &alen)) > 0)
+                                       // L2TP and L2TP REMOTE LNS
+                                       if (udp_ready[j])
                                        {
-                                               processudp(buf, s, &addr);
-                                               udp_pkts++;
+                                               alen = sizeof(addr);
+                                               if ((s = recvfrom(udpfd[j], p, size_bufp, 0, (void *) &addr, &alen)) > 0)
+                                               {
+                                                       processudp(p, s, &addr, j);
+                                                       udp_pkts[j]++;
+                                               }
+                                               else
+                                               {
+                                                       udp_ready[j] = 0;
+                                                       n--;
+                                               }
+                                       }
+                               }
+
+                               // incoming IP
+                               if (tun_ready)
+                               {
+                                       if ((s = read(tunfd, p, size_bufp)) > 0)
+                                       {
+                                               processtun(p, s);
+                                               tun_pkts++;
                                        }
                                        else
                                        {
-                                               udp_ready = 0;
+                                               tun_ready = 0;
                                                n--;
                                        }
                                }
 
-                               // incoming IP
-                               if (tun_ready)
+                               // pppoe session
+                               if (pppoesess_ready)
                                {
-                                       if ((s = read(tunfd, buf, sizeof(buf))) > 0)
+                                       if ((s = read(pppoesessfd, p, size_bufp)) > 0)
                                        {
-                                               processtun(buf, s);
-                                               tun_pkts++;
+                                               process_pppoe_sess(p, s);
+                                               pppoesess_pkts++;
                                        }
                                        else
                                        {
-                                               tun_ready = 0;
+                                               pppoesess_ready = 0;
                                                n--;
                                        }
                                }
@@ -3958,9 +4366,9 @@ static void mainloop(void)
                                if (cluster_ready)
                                {
                                        alen = sizeof(addr);
-                                       if ((s = recvfrom(cluster_sockfd, buf, sizeof(buf), MSG_WAITALL, (void *) &addr, &alen)) > 0)
+                                       if ((s = recvfrom(cluster_sockfd, p, size_bufp, MSG_WAITALL, (void *) &addr, &alen)) > 0)
                                        {
-                                               processcluster(buf, s, addr.sin_addr.s_addr);
+                                               processcluster(p, s, addr.sin_addr.s_addr);
                                                cluster_pkts++;
                                        }
                                        else
@@ -3971,14 +4379,13 @@ static void mainloop(void)
                                }
                        }
 
-                       if (udp_pkts > 1 || tun_pkts > 1 || cluster_pkts > 1)
+                       if (udp_pkts[0] > 1 || tun_pkts > 1 || cluster_pkts > 1)
                                STAT(multi_read_used);
 
                        if (c >= config->multi_read_count)
                        {
-                               LOG(3, 0, 0, "Reached multi_read_count (%d); processed %d udp, %d tun and %d cluster packets\n",
-                                       config->multi_read_count, udp_pkts, tun_pkts, cluster_pkts);
-
+                               LOG(3, 0, 0, "Reached multi_read_count (%d); processed %d udp, %d tun %d cluster and %d pppoe packets\n",
+                                       config->multi_read_count, udp_pkts[0], tun_pkts, cluster_pkts, pppoesess_pkts);
                                STAT(multi_read_exceeded);
                                more++;
                        }
@@ -4193,6 +4600,12 @@ static void initdata(int optdebug, char *optconfig)
        config->ppp_max_failure = 5;
        config->kill_timedout_sessions = 1;
        strcpy(config->random_device, RANDOMDEVICE);
+       // Set default value echo_timeout and idle_echo_timeout
+       config->echo_timeout = ECHO_TIMEOUT;
+       config->idle_echo_timeout = IDLE_ECHO_TIMEOUT;
+       config->ppp_keepalive = 1;
+       // Set default RDNSS lifetime
+       config->dns6_lifetime = 1200;
 
        log_stream = stderr;
 
@@ -4309,6 +4722,8 @@ static void initdata(int optdebug, char *optconfig)
                exit(1);
        }
 #endif /* BGP */
+
+       lac_initremotelnsdata();
 }
 
 static int assign_ip_address(sessionidt s)
@@ -4595,7 +5010,7 @@ void snoop_send_packet(uint8_t *packet, uint16_t size, in_addr_t destination, ui
 
 static int dump_session(FILE **f, sessiont *s)
 {
-       if (!s->opened || !s->ip || !(s->cin_delta || s->cout_delta) || !*s->user || s->walled_garden)
+       if (!s->opened || (!s->ip && !s->forwardtosession) || !(s->cin_delta || s->cout_delta) || !*s->user || s->walled_garden)
                return 1;
 
        if (!*f)
@@ -4614,6 +5029,21 @@ static int dump_session(FILE **f, sessiont *s)
                }
 
                LOG(3, 0, 0, "Dumping accounting information to %s\n", filename);
+               if(config->account_all_origin)
+               {
+               fprintf(*f, "# dslwatch.pl dump file V1.01\n"
+                       "# host: %s\n"
+                       "# endpoint: %s\n"
+                       "# time: %ld\n"
+                       "# uptime: %ld\n"
+                       "# format: username ip qos uptxoctets downrxoctets origin(L=LAC, R=Remote LNS, P=PPPOE)\n",
+                       hostname,
+                       fmtaddr(config->iftun_n_address[tunnel[s->tunnel].indexudp] ? config->iftun_n_address[tunnel[s->tunnel].indexudp] : my_address, 0),
+                       now,
+                       now - basetime);
+               }
+               else
+               {
                fprintf(*f, "# dslwatch.pl dump file V1.01\n"
                        "# host: %s\n"
                        "# endpoint: %s\n"
@@ -4621,18 +5051,32 @@ static int dump_session(FILE **f, sessiont *s)
                        "# uptime: %ld\n"
                        "# format: username ip qos uptxoctets downrxoctets\n",
                        hostname,
-                       fmtaddr(config->bind_address ? config->bind_address : my_address, 0),
+                       fmtaddr(config->iftun_n_address[tunnel[s->tunnel].indexudp] ? config->iftun_n_address[tunnel[s->tunnel].indexudp] : my_address, 0),
                        now,
                        now - basetime);
+               }
        }
 
        LOG(4, 0, 0, "Dumping accounting information for %s\n", s->user);
+       if(config->account_all_origin)
+       {
+       fprintf(*f, "%s %s %d %u %u %s\n",
+               s->user,                                                // username
+               fmtaddr(htonl(s->ip), 0),                               // ip
+               (s->throttle_in || s->throttle_out) ? 2 : 1,            // qos
+               (uint32_t) s->cin_delta,                                // uptxoctets
+               (uint32_t) s->cout_delta,                               // downrxoctets
+               (s->tunnel == TUNNEL_ID_PPPOE)?"P":(tunnel[s->tunnel].isremotelns?"R":"L"));    // Origin
+       }
+       else if (!tunnel[s->tunnel].isremotelns && (s->tunnel != TUNNEL_ID_PPPOE))
+       {
        fprintf(*f, "%s %s %d %u %u\n",
                s->user,                                                // username
                fmtaddr(htonl(s->ip), 0),                               // ip
                (s->throttle_in || s->throttle_out) ? 2 : 1,            // qos
                (uint32_t) s->cin_delta,                                // uptxoctets
                (uint32_t) s->cout_delta);                              // downrxoctets
+       }
 
        s->cin_delta = s->cout_delta = 0;
 
@@ -4680,9 +5124,9 @@ int main(int argc, char *argv[])
                case 'd':
                        if (fork()) exit(0);
                        setsid();
-                       freopen("/dev/null", "r", stdin);
-                       freopen("/dev/null", "w", stdout);
-                       freopen("/dev/null", "w", stderr);
+                       if(!freopen("/dev/null", "r", stdin)) LOG(0, 0, 0, "Error freopen stdin: %s\n", strerror(errno));
+                       if(!freopen("/dev/null", "w", stdout)) LOG(0, 0, 0, "Error freopen stdout: %s\n", strerror(errno));
+                       if(!freopen("/dev/null", "w", stderr)) LOG(0, 0, 0, "Error freopen stderr: %s\n", strerror(errno));
                        break;
                case 'v':
                        optdebug++;
@@ -4717,11 +5161,12 @@ int main(int argc, char *argv[])
        /* set hostname /after/ having read the config file */
        if (*config->hostname)
                strcpy(hostname, config->hostname);
-       cli_init_hostname(hostname);
+       cli_init_complete(hostname);
        update_config();
        init_tbf(config->num_tbfs);
 
        LOG(0, 0, 0, "L2TPNS version " VERSION "\n");
+       LOG(0, 0, 0, "Copyright (c) 2012, 2013, 2014 ISP FDN & SAMESWIRELESS\n");
        LOG(0, 0, 0, "Copyright (c) 2003, 2004, 2005, 2006 Optus Internet Engineering\n");
        LOG(0, 0, 0, "Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n");
        {
@@ -4733,7 +5178,7 @@ int main(int argc, char *argv[])
                        LOG(0, 0, 0, "Can't set ulimit: %s\n", strerror(errno));
 
                // Make core dumps go to /tmp
-               chdir("/tmp");
+               if(chdir("/tmp")) LOG(0, 0, 0, "Error chdir /tmp: %s\n", strerror(errno));
        }
 
        if (config->scheduler_fifo)
@@ -4768,11 +5213,36 @@ int main(int argc, char *argv[])
                exit(1);
 
        inittun();
-       LOG(1, 0, 0, "Set up on interface %s\n", config->tundevice);
+       LOG(1, 0, 0, "Set up on interface %s\n", config->tundevicename);
+
+       if (*config->pppoe_if_to_bind)
+       {
+               init_pppoe();
+               LOG(1, 0, 0, "Set up on pppoe interface %s\n", config->pppoe_if_to_bind);
+       }
+
+       if (!config->nbmultiaddress)
+       {
+               config->bind_n_address[0] = config->bind_address;
+               config->nbmultiaddress++;
+       }
+       config->nbudpfd = config->nbmultiaddress;
+       for (i = 0; i < config->nbudpfd; i++)
+               initudp(&udpfd[i], config->bind_n_address[i]);
+       initlacudp();
+       config->indexlacudpfd = config->nbudpfd;
+       udpfd[config->indexlacudpfd] = udplacfd;
+       config->nbudpfd++;
+
+       initcontrol();
+       initdae();
+
+       // Intercept
+       snoopfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
 
-       initudp();
        initrad();
        initippool();
+       dhcpv6_init();
 
        // seed prng
        {
@@ -5002,6 +5472,104 @@ static void update_config()
        if (!config->radius_dae_port)
                config->radius_dae_port = DAEPORT;
 
+       if(!config->bind_portremotelns)
+               config->bind_portremotelns = L2TPLACPORT;
+       if(!config->bind_address_remotelns)
+               config->bind_address_remotelns = INADDR_ANY;
+
+       if (*config->bind_multi_address)
+       {
+               char *sip = config->bind_multi_address;
+               char *n = sip;
+               char *e = config->bind_multi_address + strlen(config->bind_multi_address);
+               config->nbmultiaddress = 0;
+
+               while (*sip && (sip < e))
+               {
+                       in_addr_t ip = 0;
+                       uint8_t u = 0;
+
+                       while (n < e && (*n == ',' || *n == ' ')) n++;
+
+                       while (n < e && (isdigit(*n) || *n == '.'))
+                       {
+                                if (*n == '.')
+                                {
+                                        ip = (ip << 8) + u;
+                                        u = 0;
+                                }
+                                else
+                                       u = u * 10 + *n - '0';
+                                n++;
+                       }
+                       ip = (ip << 8) + u;
+                       n++;
+
+                       if (ip)
+                       {
+                               config->bind_n_address[config->nbmultiaddress] = htonl(ip);
+                               config->iftun_n_address[config->nbmultiaddress] = htonl(ip);
+                               config->nbmultiaddress++;
+                               LOG(1, 0, 0, "Bind address %s\n", fmtaddr(htonl(ip), 0));
+
+                               if (config->nbmultiaddress >= MAX_BINDADDR) break;
+                       }
+
+                       sip = n;
+               }
+
+               if (config->nbmultiaddress >= 1)
+               {
+                       config->bind_address = config->bind_n_address[0];
+                       config->iftun_address = config->bind_address;
+               }
+       }
+
+       if(!config->iftun_address)
+       {
+               config->iftun_address = config->bind_address;
+               config->iftun_n_address[0] = config->iftun_address;
+       }
+
+       if (*config->multi_hostname)
+       {
+               char *shost = config->multi_hostname;
+               char *n = shost;
+               char *e = config->multi_hostname + strlen(config->multi_hostname);
+               config->nbmultihostname = 0;
+
+               while (*shost && (shost < e))
+               {
+                       while ((n < e) && (*n == ' ' || *n == ',' || *n == '\t')) n++;
+
+                       i = 0;
+                       while (n < e && (*n != ',') && (*n != '\t'))
+                       {
+                               config->multi_n_hostname[config->nbmultihostname][i] = *n;
+                               n++;i++;
+                       }
+
+                       if (i > 0)
+                       {
+                               config->multi_n_hostname[config->nbmultihostname][i] = 0;
+                               LOG(1, 0, 0, "Bind Hostname %s\n", config->multi_n_hostname[config->nbmultihostname]);
+                               config->nbmultihostname++;
+                               if (config->nbmultihostname >= MAX_NBHOSTNAME) break;
+                       }
+
+                       shost = n;
+               }
+
+               if (config->nbmultihostname >= 1)
+               {
+                       strcpy(hostname, config->multi_n_hostname[0]);
+                       strcpy(config->hostname, hostname);
+               }
+       }
+
+       if (!*config->pppoe_ac_name)
+               strncpy(config->pppoe_ac_name, DEFAULT_PPPOE_AC_NAME, sizeof(config->pppoe_ac_name) - 1);
+
        // re-initialise the random number source
        initrandom(config->random_device);
 
@@ -5136,18 +5704,18 @@ int sessionsetup(sessionidt s, tunnelidt t)
        LOG(3, s, t, "Doing session setup for session\n");
 
        // Join a bundle if the MRRU option is accepted
-        if(session[s].mrru > 0 && session[s].bundle == 0)
-        {
-                LOG(3, s, t, "This session can be part of multilink bundle\n");
-                if (join_bundle(s) > 0)
-                       cluster_send_bundle(session[s].bundle);
+       if(session[s].mrru > 0 && session[s].bundle == 0)
+       {
+               LOG(3, s, t, "This session can be part of multilink bundle\n");
+               if (join_bundle(s) > 0)
+                       cluster_send_bundle(session[s].bundle);
                else
                {
                        LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n");
                        sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE);
                        return 0;
                }
-        }
+       }
 
        if (!session[s].ip)
        {
@@ -5162,7 +5730,6 @@ int sessionsetup(sessionidt s, tunnelidt t)
                        fmtaddr(htonl(session[s].ip), 0));
        }
 
-
        // Make sure this is right
        session[s].tunnel = t;
 
@@ -5175,13 +5742,13 @@ int sessionsetup(sessionidt s, tunnelidt t)
                for (i = 1; i <= config->cluster_highest_sessionid; i++)
                {
                        if (i == s) continue;
-                       if (!session[s].opened) continue;
+                       if (!session[s].opened) break;
                        // Allow duplicate sessions for multilink ones of the same bundle.
-                        if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
-                                continue;
+                       if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle) continue;
+
                        if (ip == session[i].ip)
                        {
-                               sessionkill(i, "Duplicate IP address");
+                               sessionshutdown(i, "Duplicate IP address", CDN_ADMIN_DISC, TERM_ADMIN_RESET);  // close radius/routes, etc.
                                continue;
                        }
 
@@ -5189,27 +5756,27 @@ int sessionsetup(sessionidt s, tunnelidt t)
                        if (session[s].walled_garden || session[i].walled_garden) continue;
                        // Guest change
                        int found = 0;
-                        int gu;
-                        for (gu = 0; gu < guest_accounts_num; gu++)
-                        {
-                                if (!strcasecmp(user, guest_users[gu]))
-                                {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        if (found) continue;
+                       int gu;
+                       for (gu = 0; gu < guest_accounts_num; gu++)
+                       {
+                               if (!strcasecmp(user, guest_users[gu]))
+                               {
+                                       found = 1;
+                                       break;
+                               }
+                       }
+                       if (found) continue;
 
                        // Drop the new session in case of duplicate sessionss, not the old one.
                        if (!strcasecmp(user, session[i].user))
-                               sessionkill(i, "Duplicate session for users");
+                               sessionshutdown(i, "Duplicate session for users", CDN_ADMIN_DISC, TERM_ADMIN_RESET);  // close radius/routes, etc.
                }
        }
 
        // no need to set a route for the same IP address of the bundle
        if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1))
        {
-               int routed = 0;
+               int routed = 0;
 
                // Add the route for this session.
                for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++)
@@ -5295,7 +5862,7 @@ int load_session(sessionidt s, sessiont *new)
        // needs update
        if (newip)
        {
-               int routed = 0;
+               int routed = 0;
 
                // remove old routes...
                for (i = 0; i < MAXROUTE && session[s].route[i].ip; i++)
@@ -5318,6 +5885,17 @@ int load_session(sessionidt s, sessiont *new)
                                uncache_ipmap(session[s].ip);
                }
 
+               // remove old IPV6 routes...
+               for (i = 0; i < MAXROUTE6 && session[s].route6[i].ipv6route.s6_addr[0] && session[s].route6[i].ipv6prefixlen; i++)
+               {
+                       route6set(s, session[s].route6[i].ipv6route, session[s].route6[i].ipv6prefixlen, 0);
+               }
+
+               if (session[s].ipv6address.s6_addr[0])
+               {
+                       route6set(s, session[s].ipv6address, 128, 0);
+               }
+
                routed = 0;
 
                // add new routes...
@@ -5344,8 +5922,20 @@ int load_session(sessionidt s, sessiont *new)
        }
 
        // check v6 routing
-       if (new->ipv6prefixlen && new->ppp.ipv6cp == Opened && session[s].ppp.ipv6cp != Opened)
-                   route6set(s, new->ipv6route, new->ipv6prefixlen, 1);
+       if (new->ppp.ipv6cp == Opened && session[s].ppp.ipv6cp != Opened)
+       {
+               for (i = 0; i < MAXROUTE6 && new->route6[i].ipv6prefixlen; i++)
+               {
+                       route6set(s, new->route6[i].ipv6route, new->route6[i].ipv6prefixlen, 1);
+               }
+       }
+
+       if (new->ipv6address.s6_addr[0] && new->ppp.ipv6cp == Opened && session[s].ppp.ipv6cp != Opened)
+       {
+               // Check if included in prefix
+               if (sessionbyipv6(new->ipv6address) != s)
+                       route6set(s, new->ipv6address, 128, 1);
+       }
 
        // check filters
        if (new->filter_in && (new->filter_in > MAXFILTER || !ip_filters[new->filter_in - 1].name[0]))
@@ -5738,7 +6328,7 @@ static tunnelidt new_tunnel()
        tunnelidt i;
        for (i = 1; i < MAXTUNNEL; i++)
        {
-               if (tunnel[i].state == TUNNELFREE)
+               if ((tunnel[i].state == TUNNELFREE) && (i != TUNNEL_ID_PPPOE))
                {
                        LOG(4, 0, i, "Assigning tunnel ID %u\n", i);
                        if (i > config->cluster_highest_tunnelid)
@@ -5792,7 +6382,7 @@ void become_master(void)
        }
 }
 
-int cmd_show_hist_idle(struct cli_def *cli, char *command, char **argv, int argc)
+int cmd_show_hist_idle(struct cli_def *cli, const char *command, char **argv, int argc)
 {
        int s, i;
        int count = 0;
@@ -5830,7 +6420,7 @@ int cmd_show_hist_idle(struct cli_def *cli, char *command, char **argv, int argc
        return CLI_OK;
 }
 
-int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc)
+int cmd_show_hist_open(struct cli_def *cli, const char *command, char **argv, int argc)
 {
        int s, i;
        int count = 0;
@@ -6055,3 +6645,49 @@ int ip_filter(uint8_t *buf, int len, uint8_t filter)
        // default deny
        return 0;
 }
+
+tunnelidt lac_new_tunnel()
+{
+       return new_tunnel();
+}
+
+void lac_tunnelclear(tunnelidt t)
+{
+       tunnelclear(t);
+}
+
+void lac_send_SCCRQ(tunnelidt t, uint8_t * auth, unsigned int auth_len)
+{
+       uint16_t version = 0x0100;      // protocol version
+
+       tunnel[t].state = TUNNELOPENING;
+
+       // Sent SCCRQ - Start Control Connection Request
+       controlt *c = controlnew(1); // sending SCCRQ
+       controls(c, 7, config->multi_n_hostname[tunnel[t].indexudp][0]?config->multi_n_hostname[tunnel[t].indexudp]:hostname, 1); // host name
+       controls(c, 8, Vendor_name, 1); // Vendor name
+       control16(c, 2, version, 1); // protocol version
+       control32(c, 3, 3, 1); // framing Capabilities
+       control16(c, 9, t, 1); // assigned tunnel
+       controlb(c, 11, (uint8_t *) auth, auth_len, 1);  // CHAP Challenge
+       LOG(3, 0, t, "Sent SCCRQ to REMOTE LNS\n");
+       controladd(c, 0, t); // send
+}
+
+void lac_send_ICRQ(tunnelidt t, sessionidt s)
+{
+       // Sent ICRQ  Incoming-call-request
+       controlt *c = controlnew(10); // ICRQ
+
+       control16(c, 14, s, 1); // assigned sesion
+       call_serial_number++;
+       control32(c, 15, call_serial_number, 1);  // call serial number
+       LOG(3, s, t, "Sent ICRQ to REMOTE LNS (far ID %u)\n", tunnel[t].far);
+       controladd(c, 0, t); // send
+}
+
+void lac_tunnelshutdown(tunnelidt t, char *reason, int result, int error, char *msg)
+{
+       tunnelshutdown(t, reason, result, error, msg);
+}
+