// L2TP Network Server
// Adrian Kennard 2002
-// Copyright (c) 2003, 2004 Optus Internet Engineering
+// Copyright (c) 2003, 2004, 2005 Optus Internet Engineering
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.70 2004/12/16 08:49:53 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.73.2.9 2005/05/16 04:51:42 bodea Exp $";
#include <arpa/inet.h>
#include <assert.h>
CONFIG("scheduler_fifo", scheduler_fifo, BOOL),
CONFIG("lock_pages", lock_pages, BOOL),
CONFIG("icmp_rate", icmp_rate, INT),
+ CONFIG("packet_limit", max_packets, INT),
CONFIG("cluster_address", cluster_address, IP),
CONFIG("cluster_interface", cluster_interface, STRING),
CONFIG("cluster_hb_interval", cluster_hb_interval, INT),
tunnelt *tunnel = NULL; // Array of tunnel structures.
sessiont *session = NULL; // Array of session structures.
-sessioncountt *sess_count = NULL; // Array of partial per-session traffic counters.
+sessionlocalt *sess_local = NULL; // Array of local per-session counters.
radiust *radius = NULL; // Array of radius structures.
ippoolt *ip_address_pool = NULL; // Array of dynamic IP addresses.
ip_filtert *ip_filters = NULL; // Array of named filters.
int s = lookup_ipmap(ip);
CSTAT(call_sessionbyip);
- if (s > 0 && s < MAXSESSION && session[s].tunnel)
+ if (s > 0 && s < MAXSESSION && session[s].opened)
return (sessionidt) s;
return 0;
int s;
CSTAT(call_sessionbyuser);
- for (s = 1; s < MAXSESSION ; ++s)
+ for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
{
+ if (!session[s].opened)
+ continue;
+
if (session[s].walled_garden)
continue; // Skip walled garden users.
sendarp(ifr.ifr_ifindex, mac, ip);
}
-// Find session by username, 0 for not found
static sessiont *sessiontbysessionidt(sessionidt s)
{
- if (!s || s > MAXSESSION) return NULL;
+ if (!s || s >= MAXSESSION) return NULL;
return &session[s];
}
static sessionidt sessionidtbysessiont(sessiont *s)
{
sessionidt val = s-session;
- if (s < session || val > MAXSESSION) return 0;
+ if (s < session || val >= MAXSESSION) return 0;
return val;
}
tunnelidt t;
in_addr_t ip;
- char * data = buf; // Keep a copy of the originals.
+ char *data = buf; // Keep a copy of the originals.
int size = len;
uint8_t b[MAXETHER + 20];
if (len < MIN_IP_SIZE)
{
LOG(1, 0, 0, "Short IP, %d bytes\n", len);
- STAT(tunnel_tx_errors);
+ STAT(tun_rx_errors);
return;
}
if (len >= MAXETHER)
{
LOG(1, 0, 0, "Oversize IP packet %d bytes\n", len);
- STAT(tunnel_tx_errors);
+ STAT(tun_rx_errors);
return;
}
t = session[s].tunnel;
sp = &session[s];
+ // DoS prevention: enforce a maximum number of packets per 0.1s for a session
+ if (config->max_packets > 0)
+ {
+ if (sess_local[s].last_packet_out == TIME)
+ {
+ int max = config->max_packets;
+
+ // All packets for throttled sessions are handled by the
+ // master, so further limit by using the throttle rate.
+ // A bit of a kludge, since throttle rate is in kbps,
+ // but should still be generous given our average DSL
+ // packet size is 200 bytes: a limit of 28kbps equates
+ // to around 180 packets per second.
+ if (!config->cluster_iam_master && sp->throttle_out && sp->throttle_out < max)
+ max = sp->throttle_out;
+
+ if (++sess_local[s].packets_out > max)
+ {
+ sess_local[s].packets_dropped++;
+ return;
+ }
+ }
+ else
+ {
+ if (sess_local[s].packets_dropped)
+ {
+ INC_STAT(tun_rx_dropped, sess_local[s].packets_dropped);
+ LOG(3, s, t, "Dropped %u/%u packets to %s for %suser %s\n",
+ sess_local[s].packets_dropped, sess_local[s].packets_out,
+ fmtaddr(ip, 0), sp->throttle_out ? "throttled " : "",
+ sp->user);
+ }
+
+ sess_local[s].last_packet_out = TIME;
+ sess_local[s].packets_out = 1;
+ sess_local[s].packets_dropped = 0;
+ }
+ }
+
// run access-list if any
if (session[s].filter_out && !ip_filter(buf, len, session[s].filter_out - 1))
return;
sp->total_cout += len; // byte count
sp->pout++;
udp_tx += len;
- sess_count[s].cout += len; // To send to master..
+ sess_local[s].cout += len; // To send to master..
}
//
sp->total_cout += len; // byte count
sp->pout++;
udp_tx += len;
- sess_count[s].cout += len; // To send to master..
+ sess_local[s].cout += len; // To send to master..
}
// add an AVP (16 bit)
//
void throttle_session(sessionidt s, int rate_in, int rate_out)
{
- if (!session[s].tunnel)
+ if (!session[s].opened)
return; // No-one home.
if (!*session[s].user)
// add/remove filters from session (-1 = no change)
void filter_session(sessionidt s, int filter_in, int filter_out)
{
- if (!session[s].tunnel)
+ if (!session[s].opened)
return; // No-one home.
if (!*session[s].user)
CSTAT(call_sessionshutdown);
- if (!session[s].tunnel)
+ if (!session[s].opened)
{
- LOG(3, s, session[s].tunnel, "Called sessionshutdown on a session with no tunnel.\n");
+ LOG(3, s, session[s].tunnel, "Called sessionshutdown on an unopened session.\n");
return; // not a live session
}
run_plugins(PLUGIN_KILL_SESSION, &data);
}
- if (session[s].opened && !walled_garden && !session[s].die)
+ if (session[s].ip && !walled_garden && !session[s].die)
{
// RADIUS Stop message
uint16_t r = session[s].radius;
if (!(r = radiusnew(s)))
{
LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Stop message\n");
- STAT(radius_overflow);
}
else
{
}
if (!session[s].die)
- session[s].die = now() + 150; // Clean up in 15 seconds
+ session[s].die = TIME + 150; // Clean up in 15 seconds
// update filter refcounts
if (session[s].filter_in) ip_filters[session[s].filter_in - 1].used--;
if (!r)
r = radiusnew(s);
+ if (!r)
+ {
+ sessionshutdown(s, "No free RADIUS sessions for IPCP");
+ return;
+ }
+
if (radius[r].state != RADIUSIPCP)
{
radius[r].state = RADIUSIPCP;
if (!q) return;
*q = ConfigReq;
- q[1] = r << RADIUS_SHIFT; // ID, dont care, we only send one type of request
+ q[1] = r >> RADIUS_SHIFT; // ID, dont care, we only send one type of request
*(uint16_t *) (q + 2) = htons(10);
q[4] = 3;
q[5] = 6;
session[s].flags &= ~SF_IPCP_ACKED; // Clear flag.
}
+static void sessionclear(sessionidt s)
+{
+ memset(&session[s], 0, sizeof(session[s]));
+ memset(&sess_local[s], 0, sizeof(sess_local[s]));
+ memset(&cli_session_actions[s], 0, sizeof(cli_session_actions[s]));
+
+ session[s].tunnel = T_FREE; // Mark it as free.
+ session[s].next = sessionfree;
+ sessionfree = s;
+}
+
// kill a session now
-static void sessionkill(sessionidt s, char *reason)
+void sessionkill(sessionidt s, char *reason)
{
CSTAT(call_sessionkill);
- session[s].die = now();
+ if (!session[s].opened) // not alive
+ return;
+
+ if (session[s].next)
+ {
+ LOG(0, s, session[s].tunnel, "Tried to kill a session with next pointer set (%d)\n", session[s].next);
+ return;
+ }
+
+ session[s].die = TIME;
sessionshutdown(s, reason); // close radius/routes, etc.
if (session[s].radius)
radiusclear(session[s].radius, s); // cant send clean accounting data, session is killed
LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
-
- memset(&session[s], 0, sizeof(session[s]));
- session[s].tunnel = T_FREE; // Mark it as free.
- session[s].next = sessionfree;
- sessionfree = s;
- cli_session_actions[s].action = 0;
+ sessionclear(s);
cluster_send_session(s);
}
controlfree = c;
}
// kill sessions
- for (s = 1; s < MAXSESSION; s++)
+ for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
if (session[s].tunnel == t)
sessionkill(s, reason);
LOG(1, 0, t, "Shutting down tunnel %d (%s)\n", t, reason);
// close session
- for (s = 1; s < MAXSESSION; s++)
+ for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
if (session[s].tunnel == t)
sessionshutdown(s, reason);
tunnel[t].state = TUNNELDIE;
- tunnel[t].die = now() + 700; // Clean up in 70 seconds
+ tunnel[t].die = TIME + 700; // Clean up in 70 seconds
cluster_send_tunnel(t);
// TBA - should we wait for sessions to stop?
{ // Send StopCCN
if (!sessionfree)
{
STAT(session_overflow);
- tunnelshutdown(t, "No free sessions");
+ LOG(1, 0, t, "No free sessions\n");
+ return;
}
else
{
if (!(r = radiusnew(s)))
{
LOG(1, s, t, "No free RADIUS sessions for ICRQ\n");
- sessionkill(s, "no free RADIUS sesions");
+ sessionclear(s);
return;
}
c = controlnew(11); // sending ICRP
session[s].id = sessionid++;
- session[s].opened = time(NULL);
+ session[s].opened = time_now;
session[s].tunnel = t;
session[s].far = asession;
session[s].last_packet = time_now;
l -= 2;
}
- if (s && !session[s].tunnel) // Is something wrong??
+ if (s && !session[s].opened) // Is something wrong??
{
if (!config->cluster_iam_master)
{
return;
}
-
- LOG(1, s, t, "UDP packet contains session %d but no session[%d].tunnel "
- "exists (LAC said tunnel = %d). Dropping packet.\n", s, s, t);
-
+ LOG(1, s, t, "UDP packet contains session which is not opened. Dropping packet.\n");
STAT(tunnel_rx_errors);
return;
}
if (s > config->cluster_highest_sessionid)
s = 1;
- if (!session[s].tunnel) // Session isn't in use
+ if (!session[s].opened) // Session isn't in use
continue;
if (!session[s].die && session[s].ip && !(session[s].flags & SF_IPCP_ACKED))
n = select(n + 1, &r, 0, 0, &to);
#endif /* BGP */
+ STAT(select_called);
+
TIME = now();
if (n < 0)
{
}
}
+ if (udp_pkts > 1 || tun_pkts > 1 || cluster_pkts > 1)
+ STAT(multi_read_used);
+
if (c >= config->multi_read_count)
+ {
LOG(3, 0, 0, "Reached multi_read_count (%d); processed %d udp, %d tun and %d cluster packets\n",
- udp_pkts, tun_pkts, cluster_pkts);
+ config->multi_read_count, udp_pkts, tun_pkts, cluster_pkts);
+
+ STAT(multi_read_exceeded);
+ }
}
// Runs on every machine (master and slaves).
exit(1);
}
- if (!(sess_count = shared_malloc(sizeof(sessioncountt) * MAXSESSION)))
+ if (!(sess_local = shared_malloc(sizeof(sessionlocalt) * MAXSESSION)))
{
- LOG(0, 0, 0, "Error doing malloc for sessions_count: %s\n", strerror(errno));
+ LOG(0, 0, 0, "Error doing malloc for sess_local: %s\n", strerror(errno));
exit(1);
}
memset(ip_address_pool, 0, sizeof(ippoolt) * MAXIPPOOL);
// Put all the sessions on the free list marked as undefined.
- for (i = 1; i < MAXSESSION - 1; i++)
+ for (i = 1; i < MAXSESSION; i++)
{
session[i].next = i + 1;
session[i].tunnel = T_UNDEF; // mark it as not filled in.
sessionfree = 1;
// Mark all the tunnels as undefined (waiting to be filled in by a download).
- for (i = 1; i < MAXTUNNEL- 1; i++)
+ for (i = 1; i < MAXTUNNEL; i++)
tunnel[i].state = TUNNELUNDEF; // mark it as not filled in.
if (!*hostname)
for (i = 0; i < MAXSESSION; ++i)
{
int ipid;
- if (!session[i].ip || !session[i].tunnel)
+ if (!(session[i].opened && session[i].ip))
continue;
ipid = - lookup_ipmap(htonl(session[i].ip));
init_tbf(config->num_tbfs);
LOG(0, 0, 0, "L2TPNS version " VERSION "\n");
- LOG(0, 0, 0, "Copyright (c) 2003, 2004 Optus Internet Engineering\n");
+ LOG(0, 0, 0, "Copyright (c) 2003, 2004, 2005 Optus Internet Engineering\n");
LOG(0, 0, 0, "Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n");
{
struct rlimit rlim;
if (!config->numradiusservers)
LOG(0, 0, 0, "No RADIUS servers defined!\n");
- config->num_radfds = 2 << RADIUS_SHIFT;
+ config->num_radfds = 1 << RADIUS_SHIFT;
// Update plugins
for (i = 0; i < MAXPLUGINS; i++)
LOG(3, s, t, "Doing session setup for session\n");
- if (!session[s].ip || session[s].ip == 0xFFFFFFFE)
+ if (!session[s].ip)
{
assign_ip_address(s);
if (!session[s].ip)
{
for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
{
- if (!session[s].tunnel) // Not an in-use session.
+ if (!session[s].opened) // Not an in-use session.
continue;
run_plugins(PLUGIN_NEW_SESSION_MASTER, &session[s]);
for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
{
int idle;
- if (!session[s].tunnel)
+ if (!session[s].opened)
continue;
idle = time_now - session[s].last_packet;
for (s = 1; s <= config->cluster_highest_sessionid ; ++s)
{
int open = 0, d;
- if (!session[s].tunnel)
+ if (!session[s].opened)
continue;
d = time_now - session[s].opened;
projects / l2tpns.git / blobdiff