// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.92 2005/05/05 02:39:54 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.105 2005/05/26 12:17:30 bodea Exp $";
#include <arpa/inet.h>
#include <assert.h>
#endif /* BGP */
// Globals
-configt *config = NULL; // all configuration
-int tunfd = -1; // tun interface file handle. (network device)
-int udpfd = -1; // UDP file handle
-int controlfd = -1; // Control signal handle
-int clifd = -1; // Socket listening for CLI connections.
-int snoopfd = -1; // UDP file handle for sending out intercept data
-int *radfds = NULL; // RADIUS requests file handles
-int ifrfd = -1; // File descriptor for routing, etc
-int ifr6fd = -1; // File descriptor for IPv6 routing, etc
-static int rand_fd = -1; // Random data source
-time_t basetime = 0; // base clock
-char hostname[1000] = ""; // us.
-static int tunidx; // ifr_ifindex of tun device
-static int syslog_log = 0; // are we logging to syslog
-static FILE *log_stream = stderr; // file handle for direct logging (i.e. direct into file, not via syslog).
-extern int cluster_sockfd; // Intra-cluster communications socket.
-uint32_t last_id = 0; // Unique ID for radius accounting
+configt *config = NULL; // all configuration
+int tunfd = -1; // tun interface file handle. (network device)
+int udpfd = -1; // UDP file handle
+int controlfd = -1; // Control signal handle
+int clifd = -1; // Socket listening for CLI connections.
+int snoopfd = -1; // UDP file handle for sending out intercept data
+int *radfds = NULL; // RADIUS requests file handles
+int ifrfd = -1; // File descriptor for routing, etc
+int ifr6fd = -1; // File descriptor for IPv6 routing, etc
+static int rand_fd = -1; // Random data source
+time_t basetime = 0; // base clock
+char hostname[1000] = ""; // us.
+static int tunidx; // ifr_ifindex of tun device
+static int syslog_log = 0; // are we logging to syslog
+static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog).
+extern int cluster_sockfd; // Intra-cluster communications socket.
+uint32_t last_id = 0; // Unique ID for radius accounting
struct cli_session_actions *cli_session_actions = NULL; // Pending session changes requested by CLI
struct cli_tunnel_actions *cli_tunnel_actions = NULL; // Pending tunnel changes required by CLI
CONFIG("primary_radius_port", radiusport[0], SHORT),
CONFIG("secondary_radius_port", radiusport[1], SHORT),
CONFIG("radius_accounting", radius_accounting, BOOL),
+ CONFIG("radius_interim", radius_interim, INT),
CONFIG("radius_secret", radiussecret, STRING),
CONFIG("radius_authtypes", radius_authtypes_s, STRING),
CONFIG("bind_address", bind_address, IPv4),
CONFIG("cluster_interface", cluster_interface, STRING),
CONFIG("cluster_hb_interval", cluster_hb_interval, INT),
CONFIG("cluster_hb_timeout", cluster_hb_timeout, INT),
+ CONFIG("cluster_master_min_adv", cluster_master_min_adv, INT),
CONFIG("ipv6_prefix", ipv6_prefix, IPv6),
{ NULL, 0, 0, 0 },
};
}
// add a control message to a tunnel, and send if within window
-static void controladd(controlt * c, tunnelidt t, sessionidt s)
+static void controladd(controlt * c, tunnelidt t, sessionidt far)
{
*(uint16_t *) (c->buf + 2) = htons(c->length); // length
*(uint16_t *) (c->buf + 4) = htons(tunnel[t].far); // tunnel
- *(uint16_t *) (c->buf + 6) = htons(s ? session[s].far : 0); // session
+ *(uint16_t *) (c->buf + 6) = htons(far); // session
*(uint16_t *) (c->buf + 8) = htons(tunnel[t].ns); // sequence
tunnel[t].ns++; // advance sequence
// link in message in to queue
if (session[s].ip && !walled_garden && !session[s].die)
{
// RADIUS Stop message
- uint16_t r = session[s].radius;
+ uint16_t r = sess_local[s].radius;
if (!r)
+ r = radiusnew(s);
+
+ if (r)
{
- if (!(r = radiusnew(s)))
- {
- LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Stop message\n");
- STAT(radius_overflow);
- }
- else
- {
- random_data(radius[r].auth, sizeof(radius[r].auth));
- }
+ // stop, if not already trying
+ if (radius[r].state != RADIUSSTOP)
+ radiussend(r, RADIUSSTOP);
}
-
- if (r && radius[r].state != RADIUSSTOP)
- radiussend(r, RADIUSSTOP); // stop, if not already trying
+ else
+ LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Stop message\n");
// Save counters to dump to accounting file
if (*config->accounting_dir && shut_acct_n < sizeof(shut_acct) / sizeof(*shut_acct))
control16(c, 1, result, 1);
control16(c, 14, s, 1); // assigned session (our end)
- controladd(c, session[s].tunnel, s); // send the message
+ controladd(c, session[s].tunnel, session[s].far); // send the message
}
if (!session[s].die)
void sendipcp(tunnelidt t, sessionidt s)
{
uint8_t buf[MAXCONTROL];
- uint16_t r = session[s].radius;
+ uint16_t r = sess_local[s].radius;
uint8_t *q;
CSTAT(sendipcp);
if (!r)
r = radiusnew(s);
+ if (!r)
+ {
+ sessionshutdown(s, "No free RADIUS sessions for IPCP", 3, 0);
+ return;
+ }
+
if (radius[r].state != RADIUSIPCP)
{
radius[r].state = RADIUSIPCP;
if (!q) return;
*q = ConfigReq;
- q[1] = r << RADIUS_SHIFT; // ID, dont care, we only send one type of request
+ q[1] = r >> RADIUS_SHIFT; // ID, dont care, we only send one type of request
*(uint16_t *) (q + 2) = htons(10);
q[4] = 3;
q[5] = 6;
if (!q) return;
*q = ConfigReq;
- q[1] = r << RADIUS_SHIFT; // ID, don't care, we
+ q[1] = r >> RADIUS_SHIFT; // ID, don't care, we
// only send one type
// of request
*(uint16_t *) (q + 2) = htons(14);
}
}
+static void sessionclear(sessionidt s)
+{
+ memset(&session[s], 0, sizeof(session[s]));
+ memset(&sess_local[s], 0, sizeof(sess_local[s]));
+ memset(&cli_session_actions[s], 0, sizeof(cli_session_actions[s]));
+
+ session[s].tunnel = T_FREE; // Mark it as free.
+ session[s].next = sessionfree;
+ sessionfree = s;
+}
+
// kill a session now
void sessionkill(sessionidt s, char *reason)
{
session[s].die = TIME;
sessionshutdown(s, reason, 3, 0); // close radius/routes, etc.
- if (session[s].radius)
- radiusclear(session[s].radius, s); // cant send clean accounting data, session is killed
+ if (sess_local[s].radius)
+ radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
-
- memset(&session[s], 0, sizeof(session[s]));
- session[s].tunnel = T_FREE; // Mark it as free.
- session[s].next = sessionfree;
- sessionfree = s;
- cli_session_actions[s].action = 0;
+ sessionclear(s);
cluster_send_session(s);
}
uint16_t message = 0xFFFF; // message type
uint8_t fatal = 0;
uint8_t mandatory = 0;
- uint8_t chap = 0; // if CHAP being used
+ uint8_t authtype = 0; // proxy auth type
uint16_t asession = 0; // assigned session
uint32_t amagic = 0; // magic number
uint8_t aflags = 0; // flags from last LCF
uint16_t version = 0x0100; // protocol version (we handle 0.0 as well and send that back just in case)
- int requestchap = 0; // do we request PAP instead of original CHAP request?
char called[MAXTEL] = ""; // called number
char calling[MAXTEL] = ""; // calling number
// LOG(4, s, t, "Firmware revision\n");
break;
case 7: // host name
- memset(tunnel[t].hostname, 0, 128);
- memcpy(tunnel[t].hostname, b, (n >= 127) ? 127 : n);
+ memset(tunnel[t].hostname, 0, sizeof(tunnel[t].hostname));
+ memcpy(tunnel[t].hostname, b, (n < sizeof(tunnel[t].hostname)) ? n : sizeof(tunnel[t].hostname) - 1);
LOG(4, s, t, " Tunnel hostname = \"%s\"\n", tunnel[t].hostname);
// TBA - to send to RADIUS
break;
case 8: // vendor name
memset(tunnel[t].vendor, 0, sizeof(tunnel[t].vendor));
- memcpy(tunnel[t].vendor, b, (n >= sizeof(tunnel[t].vendor) - 1) ? sizeof(tunnel[t].vendor) - 1 : n);
+ memcpy(tunnel[t].vendor, b, (n < sizeof(tunnel[t].vendor)) ? n : sizeof(tunnel[t].vendor) - 1);
LOG(4, s, t, " Vendor name = \"%s\"\n", tunnel[t].vendor);
break;
case 9: // assigned tunnel
// TBA
break;
case 21: // called number
- memset(called, 0, MAXTEL);
- memcpy(called, b, (n >= MAXTEL) ? (MAXTEL-1) : n);
+ memset(called, 0, sizeof(called));
+ memcpy(called, b, (n < sizeof(called)) ? n : sizeof(called) - 1);
LOG(4, s, t, " Called <%s>\n", called);
break;
case 22: // calling number
- memset(calling, 0, MAXTEL);
- memcpy(calling, b, (n >= MAXTEL) ? (MAXTEL-1) : n);
+ memset(calling, 0, sizeof(calling));
+ memcpy(calling, b, (n < sizeof(calling)) ? n : sizeof(calling) - 1);
LOG(4, s, t, " Calling <%s>\n", calling);
break;
case 23: // subtype
else
{
// AS5300s send connect speed as a string
- char tmp[30] = {0};
- memcpy(tmp, b, (n >= 30) ? 30 : n);
+ char tmp[30];
+ memset(tmp, 0, sizeof(tmp));
+ memcpy(tmp, b, (n < sizeof(tmp)) ? n : sizeof(tmp) - 1);
session[s].tx_connect_speed = atol(tmp);
}
LOG(4, s, t, " TX connect speed <%u>\n", session[s].tx_connect_speed);
else
{
// AS5300s send connect speed as a string
- char tmp[30] = {0};
- memcpy(tmp, b, (n >= 30) ? 30 : n);
+ char tmp[30];
+ memset(tmp, 0, sizeof(tmp));
+ memcpy(tmp, b, (n < sizeof(tmp)) ? n : sizeof(tmp) - 1);
session[s].rx_connect_speed = atol(tmp);
}
LOG(4, s, t, " RX connect speed <%u>\n", session[s].rx_connect_speed);
{
uint16_t atype = ntohs(*(uint16_t *)b);
LOG(4, s, t, " Proxy Auth Type %d (%s)\n", atype, auth_type(atype));
- requestchap = (atype == 2);
+ if (atype == 2)
+ authtype = AUTHCHAP;
+ else if (atype == 3)
+ authtype = AUTHPAP;
+
break;
}
case 30: // Proxy Authentication Name
{
- char authname[64] = {0};
- memcpy(authname, b, (n > 63) ? 63 : n);
+ char authname[64];
+ memset(authname, 0, sizeof(authname));
+ memcpy(authname, b, (n < sizeof(authname)) ? n : sizeof(authname) - 1);
LOG(4, s, t, " Proxy Auth Name (%s)\n",
authname);
break;
}
case 31: // Proxy Authentication Challenge
{
- memcpy(radius[session[s].radius].auth, b, 16);
LOG(4, s, t, " Proxy Auth Challenge\n");
+ if (sess_local[s].radius)
+ memcpy(radius[sess_local[s].radius].auth, b, 16);
break;
}
case 32: // Proxy Authentication ID
{
uint16_t authid = ntohs(*(uint16_t *)(b));
LOG(4, s, t, " Proxy Auth ID (%d)\n", authid);
- if (session[s].radius)
- radius[session[s].radius].id = authid;
+ if (sess_local[s].radius)
+ radius[sess_local[s].radius].id = authid;
break;
}
case 33: // Proxy Authentication Response
- {
- char authresp[64] = {0};
- memcpy(authresp, b, (n > 63) ? 63 : n);
- LOG(4, s, t, " Proxy Auth Response\n");
- break;
- }
- case 27: // last send lcp
+ LOG(4, s, t, " Proxy Auth Response\n");
+ break;
+ case 27: // last sent lcp
{ // find magic number
uint8_t *p = b, *e = p + n;
while (p + 1 < e && p[1] && p + p[1] <= e)
{
if (*p == 5 && p[1] == 6) // Magic-Number
amagic = ntohl(*(uint32_t *) (p + 2));
- else if (*p == 3 && p[1] == 5 && *(uint16_t *) (p + 2) == htons(PPPCHAP) && p[4] == 5) // Authentication-Protocol
- chap = 1;
+ else if (*p == 3 && p[1] == 4 && *(uint16_t *) (p + 2) == htons(PPPPAP)) // Authentication-Protocol (PAP)
+ authtype = AUTHPAP;
+ else if (*p == 3 && p[1] == 5 && *(uint16_t *) (p + 2) == htons(PPPCHAP) && p[4] == 5) // Authentication-Protocol (CHAP)
+ authtype = AUTHCHAP;
else if (*p == 7) // Protocol-Field-Compression
aflags |= SESSIONPFC;
else if (*p == 8) // Address-and-Control-Field-Compression
controls(c, 7, tunnel[t].hostname, 1); // host name (TBA)
if (chapresponse) controlb(c, 13, chapresponse, 16, 1); // Challenge response
control16(c, 9, t, 1); // assigned tunnel
- controladd(c, t, s); // send the resply
+ controladd(c, t, 0); // send the resply
}
tunnel[t].state = TUNNELOPENING;
break;
// TBA
break;
case 10: // ICRQ
- if (!sessionfree)
- {
- STAT(session_overflow);
- LOG(1, 0, t, "No free sessions");
- return;
- }
- else
+ if (sessionfree)
{
uint16_t r;
- controlt *c;
s = sessionfree;
sessionfree = session[s].next;
config->cluster_highest_sessionid = s;
// make a RADIUS session
- if (!(r = radiusnew(s)))
+ if ((r = radiusnew(s)))
{
- LOG(1, s, t, "No free RADIUS sessions for ICRQ\n");
- sessionkill(s, "no free RADIUS sesions");
- return;
+ controlt *c = controlnew(11); // sending ICRP
+ session[s].opened = time_now;
+ session[s].tunnel = t;
+ session[s].far = asession;
+ session[s].last_packet = time_now;
+ LOG(3, s, t, "New session (%d/%d)\n", tunnel[t].far, session[s].far);
+ control16(c, 14, s, 1); // assigned session
+ controladd(c, t, asession); // send the reply
+
+ strncpy(radius[r].calling, calling, sizeof(radius[r].calling) - 1);
+ strncpy(session[s].called, called, sizeof(session[s].called) - 1);
+ strncpy(session[s].calling, calling, sizeof(session[s].calling) - 1);
+ STAT(session_created);
+ break;
}
- c = controlnew(11); // sending ICRP
- session[s].opened = time_now;
- session[s].tunnel = t;
- session[s].far = asession;
- session[s].last_packet = time_now;
- LOG(3, s, t, "New session (%d/%d)\n", tunnel[t].far, session[s].far);
- control16(c, 14, s, 1); // assigned session
- controladd(c, t, s); // send the reply
-
- // Generate a random challenge
- random_data(radius[r].auth, sizeof(radius[r].auth));
- strncpy(radius[r].calling, calling, sizeof(radius[r].calling) - 1);
- strncpy(session[s].called, called, sizeof(session[s].called) - 1);
- strncpy(session[s].calling, calling, sizeof(session[s].calling) - 1);
- STAT(session_created);
+
+ LOG(1, s, t, "No free RADIUS sessions for ICRQ\n");
+ sessionclear(s);
}
- break;
+ else
+ {
+ STAT(session_overflow);
+ LOG(1, 0, t, "No free sessions\n");
+ }
+
+ {
+ controlt *c = controlnew(14); // CDN
+ control16(c, 1, 4, 1); // temporary lack of resources
+ controladd(c, session[s].tunnel, asession); // send the message
+ }
+ return;
case 11: // ICRP
// TBA
break;
session[s].l2tp_flags = aflags; // set flags received
LOG(3, s, t, "Magic %X Flags %X\n", amagic, aflags);
controlnull(t); // ack
- // In CHAP state, request PAP instead
- if (requestchap)
- initlcp(t, s);
+ // proxy authentication type is not supported
+ if (!(config->radius_authtypes & authtype))
+ authtype = config->radius_authprefer;
+
+ // start LCP
+ sendlcp(t, s, authtype);
break;
case 14: // CDN
controlnull(t); // ack
if (!session[s].opened) // Session isn't in use
continue;
- if (!session[s].die && session[s].ip && !(session[s].flags & SF_IPCP_ACKED))
+ // check for expired sessions
+ if (session[s].die)
{
- // IPCP has not completed yet. Resend
- LOG(3, s, session[s].tunnel, "No ACK for initial IPCP ConfigReq... resending\n");
- sendipcp(session[s].tunnel, s);
+ if (session[s].die <= TIME)
+ {
+ sessionkill(s, "Expired");
+ if (++count >= MAX_ACTIONS) break;
+ }
+ continue;
}
- // check for expired sessions
- if (session[s].die && session[s].die <= TIME)
+ if (session[s].ip && !(session[s].flags & SF_IPCP_ACKED))
{
- sessionkill(s, "Expired");
- if (++count >= MAX_ACTIONS) break;
- continue;
+ // IPCP has not completed yet. Resend
+ LOG(3, s, session[s].tunnel, "No ACK for initial IPCP ConfigReq... resending\n");
+ sendipcp(session[s].tunnel, s);
}
// Drop sessions who have not responded within IDLE_TIMEOUT seconds
if (++count >= MAX_ACTIONS) break;
}
+
+ // RADIUS interim accounting
+ if (config->radius_accounting && config->radius_interim > 0
+ && session[s].ip && !session[s].walled_garden
+ && !sess_local[s].radius // RADIUS already in progress
+ && time_now - sess_local[s].last_interim >= config->radius_interim)
+ {
+ if (!(r = radiusnew(s)))
+ {
+ LOG(1, s, session[s].tunnel, "No free RADIUS sessions for Interim message\n");
+ STAT(radius_overflow);
+ continue;
+ }
+
+ LOG(3, s, session[s].tunnel, "Sending RADIUS Interim for %s (%u)\n",
+ session[s].user, session[s].unique_id);
+
+ radiussend(r, RADIUSINTERIM);
+ sess_local[s].last_interim = time_now;
+
+ if (++count >= MAX_ACTIONS)
+ break;
+ }
}
if (*config->accounting_dir)
config->debug = optdebug;
config->num_tbfs = MAXTBFS;
config->rl_rate = 28; // 28kbps
+ config->cluster_master_min_adv = 1;
strcpy(config->random_device, RANDOMDEVICE);
+ log_stream = stderr;
+
#ifdef RINGBUFFER
if (!(ringbuffer = shared_malloc(sizeof(struct Tringbuffer))))
{
// test twice, In case someone works with
// a secondary radius server without defining
// a primary one, this will work even then.
- if (i>0 && !config->radiusport[i])
+ if (i > 0 && !config->radiusport[i])
config->radiusport[i] = config->radiusport[i-1];
if (!config->radiusport[i])
config->radiusport[i] = RADPORT;
if (!config->numradiusservers)
LOG(0, 0, 0, "No RADIUS servers defined!\n");
- config->num_radfds = 2 << RADIUS_SHIFT;
+ config->num_radfds = 1 << RADIUS_SHIFT;
// parse radius_authtypes_s
config->radius_authtypes = config->radius_authprefer = 0;
p = config->radius_authtypes_s;
- while (*p)
+ while (p && *p)
{
char *s = strpbrk(p, " \t,");
int type = 0;
else if (!strncasecmp("pap", p, strlen(p)))
type = AUTHPAP;
else
- LOG(0, 0, 0, "Invalid RADIUS authentication type \"%s\"", p);
+ LOG(0, 0, 0, "Invalid RADIUS authentication type \"%s\"\n", p);
config->radius_authtypes |= type;
if (!config->radius_authprefer)
config->radius_authprefer = type;
+
+ p = s;
}
if (!config->radius_authtypes)
radiusnew,
radiussend,
getconfig,
+ sessionshutdown,
sessionkill,
throttle_session,
cluster_send_session,
projects / l2tpns.git / blobdiff