// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.84 2005-02-14 06:58:39 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.86 2005-03-10 05:47:24 bodea Exp $";
#include <arpa/inet.h>
#include <assert.h>
static void plugins_done(void);
static void processcontrol(uint8_t *buf, int len, struct sockaddr_in *addr, int alen);
static tunnelidt new_tunnel(void);
-static int unhide_avp(uint8_t *avp, tunnelidt t, sessionidt s, uint16_t length);
+static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len);
// return internal time (10ths since process startup)
static clockt now(void)
c->length += 10;
}
-// add an AVP (32 bit)
+// add an AVP (string)
static void controls(controlt * c, uint16_t avp, char *val, uint8_t m)
{
uint16_t l = ((m ? 0x8000 : 0) + strlen(val) + 6);
// free tunnel
tunnelclear(t);
LOG(1, 0, t, "Kill tunnel %d: %s\n", t, reason);
- cli_tunnel_actions[s].action = 0;
+ cli_tunnel_actions[t].action = 0;
cluster_send_tunnel(t);
}
// shut down a tunnel cleanly
-static void tunnelshutdown(tunnelidt t, char *reason)
+static void tunnelshutdown(tunnelidt t, char *reason, int result, int error, char *msg)
{
sessionidt s;
tunnel[t].die = TIME + 700; // Clean up in 70 seconds
cluster_send_tunnel(t);
// TBA - should we wait for sessions to stop?
- { // Send StopCCN
- controlt *c = controlnew(4); // sending StopCCN
- control16(c, 1, 1, 1); // result code (admin reasons - TBA make error, general error, add message)
- control16(c, 9, t, 1); // assigned tunnel (our end)
- controladd(c, t, 0); // send the message
+ if (result)
+ {
+ controlt *c = controlnew(4); // sending StopCCN
+ if (error)
+ {
+ char buf[64];
+ int l = 4;
+ *(uint16_t *) buf = htons(result);
+ *(uint16_t *) (buf+2) = htons(error);
+ if (msg)
+ {
+ int m = strlen(msg);
+ if (m + 4 > sizeof(buf))
+ m = sizeof(buf) - 4;
+
+ memcpy(buf+4, msg, m);
+ l += m;
+ }
+
+ controlb(c, 1, buf, l, 1);
+ }
+ else
+ control16(c, 1, result, 1);
+
+ control16(c, 9, t, 1); // assigned tunnel (our end)
+ controladd(c, t, 0); // send the message
}
}
{ // control
uint16_t message = 0xFFFF; // message type
uint8_t fatal = 0;
- uint8_t mandatorymessage = 0;
+ uint8_t mandatory = 0;
uint8_t chap = 0; // if CHAP being used
uint16_t asession = 0; // assigned session
uint32_t amagic = 0; // magic number
return;
}
- if ((*buf & 0xCA) != 0xC8)
+ // control messages must have bits 0x80|0x40|0x08
+ // (type, length and sequence) set, and bits 0x02|0x01
+ // (offset and priority) clear
+ if ((*buf & 0xCB) != 0xC8)
{
LOG(1, s, t, "Bad control header %02X\n", *buf);
STAT(tunnel_rx_errors);
}
if (l)
{ // if not a null message
+ int result = 0;
+ int error = 0;
+ char *msg = 0;
+
// process AVPs
- while (l && !(fatal & 0x80))
+ while (l && !(fatal & 0x80)) // 0x80 = mandatory AVP
{
uint16_t n = (ntohs(*(uint16_t *) p) & 0x3FF);
uint8_t *b = p;
uint8_t flags = *p;
uint16_t mtype;
- p += n; // next
- if (l < n)
+ if (n > l)
{
LOG(1, s, t, "Invalid length in AVP\n");
STAT(tunnel_rx_errors);
- fatal = flags;
return;
}
+ p += n; // next
l -= n;
+ if (flags & 0x3C) // reserved bits, should be clear
+ {
+ LOG(1, s, t, "Unrecognised AVP flags %02X\n", *b);
+ fatal = flags;
+ result = 2; // general error
+ error = 3; // reserved field non-zero
+ msg = 0;
+ continue; // next
+ }
+ b += 2;
+ if (*(uint16_t *) (b))
+ {
+ LOG(2, s, t, "Unknown AVP vendor %d\n", ntohs(*(uint16_t *) (b)));
+ fatal = flags;
+ result = 2; // general error
+ error = 6; // generic vendor-specific error
+ msg = "unsupported vendor-specific";
+ continue; // next
+ }
+ b += 2;
+ mtype = ntohs(*(uint16_t *) (b));
+ b += 2;
+ n -= 6;
+
if (flags & 0x40)
{
+ uint16_t orig_len;
+
// handle hidden AVPs
if (!*config->l2tpsecret)
{
LOG(1, s, t, "Hidden AVP requested, but no L2TP secret.\n");
fatal = flags;
+ result = 2; // general error
+ error = 6; // generic vendor-specific error
+ msg = "secret not specified";
continue;
}
if (!session[s].random_vector_length)
{
LOG(1, s, t, "Hidden AVP requested, but no random vector.\n");
fatal = flags;
+ result = 2; // general error
+ error = 6; // generic
+ msg = "no random vector";
continue;
}
+ if (n < 8)
+ {
+ LOG(2, s, t, "Short hidden AVP.\n");
+ fatal = flags;
+ result = 2; // general error
+ error = 2; // length is wrong
+ msg = 0;
+ continue;
+ }
+
LOG(4, s, t, "Hidden AVP\n");
+
// Unhide the AVP
- n = unhide_avp(b, t, s, n);
- if (n == 0)
+ unhide_value(b, n, mtype, session[s].random_vector, session[s].random_vector_length);
+
+ orig_len = ntohs(*(uint16_t *) b);
+ if (orig_len > n + 2)
{
+ LOG(1, s, t, "Original length %d too long in hidden AVP of length %d; wrong secret?\n",
+ orig_len, n);
+
fatal = flags;
+ result = 2; // general error
+ error = 2; // length is wrong
+ msg = 0;
continue;
}
+
+ b += 2;
+ n = orig_len;
}
- if (*b & 0x3C)
- {
- LOG(1, s, t, "Unrecognised AVP flags %02X\n", *b);
- fatal = flags;
- continue; // next
- }
- b += 2;
- if (*(uint16_t *) (b))
- {
- LOG(2, s, t, "Unknown AVP vendor %d\n", ntohs(*(uint16_t *) (b)));
- fatal = flags;
- continue; // next
- }
- b += 2;
- mtype = ntohs(*(uint16_t *) (b));
- b += 2;
- n -= 6;
LOG(4, s, t, " AVP %d (%s) len %d\n", mtype, avp_name(mtype), n);
switch (mtype)
{
case 0: // message type
message = ntohs(*(uint16_t *) b);
+ mandatory = flags & 0x80;
LOG(4, s, t, " Message type = %d (%s)\n", *b, l2tp_message_type(message));
- mandatorymessage = flags;
break;
case 1: // result code
{
{ // allow 0.0 and 1.0
LOG(1, s, t, " Bad protocol version %04X\n", version);
fatal = flags;
+ result = 5; // unspported protocol version
+ error = 0x0100; // supported version
+ msg = 0;
continue; // next
}
}
session[s].random_vector_length = n;
break;
default:
- LOG(2, s, t, " Unknown AVP type %d\n", mtype);
- fatal = flags;
- continue; // next
+ {
+ static char e[] = "unknown AVP 0xXXXX";
+ LOG(2, s, t, " Unknown AVP type %d\n", mtype);
+ fatal = flags;
+ result = 2; // general error
+ error = 8; // unknown mandatory AVP
+ sprintf((msg = e) + 14, "%04x", mtype);
+ continue; // next
+ }
}
}
// process message
if (fatal & 0x80)
- tunnelshutdown(t, "Unknown Mandatory AVP");
+ tunnelshutdown(t, "Invalid mandatory AVP", result, error, msg);
else
switch (message)
{
break;
case 4: // StopCCN
controlnull(t); // ack
- tunnelshutdown(t, "Stopped"); // Shut down cleanly
- tunnelkill(t, "Stopped"); // Immediately force everything dead
+ tunnelshutdown(t, "Stopped", 0, 0, 0); // Shut down cleanly
break;
case 6: // HELLO
controlnull(t); // simply ACK
break;
default:
STAT(tunnel_rx_errors);
- if (mandatorymessage & 0x80)
- tunnelshutdown(t, "Unknown message");
+ if (mandatory)
+ tunnelshutdown(t, "Unknown message type", 2, 6, "unknown message type");
else
LOG(1, s, t, "Unknown message type %d\n", message);
break;
if (a & CLI_TUN_KILL)
{
LOG(2, 0, t, "Dropping tunnel by CLI\n");
- tunnelshutdown(t, "Requested by administrator");
+ tunnelshutdown(t, "Requested by administrator", 1, 0, 0);
}
}
for (i = 1; i < MAXTUNNEL; i++)
{
if (tunnel[i].ip || tunnel[i].state)
- tunnelshutdown(i, "L2TPNS Closing");
+ tunnelshutdown(i, "L2TPNS Closing", 6, 0, 0);
}
}
/* Unhide an avp.
*
- * This unencodes the AVP using the L2TP CHAP secret and the
- * previously stored random vector. It replaces the hidden data with
- * the cleartext data and returns the length of the cleartext data
- * (including the AVP "header" of 6 bytes).
- *
- * Based on code from rp-l2tpd by Roaring Penguin Software Inc.
+ * This unencodes the AVP using the L2TP secret and the previously
+ * stored random vector. It overwrites the hidden data with the
+ * unhidden AVP subformat.
*/
-static int unhide_avp(uint8_t *avp, tunnelidt t, sessionidt s, uint16_t length)
+static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len)
{
MD5_CTX ctx;
- uint8_t *cursor;
uint8_t digest[16];
- uint8_t working_vector[16];
- uint16_t hidden_length;
- uint8_t type[2];
- size_t done, todo;
- uint8_t *output;
-
- // Find the AVP type.
- type[0] = *(avp + 4);
- type[1] = *(avp + 5);
-
- // Line up with the hidden data
- cursor = output = avp + 6;
+ uint8_t *last;
+ size_t d = 0;
// Compute initial pad
MD5Init(&ctx);
- MD5Update(&ctx, type, 2);
+ MD5Update(&ctx, (uint8_t) (type >> 8) & 0xff, 1);
+ MD5Update(&ctx, (uint8_t) type & 0xff, 1);
MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
- MD5Update(&ctx, session[s].random_vector, session[s].random_vector_length);
+ MD5Update(&ctx, vector, vec_len);
MD5Final(digest, &ctx);
- // Get hidden length
- hidden_length = ((uint16_t) (digest[0] ^ cursor[0])) * 256 + (uint16_t) (digest[1] ^ cursor[1]);
+ // pointer to last decoded 16 octets
+ last = value;
- // Keep these for later use
- working_vector[0] = *cursor;
- working_vector[1] = *(cursor + 1);
- cursor += 2;
-
- if (hidden_length > length - 8)
- {
- LOG(1, s, t, "Hidden length %d too long in AVP of length %d\n", (int) hidden_length, (int) length);
- return 0;
- }
-
- /* Decrypt remainder */
- done = 2;
- todo = hidden_length;
- while (todo)
+ while (len > 0)
{
- working_vector[done] = *cursor;
- *output = digest[done] ^ *cursor;
- ++output;
- ++cursor;
- --todo;
- ++done;
- if (done == 16 && todo)
+ // calculate a new pad based on the last decoded block
+ if (d >= sizeof(digest))
{
- // Compute new digest
- done = 0;
MD5Init(&ctx);
MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret));
- MD5Update(&ctx, &working_vector, 16);
+ MD5Update(&ctx, last, sizeof(digest));
MD5Final(digest, &ctx);
+
+ d = 0;
+ last = value;
}
- }
- return hidden_length + 6;
+ *value++ ^= digest[d++];
+ len--;
+ }
}
static int ip_filter_port(ip_filter_portt *p, uint16_t port)
projects / l2tpns.git / blobdiff