Fix possible IPv6 spoofing

[l2tpns.git] / ppp.c

diff --git a/ppp.c b/ppp.c
index 7942e6e..bd70e4d 100644 (file)
--- a/ppp.c
+++ b/ppp.c
@@ -1,7 +1,5 @@
 // L2TPNS PPP Stuff
 
 // L2TPNS PPP Stuff
 

-char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009/12/08 14:49:28 bodea Exp $";
-

 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>


@@ -14,6 +12,11 @@ char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009/12/08 14:49:28 bodea Exp $";
 #include "tbf.h"
 #include "cluster.h"
 
 #include "tbf.h"
 #include "cluster.h"
 

+#ifdef LAC
+#include "l2tplac.h"
+#endif
+#include "pppoe.h"
+

 extern tunnelt *tunnel;
 extern bundlet *bundle;
 extern fragmentationt *frag;
 extern tunnelt *tunnel;
 extern bundlet *bundle;
 extern fragmentationt *frag;


@@ -23,6 +26,7 @@ extern int tunfd;
 extern char hostname[];
 extern uint32_t eth_tx;
 extern time_t time_now;
 extern char hostname[];
 extern uint32_t eth_tx;
 extern time_t time_now;

+extern uint64_t time_now_ms;

 extern configt *config;
 
 static int add_lcp_auth(uint8_t *b, int size, int authtype);
 extern configt *config;
 
 static int add_lcp_auth(uint8_t *b, int size, int authtype);


@@ -101,6 +105,14 @@ void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                LOG(3, s, t, "PAP login %s/%s\n", user, pass);
        }
 
                LOG(3, s, t, "PAP login %s/%s\n", user, pass);
        }
 

+#ifdef LAC
+       if ((!config->disable_lac_func) && lac_conf_forwardtoremotelns(s, user))
+       {
+               // Creating a tunnel/session has been started
+               return;
+       }
+#endif
+

        if (session[s].ip || !(r = radiusnew(s)))
        {
                // respond now, either no RADIUS available or already authenticated
        if (session[s].ip || !(r = radiusnew(s)))
        {
                // respond now, either no RADIUS available or already authenticated


@@ -252,6 +264,16 @@ void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                packet.username = calloc(l + 1, 1);
                memcpy(packet.username, p, l);
 
                packet.username = calloc(l + 1, 1);
                memcpy(packet.username, p, l);
 

+#ifdef LAC
+               if ((!config->disable_lac_func) && lac_conf_forwardtoremotelns(s, packet.username))
+               {
+                       free(packet.username);
+                       free(packet.password);
+                       // Creating a tunnel/session has been started
+                       return;
+               }
+#endif
+

                run_plugins(PLUGIN_PRE_AUTH, &packet);
                if (!packet.continue_auth)
                {
                run_plugins(PLUGIN_PRE_AUTH, &packet);
                if (!packet.continue_auth)
                {


@@ -404,7 +426,7 @@ void lcp_open(sessionidt s, tunnelidt t)
        }
 }
 
        }
 }
 

-static void lcp_restart(sessionidt s)
+void lcp_restart(sessionidt s)

 {
        session[s].ppp.phase = Establish;
        // This-Layer-Down
 {
        session[s].ppp.phase = Establish;
        // This-Layer-Down


@@ -537,7 +559,7 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
        if (session[s].die) // going down...
                return;
 
        if (session[s].die) // going down...
                return;
 

-       LOG((*p == EchoReq || *p == EchoReply) ? 4 : 3, s, t,
+       LOG(((*p == EchoReq || *p == EchoReply) ? 4 : 3), s, t,

                "LCP: recv %s\n", ppp_code(*p));
 
        if (config->debug > 3) dumplcp(p, l);
                "LCP: recv %s\n", ppp_code(*p));
 
        if (config->debug > 3) dumplcp(p, l);


@@ -821,6 +843,10 @@ void processlcp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
                        break;
 
 
                        break;
 

+               case Closing:
+                       sessionshutdown(s, "LCP: ConfigReq in state Closing. This should not happen. Killing session.", CDN_ADMIN_DISC, TERM_LOST_SERVICE);
+                       break;
+

                default:
                        LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                        return;
                default:
                        LOG(2, s, t, "LCP: ignoring %s in state %s\n", ppp_code(*p), ppp_state(session[s].ppp.lcp));
                        return;


@@ -1178,24 +1204,24 @@ static void setepdis(epdist *ep1, epdist ep2)
 
 static bundleidt new_bundle()
 {
 
 static bundleidt new_bundle()
 {

-        bundleidt i;
-        for (i = 1; i < MAXBUNDLE; i++)
-        {
-                if (bundle[i].state == BUNDLEFREE)
-                {
-                        LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
-                        bundle[i].num_of_links = 1;
-                        bundle[i].last_check = time_now;        // Initialize last_check value
-                        bundle[i].state = BUNDLEOPEN;
-                        bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first
+       bundleidt i;
+       for (i = 1; i < MAXBUNDLE; i++)
+       {
+               if (bundle[i].state == BUNDLEFREE)
+               {
+                       LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
+                       bundle[i].num_of_links = 1;
+                       bundle[i].last_check = time_now;        // Initialize last_check value
+                       bundle[i].state = BUNDLEOPEN;
+                       bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first

                        memset(&frag[i], 0, sizeof(fragmentationt));
                        memset(&frag[i], 0, sizeof(fragmentationt));

-                        if (i > config->cluster_highest_bundleid)
-                                config->cluster_highest_bundleid = i;
-                        return i;
-                }
-        }
-        LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
-        return 0;
+                       if (i > config->cluster_highest_bundleid)
+                                       config->cluster_highest_bundleid = i;
+                       return i;
+               }
+       }
+       LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
+       return 0;

 }
 
 static void ipcp_open(sessionidt s, tunnelidt t)
 }
 
 static void ipcp_open(sessionidt s, tunnelidt t)


@@ -1536,7 +1562,7 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                uint8_t *o = p + 4;
                int length = l - 4;
                int gotip = 0;
                uint8_t *o = p + 4;
                int length = l - 4;
                int gotip = 0;

-               uint8_t ident[8];
+               uint32_t ident[2];

 
                while (length > 2)
                {
 
                while (length > 2)
                {


@@ -1548,12 +1574,12 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                                gotip++; // seen address
                                if (o[1] != 10) return;
 
                                gotip++; // seen address
                                if (o[1] != 10) return;
 

-                               *(uint32_t *) ident = htonl(session[s].ip);
-                               *(uint32_t *) (ident + 4) = 0;
+                               ident[0] = htonl(session[s].ip);
+                               ident[1] = 0;

 
                                if (memcmp(o + 2, ident, sizeof(ident)))
                                {
 
                                if (memcmp(o + 2, ident, sizeof(ident)))
                                {

-                                       q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, ident, sizeof(ident));
+                                       q = ppp_conf_nak(s, b, sizeof(b), PPPIPV6CP, &response, q, p, o, (uint8_t *)ident, sizeof(ident));

                                        if (!q) return;
                                }
 
                                        if (!q) return;
                                }
 


@@ -1743,7 +1769,7 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
        if (!session[s].bundle || bundle[session[s].bundle].num_of_links < 2) // FIXME: 
        {
                // no spoof (do sessionbyip to handled statically routed subnets)
        if (!session[s].bundle || bundle[session[s].bundle].num_of_links < 2) // FIXME: 
        {
                // no spoof (do sessionbyip to handled statically routed subnets)

-               if (ip != session[s].ip && sessionbyip(htonl(ip)) != s)
+               if (!config->disable_no_spoof && ip != session[s].ip && sessionbyip(htonl(ip)) != s)

                {
                        LOG(4, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
                        return;
                {
                        LOG(4, s, t, "Dropping packet with spoofed IP %s\n", fmtaddr(htonl(ip), 0));
                        return;


@@ -1807,189 +1833,387 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 // process Multilink PPP packet received
 void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {
 // process Multilink PPP packet received
 void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {

-        bundleidt b = session[s].bundle;
+       bundleidt b = session[s].bundle;

        bundlet * this_bundle = &bundle[b];
        bundlet * this_bundle = &bundle[b];

-       uint32_t frag_offset, M_offset;
-       uint16_t frag_index, M_index;
+       uint32_t maskSeq, max_seq;
+       int frag_offset;
+       uint16_t frag_index, frag_index_next, frag_index_prev;

        fragmentationt *this_fragmentation = &frag[b];
        uint8_t begin_frame = (*p & MP_BEGIN);
        fragmentationt *this_fragmentation = &frag[b];
        uint8_t begin_frame = (*p & MP_BEGIN);

-        uint8_t end_frame = (*p & MP_END);
-        uint32_t seq_num;
+       uint8_t end_frame = (*p & MP_END);
+       uint32_t seq_num, seq_num_next, seq_num_prev;
+       uint32_t i;

        uint8_t flags = *p;
        uint16_t begin_index, end_index;
 
        // Perform length checking
        uint8_t flags = *p;
        uint16_t begin_index, end_index;
 
        // Perform length checking

-        if(l > MAXFRAGLEN)
-        {
-               LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
-               return;
-        }
+       if(l > MAXFRAGLEN)
+       {
+               LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
+               return;
+       }

 
 

-        if(!b)
-        {
-                LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
-                return;
-        }
+       if(!b)
+       {
+               LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
+               return;
+       }

        // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf
        // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf

-        /* if(session[s].mssf)
-        {
-                // Get 12 bit for seq number
-                seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
-                p += 2;
-                l -= 2;
-                // After this point the pointer should be advanced 2 bytes
-                LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
-        }
-        else */
-        {
-                // Get 24 bit for seq number
-                seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
-                p += 4;
-                l -= 4;
-                // After this point the pointer should be advanced 4 bytes
-                LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
-        }
+       /* if(session[s].mssf)
+       {
+               // Get 12 bit for seq number
+               seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
+               p += 2;
+               l -= 2;
+               // After this point the pointer should be advanced 2 bytes
+               LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
+       }
+       else */
+       {
+               // Get 24 bit for seq number
+               seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
+               p += 4;
+               l -= 4;
+               // After this point the pointer should be advanced 4 bytes
+               LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
+       }

 
 

-       // calculate this fragment's offset from the begin seq in the bundle
-       frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+       max_seq = this_bundle->max_seq;
+       maskSeq = max_seq - 1;

 
 

-       // discard this fragment if frag_offset is bigger that the fragmentation buffer size
-       if (frag_offset >= MAXFRAGNUM)
-        {
-               LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
-                return;
-        }
+       /*
+        * Expand sequence number to 32 bits, making it as close
+        * as possible to this_fragmentation->M.
+        */
+       seq_num |= this_fragmentation->M & ~maskSeq;
+       if ((int)(this_fragmentation->M - seq_num) > (int)(maskSeq >> 1))
+       {
+               seq_num += maskSeq + 1;
+       }
+       else if ((int)(seq_num - this_fragmentation->M) > (int)(maskSeq >> 1))
+       {
+               seq_num -= maskSeq + 1; /* should never happen */
+       }
+
+       // calculate this fragment's offset from the begin seq in the bundle
+       frag_offset = (int) (seq_num - this_fragmentation->start_seq);

        
        

-       // update M

        sess_local[s].last_seq = seq_num;
        sess_local[s].last_seq = seq_num;

+
+       // calculate the jitter average
+       uint32_t ljitter = time_now_ms - sess_local[s].prev_time;
+       if (ljitter > 0)
+       {
+               sess_local[s].jitteravg = (sess_local[s].jitteravg + ljitter)>>1;
+               sess_local[s].prev_time = time_now_ms;
+       }
+
+       uint32_t Mmin;
+

        if (seq_num < this_fragmentation->M)
        if (seq_num < this_fragmentation->M)

+       {
+               Mmin = seq_num;

                this_fragmentation->M = seq_num;
                this_fragmentation->M = seq_num;

+       }

        else
        {
        else
        {

-               uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;;
+               Mmin = sess_local[(this_bundle->members[0])].last_seq;

                for (i = 1; i < this_bundle->num_of_links; i++)
                {
                for (i = 1; i < this_bundle->num_of_links; i++)
                {

-                       uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq; 
-                       if (s_seq < min)
-                               min = s_seq;
+                       uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq;
+                       if (s_seq < Mmin)
+                               Mmin = s_seq;

                }
                }

-               this_fragmentation->M = min;
+               this_fragmentation->M = Mmin;

        }
 
        }
 

-       LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M); 
-       //calculate M's offset from the begin seq in the bundle
-       M_offset = (this_fragmentation->M + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+       // calculate M offset of the M seq in the bundle
+       int M_offset = (int) (Mmin - this_fragmentation->start_seq);
+
+       if (M_offset >= MAXFRAGNUM)
+       {
+               // There have a long break of the link !!!!!!!!
+               // M_offset is bigger that the fragmentation buffer size
+               LOG(3, s, t, "MPPP: M_offset out of range, min:%d, begin_seq:%d\n", Mmin, this_fragmentation->start_seq);
+
+               // Calculate the new start index, the previous frag are lost
+               begin_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
+
+               // Set new Start sequence
+               this_fragmentation->start_index = begin_index;
+               this_fragmentation->start_seq = Mmin;
+               M_offset = 0;
+               // recalculate the fragment offset from the new begin seq in the bundle
+               frag_offset = (int) (seq_num - Mmin);
+       }
+
+       // discard this fragment if the packet comes before the start sequence
+       if (frag_offset < 0)
+       {
+               // this packet comes before the next
+               LOG(3, s, t, "MPPP: (COMES BEFORE) the next, seq:%d, begin_seq:%d, size_frag:%d, flags:%02X is LOST\n", seq_num, this_fragmentation->start_seq, l, flags);
+               return;
+       }
+
+       // discard if frag_offset is bigger that the fragmentation buffer size
+       if (frag_offset >= MAXFRAGNUM)
+       {
+               // frag_offset is bigger that the fragmentation buffer size
+               LOG(3, s, t, "MPPP: Index out of range, seq:%d, begin_seq:%d\n", seq_num, this_fragmentation->start_seq);
+               return;
+       }

 
 

-       //caculate M's index in the fragment array
-       M_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
-       

        //caculate received fragment's index in the fragment array
        frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
 
        //caculate received fragment's index in the fragment array
        frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
 

-       //frame with a single fragment
-       if (begin_frame && end_frame)
-       {
-               // process and reset fragmentation
-                LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
-               this_fragmentation->fragment[frag_index].length = l;
-               this_fragmentation->fragment[frag_index].sid = s;
-               this_fragmentation->fragment[frag_index].flags = flags;
-               this_fragmentation->fragment[frag_index].seq = seq_num;
-               this_fragmentation->re_frame_begin_index = frag_index;
-               this_fragmentation->re_frame_end_index = frag_index;
-               processmpframe(s, t, p, l, 0);
-               this_fragmentation->fragment[frag_index].length = 0;
-               this_fragmentation->fragment[frag_index].flags = 0;
-               end_index = frag_index;
+       // insert the frame in it's place
+       fragmentt *this_frag = &this_fragmentation->fragment[frag_index];
+
+       if (this_frag->length > 0)
+               // This fragment is lost, It was around the buffer and it was never completed the packet.
+               LOG(3, this_frag->sid, this_frag->tid, "MPPP: (INSERT) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                       this_frag->seq, frag_index, this_frag->flags);
+
+       this_frag->length = l;
+       this_frag->sid = s;
+       this_frag->tid = t;
+       this_frag->flags = flags;
+       this_frag->seq = seq_num;
+       this_frag->jitteravg = sess_local[s].jitteravg;
+       memcpy(this_frag->data, p, l);
+
+       LOG(4, s, t, "MPPP: seq_num:%d frag_index:%d INSERTED flags: %02X\n",  seq_num, frag_index, flags);
+
+       //next frag index
+       frag_index_next = (frag_index + 1) & MAXFRAGNUM_MASK;
+       //previous frag index
+       frag_index_prev = (frag_index - 1) & MAXFRAGNUM_MASK;
+       // next seq
+       seq_num_next = seq_num + 1;
+       // previous seq
+       seq_num_prev = seq_num - 1;
+
+       // Clean the buffer and log the lost fragments
+       if ((frag_index_next != this_fragmentation->start_index) && this_fragmentation->fragment[frag_index_next].length)
+       {
+               // check if the next frag is a lost fragment
+               if (this_fragmentation->fragment[frag_index_next].seq != seq_num_next)
+               {
+                       // This fragment is lost, It was around the buffer and it was never completed the packet.
+                       LOG(3, this_fragmentation->fragment[frag_index_next].sid, this_fragmentation->fragment[frag_index_next].tid,
+                               "MPPP: (NEXT) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                               this_fragmentation->fragment[frag_index_next].seq, frag_index_next,
+                               this_fragmentation->fragment[frag_index_next].flags);
+                       // this frag is lost
+                       this_fragmentation->fragment[frag_index_next].length = 0;
+                       this_fragmentation->fragment[frag_index_next].flags = 0;
+
+                       if (begin_frame && (!end_frame)) return; // assembling frame failed
+               }

        }
        }

-       else
+
+       // Clean the buffer and log the lost fragments
+       if ((frag_index != this_fragmentation->start_index) && this_fragmentation->fragment[frag_index_prev].length)

        {
        {

-               // insert the frame in it's place
-               fragmentt *this_frag = &this_fragmentation->fragment[frag_index];
-               this_frag->length = l;
-               this_frag->sid = s;
-               this_frag->flags = flags;
-               this_frag->seq = seq_num;
-                memcpy(this_frag->data, p, l);
-
-               // try to assemble the frame that has the received fragment as a member         
-               // get the beginning of this frame
-               begin_index = end_index = frag_index;
-               while (this_fragmentation->fragment[begin_index].length)
+               // check if the next frag is a lost fragment
+               if (this_fragmentation->fragment[frag_index_prev].seq != seq_num_prev)

                {
                {

-                       if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN)
-                               break;
-                       begin_index = (begin_index ? (begin_index -1) : (MAXFRAGNUM -1)); 
+                       // This fragment is lost, It was around the buffer and it was never completed the packet.
+                       LOG(3, this_fragmentation->fragment[frag_index_prev].sid, this_fragmentation->fragment[frag_index_prev].tid,
+                               "MPPP: (PREV) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                               this_fragmentation->fragment[frag_index_prev].seq, frag_index_prev,
+                               this_fragmentation->fragment[frag_index_prev].flags);
+
+                       this_fragmentation->fragment[frag_index_prev].length = 0;
+                       this_fragmentation->fragment[frag_index_prev].flags = 0;
+
+                       if (end_frame && (!begin_frame)) return; // assembling frame failed

                }
                }

+       }

 
 

-               // return if a lost fragment is found
-               if (!(this_fragmentation->fragment[begin_index].length))
-                       return; // assembling frame failed
-               // get the end of his frame
-               while (this_fragmentation->fragment[end_index].length)
+find_frame:
+       begin_index = this_fragmentation->start_index;
+       uint32_t b_seq = this_fragmentation->start_seq;
+       // Try to find a Begin sequence from the start_seq sequence to M sequence
+       while (b_seq < Mmin)
+       {
+               if (this_fragmentation->fragment[begin_index].length)

                {
                {

-                       if (this_fragmentation->fragment[end_index].flags & MP_END)
-                               break;
-                       end_index = (end_index +1) & MAXFRAGNUM_MASK; 
+                       if (b_seq == this_fragmentation->fragment[begin_index].seq)
+                       {
+                               if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN)
+                               {
+                                       int isfoundE = 0;
+                                       // Adjust the new start sequence and start index
+                                       this_fragmentation->start_index = begin_index;
+                                       this_fragmentation->start_seq = b_seq;
+                                       // Begin Sequence found, now try to found the End Sequence to complete the frame
+                                       end_index = begin_index;
+                                       while (b_seq < Mmin)
+                                       {
+                                               if (this_fragmentation->fragment[end_index].length)
+                                               {
+                                                       if (b_seq == this_fragmentation->fragment[end_index].seq)
+                                                       {
+                                                               if (this_fragmentation->fragment[end_index].flags & MP_END)
+                                                               {
+                                                                       // The End sequence was found and the frame is complete
+                                                                       isfoundE = 1;
+                                                                       break;
+                                                               }
+                                                       }
+                                                       else
+                                                       {
+                                                               // This fragment is lost, it was never completed the packet.
+                                                               LOG(3, this_fragmentation->fragment[end_index].sid, this_fragmentation->fragment[end_index].tid,
+                                                                       "MPPP: (FIND END) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                                                                       this_fragmentation->fragment[end_index].seq, begin_index,
+                                                                       this_fragmentation->fragment[end_index].flags);
+                                                               // this frag is lost
+                                                               this_fragmentation->fragment[end_index].length = 0;
+                                                               this_fragmentation->fragment[end_index].flags = 0;
+                                                               // This frame is not complete find the next Begin
+                                                               break;
+                                                       }
+                                               }
+                                               else
+                                               {
+                                                       // This frame is not complete find the next Begin if exist
+                                                       break;
+                                               }
+                                               end_index = (end_index +1) & MAXFRAGNUM_MASK;
+                                               b_seq++;
+                                       }
+
+                                       if (isfoundE)
+                                               // The End sequence was found and the frame is complete
+                                               break;
+                                       else
+                                               // find the next Begin
+                                               begin_index = end_index;
+                               }
+                       }
+                       else
+                       {
+                               // This fragment is lost, it was never completed the packet.
+                               LOG(3, this_fragmentation->fragment[begin_index].sid, this_fragmentation->fragment[begin_index].tid,
+                                       "MPPP: (FIND BEGIN) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                                       this_fragmentation->fragment[begin_index].seq, begin_index,
+                                       this_fragmentation->fragment[begin_index].flags);
+                               // this frag is lost
+                               this_fragmentation->fragment[begin_index].length = 0;
+                               this_fragmentation->fragment[begin_index].flags = 0;
+                       }

                }
                }

+               begin_index = (begin_index +1) & MAXFRAGNUM_MASK;
+               b_seq++;
+       }

 
 

-               // return if a lost fragment is found
-               if (!(this_fragmentation->fragment[end_index].length))
+assembling_frame:
+       // try to assemble the frame that has the received fragment as a member
+       // get the beginning of this frame
+       begin_index = end_index = this_fragmentation->start_index;
+       if (this_fragmentation->fragment[begin_index].length)
+       {
+               if (!(this_fragmentation->fragment[begin_index].flags & MP_BEGIN))
+               {
+                       LOG(3, this_fragmentation->fragment[begin_index].sid, this_fragmentation->fragment[begin_index].tid,
+                               "MPPP: (NOT BEGIN) seq_num:%d frag_index:%d flags:%02X\n",
+                               this_fragmentation->fragment[begin_index].seq, begin_index,
+                               this_fragmentation->fragment[begin_index].flags);
+                       // should occur only after an "M_Offset out of range"
+                       // The start sequence must be a begin sequence
+                       this_fragmentation->start_index = (begin_index +1) & MAXFRAGNUM_MASK;
+                       this_fragmentation->start_seq++;

                        return; // assembling frame failed
                        return; // assembling frame failed

+               }
+       }
+       else
+               return; // assembling frame failed

 
 

-               // assemble the packet
-               //assemble frame, process it, reset fragmentation
-               uint16_t cur_len = 4;   // This is set to 4 to leave 4 bytes for function processipin
-               uint32_t i;
-
-                       LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
-                       // Push to the receive buffer
-                                       
-               for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
-                {
-                       this_frag = &this_fragmentation->fragment[i];
-                        if(cur_len + this_frag->length > MAXETHER)
-                        {
-                                LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");                            
-                                break;
-                        }
-                        memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
-                       LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
-                        cur_len += this_frag->length;
-                       if (i == end_index)
-                       {
-                               this_fragmentation->re_frame_len = cur_len;
-                               this_fragmentation->re_frame_begin_index = begin_index;
-                               this_fragmentation->re_frame_end_index = end_index;
-                               // Process the resassembled frame
-                               LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
-                               processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
-                               break;
-                       }
-                }
-                // Set reassembled frame length to zero after processing it
-                this_fragmentation->re_frame_len = 0;
-               for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
+       // get the end of his frame
+       while (this_fragmentation->fragment[end_index].length)
+       {
+               if (this_fragmentation->fragment[end_index].flags & MP_END)
+                       break;
+
+               end_index = (end_index +1) & MAXFRAGNUM_MASK;
+
+               if (end_index == this_fragmentation->start_index)
+                       return; // assembling frame failed
+       }
+
+       // return if a lost fragment is found
+       if (!(this_fragmentation->fragment[end_index].length))
+               return; // assembling frame failed
+
+       // assemble the packet
+       //assemble frame, process it, reset fragmentation
+       uint16_t cur_len = 4;   // This is set to 4 to leave 4 bytes for function processipin
+
+       LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
+       // Push to the receive buffer
+
+       for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
+       {
+               this_frag = &this_fragmentation->fragment[i];
+               if(cur_len + this_frag->length > MAXETHER)

                {
                {

-                       this_fragmentation->fragment[i].length = 0;      // Indicates that this fragment has been consumed
-                       this_fragmentation->fragment[i].flags = 0;
-                       if (i == end_index)
-                               break;
+                       LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");
+                       break;
+               }
+
+               memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
+               LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
+
+               cur_len += this_frag->length;
+               if (i == end_index)
+               {
+                       this_fragmentation->re_frame_len = cur_len;
+                       this_fragmentation->re_frame_begin_index = begin_index;
+                       this_fragmentation->re_frame_end_index = end_index;
+                       // Process the resassembled frame
+                       LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
+                       processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
+                       break;

                }
        }
                }
        }

-       //discard fragments received before the recently assembled frame
-       begin_index = this_fragmentation->start_index;
+
+       // Set reassembled frame length to zero after processing it
+       this_fragmentation->re_frame_len = 0;
+       for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
+       {
+               this_fragmentation->fragment[i].length = 0;      // Indicates that this fragment has been consumed
+               this_fragmentation->fragment[i].flags = 0;
+               if (i == end_index)
+                       break;
+       }
+
+       // Set the new start_index and start_seq

        this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
        this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;

-        this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
-       //clear length and flags of the discarded fragments
-       while (begin_index != this_fragmentation->start_index)
-        {
-                this_fragmentation->fragment[begin_index].flags = 0;
-               this_fragmentation->fragment[begin_index].length = 0;
-                begin_index = (begin_index + 1) & MAXFRAGNUM_MASK;
-        }
+       this_fragmentation->start_seq = this_fragmentation->fragment[end_index].seq + 1;
+       LOG(4, s, t, "MPPP after assembling: start index is = %d, start seq=%d\n", this_fragmentation->start_index, this_fragmentation->start_seq);
+
+       begin_index = this_fragmentation->start_index;
+       if ((this_fragmentation->fragment[begin_index].length) &&
+               (this_fragmentation->fragment[begin_index].seq != this_fragmentation->start_seq))
+       {
+               LOG(3, this_fragmentation->fragment[begin_index].sid, this_fragmentation->fragment[begin_index].tid,
+                               "MPPP: (START) seq_num:%d frag_index:%d flags:%02X is LOST\n",
+                               this_fragmentation->fragment[begin_index].seq, begin_index,
+                               this_fragmentation->fragment[begin_index].flags);
+                       this_fragmentation->fragment[begin_index].length = 0;
+                       this_fragmentation->fragment[begin_index].flags = 0;
+       }
+
+       if (this_fragmentation->start_seq <= Mmin)
+               // It's possible to find other complete frame or lost frame.
+               goto find_frame;
+       else if ((this_fragmentation->fragment[begin_index].length) &&
+                         (this_fragmentation->fragment[begin_index].flags & MP_BEGIN))
+               // may be that the next frame is completed
+               goto assembling_frame;

 
 

-       LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq);     

        return;
 }
 
        return;
 }
 


@@ -2020,7 +2244,7 @@ void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                return;
 
        // no spoof
                return;
 
        // no spoof

-       if (ipv4 != session[s].ip && memcmp(&config->ipv6_prefix, &ip, 8) && sessionbyipv6(ip) != s)
+       if ((ipv4 != session[s].ip || memcmp(&config->ipv6_prefix, &ip, 8)) && sessionbyipv6(ip) != s)

        {
                char str[INET6_ADDRSTRLEN];
                LOG(5, s, t, "Dropping packet with spoofed IP %s\n",
        {
                char str[INET6_ADDRSTRLEN];
                LOG(5, s, t, "Dropping packet with spoofed IP %s\n",


@@ -2302,6 +2526,11 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
        uint16_t type = mtype;
        uint8_t *start = b;
 
        uint16_t type = mtype;
        uint8_t *start = b;
 

+       if (t == TUNNEL_ID_PPPOE)
+       {
+               return pppoe_makeppp(b, size, p, l, s, t, mtype, prio, bid, mp_bits);
+       }
+

        if (size < 16) // Need more space than this!!
        {
                LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
        if (size < 16) // Need more space than this!!
        {
                LOG(0, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);


@@ -2371,7 +2600,7 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
 
        if ((b - start) + l > size)
        {
 
        if ((b - start) + l > size)
        {

-               LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, (b - start) + l);
+               LOG(2, s, t, "makeppp would overflow buffer (size=%d, header+payload=%td)\n", size, (b - start) + l);

                return NULL;
        }
 
                return NULL;
        }
 


@@ -2382,6 +2611,85 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
        return b;
 }
 
        return b;
 }
 

+// fill in a L2TP message with a PPP frame,
+// returns start of PPP frame
+//(note: THIS ROUTINE CAN WRITES TO p[-28]).
+uint8_t *opt_makeppp(uint8_t *p, int l, sessionidt s, tunnelidt t, uint16_t mtype, uint8_t prio, bundleidt bid, uint8_t mp_bits)
+{
+       uint16_t hdr = 0x0002; // L2TP with no options
+       uint16_t type = mtype;
+       uint8_t *b = p;
+
+       if (t == TUNNEL_ID_PPPOE)
+       {
+               return opt_pppoe_makeppp(p, l, s, t, mtype, prio, bid, mp_bits);
+       }
+
+       // Check whether this session is part of multilink
+       if (bid)
+       {
+               if (bundle[bid].num_of_links > 1)
+                       type = PPPMP; // Change PPP message type to the PPPMP
+               else
+                       bid = 0;
+       }
+
+       if (bid)
+       {
+               // Add the message type if this fragment has the begin bit set
+               if (mp_bits & MP_BEGIN)
+               {
+                       b -= 2;
+                       *(uint16_t *) b = htons(mtype); // Message type
+               }
+
+               // Set the sequence number and (B)egin (E)nd flags
+               if (session[s].mssf)
+               {
+                       // Set the multilink bits
+                       uint16_t bits_send = mp_bits;
+                       b -= 2;
+                       *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0x0FFF)|bits_send);
+               }
+               else
+               {
+                       b -= 4;
+                       *(uint32_t *) b = htonl(bundle[bid].seq_num_t);
+                       // Set the multilink bits
+                       *b = mp_bits;
+               }
+
+               bundle[bid].seq_num_t++;
+       }
+
+       if (type < 0x100 && session[s].flags & SESSION_PFC)
+       {
+               b--;
+               *b = type;
+       }
+       else
+       {
+               b -= 2;
+               *(uint16_t *) b = htons(type);
+       }
+
+       if (type == PPPLCP || !(session[s].flags & SESSION_ACFC))
+       {
+               b -= 2;
+               *(uint16_t *) b = htons(0xFF03); // HDLC header
+       }
+
+       if (prio) hdr |= 0x0100; // set priority bit
+       b -= 2;
+       *(uint16_t *) b = htons(session[s].far); // session
+       b -= 2;
+       *(uint16_t *) b = htons(tunnel[t].far); // tunnel
+       b -= 2;
+       *(uint16_t *) b = htons(hdr);
+
+       return b;
+}
+

 static int add_lcp_auth(uint8_t *b, int size, int authtype)
 {
        int len = 0;
 static int add_lcp_auth(uint8_t *b, int size, int authtype)
 {
        int len = 0;