X-Git-Url: http://git.sameswireless.fr/l2tpns.git/blobdiff_plain/90ebb19a3d853e3e261a839f52aa65e18c99527d..41de03f89f24afe1163012419f7e83beeed44a0a:/l2tpns.c diff --git a/l2tpns.c b/l2tpns.c index 262ae31..7d726cb 100644 --- a/l2tpns.c +++ b/l2tpns.c @@ -4,7 +4,7 @@ // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // vim: sw=8 ts=8 -char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.24 2004/08/26 06:22:37 fred_nerk Exp $"; +char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.28 2004/09/20 23:34:35 fred_nerk Exp $"; #include #include @@ -57,13 +57,13 @@ int snoopfd = -1; // UDP file handle for sending out intercept data int *radfds = NULL; // RADIUS requests file handles int ifrfd = -1; // File descriptor for routing, etc time_t basetime = 0; // base clock -char hostname[1000] = ""; // us. +char *hostname = NULL; // us. int tunidx; // ifr_ifindex of tun device u32 sessionid = 0; // session id for radius accounting int syslog_log = 0; // are we logging to syslog FILE *log_stream = NULL; // file handle for direct logging (i.e. direct into file, not via syslog). extern int cluster_sockfd; // Intra-cluster communications socket. -u32 last_sid = 0; // Last used PPP SID. Can I kill this?? -- mo +u32 last_id = 0; // Last used PPP SID. Can I kill this?? -- mo int clifd = 0; // Socket listening for CLI connections. struct cli_session_actions *cli_session_actions = NULL; // Pending session changes requested by CLI @@ -95,6 +95,7 @@ struct config_descriptt config_values[] = { CONFIG("debug", debug, INT), CONFIG("log_file", log_filename, STRING), CONFIG("pid_file", pid_file, STRING), + CONFIG("hostname", hostname, STRING), CONFIG("l2tp_secret", l2tpsecret, STRING), CONFIG("primary_dns", default_dns1, IP), CONFIG("secondary_dns", default_dns2, IP), @@ -169,6 +170,7 @@ void dump_state(); void tunnel_clean(); tunnelidt new_tunnel(); void update_config(); +int unhide_avp(u8 *avp, tunnelidt t, sessionidt s, u16 length); static void cache_ipmap(ipt ip, int s); static void uncache_ipmap(ipt ip); @@ -1452,6 +1454,13 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) continue; } log(4, ntohl(addr->sin_addr.s_addr), s, t, "Hidden AVP\n"); + // Unhide the AVP + n = unhide_avp(b, t, s, n); + if (n == 0) + { + fatal = flags; + continue; + } } if (*b & 0x3C) { @@ -1566,6 +1575,11 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) build_chap_response(b, 2, n, &chapresponse); } break; + case 13: // Response + // Why did they send a response? We never challenge. + log(2, ntohl(addr->sin_addr.s_addr), s, t, " received unexpected challenge response\n"); + break; + case 14: // assigned session asession = session[s].far = ntohs(*(u16 *) (b)); log(4, ntohl(addr->sin_addr.s_addr), s, t, " assigned session = %d\n", asession); @@ -1811,7 +1825,7 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) // TBA break; case 12: // ICCN - if ( amagic == 0) amagic = time_now; + if (amagic == 0) amagic = time_now; session[s].magic = amagic; // set magic number session[s].l2tp_flags = aflags; // set flags received log(3, ntohl(addr->sin_addr.s_addr), s, t, "Magic %X Flags %X\n", amagic, aflags); @@ -2448,75 +2462,71 @@ void mainloop(void) void initdata(void) { int i; + char *p; - _statistics = mmap(NULL, sizeof(struct Tstats), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (_statistics == MAP_FAILED) + if ((_statistics = shared_malloc(sizeof(struct Tstats))) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for _statistics: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for _statistics: %s\n", strerror(errno)); exit(1); } - config = mmap(NULL, sizeof(struct configt), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (config == MAP_FAILED) + if ((config = shared_malloc(sizeof(struct configt))) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for configuration: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for configuration: %s\n", strerror(errno)); exit(1); } memset(config, 0, sizeof(struct configt)); time(&config->start_time); strncpy(config->config_file, CONFIGFILE, sizeof(config->config_file) - 1); - tunnel = mmap(NULL, sizeof(tunnelt) * MAXTUNNEL, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (tunnel == MAP_FAILED) + if ((tunnel = shared_malloc(sizeof(tunnelt) * MAXTUNNEL)) == MAP_FAILED); { - log(0, 0, 0, 0, "Error doing mmap for tunnels: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for tunnels: %s\n", strerror(errno)); exit(1); } - session = mmap(NULL, sizeof(sessiont) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (session == MAP_FAILED) + if ((session = shared_malloc(sizeof(sessiont) * MAXSESSION)) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for sessions: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for sessions: %s\n", strerror(errno)); exit(1); } - sess_count = mmap(NULL, sizeof(sessioncountt) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (sess_count == MAP_FAILED) + if ((sess_count = shared_malloc(sizeof(sessioncountt) * MAXSESSION)) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for sessions_count: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for sessions_count: %s\n", strerror(errno)); exit(1); } - radius = mmap(NULL, sizeof(radiust) * MAXRADIUS, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (radius == MAP_FAILED) + if ((radius = shared_malloc(sizeof(radiust) * MAXRADIUS)) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for radius: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for radius: %s\n", strerror(errno)); exit(1); } - ip_address_pool = mmap(NULL, sizeof(ippoolt) * MAXIPPOOL, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (ip_address_pool == MAP_FAILED) + + if ((ip_address_pool = shared_malloc(sizeof(ippoolt) * MAXIPPOOL)) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for ip_address_pool: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for ip_address_pool: %s\n", strerror(errno)); exit(1); } + #ifdef RINGBUFFER - ringbuffer = mmap(NULL, sizeof(struct Tringbuffer), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (ringbuffer == MAP_FAILED) + if ((ringbuffer = shared_malloc(sizeof(struct Tringbuffer))) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for ringbuffer: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for ringbuffer: %s\n", strerror(errno)); exit(1); } memset(ringbuffer, 0, sizeof(struct Tringbuffer)); #endif - cli_session_actions = mmap(NULL, sizeof(struct cli_session_actions) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (cli_session_actions == MAP_FAILED) + if ((cli_session_actions = shared_malloc(sizeof(struct cli_session_actions) * MAXSESSION)) + == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for cli session actions: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for cli session actions: %s\n", strerror(errno)); exit(1); } memset(cli_session_actions, 0, sizeof(struct cli_session_actions) * MAXSESSION); - cli_tunnel_actions = mmap(NULL, sizeof(struct cli_tunnel_actions) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (cli_tunnel_actions == MAP_FAILED) + + if ((cli_tunnel_actions = shared_malloc(sizeof(struct cli_tunnel_actions) * MAXSESSION)) + == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for cli tunnel actions: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for cli tunnel actions: %s\n", strerror(errno)); exit(1); } memset(cli_tunnel_actions, 0, sizeof(struct cli_tunnel_actions) * MAXSESSION); @@ -2539,20 +2549,17 @@ void initdata(void) for (i = 1; i < MAXTUNNEL- 1; i++) tunnel[i].state = TUNNELUNDEF; // mark it as not filled in. - if (!*hostname) - { - char *p; - // Grab my hostname unless it's been specified - gethostname(hostname, sizeof(hostname)); - if ((p = strchr(hostname, '.'))) *p = 0; - } + // Grab my hostname unless it's been specified + gethostname(config->hostname, sizeof(config->hostname)); + if ((p = strchr(config->hostname, '.'))) *p = 0; + hostname = config->hostname; + _statistics->start_time = _statistics->last_reset = time(NULL); #ifdef BGP - bgp_peers = mmap(NULL, sizeof(struct bgp_peer) * BGP_NUM_PEERS, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (bgp_peers == MAP_FAILED) + if ((bgp_peers = shared_malloc(sizeof(struct bgp_peer) * BGP_NUM_PEERS)) == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for bgp: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing malloc for bgp: %s\n", strerror(errno)); exit(1); } #endif /* BGP */ @@ -2860,7 +2867,7 @@ void dump_acct_info() for (i = 0; i < MAXSESSION; i++) { - if (!session[i].opened || !session[i].ip || !session[i].cin || !session[i].cout || !*session[i].user || session[i].walled_garden) + if (!session[i].opened || !session[i].ip || (!session[i].cin && !session[i].cout) || !*session[i].user || session[i].walled_garden) continue; if (!f) { @@ -2950,7 +2957,7 @@ int main(int argc, char *argv[]) config->debug = optdebug; init_tbf(); - init_cli(hostname); + init_cli(); read_config_file(); log(0, 0, 0, 0, "L2TPNS version " VERSION "\n"); @@ -3567,12 +3574,12 @@ int sessionsetup(tunnelidt t, sessionidt s) for (r = 0; r < MAXROUTE && session[s].route[r].ip; r++) routeset(s, session[s].route[r].ip, session[s].route[r].mask, session[s].ip, 1); - if (!session[s].sid) + if (!session[s].unique_id) { // did this session just finish radius? log(3, session[s].ip, s, t, "Sending initial IPCP to client\n"); sendipcp(t, s); - session[s].sid = ++last_sid; + session[s].unique_id = ++last_id; } // Run the plugin's against this new session. @@ -4019,3 +4026,77 @@ int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc cli_print(cli, "%d total sessions open.", count); return CLI_OK; } + +/* Unhide an avp. + * + * This unencodes the AVP using the L2TP CHAP secret and the + * previously stored random vector. It replaces the hidden data with + * the cleartext data and returns the length of the cleartext data + * (including the AVP "header" of 6 bytes). + * + * Based on code from rp-l2tpd by Roaring Penguin Software Inc. + */ +int unhide_avp(u8 *avp, tunnelidt t, sessionidt s, u16 length) +{ + MD5_CTX ctx; + u8 *cursor; + u8 digest[16]; + u8 working_vector[16]; + uint16_t hidden_length; + u8 type[2]; + size_t done, todo; + u8 *output; + + // Find the AVP type. + type[0] = *(avp + 4); + type[1] = *(avp + 5); + + // Line up with the hidden data + cursor = output = avp + 6; + + // Compute initial pad + MD5Init(&ctx); + MD5Update(&ctx, type, 2); + MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret)); + MD5Update(&ctx, session[s].random_vector, session[s].random_vector_length); + MD5Final(digest, &ctx); + + // Get hidden length + hidden_length = ((uint16_t) (digest[0] ^ cursor[0])) * 256 + (uint16_t) (digest[1] ^ cursor[1]); + + // Keep these for later use + working_vector[0] = *cursor; + working_vector[1] = *(cursor + 1); + cursor += 2; + + if (hidden_length > length - 8) + { + log(1, 0, s, t, "Hidden length %d too long in AVP of length %d\n", (int) hidden_length, (int) length); + return 0; + } + + /* Decrypt remainder */ + done = 2; + todo = hidden_length; + while (todo) + { + working_vector[done] = *cursor; + *output = digest[done] ^ *cursor; + ++output; + ++cursor; + --todo; + ++done; + if (done == 16 && todo) + { + // Compute new digest + done = 0; + MD5Init(&ctx); + MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret)); + MD5Update(&ctx, &working_vector, 16); + MD5Final(digest, &ctx); + } + } + + return hidden_length + 6; +} +