X-Git-Url: http://git.sameswireless.fr/l2tpns.git/blobdiff_plain/983b38e12f2ba4afcb8046835f3e3c158b6435c3..4b0c9226f77ae52b70ee1ed676b6ef77e43d7c86:/l2tpns.c diff --git a/l2tpns.c b/l2tpns.c index fb02e1c..b988b78 100644 --- a/l2tpns.c +++ b/l2tpns.c @@ -4,7 +4,7 @@ // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // vim: sw=8 ts=8 -char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.84 2005-02-14 06:58:39 bodea Exp $"; +char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.86 2005-03-10 05:47:24 bodea Exp $"; #include #include @@ -187,7 +187,7 @@ static int remove_plugin(char *plugin_name); static void plugins_done(void); static void processcontrol(uint8_t *buf, int len, struct sockaddr_in *addr, int alen); static tunnelidt new_tunnel(void); -static int unhide_avp(uint8_t *avp, tunnelidt t, sessionidt s, uint16_t length); +static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len); // return internal time (10ths since process startup) static clockt now(void) @@ -1264,7 +1264,7 @@ static void control32(controlt * c, uint16_t avp, uint32_t val, uint8_t m) c->length += 10; } -// add an AVP (32 bit) +// add an AVP (string) static void controls(controlt * c, uint16_t avp, char *val, uint8_t m) { uint16_t l = ((m ? 0x8000 : 0) + strlen(val) + 6); @@ -1654,12 +1654,12 @@ static void tunnelkill(tunnelidt t, char *reason) // free tunnel tunnelclear(t); LOG(1, 0, t, "Kill tunnel %d: %s\n", t, reason); - cli_tunnel_actions[s].action = 0; + cli_tunnel_actions[t].action = 0; cluster_send_tunnel(t); } // shut down a tunnel cleanly -static void tunnelshutdown(tunnelidt t, char *reason) +static void tunnelshutdown(tunnelidt t, char *reason, int result, int error, char *msg) { sessionidt s; @@ -1682,11 +1682,32 @@ static void tunnelshutdown(tunnelidt t, char *reason) tunnel[t].die = TIME + 700; // Clean up in 70 seconds cluster_send_tunnel(t); // TBA - should we wait for sessions to stop? - { // Send StopCCN - controlt *c = controlnew(4); // sending StopCCN - control16(c, 1, 1, 1); // result code (admin reasons - TBA make error, general error, add message) - control16(c, 9, t, 1); // assigned tunnel (our end) - controladd(c, t, 0); // send the message + if (result) + { + controlt *c = controlnew(4); // sending StopCCN + if (error) + { + char buf[64]; + int l = 4; + *(uint16_t *) buf = htons(result); + *(uint16_t *) (buf+2) = htons(error); + if (msg) + { + int m = strlen(msg); + if (m + 4 > sizeof(buf)) + m = sizeof(buf) - 4; + + memcpy(buf+4, msg, m); + l += m; + } + + controlb(c, 1, buf, l, 1); + } + else + control16(c, 1, result, 1); + + control16(c, 9, t, 1); // assigned tunnel (our end) + controladd(c, t, 0); // send the message } } @@ -1761,7 +1782,7 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) { // control uint16_t message = 0xFFFF; // message type uint8_t fatal = 0; - uint8_t mandatorymessage = 0; + uint8_t mandatory = 0; uint8_t chap = 0; // if CHAP being used uint16_t asession = 0; // assigned session uint32_t amagic = 0; // magic number @@ -1777,7 +1798,10 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) return; } - if ((*buf & 0xCA) != 0xC8) + // control messages must have bits 0x80|0x40|0x08 + // (type, length and sequence) set, and bits 0x02|0x01 + // (offset and priority) clear + if ((*buf & 0xCB) != 0xC8) { LOG(1, s, t, "Bad control header %02X\n", *buf); STAT(tunnel_rx_errors); @@ -1887,71 +1911,111 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) } if (l) { // if not a null message + int result = 0; + int error = 0; + char *msg = 0; + // process AVPs - while (l && !(fatal & 0x80)) + while (l && !(fatal & 0x80)) // 0x80 = mandatory AVP { uint16_t n = (ntohs(*(uint16_t *) p) & 0x3FF); uint8_t *b = p; uint8_t flags = *p; uint16_t mtype; - p += n; // next - if (l < n) + if (n > l) { LOG(1, s, t, "Invalid length in AVP\n"); STAT(tunnel_rx_errors); - fatal = flags; return; } + p += n; // next l -= n; + if (flags & 0x3C) // reserved bits, should be clear + { + LOG(1, s, t, "Unrecognised AVP flags %02X\n", *b); + fatal = flags; + result = 2; // general error + error = 3; // reserved field non-zero + msg = 0; + continue; // next + } + b += 2; + if (*(uint16_t *) (b)) + { + LOG(2, s, t, "Unknown AVP vendor %d\n", ntohs(*(uint16_t *) (b))); + fatal = flags; + result = 2; // general error + error = 6; // generic vendor-specific error + msg = "unsupported vendor-specific"; + continue; // next + } + b += 2; + mtype = ntohs(*(uint16_t *) (b)); + b += 2; + n -= 6; + if (flags & 0x40) { + uint16_t orig_len; + // handle hidden AVPs if (!*config->l2tpsecret) { LOG(1, s, t, "Hidden AVP requested, but no L2TP secret.\n"); fatal = flags; + result = 2; // general error + error = 6; // generic vendor-specific error + msg = "secret not specified"; continue; } if (!session[s].random_vector_length) { LOG(1, s, t, "Hidden AVP requested, but no random vector.\n"); fatal = flags; + result = 2; // general error + error = 6; // generic + msg = "no random vector"; continue; } + if (n < 8) + { + LOG(2, s, t, "Short hidden AVP.\n"); + fatal = flags; + result = 2; // general error + error = 2; // length is wrong + msg = 0; + continue; + } + LOG(4, s, t, "Hidden AVP\n"); + // Unhide the AVP - n = unhide_avp(b, t, s, n); - if (n == 0) + unhide_value(b, n, mtype, session[s].random_vector, session[s].random_vector_length); + + orig_len = ntohs(*(uint16_t *) b); + if (orig_len > n + 2) { + LOG(1, s, t, "Original length %d too long in hidden AVP of length %d; wrong secret?\n", + orig_len, n); + fatal = flags; + result = 2; // general error + error = 2; // length is wrong + msg = 0; continue; } + + b += 2; + n = orig_len; } - if (*b & 0x3C) - { - LOG(1, s, t, "Unrecognised AVP flags %02X\n", *b); - fatal = flags; - continue; // next - } - b += 2; - if (*(uint16_t *) (b)) - { - LOG(2, s, t, "Unknown AVP vendor %d\n", ntohs(*(uint16_t *) (b))); - fatal = flags; - continue; // next - } - b += 2; - mtype = ntohs(*(uint16_t *) (b)); - b += 2; - n -= 6; LOG(4, s, t, " AVP %d (%s) len %d\n", mtype, avp_name(mtype), n); switch (mtype) { case 0: // message type message = ntohs(*(uint16_t *) b); + mandatory = flags & 0x80; LOG(4, s, t, " Message type = %d (%s)\n", *b, l2tp_message_type(message)); - mandatorymessage = flags; break; case 1: // result code { @@ -1986,6 +2050,9 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) { // allow 0.0 and 1.0 LOG(1, s, t, " Bad protocol version %04X\n", version); fatal = flags; + result = 5; // unspported protocol version + error = 0x0100; // supported version + msg = 0; continue; // next } } @@ -2162,14 +2229,20 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) session[s].random_vector_length = n; break; default: - LOG(2, s, t, " Unknown AVP type %d\n", mtype); - fatal = flags; - continue; // next + { + static char e[] = "unknown AVP 0xXXXX"; + LOG(2, s, t, " Unknown AVP type %d\n", mtype); + fatal = flags; + result = 2; // general error + error = 8; // unknown mandatory AVP + sprintf((msg = e) + 14, "%04x", mtype); + continue; // next + } } } // process message if (fatal & 0x80) - tunnelshutdown(t, "Unknown Mandatory AVP"); + tunnelshutdown(t, "Invalid mandatory AVP", result, error, msg); else switch (message) { @@ -2194,8 +2267,7 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) break; case 4: // StopCCN controlnull(t); // ack - tunnelshutdown(t, "Stopped"); // Shut down cleanly - tunnelkill(t, "Stopped"); // Immediately force everything dead + tunnelshutdown(t, "Stopped", 0, 0, 0); // Shut down cleanly break; case 6: // HELLO controlnull(t); // simply ACK @@ -2276,8 +2348,8 @@ void processudp(uint8_t * buf, int len, struct sockaddr_in *addr) break; default: STAT(tunnel_rx_errors); - if (mandatorymessage & 0x80) - tunnelshutdown(t, "Unknown message"); + if (mandatory) + tunnelshutdown(t, "Unknown message type", 2, 6, "unknown message type"); else LOG(1, s, t, "Unknown message type %d\n", message); break; @@ -2522,7 +2594,7 @@ static int regular_cleanups(void) if (a & CLI_TUN_KILL) { LOG(2, 0, t, "Dropping tunnel by CLI\n"); - tunnelshutdown(t, "Requested by administrator"); + tunnelshutdown(t, "Requested by administrator", 1, 0, 0); } } @@ -3755,7 +3827,7 @@ static void sigquit_handler(int sig) for (i = 1; i < MAXTUNNEL; i++) { if (tunnel[i].ip || tunnel[i].state) - tunnelshutdown(i, "L2TPNS Closing"); + tunnelshutdown(i, "L2TPNS Closing", 6, 0, 0); } } @@ -4727,75 +4799,45 @@ int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc /* Unhide an avp. * - * This unencodes the AVP using the L2TP CHAP secret and the - * previously stored random vector. It replaces the hidden data with - * the cleartext data and returns the length of the cleartext data - * (including the AVP "header" of 6 bytes). - * - * Based on code from rp-l2tpd by Roaring Penguin Software Inc. + * This unencodes the AVP using the L2TP secret and the previously + * stored random vector. It overwrites the hidden data with the + * unhidden AVP subformat. */ -static int unhide_avp(uint8_t *avp, tunnelidt t, sessionidt s, uint16_t length) +static void unhide_value(uint8_t *value, size_t len, uint16_t type, uint8_t *vector, size_t vec_len) { MD5_CTX ctx; - uint8_t *cursor; uint8_t digest[16]; - uint8_t working_vector[16]; - uint16_t hidden_length; - uint8_t type[2]; - size_t done, todo; - uint8_t *output; - - // Find the AVP type. - type[0] = *(avp + 4); - type[1] = *(avp + 5); - - // Line up with the hidden data - cursor = output = avp + 6; + uint8_t *last; + size_t d = 0; // Compute initial pad MD5Init(&ctx); - MD5Update(&ctx, type, 2); + MD5Update(&ctx, (uint8_t) (type >> 8) & 0xff, 1); + MD5Update(&ctx, (uint8_t) type & 0xff, 1); MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret)); - MD5Update(&ctx, session[s].random_vector, session[s].random_vector_length); + MD5Update(&ctx, vector, vec_len); MD5Final(digest, &ctx); - // Get hidden length - hidden_length = ((uint16_t) (digest[0] ^ cursor[0])) * 256 + (uint16_t) (digest[1] ^ cursor[1]); + // pointer to last decoded 16 octets + last = value; - // Keep these for later use - working_vector[0] = *cursor; - working_vector[1] = *(cursor + 1); - cursor += 2; - - if (hidden_length > length - 8) - { - LOG(1, s, t, "Hidden length %d too long in AVP of length %d\n", (int) hidden_length, (int) length); - return 0; - } - - /* Decrypt remainder */ - done = 2; - todo = hidden_length; - while (todo) + while (len > 0) { - working_vector[done] = *cursor; - *output = digest[done] ^ *cursor; - ++output; - ++cursor; - --todo; - ++done; - if (done == 16 && todo) + // calculate a new pad based on the last decoded block + if (d >= sizeof(digest)) { - // Compute new digest - done = 0; MD5Init(&ctx); MD5Update(&ctx, config->l2tpsecret, strlen(config->l2tpsecret)); - MD5Update(&ctx, &working_vector, 16); + MD5Update(&ctx, last, sizeof(digest)); MD5Final(digest, &ctx); + + d = 0; + last = value; } - } - return hidden_length + 6; + *value++ ^= digest[d++]; + len--; + } } static int ip_filter_port(ip_filter_portt *p, uint16_t port)