X-Git-Url: http://git.sameswireless.fr/l2tpns.git/blobdiff_plain/ed90ea49e025e0c8083f9d98768d870e6a880f13..4b259db0af5f85f423dd75292434bc65832078ea:/l2tpns.c?ds=sidebyside diff --git a/l2tpns.c b/l2tpns.c index abdfb9c..51aec99 100644 --- a/l2tpns.c +++ b/l2tpns.c @@ -1,8 +1,11 @@ // L2TP Network Server // Adrian Kennard 2002 -// (c) Copyrigth 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) +// Copyright (c) 2003, 2004 Optus Internet Engineering +// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // vim: sw=8 ts=8 +char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.15 2004/07/12 15:16:27 bodea Exp $"; + #include #include #include @@ -19,7 +22,6 @@ #include #include #include -#define __USE_GNU #include #include #include @@ -48,7 +50,7 @@ // Globals struct configt *config = NULL; // all configuration -int tapfd = -1; // tap interface file handle +int tunfd = -1; // tun interface file handle. (network device) int udpfd = -1; // UDP file handle int controlfd = -1; // Control signal handle int snoopfd = -1; // UDP file handle for sending out intercept data @@ -56,24 +58,25 @@ int *radfds = NULL; // RADIUS requests file handles int ifrfd = -1; // File descriptor for routing, etc time_t basetime = 0; // base clock char hostname[1000] = ""; // us. -u16 tapmac[3]; // MAC of tap interface -int tapidx; // ifr_ifindex of tap device +int tunidx; // ifr_ifindex of tun device u32 sessionid = 0; // session id for radius accounting int syslog_log = 0; // are we logging to syslog -FILE *log_stream = NULL; -struct sockaddr_in snoop_addr = {0}; -extern int cluster_sockfd; -u32 last_sid = 0; -int clifd = 0; -sessionidt *cli_session_kill = NULL; -tunnelidt *cli_tunnel_kill = NULL; -static void *ip_hash[256]; -u32 udp_tx = 0, udp_rx = 0, udp_rx_pkt = 0; +FILE *log_stream = NULL; // file handle for direct logging (i.e. direct into file, not via syslog). +extern int cluster_sockfd; // Intra-cluster communications socket. +u32 last_sid = 0; // Last used PPP SID. Can I kill this?? -- mo +int clifd = 0; // Socket listening for CLI connections. + +struct cli_session_actions *cli_session_actions = NULL; // Pending session changes requested by CLI +struct cli_tunnel_actions *cli_tunnel_actions = NULL; // Pending tunnel changes required by CLI + +static void *ip_hash[256]; // Mapping from IP address to session structures. + +u32 udp_tx = 0, udp_rx = 0, udp_rx_pkt = 0; // Global traffic counters. u32 eth_tx = 0, eth_rx = 0, eth_rx_pkt = 0; -u32 ip_pool_size = 1; -time_t time_now = 0; -char time_now_string[64] = {0}; -char main_quit = 0; +u32 ip_pool_size = 1; // Size of the pool of addresses used for dynamic address allocation. +time_t time_now = 0; // Current time in seconds since epoch. +char time_now_string[64] = {0}; // Current time as a string. +char main_quit = 0; // True if we're in the process of exiting. char *_program_name = NULL; linked_list *loaded_plugins; linked_list *plugins[MAX_PLUGIN_TYPES]; @@ -108,9 +111,12 @@ struct config_descriptt config_values[] = { CONFIG("cleanup_interval", cleanup_interval, INT), CONFIG("multi_read_count", multi_read_count, INT), CONFIG("scheduler_fifo", scheduler_fifo, BOOL), + CONFIG("lock_pages", lock_pages, BOOL), CONFIG("icmp_rate", icmp_rate, INT), CONFIG("cluster_address", cluster_address, IP), CONFIG("cluster_interface", cluster_interface, STRING), + CONFIG("cluster_hb_interval", cluster_hb_interval, INT), + CONFIG("cluster_hb_timeout", cluster_hb_timeout, INT), #ifdef BGP CONFIG("as_number", as_number, SHORT), CONFIG("bgp_peer1", bgp_peer[0], STRING), @@ -138,11 +144,11 @@ char *plugin_functions[] = { #define max_plugin_functions (sizeof(plugin_functions) / sizeof(char *)) -tunnelt *tunnel = NULL; // 1000 * 45 = 45000 = 45k -sessiont *session = NULL; // 5000 * 213 = 1065000 = 1 Mb -sessioncountt *sess_count = NULL; -radiust *radius = NULL; -ippoolt *ip_address_pool = NULL; +tunnelt *tunnel = NULL; // Array of tunnel structures. +sessiont *session = NULL; // Array of session structures. +sessioncountt *sess_count = NULL; // Array of partial per-session traffic counters. +radiust *radius = NULL; // Array of radius structures. +ippoolt *ip_address_pool = NULL; // Array of dynamic IP addresses. controlt *controlfree = 0; struct Tstats *_statistics = NULL; #ifdef RINGBUFFER @@ -164,7 +170,7 @@ void update_config(); static void cache_ipmap(ipt ip, int s); static void uncache_ipmap(ipt ip); -// return internal time (10ths since run) +// return internal time (10ths since process startup) clockt now(void) { struct timeval t; @@ -173,12 +179,18 @@ clockt now(void) } // work out a retry time based on try number +// This is a straight bounded exponential backoff. +// Maximum re-try time is 32 seconds. (2^5). clockt backoff(u8 try) { if (try > 5) try = 5; // max backoff return now() + 10 * (1 << try); } + +// +// Log a debug message. +// void _log(int level, ipt address, sessionidt s, tunnelidt t, const char *format, ...) { static char message[65536] = {0}; @@ -289,10 +301,10 @@ void routeset(sessionidt s, ipt ip, ipt mask, ipt gw, u8 add) if (!mask) mask = 0xffffffff; - ip = ip & mask; // Force the ip to be the first one in the route. + ip &= mask; // Force the ip to be the first one in the route. memset(&r, 0, sizeof(r)); - r.rt_dev = config->tapdevice; + r.rt_dev = config->tundevice; r.rt_dst.sa_family = AF_INET; *(u32 *) & (((struct sockaddr_in *) &r.rt_dst)->sin_addr.s_addr) = htonl(ip); r.rt_gateway.sa_family = AF_INET; @@ -304,8 +316,6 @@ void routeset(sessionidt s, ipt ip, ipt mask, ipt gw, u8 add) r.rt_flags |= RTF_GATEWAY; else if (mask == 0xffffffff) r.rt_flags |= RTF_HOST; - if (ioctl(ifrfd, add ? SIOCADDRT : SIOCDELRT, (void *) &r) < 0) - log(0, 0, 0, 0, "routeset() error in ioctl: %s\n", strerror(errno)); log(1, ip, 0, 0, "Route %s %u.%u.%u.%u/%u.%u.%u.%u %u.%u.%u.%u\n", add ? "add" : "del", @@ -313,6 +323,9 @@ void routeset(sessionidt s, ipt ip, ipt mask, ipt gw, u8 add) mask >> 24, mask >> 16 & 0xff, mask >> 8 & 0xff, mask & 0xff, gw >> 24, gw >> 16 & 0xff, gw >> 8 & 0xff, gw & 0xff); + if (ioctl(ifrfd, add ? SIOCADDRT : SIOCDELRT, (void *) &r) < 0) + log(0, 0, 0, 0, "routeset() error in ioctl: %s\n", strerror(errno)); + #ifdef BGP if (add) bgp_add_route(htonl(ip), htonl(mask)); @@ -338,31 +351,32 @@ void routeset(sessionidt s, ipt ip, ipt mask, ipt gw, u8 add) } } -// Set up TAP interface -void inittap(void) +// +// Set up TUN interface +void inittun(void) { struct ifreq ifr; struct sockaddr_in sin = {0}; memset(&ifr, 0, sizeof(ifr)); ifr.ifr_flags = IFF_TUN; - tapfd = open(TAPDEVICE, O_RDWR); - if (tapfd < 0) + tunfd = open(TUNDEVICE, O_RDWR); + if (tunfd < 0) { // fatal - log(0, 0, 0, 0, "Can't open %s: %s\n", TAPDEVICE, strerror(errno)); + log(0, 0, 0, 0, "Can't open %s: %s\n", TUNDEVICE, strerror(errno)); exit(1); } { - int flags = fcntl(tapfd, F_GETFL, 0); - fcntl(tapfd, F_SETFL, flags | O_NONBLOCK); + int flags = fcntl(tunfd, F_GETFL, 0); + fcntl(tunfd, F_SETFL, flags | O_NONBLOCK); } - if (ioctl(tapfd, TUNSETIFF, (void *) &ifr) < 0) + if (ioctl(tunfd, TUNSETIFF, (void *) &ifr) < 0) { - log(0, 0, 0, 0, "Can't set tap interface: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Can't set tun interface: %s\n", strerror(errno)); exit(1); } - assert(strlen(ifr.ifr_name) < sizeof(config->tapdevice)); - strncpy(config->tapdevice, ifr.ifr_name, sizeof(config->tapdevice) - 1); + assert(strlen(ifr.ifr_name) < sizeof(config->tundevice)); + strncpy(config->tundevice, ifr.ifr_name, sizeof(config->tundevice) - 1); ifrfd = socket(PF_INET, SOCK_DGRAM, IPPROTO_IP); sin.sin_family = AF_INET; @@ -387,18 +401,12 @@ void inittap(void) log(0, 0, 0, 0, "Error setting tun flags: %s\n", strerror(errno)); exit(1); } - if (ioctl(ifrfd, SIOCGIFHWADDR, (void *) &ifr) < 0) - { - log(0, 0, 0, 0, "Error setting tun hardware address: %s\n", strerror(errno)); - exit(1); - } - memcpy(&tapmac, 2 + (u8 *) & ifr.ifr_hwaddr, 6); if (ioctl(ifrfd, SIOCGIFINDEX, (void *) &ifr) < 0) { log(0, 0, 0, 0, "Error setting tun ifindex: %s\n", strerror(errno)); exit(1); } - tapidx = ifr.ifr_ifindex; + tunidx = ifr.ifr_ifindex; } // set up UDP port @@ -412,7 +420,7 @@ void initudp(void) addr.sin_family = AF_INET; addr.sin_port = htons(L2TPPORT); addr.sin_addr.s_addr = config->bind_address; - udpfd = socket(AF_INET, SOCK_DGRAM, UDP); + udpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); setsockopt(udpfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); { int flags = fcntl(udpfd, F_GETFL, 0); @@ -423,8 +431,7 @@ void initudp(void) log(0, 0, 0, 0, "Error in UDP bind: %s\n", strerror(errno)); exit(1); } - snoopfd = socket(AF_INET, SOCK_DGRAM, UDP); - snoop_addr.sin_family = AF_INET; + snoopfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); // Control memset(&addr, 0, sizeof(addr)); @@ -471,10 +478,8 @@ int lookup_ipmap(ipt ip) sessionidt sessionbyip(ipt ip) { int s = lookup_ipmap(ip); + CSTAT(call_sessionbyip); -#ifdef STAT_CALLS - STAT(call_sessionbyip); -#endif if (s > 0 && s < MAXSESSION && session[s].tunnel) return s; return 0; @@ -527,6 +532,9 @@ int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc) int i, j, k, l; int count = 0; + if (CLI_HELP_REQUESTED) + return CLI_HELP_NO_ARGS; + cli_print(cli, "%7s %s", "Sess#", "IP Address"); for (i = 0; i < 256; ++i) { @@ -560,9 +568,8 @@ int cmd_show_ipcache(struct cli_def *cli, char *command, char **argv, int argc) sessionidt sessionbyuser(char *username) { int s; -#ifdef STAT_CALLS - STAT(call_sessionbyuser); -#endif + CSTAT(call_sessionbyuser); + for (s = 1; s < MAXSESSION ; ++s) { if (session[s].walled_garden) continue; // Skip walled garden users. @@ -619,91 +626,13 @@ sessionidt sessionidtbysessiont(sessiont *s) return val; } -// Handle ARP requests -void processarp(u8 * buf, int len) -{ - ipt ip; - sessionidt s; - -#ifdef STAT_CALLS - STAT(call_processarp); -#endif - STAT(arp_recv); - if (len != 46) - { - log(0, 0, 0, 0, "Unexpected length ARP %d bytes\n", len); - STAT(arp_errors); - return; - } - if (*(u16 *) (buf + 16) != htons(PKTARP)) - { - log(0, 0, 0, 0, "Unexpected ARP type %04X\n", ntohs(*(u16 *) (buf + 16))); - STAT(arp_errors); - return; - } - if (*(u16 *) (buf + 18) != htons(0x0001)) - { - log(0, 0, 0, 0, "Unexpected ARP hard type %04X\n", ntohs(*(u16 *) (buf + 18))); - STAT(arp_errors); - return; - } - if (*(u16 *) (buf + 20) != htons(PKTIP)) - { - log(0, 0, 0, 0, "Unexpected ARP prot type %04X\n", ntohs(*(u16 *) (buf + 20))); - STAT(arp_errors); - return; - } - if (buf[22] != 6) - { - log(0, 0, 0, 0, "Unexpected ARP hard len %d\n", buf[22]); - STAT(arp_errors); - return; - } - if (buf[23] != 4) - { - log(0, 0, 0, 0, "Unexpected ARP prot len %d\n", buf[23]); - STAT(arp_errors); - return; - } - if (*(u16 *) (buf + 24) != htons(0x0001)) - { - log(0, 0, 0, 0, "Unexpected ARP op %04X\n", ntohs(*(u16 *) (buf + 24))); - STAT(arp_errors); - return; - } - ip = *(u32 *) (buf + 42); - // look up session - s = sessionbyip(ip); - if (s) - { - log(3, ntohl(ip), s, session[s].tunnel, "ARP reply for %s\n", inet_toa(ip)); - memcpy(buf + 4, buf + 10, 6); // set destination as source - *(u16 *) (buf + 10) = htons(tapmac[0]); // set source address - *(u16 *) (buf + 12) = htons(tapmac[1]); - *(u16 *) (buf + 14) = htons(tapmac[2]); - *(u16 *) (buf + 24) = htons(0x0002); // ARP reply - memcpy(buf + 26, buf + 10, 6); // sender ethernet - memcpy(buf + 36, buf + 4, 6); // target ethernet - *(u32 *) (buf + 42) = *(u32 *) (buf + 32); // target IP - *(u32 *) (buf + 32) = ip; // sender IP - write(tapfd, buf, len); - STAT(arp_replies); - } - else - { - log(3, ntohl(ip), 0, 0, "ARP request for unknown IP %s\n", inet_toa(ip)); - STAT(arp_discarded); - } -} - // actually send a control message for a specific tunnel void tunnelsend(u8 * buf, u16 l, tunnelidt t) { struct sockaddr_in addr; -#ifdef STAT_CALLS - STAT(call_tunnelsend); -#endif + CSTAT(call_tunnelsend); + if (!t) { static int backtrace_count = 0; @@ -760,7 +689,7 @@ void tunnelsend(u8 * buf, u16 l, tunnelidt t) // int tun_write(u8 * data, int size) { - return write(tapfd, data, size); + return write(tunfd, data, size); } // process outgoing (to tunnel) IP @@ -776,9 +705,9 @@ void processipout(u8 * buf, int len) int size = len; u8 b[MAXETHER + 20]; -#ifdef STAT_CALLS - STAT(call_processipout); -#endif + + CSTAT(call_processipout); + if (len < MIN_IP_SIZE) { log(1, 0, 0, 0, "Short IP, %d bytes\n", len); @@ -894,7 +823,7 @@ void send_ipout(sessionidt s, u8 *buf, int len) log(5, session[s].ip, s, t, "Ethernet -> Tunnel (%d bytes)\n", len); - // Snooping this session, send it to ASIO + // Snooping this session. if (sp->snoop_ip && sp->snoop_port) snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port); @@ -1078,16 +1007,16 @@ void sessionshutdown(sessionidt s, char *reason) int dead = session[s].die; int walled_garden = session[s].walled_garden; -#ifdef STAT_CALLS - STAT(call_sessionshutdown); -#endif + + CSTAT(call_sessionshutdown); + if (!session[s].tunnel) { log(3, session[s].ip, s, session[s].tunnel, "Called sessionshutdown on a session with no tunnel.\n"); return; // not a live session } - if (!session[s].die) + if (!dead) log(2, 0, s, session[s].tunnel, "Shutting down session %d: %s\n", s, reason); session[s].die = now() + 150; // Clean up in 15 seconds @@ -1152,19 +1081,22 @@ void sendipcp(tunnelidt t, sessionidt s) u8 buf[MAXCONTROL]; u16 r = session[s].radius; u8 *q; -#ifdef STAT_CALLS - STAT(call_sendipcp); -#endif + + CSTAT(call_sendipcp); + if (!r) r = radiusnew(s); + if (radius[r].state != RADIUSIPCP) { radius[r].state = RADIUSIPCP; radius[r].try = 0; } + radius[r].retry = backoff(radius[r].try++); if (radius[r].try > 10) { + radiusclear(r, s); // Clear radius session. sessionshutdown(s, "No reply on IPCP"); return; } @@ -1188,12 +1120,14 @@ void sendipcp(tunnelidt t, sessionidt s) // kill a session now void sessionkill(sessionidt s, char *reason) { -#ifdef STAT_CALLS - STAT(call_sessionkill); -#endif + + CSTAT(call_sessionkill); + + session[s].die = now(); sessionshutdown(s, reason); // close radius/routes, etc. if (session[s].radius) - radiusclear(session[s].radius, 0); // cant send clean accounting data, session is killed + radiusclear(session[s].radius, s); // cant send clean accounting data, session is killed + log(2, 0, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason); throttle_session(s, 0); // Force session to be un-throttle. Free'ing TBF structures. @@ -1202,6 +1136,7 @@ void sessionkill(sessionidt s, char *reason) session[s].tunnel = T_FREE; // Mark it as free. session[s].next = sessionfree; sessionfree = s; + cli_session_actions[s].action = 0; cluster_send_session(s); } @@ -1210,9 +1145,8 @@ void tunnelkill(tunnelidt t, char *reason) { sessionidt s; controlt *c; -#ifdef STAT_CALLS - STAT(call_tunnelkill); -#endif + + CSTAT(call_tunnelkill); tunnel[t].state = TUNNELDIE; @@ -1232,19 +1166,18 @@ void tunnelkill(tunnelidt t, char *reason) // free tunnel tunnelclear(t); - cluster_send_tunnel(t); log(1, 0, 0, t, "Kill tunnel %d: %s\n", t, reason); - tunnel[t].die = 0; - tunnel[t].state = TUNNELFREE; + cli_tunnel_actions[s].action = 0; + cluster_send_tunnel(t); } // shut down a tunnel cleanly void tunnelshutdown(tunnelidt t, char *reason) { sessionidt s; -#ifdef STAT_CALLS - STAT(call_tunnelshutdown); -#endif + + CSTAT(call_tunnelshutdown); + if (!tunnel[t].last || !tunnel[t].far || tunnel[t].state == TUNNELFREE) { // never set up, can immediately kill @@ -1277,9 +1210,9 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) u16 l = len, t = 0, s = 0, ns = 0, nr = 0; u8 *p = buf + 2; -#ifdef STAT_CALLS - STAT(call_processudp); -#endif + + CSTAT(call_processudp); + udp_rx += len; udp_rx_pkt++; log_hex(5, "UDP Data", buf, len); @@ -1373,9 +1306,9 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) // Is this a duplicate of the first packet? (SCCRQ) // for ( i = 1; i <= config->cluster_highest_tunnelid ; ++i) { - if (tunnel[t].state != TUNNELOPENING || - tunnel[t].ip != ntohl(*(ipt *) & addr->sin_addr) || - tunnel[t].port != ntohs(addr->sin_port) ) + if (tunnel[i].state != TUNNELOPENING || + tunnel[i].ip != ntohl(*(ipt *) & addr->sin_addr) || + tunnel[i].port != ntohs(addr->sin_port) ) continue; t = i; break; @@ -1539,13 +1472,10 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) log(4, ntohl(addr->sin_addr.s_addr), s, t, " Error Code %d: %s\n", errcode, errdesc); } - if (n > 4) { - /* %*s doesn't work?? */ - char *buf = (char *)strndup(b+4, n-4); - log(4, ntohl(addr->sin_addr.s_addr), s, t, " Error String: %s\n", - buf); - free(buf); - } + if (n > 4) + log(4, ntohl(addr->sin_addr.s_addr), s, t, " Error String: %.*s\n", + n-4, b+4); + break; } break; @@ -1582,8 +1512,8 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) // TBA - to send to RADIUS break; case 8: // vendor name - memset(tunnel[t].vendor, 0, 128); - memcpy(tunnel[t].vendor, b, (n >= 127) ? 127 : n); + memset(tunnel[t].vendor, 0, sizeof(tunnel[t].vendor)); + memcpy(tunnel[t].vendor, b, (n >= sizeof(tunnel[t].vendor) - 1) ? sizeof(tunnel[t].vendor) - 1 : n); log(4, ntohl(addr->sin_addr.s_addr), s, t, " Vendor name = \"%s\"\n", tunnel[t].vendor); break; case 9: // assigned tunnel @@ -1816,7 +1746,7 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) if (!(r = radiusnew(s))) { log(1, ntohl(addr->sin_addr.s_addr), s, t, "No free RADIUS sessions for ICRQ\n"); -// sessionkill(s, "no free RADIUS sesions"); + sessionkill(s, "no free RADIUS sesions"); return; } @@ -1990,26 +1920,25 @@ void processudp(u8 * buf, int len, struct sockaddr_in *addr) } } -// read and process packet on tap -void processtap(u8 * buf, int len) +// read and process packet on tun +void processtun(u8 * buf, int len) { - log_hex(5, "Receive TAP Data", buf, len); - STAT(tap_rx_packets); - INC_STAT(tap_rx_bytes, len); -#ifdef STAT_CALLS - STAT(call_processtap); -#endif + log_hex(5, "Receive TUN Data", buf, len); + STAT(tun_rx_packets); + INC_STAT(tun_rx_bytes, len); + + CSTAT(call_processtun); + eth_rx_pkt++; eth_rx += len; if (len < 22) { - log(1, 0, 0, 0, "Short tap packet %d bytes\n", len); - STAT(tap_rx_errors); + log(1, 0, 0, 0, "Short tun packet %d bytes\n", len); + STAT(tun_rx_errors); return; } - if (*(u16 *) (buf + 2) == htons(PKTARP)) // ARP - processarp(buf, len); - else if (*(u16 *) (buf + 2) == htons(PKTIP)) // IP + + if (*(u16 *) (buf + 2) == htons(PKTIP)) // IP processipout(buf, len); // Else discard. } @@ -2027,6 +1956,7 @@ int regular_cleanups(void) int count=0,i; u16 r; static clockt next_acct = 0; + int a; log(3, 0, 0, 0, "Begin regular cleanup\n"); @@ -2036,15 +1966,15 @@ int regular_cleanups(void) continue; if (radius[r].retry) { - if (radius[r].retry <= config->current_time) + if (radius[r].retry <= TIME) radiusretry(r); } else radius[r].retry = backoff(radius[r].try+1); // Is this really needed? --mo } - for (t = 1; t < config->cluster_highest_tunnelid; t++) + for (t = 1; t <= config->cluster_highest_tunnelid; t++) { // check for expired tunnels - if (tunnel[t].die && tunnel[t].die <= config->current_time) + if (tunnel[t].die && tunnel[t].die <= TIME) { STAT(tunnel_timeout); tunnelkill(t, "Expired"); @@ -2054,7 +1984,7 @@ int regular_cleanups(void) if (tunnel[t].retry && tunnel[t].controlc) { // resend pending messages as timeout on reply - if (tunnel[t].retry <= config->current_time) + if (tunnel[t].retry <= TIME) { controlt *c = tunnel[t].controls; u8 w = tunnel[t].window; @@ -2070,43 +2000,31 @@ int regular_cleanups(void) } } // Send hello - if (tunnel[t].state == TUNNELOPEN && tunnel[t].lastrec < config->current_time + 600) + if (tunnel[t].state == TUNNELOPEN && tunnel[t].lastrec < TIME + 600) { controlt *c = controlnew(6); // sending HELLO controladd(c, t, 0); // send the message log(3, tunnel[t].ip, 0, t, "Sending HELLO message\n"); } - } - // Check for sessions that have been killed from the CLI - if (cli_session_kill[0]) - { - int i; - for (i = 0; i < MAXSESSION && cli_session_kill[i]; i++) + // Check for tunnel changes requested from the CLI + if ((a = cli_tunnel_actions[t].action)) { - log(2, 0, cli_session_kill[i], 0, "Dropping session by CLI\n"); - sessionshutdown(cli_session_kill[i], "Requested by administrator"); - cli_session_kill[i] = 0; - } - } - // Check for tunnels that have been killed from the CLI - if (cli_tunnel_kill[0]) - { - int i; - for (i = 1; i < MAXTUNNEL && cli_tunnel_kill[i]; i++) - { - log(2, 0, cli_tunnel_kill[i], 0, "Dropping tunnel by CLI\n"); - tunnelshutdown(cli_tunnel_kill[i], "Requested by administrator"); - cli_tunnel_kill[i] = 0; + cli_tunnel_actions[t].action = 0; + if (a & CLI_TUN_KILL) + { + log(2, tunnel[t].ip, 0, t, "Dropping tunnel by CLI\n"); + tunnelshutdown(t, "Requested by administrator"); + } } + } count = 0; - for (i = 1; i < config->cluster_highest_sessionid; i++) + for (i = 1; i <= config->cluster_highest_sessionid; i++) { - s++; - if (s >= config->cluster_highest_sessionid) + if (s > config->cluster_highest_sessionid) s = 1; if (!session[s].tunnel) // Session isn't in use @@ -2120,7 +2038,7 @@ int regular_cleanups(void) } // check for expired sessions - if (session[s].die && session[s].die <= config->current_time) + if (session[s].die && session[s].die <= TIME) { sessionkill(s, "Expired"); if (++count >= MAX_ACTIONS) break; @@ -2158,11 +2076,64 @@ int regular_cleanups(void) if (++count >= MAX_ACTIONS) break; continue; } + + // Check for actions requested from the CLI + if ((a = cli_session_actions[s].action)) + { + int send = 0; + + cli_session_actions[s].action = 0; + if (a & CLI_SESS_KILL) + { + log(2, 0, s, session[s].tunnel, "Dropping session by CLI\n"); + sessionshutdown(s, "Requested by administrator"); + a = 0; // dead, no need to check for other actions + } + + if (a & CLI_SESS_SNOOP) + { + log(2, 0, s, session[s].tunnel, "Snooping session by CLI (to %s:%d)\n", + inet_toa(cli_session_actions[s].snoop_ip), cli_session_actions[s].snoop_port); + + session[s].snoop_ip = cli_session_actions[s].snoop_ip; + session[s].snoop_port = cli_session_actions[s].snoop_port; + send++; + } + + if (a & CLI_SESS_NOSNOOP) + { + log(2, 0, s, session[s].tunnel, "Unsnooping session by CLI\n"); + session[s].snoop_ip = 0; + session[s].snoop_port = 0; + send++; + } + + if (a & CLI_SESS_THROTTLE) + { + log(2, 0, s, session[s].tunnel, "Throttling session by CLI (to %d)\n", + cli_session_actions[s].throttle); + + throttle_session(s, cli_session_actions[s].throttle); + } + + if (a & CLI_SESS_NOTHROTTLE) + { + log(2, 0, s, session[s].tunnel, "Un-throttling session by CLI\n"); + throttle_session(s, 0); + } + + if (send) + cluster_send_session(s); + + if (++count >= MAX_ACTIONS) break; + continue; + } } - if (config->accounting_dir && next_acct <= config->current_time) + + if (config->accounting_dir && next_acct <= TIME) { // Dump accounting data - next_acct = config->current_time + ACCT_TIME; + next_acct = TIME + ACCT_TIME; dump_acct_info(); } @@ -2186,9 +2157,9 @@ int still_busy(void) if (!tunnel[i].controlc) continue; - if (last_talked != config->current_time) { - log(2,0,0,0, "Tunnel %d still has an-acked control messages.\n", i); - last_talked = config->current_time; + if (last_talked != TIME) { + log(2,0,0,0, "Tunnel %d still has un-acked control messages.\n", i); + last_talked = TIME; } return 1; } @@ -2200,9 +2171,9 @@ int still_busy(void) if (radius[i].state == RADIUSWAIT) continue; - if (last_talked != config->current_time) { + if (last_talked != TIME) { log(2,0,0,0, "Radius session %d is still busy (sid %d)\n", i, radius[i].session); - last_talked = config->current_time; + last_talked = TIME; } return 1; } @@ -2210,27 +2181,27 @@ int still_busy(void) return 0; } -// main loop - gets packets on tap or udp and processes them +// main loop - gets packets on tun or udp and processes them void mainloop(void) { fd_set cr; int cn, i; u8 buf[65536]; struct timeval to; - time_t next_cluster_ping = 0; // default 1 second pings. - clockt next_clean = time_now + config->cleanup_interval; + clockt next_cluster_ping = 0; // send initial ping immediately + time_t next_clean = time_now + config->cleanup_interval; - log(4, 0, 0, 0, "Beginning of main loop. udpfd=%d, tapfd=%d, cluster_sockfd=%d, controlfd=%d\n", - udpfd, tapfd, cluster_sockfd, controlfd); + log(4, 0, 0, 0, "Beginning of main loop. udpfd=%d, tunfd=%d, cluster_sockfd=%d, controlfd=%d\n", + udpfd, tunfd, cluster_sockfd, controlfd); FD_ZERO(&cr); FD_SET(udpfd, &cr); - FD_SET(tapfd, &cr); + FD_SET(tunfd, &cr); FD_SET(controlfd, &cr); FD_SET(clifd, &cr); if (cluster_sockfd) FD_SET(cluster_sockfd, &cr); cn = udpfd; - if (cn < tapfd) cn = tapfd; + if (cn < tunfd) cn = tunfd; if (cn < controlfd) cn = controlfd; if (cn < clifd) cn = clifd; if (cn < cluster_sockfd) cn = cluster_sockfd; @@ -2286,7 +2257,7 @@ void mainloop(void) n = select(n + 1, &r, 0, 0, &to); #endif /* BGP */ - config->current_time = now(); + TIME = now(); if (n < 0) { if (errno == EINTR) @@ -2311,13 +2282,13 @@ void mainloop(void) break; } } - if (FD_ISSET(tapfd, &r)) + if (FD_ISSET(tunfd, &r)) { int c, n; for (c = 0; c < config->multi_read_count; c++) { - if ((n = read(tapfd, buf, sizeof(buf))) > 0) - processtap(buf, n); + if ((n = read(tunfd, buf, sizeof(buf))) > 0) + processtun(buf, n); else break; } @@ -2352,16 +2323,22 @@ void mainloop(void) } // Runs on every machine (master and slaves). - if (cluster_sockfd && next_cluster_ping <= time_now) + if (cluster_sockfd && next_cluster_ping <= TIME) { // Check to see which of the cluster is still alive.. - next_cluster_ping = time_now + 1; - cluster_send_ping(basetime); - cluster_check_master(); + cluster_send_ping(basetime); // Only does anything if we're a slave + cluster_check_master(); // ditto. + + cluster_heartbeat(); // Only does anything if we're a master. + cluster_check_slaves(); // ditto. - cluster_heartbeat(config->cluster_highest_sessionid, sessionfree, config->cluster_highest_tunnelid); // Only does anything if we're a master. master_update_counts(); // If we're a slave, send our byte counters to our master. + + if (config->cluster_iam_master && !config->cluster_iam_uptodate) + next_cluster_ping = TIME + 1; // out-of-date slaves, do fast updates + else + next_cluster_ping = TIME + config->cluster_hb_interval; } // Run token bucket filtering queue.. @@ -2369,8 +2346,8 @@ void mainloop(void) // Runs on all machines both master and slave. { static clockt last_run = 0; - if (last_run != config->current_time) { - last_run = config->current_time; + if (last_run != TIME) { + last_run = TIME; tbf_run_timer(); } } @@ -2398,11 +2375,8 @@ void mainloop(void) } // Are we the master and shutting down?? - if (config->cluster_iam_master) { - - cluster_heartbeat(config->cluster_highest_sessionid, sessionfree, - config->cluster_highest_tunnelid); // Flush any queued changes.. - } + if (config->cluster_iam_master) + cluster_heartbeat(); // Flush any queued changes.. // Ok. Notify everyone we're shutting down. If we're // the master, this will force an election. @@ -2461,33 +2435,33 @@ void initdata(void) ip_address_pool = mmap(NULL, sizeof(ippoolt) * MAXIPPOOL, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); if (ip_address_pool == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for radius: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing mmap for ip_address_pool: %s\n", strerror(errno)); exit(1); } #ifdef RINGBUFFER ringbuffer = mmap(NULL, sizeof(struct Tringbuffer), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); if (ringbuffer == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for radius: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing mmap for ringbuffer: %s\n", strerror(errno)); exit(1); } memset(ringbuffer, 0, sizeof(struct Tringbuffer)); #endif - cli_session_kill = mmap(NULL, sizeof(sessionidt) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (cli_session_kill == MAP_FAILED) + cli_session_actions = mmap(NULL, sizeof(struct cli_session_actions) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); + if (cli_session_actions == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for cli session kill: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing mmap for cli session actions: %s\n", strerror(errno)); exit(1); } - memset(cli_session_kill, 0, sizeof(sessionidt) * MAXSESSION); - cli_tunnel_kill = mmap(NULL, sizeof(tunnelidt) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); - if (cli_tunnel_kill == MAP_FAILED) + memset(cli_session_actions, 0, sizeof(struct cli_session_actions) * MAXSESSION); + cli_tunnel_actions = mmap(NULL, sizeof(struct cli_tunnel_actions) * MAXSESSION, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, 0, 0); + if (cli_tunnel_actions == MAP_FAILED) { - log(0, 0, 0, 0, "Error doing mmap for cli tunnel kill: %s\n", strerror(errno)); + log(0, 0, 0, 0, "Error doing mmap for cli tunnel actions: %s\n", strerror(errno)); exit(1); } - memset(cli_tunnel_kill, 0, sizeof(tunnelidt) * MAXSESSION); + memset(cli_tunnel_actions, 0, sizeof(struct cli_tunnel_actions) * MAXSESSION); memset(tunnel, 0, sizeof(tunnelt) * MAXTUNNEL); memset(session, 0, sizeof(sessiont) * MAXSESSION); @@ -2509,8 +2483,10 @@ void initdata(void) if (!*hostname) { + char *p; // Grab my hostname unless it's been specified gethostname(hostname, sizeof(hostname)); + if ((p = strchr(hostname, '.'))) *p = 0; } _statistics->start_time = _statistics->last_reset = time(NULL); @@ -2536,13 +2512,13 @@ int assign_ip_address(sessionidt s) { u32 i; int best = -1; - clockt best_time = time_now; + time_t best_time = time_now; char *u = session[s].user; char reuse = 0; -#ifdef STAT_CALLS - STAT(call_assign_ip_address); -#endif + + CSTAT(call_assign_ip_address); + for (i = 1; i < ip_pool_size; i++) { if (!ip_address_pool[i].address || ip_address_pool[i].assigned) @@ -2606,9 +2582,9 @@ void free_ip_address(sessionidt s) ip_address_pool[i].session = 0; ip_address_pool[i].last = time_now; -#ifdef STAT_CALLS - STAT(call_free_ip_address); -#endif + + CSTAT(call_free_ip_address); + } // @@ -2644,7 +2620,7 @@ void rebuild_address_pool(void) if (ipid < 1) // Not found in the pool either? good. continue; - log(0, 0, i, 0, "Session %d has an IP address (%s) that was marked static, but is in the pool (%d)!", + log(0, 0, i, 0, "Session %d has an IP address (%s) that was marked static, but is in the pool (%d)!\n", i, inet_toa(session[i].ip), ipid); // Fall through and process it as part of the pool. @@ -2747,7 +2723,7 @@ void initippool() src = inet_addr(buf); if (src == INADDR_NONE) { - log(0, 0, 0, 0, "Invalid address pool IP %s", buf); + log(0, 0, 0, 0, "Invalid address pool IP %s\n", buf); exit(1); } // This entry is for a specific IP only @@ -2790,9 +2766,11 @@ void initippool() void snoop_send_packet(char *packet, u16 size, ipt destination, u16 port) { + struct sockaddr_in snoop_addr = {0}; if (!destination || !port || snoopfd <= 0 || size <= 0 || !packet) return; + snoop_addr.sin_family = AF_INET; snoop_addr.sin_addr.s_addr = destination; snoop_addr.sin_port = ntohs(port); @@ -2811,9 +2789,9 @@ void dump_acct_info() int i; FILE *f = NULL; -#ifdef STAT_CALLS - STAT(call_dump_acct_info); -#endif + + CSTAT(call_dump_acct_info); + strftime(timestr, 64, "%Y%m%d%H%M%S", localtime(&t)); snprintf(filename, 1024, "%s/%s", config->accounting_dir, timestr); @@ -2859,6 +2837,7 @@ void dump_acct_info() int main(int argc, char *argv[]) { int o; + int optdebug = 0; _program_name = strdup(argv[0]); @@ -2875,10 +2854,10 @@ int main(int argc, char *argv[]) if (fork()) exit(0); break; case 'v': - config->debug++; + optdebug++; break; case 'h': - strncpy(hostname, optarg, 999); + snprintf(hostname, sizeof(hostname), "%s", optarg); break; case '?': default: @@ -2896,20 +2875,23 @@ int main(int argc, char *argv[]) // Start the timer routine off time(&time_now); - strftime(time_now_string, 64, "%Y-%m-%d %H:%M:%S", localtime(&time_now)); + strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now)); signal(SIGALRM, sigalrm_handler); siginterrupt(SIGALRM, 0); initiptables(); initplugins(); initdata(); + + config->debug = optdebug; + init_tbf(); - init_cli(); + init_cli(hostname); read_config_file(); - log(0, 0, 0, 0, "$Id: l2tpns.c,v 1.8 2004/06/23 03:52:24 fred_nerk Exp $\n" - "(c) Copyright 2003, 2004 Optus Internet Engineering\n" - "(c) Copyright 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n"); + log(0, 0, 0, 0, "L2TPNS version " VERSION "\n"); + log(0, 0, 0, 0, "Copyright (c) 2003, 2004 Optus Internet Engineering\n"); + log(0, 0, 0, 0, "Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced\n"); { struct rlimit rlim; rlim.rlim_cur = RLIM_INFINITY; @@ -2963,8 +2945,8 @@ int main(int argc, char *argv[]) config->bgp_peer_as[1], 0); #endif /* BGP */ - inittap(); - log(1, 0, 0, 0, "Set up on interface %s\n", config->tapdevice); + inittun(); + log(1, 0, 0, 0, "Set up on interface %s\n", config->tundevice); initudp(); initrad(); @@ -2978,6 +2960,15 @@ int main(int argc, char *argv[]) signal(SIGQUIT, sigquit_handler); signal(SIGCHLD, sigchild_handler); + // Prevent us from getting paged out + if (config->lock_pages) + { + if (!mlockall(MCL_CURRENT)) + log(1, 0, 0, 0, "Locking pages into memory\n"); + else + log(0, 0, 0, 0, "Can't lock pages: %s\n", strerror(errno)); + } + alarm(1); // Drop privileges here @@ -3039,7 +3030,7 @@ void sigalrm_handler(int junk) // Update the internal time counter time(&time_now); - strftime(time_now_string, 64, "%Y-%m-%d %H:%M:%S", localtime(&time_now)); + strftime(time_now_string, sizeof(time_now_string), "%Y-%m-%d %H:%M:%S", localtime(&time_now)); alarm(1); { @@ -3288,6 +3279,8 @@ static int facility_value(char *name) void update_config() { int i; + static int timeout = 0; + static int interval = 0; // Update logging closelog(); @@ -3359,11 +3352,37 @@ void update_config() } memcpy(config->old_plugins, config->plugins, sizeof(config->plugins)); if (!config->cleanup_interval) config->cleanup_interval = 10; - if (!config->multi_read_count) config->multi_read_count = 1; + if (!config->multi_read_count) config->multi_read_count = 10; if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR); if (!*config->cluster_interface) strncpy(config->cluster_interface, DEFAULT_MCAST_INTERFACE, sizeof(config->cluster_interface) - 1); + if (!config->cluster_hb_interval) + config->cluster_hb_interval = PING_INTERVAL; // Heartbeat every 0.5 seconds. + + if (!config->cluster_hb_timeout) + config->cluster_hb_timeout = HB_TIMEOUT; // 10 missed heartbeat triggers an election. + + if (interval != config->cluster_hb_interval || timeout != config->cluster_hb_timeout) + { + // Paranoia: cluster_check_master() treats 2 x interval + 1 sec as + // late, ensure we're sufficiently larger than that + int t = 4 * config->cluster_hb_interval + 11; + + if (config->cluster_hb_timeout < t) + { + log(0,0,0,0, "Heartbeat timeout %d too low, adjusting to %d\n", config->cluster_hb_timeout, t); + config->cluster_hb_timeout = t; + } + + // Push timing changes to the slaves immediately if we're the master + if (config->cluster_iam_master) + cluster_heartbeat(); + + interval = config->cluster_hb_interval; + timeout = config->cluster_hb_timeout; + } + config->reload_config = 0; } @@ -3391,9 +3410,9 @@ int sessionsetup(tunnelidt t, sessionidt s) char *user; sessionidt i; int r; -#ifdef STAT_CALLS - STAT(call_sessionsetup); -#endif + + CSTAT(call_sessionsetup); + log(3, session[s].ip, s, t, "Doing session setup for session\n"); @@ -3501,9 +3520,16 @@ int load_session(sessionidt s, sessiont *new) { if (session[s].ip) // If there's an old one, remove it. { + // Remove any routes if the IP has changed + for (i = 0; i < MAXROUTE && session[s].route[i].ip; i++) + { + routeset(s, session[s].route[i].ip, session[s].route[i].mask, session[s].ip, 0); + session[s].route[i].ip = 0; + } + if (session[s].ip_pool_index == -1) // static IP routeset(s, session[s].ip, 0, 0, 0); - else // It's part of the IP pool, add it manually. + else // It's part of the IP pool, remove it manually. uncache_ipmap(session[s].ip); } @@ -3515,7 +3541,7 @@ int load_session(sessionidt s, sessiont *new) } } - // Add routes for the session if they're new. + // Update routed networks for (i = 0; i < MAXROUTE && (session[s].route[i].ip || new->route[i].ip); i++) { if (new->route[i].ip == session[s].route[i].ip && @@ -3523,14 +3549,12 @@ int load_session(sessionidt s, sessiont *new) continue; if (session[s].route[i].ip) // Remove the old one if it exists. - routeset(s, session[s].route[i].ip, session[s].route[i].mask, session[s].route[i].ip, 0); + routeset(s, session[s].route[i].ip, session[s].route[i].mask, session[s].ip, 0); if (new->route[i].ip) // Add the new one if it exists. routeset(s, new->route[i].ip, new->route[i].mask, new->ip, 1); } - - if (new->tunnel && s > config->cluster_highest_sessionid) // Maintain this in the slave. It's used // for walking the sessions to forward byte counts to the master. config->cluster_highest_sessionid = s; @@ -3540,6 +3564,7 @@ int load_session(sessionidt s, sessiont *new) // Do fixups into address pool. if (new->ip_pool_index != -1) fix_address_pool(s); + return 1; } @@ -3706,9 +3731,12 @@ void processcontrol(u8 * buf, int len, struct sockaddr_in *addr) int l; struct param_control param = { buf, len, ntohl(addr->sin_addr.s_addr), ntohs(addr->sin_port), NULL, 0, 0 }; - log(4, ntohl(addr->sin_addr.s_addr), 0, 0, "Received "); - if (log_stream) + + if (log_stream && config->debug >= 4) + { + log(4, ntohl(addr->sin_addr.s_addr), 0, 0, "Received "); dump_packet(buf, log_stream); + } resp = calloc(1400, 1); l = new_packet(PKT_RESP_ERROR, resp); @@ -3789,7 +3817,7 @@ void become_master(void) int s; run_plugins(PLUGIN_BECOME_MASTER, NULL); - for (s = 0; s < config->cluster_highest_sessionid ; ++s) { + for (s = 1; s <= config->cluster_highest_sessionid ; ++s) { if (!session[s].tunnel) // Not an in-use session. continue; @@ -3805,10 +3833,13 @@ int cmd_show_hist_idle(struct cli_def *cli, char *command, char **argv, int argc int count = 0; int buckets[64]; + if (CLI_HELP_REQUESTED) + return CLI_HELP_NO_ARGS; + time(&time_now); for (i = 0; i < 64;++i) buckets[i] = 0; - for (s = 0; s < config->cluster_highest_sessionid ; ++s) { + for (s = 1; s <= config->cluster_highest_sessionid ; ++s) { int idle; if (!session[s].tunnel) continue; @@ -3838,10 +3869,13 @@ int cmd_show_hist_open(struct cli_def *cli, char *command, char **argv, int argc int count = 0; int buckets[64]; + if (CLI_HELP_REQUESTED) + return CLI_HELP_NO_ARGS; + time(&time_now); for (i = 0; i < 64;++i) buckets[i] = 0; - for (s = 0; s < config->cluster_highest_sessionid ; ++s) { + for (s = 1; s <= config->cluster_highest_sessionid ; ++s) { int open = 0, d; if (!session[s].tunnel) continue;