Apply MLPPP patch from Muhammad Tayseer Alquoatli, very belatedly, with

thanks.  Changes:
- Handle session shutdown gracefully regarding leaving the bundle (bug that is
  caused when a all session leaves a bundle then another join)
- IP assignment is done only for the first session in the bundle (save IP
  waste for multiple MLPPP sessions)
- Route is being added only for the first session in the bundle (less routes
  on l2tpns system)
- Fix route deletion problem for MLPPP sessions (bug that caused when a
  session leaves a bundle)
- Uniformity of sequence number space satisfied (according to RFC1990)
- Fix reassembling fragmented packets and handling lost fragments (according
  to RFC 1990)
- FragmentatConnection to l2tpns.cvs.sourceforge.net closed by remote host.n
  across N session rather than two)
- Sequence numbers extraction mask has been corrected (bug in extracting
  sequence numbers)
- some clustering support fixes
- Upload/Download statistics has been corrected
- add "kill_timedout_sessions" config option

diff --git a/Changes b/Changes
index 83b307a..16a2524 100644 (file)
--- a/Changes
+++ b/Changes
@@ -1,3 +1,6 @@
+Wed Dec 9 2009 Brendan O'Dea <bod@optus.net> 2.2.x
+- Apply MLPPP patch from Muhammad Tayseer Alquoatli.
+

 * Mon Dec 18 2006 Brendan O'Dea <bod@optus.net> 2.2.0
 - Only poll clifd if successfully bound.
 - Add "Practical VPNs" document from Liran Tal as Docs/vpn .
 * Mon Dec 18 2006 Brendan O'Dea <bod@optus.net> 2.2.0
 - Only poll clifd if successfully bound.
 - Add "Practical VPNs" document from Liran Tal as Docs/vpn .

diff --git a/THANKS b/THANKS
index bc38c6d..5483a89 100644 (file)
--- a/THANKS
+++ b/THANKS
@@ -29,3 +29,4 @@ Patrick Cole               <z@amused.net>
 Khaled Al Hamwi            <kh.alhamwi@gmail.com>
 Graham Maltby              <gmaltby+l2tpns@iig.com.au>
 Rhys Kidd                  <rhys.kidd@staff.westnet.com.au>
 Khaled Al Hamwi            <kh.alhamwi@gmail.com>
 Graham Maltby              <gmaltby+l2tpns@iig.com.au>
 Rhys Kidd                  <rhys.kidd@staff.westnet.com.au>

+Muhammad Tayseer Alquoatli <idoit.ief@gmail.com>

diff --git a/cluster.c b/cluster.c
index fb71070..42db014 100644 (file)
--- a/cluster.c
+++ b/cluster.c
@@ -1,6 +1,6 @@
 // L2TPNS Clustering Stuff
 
 // L2TPNS Clustering Stuff
 

-char const *cvs_id_cluster = "$Id: cluster.c,v 1.54 2006-12-04 20:50:02 bodea Exp $";
+char const *cvs_id_cluster = "$Id: cluster.c,v 1.55 2009-12-08 14:49:28 bodea Exp $";

 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>


@@ -402,7 +402,7 @@ void cluster_send_ping(time_t basetime)
 
        x.ver = 1;
        x.addr = config->bind_address;
 
        x.ver = 1;
        x.addr = config->bind_address;

-       x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels;
+       x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels + config->cluster_undefined_bundles;

        x.basetime = basetime;
 
        add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x));
        x.basetime = basetime;
 
        add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x));


@@ -940,9 +940,8 @@ void cluster_heartbeat()
                if (bcount >= config->cluster_highest_bundleid)
                        break;
 
                if (bcount >= config->cluster_highest_bundleid)
                        break;
 

-               hb_add_type(&p, C_CTUNNEL, walk_bundle_number);
-               walk_tunnel_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1);       // +1 avoids divide by zero.
-
+               hb_add_type(&p, C_CBUNDLE, walk_bundle_number);
+               walk_bundle_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1);       // +1 avoids divide by zero.

                ++bcount;
         }
 
                ++bcount;
         }
 

diff --git a/constants.c b/constants.c
index 48e7d59..b62b5dd 100644 (file)
--- a/constants.c
+++ b/constants.c
@@ -1,6 +1,6 @@
 // L2TPNS: constants
 
 // L2TPNS: constants
 

-char const *cvs_id_constants = "$Id: constants.c,v 1.7 2005-07-31 10:04:10 bodea Exp $";
+char const *cvs_id_constants = "$Id: constants.c,v 1.8 2009-12-08 14:49:28 bodea Exp $";

 
 #include <stdio.h>
 #include "constants.h"
 
 #include <stdio.h>
 #include "constants.h"


@@ -197,7 +197,8 @@ CONSTANT(radius_state,
     "RADIUSSTART",                                     // 3
     "RADIUSSTOP",                                      // 4
     "RADIUSINTERIM",                                   // 5
     "RADIUSSTART",                                     // 3
     "RADIUSSTOP",                                      // 4
     "RADIUSINTERIM",                                   // 5

-    "RADIUSWAIT"                                       // 6
+    "RADIUSWAIT",                                      // 6
+    "RADIUSJUSTAUTH"                                   // 7

 )
 
 CONSTANT(radius_code,
 )
 
 CONSTANT(radius_code,

diff --git a/etc/startup-config.default b/etc/startup-config.default
index c448de2..77425c8 100644 (file)
--- a/etc/startup-config.default
+++ b/etc/startup-config.default
@@ -41,6 +41,9 @@ set radius_secret "secret"
 # Allow multiple logins for the same username
 #set allow_duplicate_users no
 
 # Allow multiple logins for the same username
 #set allow_duplicate_users no
 

+# Kill timedout sessions ? (default yes)
+#set kill_timedout_sessions no
+

 # Allow multiple logins for specific username
 #set guest_account ""
 
 # Allow multiple logins for specific username
 #set guest_account ""
 

diff --git a/l2tpns.c b/l2tpns.c
index 41f3dc9..a544134 100644 (file)
--- a/l2tpns.c
+++ b/l2tpns.c
@@ -4,7 +4,7 @@
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 
 // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
 // vim: sw=8 ts=8
 

-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.172 2006-12-18 12:05:36 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.173 2009-12-08 14:49:28 bodea Exp $";

 
 #include <arpa/inet.h>
 #include <assert.h>
 
 #include <arpa/inet.h>
 #include <assert.h>


@@ -74,6 +74,9 @@ static int tunidx;            // ifr_ifindex of tun device
 static int syslog_log = 0;     // are we logging to syslog
 static FILE *log_stream = 0;   // file handle for direct logging (i.e. direct into file, not via syslog).
 uint32_t last_id = 0;          // Unique ID for radius accounting
 static int syslog_log = 0;     // are we logging to syslog
 static FILE *log_stream = 0;   // file handle for direct logging (i.e. direct into file, not via syslog).
 uint32_t last_id = 0;          // Unique ID for radius accounting

+// Guest change
+char guest_users[10][32];       // Array of guest users
+int guest_accounts_num = 0;     // Number of guest users

 
 // calculated from config->l2tp_mtu
 uint16_t MRU = 0;              // PPP MRU
 
 // calculated from config->l2tp_mtu
 uint16_t MRU = 0;              // PPP MRU


@@ -133,6 +136,7 @@ config_descriptt config_values[] = {
        CONFIG("radius_bind_min", radius_bind_min, SHORT),
        CONFIG("radius_bind_max", radius_bind_max, SHORT),
        CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL),
        CONFIG("radius_bind_min", radius_bind_min, SHORT),
        CONFIG("radius_bind_max", radius_bind_max, SHORT),
        CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL),

+       CONFIG("kill_timedout_sessions", kill_timedout_sessions, BOOL),

        CONFIG("guest_account", guest_user, STRING),
        CONFIG("bind_address", bind_address, IPv4),
        CONFIG("peer_address", peer_address, IPv4),
        CONFIG("guest_account", guest_user, STRING),
        CONFIG("bind_address", bind_address, IPv4),
        CONFIG("peer_address", peer_address, IPv4),


@@ -1070,45 +1074,63 @@ void processmpframe(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint8_t e
                l -= 4;
        }
 
                l -= 4;
        }
 

-       // Process this frame
-       if (*p & 1)
-       {
-               proto = *p++;
-               l--;
-       }
-       else
-       {
-               proto = ntohs(*(uint16_t *) p);
-               p += 2;
-               l -= 2;
-       }
-
-       if (proto == PPPIP)
-       {
-               if (session[s].die)
-               {
-                       LOG(4, s, t, "MPPP: Session %u is closing.  Don't process PPP packets\n", s);
-                       return;              // closing session, PPP not processed
-               }
+        if (*p & 1)
+        {
+                proto = *p++;
+                l--;
+        }
+        else
+        {
+                proto = ntohs(*(uint16_t *) p);
+                p += 2;
+                l -= 2;
+        }
+        if (proto == PPPIP)
+        {
+                if (session[s].die)
+                {
+                        LOG(4, s, t, "MPPP: Session %d is closing.  Don't process PPP packets\n", s);
+                        return;              // closing session, PPP not processed
+                }
+                session[s].last_packet = session[s].last_data = time_now;
+                processipin(s, t, p, l);
+        }
+        else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
+        {
+                if (session[s].die)
+                {
+                        LOG(4, s, t, "MPPP: Session %d is closing.  Don't process PPP packets\n", s);
+                        return;              // closing session, PPP not processed
+                }
+
+                session[s].last_packet = session[s].last_data = time_now;
+                processipv6in(s, t, p, l);
+        }
+       else if (proto == PPPIPCP)
+        {
+                session[s].last_packet = session[s].last_data = time_now;
+                processipcp(s, t, p, l);
+        }
+        else if (proto == PPPCCP)
+        {
+                session[s].last_packet = session[s].last_data = time_now;
+                processccp(s, t, p, l);
+        }
+        else
+        {
+                LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
+        }
+}

 
 

-               session[s].last_packet = session[s].last_data = time_now;
-               processipin(s, t, p, l);
-       }
-       else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
-       {
-               if (session[s].die)
-               {
-                       LOG(4, s, t, "MPPP: Session %u is closing.  Don't process PPP packets\n", s);
-                       return;              // closing session, PPP not processed
-               }
+static void update_session_out_stat(sessionidt s, sessiont *sp, int len)
+{
+       increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
+       sp->cout_delta += len;
+       sp->pout++;
+       sp->last_data = time_now;

 
 

-               session[s].last_packet = session[s].last_data = time_now;
-               processipv6in(s, t, p, l);
-       }
-       else
-       {
-               LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
-       }
+       sess_local[s].cout += len;      // To send to master..
+       sess_local[s].pout++;

 }
 
 // process outgoing (to tunnel) IP
 }
 
 // process outgoing (to tunnel) IP


@@ -1123,8 +1145,7 @@ static void processipout(uint8_t *buf, int len)
        uint8_t *data = buf;    // Keep a copy of the originals.
        int size = len;
 
        uint8_t *data = buf;    // Keep a copy of the originals.
        int size = len;
 

-       uint8_t b1[MAXETHER + 20];
-       uint8_t b2[MAXETHER + 20];
+       uint8_t fragbuf[MAXETHER + 20];

 
        CSTAT(processipout);
 
 
        CSTAT(processipout);
 


@@ -1173,9 +1194,15 @@ static void processipout(uint8_t *buf, int len)
                }
                return;
        }
                }
                return;
        }

+

        t = session[s].tunnel;
        t = session[s].tunnel;

+       if (len > session[s].mru || (session[s].mrru && len > session[s].mrru))
+       {
+               LOG(3, s, t, "Packet size more than session MRU\n");
+               return;
+       }
+

        sp = &session[s];
        sp = &session[s];

-       sp->last_data = time_now;

 
        // DoS prevention: enforce a maximum number of packets per 0.1s for a session
        if (config->max_packets > 0)
 
        // DoS prevention: enforce a maximum number of packets per 0.1s for a session
        if (config->max_packets > 0)


@@ -1246,55 +1273,80 @@ static void processipout(uint8_t *buf, int len)
        }
 
        // Add on L2TP header
        }
 
        // Add on L2TP header

-       {
-               bundleidt bid = 0;
-               if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1)
-               {
-                       bid = session[s].bundle;
-                       s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
-                       LOG(4, s, t, "MPPP: (1)Session number becomes: %u\n", s);
-                       if (len > 256)
-                       {
-                               // Partition the packet to 2 fragments
-                               uint32_t frag1len = len / 2;
-                               uint32_t frag2len = len - frag1len;
-                               uint8_t *p = makeppp(b1, sizeof(b1), buf, frag1len, s, t, PPPIP, 0, bid, MP_BEGIN);
-                               uint8_t *q;
-
-                               if (!p) return;
-                               tunnelsend(b1, frag1len + (p-b1), t); // send it...
-                               s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
-                               LOG(4, s, t, "MPPP: (2)Session number becomes: %u\n", s);
-                               q = makeppp(b2, sizeof(b2), buf+frag1len, frag2len, s, t, PPPIP, 0, bid, MP_END);
-                               if (!q) return;
-                               tunnelsend(b2, frag2len + (q-b2), t); // send it...
-                       }
-                       else {
-                               // Send it as one frame
-                               uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
-                               if (!p) return;
-                               tunnelsend(b1, len + (p-b1), t); // send it...
-                       }
-               }
-               else
-               {
-                       uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, 0, 0);
-                       if (!p) return;
-                       tunnelsend(b1, len + (p-b1), t); // send it...
-               }
-       }
+        {
+                bundleidt bid = 0;
+                if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1)
+                {
+                        bid = session[s].bundle;
+                        s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
+                       t = session[s].tunnel;
+                       sp = &session[s];
+                        LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s);
+                        if(len > MINFRAGLEN)
+                        {
+                                // Partition the packet to "bundle[b].num_of_links" fragments
+                               bundlet *b = &bundle[bid];
+                               uint32_t num_of_links = b->num_of_links;
+                                uint32_t fraglen = len / num_of_links;
+                               fraglen = (fraglen > session[s].mru ? session[s].mru : fraglen);
+                               uint32_t last_fraglen = fraglen + len % num_of_links;
+                               last_fraglen = (last_fraglen > session[s].mru ? len % num_of_links : last_fraglen);
+                               uint32_t remain = len;
+
+                               // send the first packet
+                                uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
+                                if (!p) return;
+                                tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+                               // statistics
+                               update_session_out_stat(s, sp, fraglen);
+                               remain -= fraglen;
+                               while (remain > last_fraglen)
+                               { 
+                                       s = b->members[b->current_ses = ++b->current_ses % num_of_links];
+                                       t = session[s].tunnel;
+                                       sp = &session[s];
+                                       LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
+                                       p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
+                                       if (!p) return;
+                                       tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+                                       update_session_out_stat(s, sp, fraglen);
+                                       remain -= fraglen;
+                               }
+                               // send the last fragment
+                               s = b->members[b->current_ses = ++b->current_ses % num_of_links];
+                               t = session[s].tunnel;
+                               sp = &session[s];
+                                       LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
+                                       p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
+                                       if (!p) return;
+                                       tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
+                               update_session_out_stat(s, sp, remain);
+                               if (remain != last_fraglen)
+                                       LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
+                        }
+                        else {
+                                // Send it as one frame
+                                uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
+                                if (!p) return;
+                                tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+                               LOG(4, s, t, "MPPP: packet sent as one frame\n");
+                               update_session_out_stat(s, sp, len);
+                        }
+                }
+                else
+                {
+                        uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
+                        if (!p) return;
+                        tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+                       update_session_out_stat(s, sp, len);
+                }
+        }

 
        // Snooping this session, send it to intercept box
        if (sp->snoop_ip && sp->snoop_port)
                snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
 
 
        // Snooping this session, send it to intercept box
        if (sp->snoop_ip && sp->snoop_port)
                snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
 

-       increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
-       sp->cout_delta += len;
-       sp->pout++;

        udp_tx += len;
        udp_tx += len;

-
-       sess_local[s].cout += len;      // To send to master..
-       sess_local[s].pout++;

 }
 
 // process outgoing (to tunnel) IPv6
 }
 
 // process outgoing (to tunnel) IPv6


@@ -1661,7 +1713,9 @@ void filter_session(sessionidt s, int filter_in, int filter_out)
 void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause)
 {
        int walled_garden = session[s].walled_garden;
 void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause)
 {
        int walled_garden = session[s].walled_garden;

-
+       bundleidt b = session[s].bundle;
+       //delete routes only for last session in bundle (in case of MPPP)
+       int del_routes = !b || (bundle[b].num_of_links == 1);

 
        CSTAT(sessionshutdown);
 
 
        CSTAT(sessionshutdown);
 


@@ -1710,21 +1764,52 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e
                            (session[s].route[r].ip & session[s].route[r].mask))
                                routed++;
 
                            (session[s].route[r].ip & session[s].route[r].mask))
                                routed++;
 

-                       routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0);
+                       if (del_routes) routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0);

                        session[s].route[r].ip = 0;
                }
 
                if (session[s].ip_pool_index == -1) // static ip
                {
                        session[s].route[r].ip = 0;
                }
 
                if (session[s].ip_pool_index == -1) // static ip
                {

-                       if (!routed) routeset(s, session[s].ip, 0, 0, 0);
+                       if (!routed && del_routes) routeset(s, session[s].ip, 0, 0, 0);

                        session[s].ip = 0;
                }
                else
                        free_ip_address(s);
 
                // unroute IPv6, if setup
                        session[s].ip = 0;
                }
                else
                        free_ip_address(s);
 
                // unroute IPv6, if setup

-               if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen)
+               if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes)

                        route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);
                        route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);

+               
+               if (b) 
+               {
+                       // This session was part of a bundle
+                       bundle[b].num_of_links--;
+                       LOG(3, s, 0, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
+                       if(bundle[b].num_of_links == 0) 
+                       {
+                               bundleclear(b);
+                               LOG(3, s, 0, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
+                       }
+                       else 
+                       {
+                               // Adjust the members array to accomodate the new change
+                               uint8_t mem_num = 0;
+                               // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
+                               if(bundle[b].members[bundle[b].num_of_links] != s) 
+                               {
+                                       uint8_t ml;
+                                       for(ml = 0; ml<bundle[b].num_of_links; ml++)
+                                               if(bundle[b].members[ml] == s)
+                                               {
+                                                       mem_num = ml;
+                                                       break;
+                                               }
+                                       bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
+                                       LOG(3, s, 0, "MPPP: Adjusted member links array\n");
+                               }
+                       }
+                       cluster_send_bundle(b);
+               }

        }
 
        if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
        }
 
        if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.


@@ -1834,8 +1919,6 @@ static void sessionclear(sessionidt s)
 // kill a session now
 void sessionkill(sessionidt s, char *reason)
 {
 // kill a session now
 void sessionkill(sessionidt s, char *reason)
 {

-       bundleidt b;
-

        CSTAT(sessionkill);
 
        if (!session[s].opened) // not alive
        CSTAT(sessionkill);
 
        if (!session[s].opened) // not alive


@@ -1852,39 +1935,7 @@ void sessionkill(sessionidt s, char *reason)
        if (sess_local[s].radius)
                radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
 
        if (sess_local[s].radius)
                radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
 

-       LOG(2, s, session[s].tunnel, "Kill session %u (%s): %s\n", s, session[s].user, reason);
-       if ((b = session[s].bundle))
-       {
-               // This session was part of a bundle
-               bundle[b].num_of_links--;
-               LOG(3, s, 0, "MPPP: Dropping member link: %u from bundle %u\n", s, b);
-               if (bundle[b].num_of_links == 0)
-               {
-                       bundleclear(b);
-                       LOG(3, s, 0, "MPPP: Kill bundle: %u (No remaing member links)\n", b);
-               }
-               else
-               {
-                       // Adjust the members array to accomodate the new change
-                       uint8_t mem_num = 0;
-                       // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
-                       if (bundle[b].members[bundle[b].num_of_links] != s)
-                       {
-                               uint8_t ml;
-                               for (ml = 0; ml<bundle[b].num_of_links; ml++)
-                               {
-                                       if (bundle[b].members[ml] == s)
-                                       {
-                                               mem_num = ml;
-                                               break;
-                                       }
-                               }
-                               bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
-                               LOG(3, s, 0, "MPPP: Adjusted member links array\n");
-                       }
-               }
-               cluster_send_bundle(b);
-       }
+       LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);

        sessionclear(s);
        cluster_send_session(s);
 }
        sessionclear(s);
        cluster_send_session(s);
 }


@@ -3911,6 +3962,7 @@ static void initdata(int optdebug, char *optconfig)
        config->ppp_restart_time = 3;
        config->ppp_max_configure = 10;
        config->ppp_max_failure = 5;
        config->ppp_restart_time = 3;
        config->ppp_max_configure = 10;
        config->ppp_max_failure = 5;

+       config->kill_timedout_sessions = 1;

        strcpy(config->random_device, RANDOMDEVICE);
 
        log_stream = stderr;
        strcpy(config->random_device, RANDOMDEVICE);
 
        log_stream = stderr;


@@ -4737,6 +4789,40 @@ static void update_config()
                }
        }
 
                }
        }
 

+       // Guest change
+        guest_accounts_num = 0;
+        char *p2 = config->guest_user;
+        while (p2 && *p2)
+        {
+                char *s = strpbrk(p2, " \t,");
+                if (s)
+                {
+                        *s++ = 0;
+                        while (*s == ' ' || *s == '\t')
+                                s++;
+
+                        if (!*s)
+                                s = 0;
+                }
+
+                strcpy(guest_users[guest_accounts_num], p2);
+                LOG(1, 0, 0, "Guest account[%d]: %s\n", guest_accounts_num, guest_users[guest_accounts_num]);
+                guest_accounts_num++;
+                p2 = s;
+        }
+        // Rebuild the guest_user array
+        strcpy(config->guest_user, "");
+        int ui = 0;
+        for (ui=0; ui<guest_accounts_num; ui++)
+        {
+                strcat(config->guest_user, guest_users[ui]);
+                if (ui<guest_accounts_num-1)
+                {
+                        strcat(config->guest_user, ",");
+                }
+        }
+
+

        memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
        if (!config->multi_read_count) config->multi_read_count = 10;
        if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);
        memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
        if (!config->multi_read_count) config->multi_read_count = 10;
        if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);


@@ -4815,6 +4901,20 @@ int sessionsetup(sessionidt s, tunnelidt t)
 
        LOG(3, s, t, "Doing session setup for session\n");
 
 
        LOG(3, s, t, "Doing session setup for session\n");
 

+       // Join a bundle if the MRRU option is accepted
+        if(session[s].mrru > 0 && session[s].bundle == 0)
+        {
+                LOG(3, s, t, "This session can be part of multilink bundle\n");
+                if (join_bundle(s) > 0)
+                       cluster_send_bundle(session[s].bundle);
+               else
+               {
+                       LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n");
+                       sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE);
+                       return 0;
+               }
+        }
+

        if (!session[s].ip)
        {
                assign_ip_address(s);
        if (!session[s].ip)
        {
                assign_ip_address(s);


@@ -4832,14 +4932,6 @@ int sessionsetup(sessionidt s, tunnelidt t)
        // Make sure this is right
        session[s].tunnel = t;
 
        // Make sure this is right
        session[s].tunnel = t;
 

-       // Join a bundle if the MRRU option is accepted
-       if (session[s].mrru > 0 && !session[s].bundle)
-       {
-               LOG(3, s, t, "This session can be part of multilink bundle\n");
-               if (join_bundle(s))
-                       cluster_send_bundle(session[s].bundle);
-       }
-

        // zap old sessions with same IP and/or username
        // Don't kill gardened sessions - doing so leads to a DoS
        // from someone who doesn't need to know the password
        // zap old sessions with same IP and/or username
        // Don't kill gardened sessions - doing so leads to a DoS
        // from someone who doesn't need to know the password


@@ -4850,25 +4942,29 @@ int sessionsetup(sessionidt s, tunnelidt t)
                {
                        if (i == s) continue;
                        if (!session[s].opened) continue;
                {
                        if (i == s) continue;
                        if (!session[s].opened) continue;

+                       // Allow duplicate sessions for multilink ones of the same bundle.
+                        if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
+                                continue;

                        if (ip == session[i].ip)
                        {
                                sessionkill(i, "Duplicate IP address");
                                continue;
                        }
 
                        if (ip == session[i].ip)
                        {
                                sessionkill(i, "Duplicate IP address");
                                continue;
                        }
 

-                       if (config->allow_duplicate_users)
-                               continue;
-
-                       if (session[s].walled_garden || session[i].walled_garden)
-                               continue;
-
-                       // Allow duplicate sessions for guest account.
-                       if (*config->guest_user && !strcasecmp(user, config->guest_user))
-                               continue;
-
-                       // Allow duplicate sessions for multilink ones of the same bundle.
-                       if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
-                               continue;
+                       if (config->allow_duplicate_users) continue;
+                       if (session[s].walled_garden || session[i].walled_garden) continue;
+                       // Guest change
+                       int found = 0;
+                        int gu;
+                        for (gu = 0; gu < guest_accounts_num; gu++)
+                        {
+                                if (!strcasecmp(user, guest_users[gu]))
+                                {
+                                        found = 1;
+                                        break;
+                                }
+                        }
+                        if (found) continue;

 
                        // Drop the new session in case of duplicate sessionss, not the old one.
                        if (!strcasecmp(user, session[i].user))
 
                        // Drop the new session in case of duplicate sessionss, not the old one.
                        if (!strcasecmp(user, session[i].user))


@@ -4876,6 +4972,8 @@ int sessionsetup(sessionidt s, tunnelidt t)
                }
        }
 
                }
        }
 

+       // no need to set a route for the same IP address of the bundle
+       if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1))

        {
                int routed = 0;
 
        {
                int routed = 0;
 

diff --git a/l2tpns.h b/l2tpns.h
index 5614ae9..c68d9c3 100644 (file)
--- a/l2tpns.h
+++ b/l2tpns.h
@@ -1,5 +1,5 @@
 // L2TPNS Global Stuff
 // L2TPNS Global Stuff

-// $Id: l2tpns.h,v 1.120 2006-10-23 02:51:53 bodea Exp $
+// $Id: l2tpns.h,v 1.121 2009-12-08 14:49:28 bodea Exp $

 
 #ifndef __L2TPNS_H__
 #define __L2TPNS_H__
 
 #ifndef __L2TPNS_H__
 #define __L2TPNS_H__


@@ -19,10 +19,8 @@
 // Limits
 #define MAXTUNNEL      500             // could be up to 65535
 #define MAXBUNDLE      300             // could be up to 65535
 // Limits
 #define MAXTUNNEL      500             // could be up to 65535
 #define MAXBUNDLE      300             // could be up to 65535

-#define MAXBUNDLESES   10              // Maximum number of member links in bundle
+#define MAXBUNDLESES   12              // Maximum number of member links in bundle

 #define MAXADDRESS     20              // Maximum length for the Endpoint Discrminiator address
 #define MAXADDRESS     20              // Maximum length for the Endpoint Discrminiator address

-#define MAXFRAGNUM     1500            // Maximum number of Multilink fragment in a bundle
-#define MAXFRAGLEN      1000           // Maximum length for Multilink fragment

 #define MAXSESSION     60000           // could be up to 65535
 #define MAXTBFS                6000            // Maximum token bucket filters. Might need up to 2 * session.
 
 #define MAXSESSION     60000           // could be up to 65535
 #define MAXTBFS                6000            // Maximum token bucket filters. Might need up to 2 * session.
 


@@ -52,9 +50,15 @@
 #define IDLE_TIMEOUT   240             // Time between last packet seen and session shutdown
 #define BUSY_WAIT_TIME 3000            // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown
 
 #define IDLE_TIMEOUT   240             // Time between last packet seen and session shutdown
 #define BUSY_WAIT_TIME 3000            // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown
 

-#define MP_BEGIN       0x80            // This value is used when (b)egin bit is set in MP header
-#define MP_END         0x40            // This value is used when (e)nd bit is set in MP header
-#define MP_BOTH_BITS   0xC0            // This value is used when both bits (begin and end) are set in MP header
+#define MP_BEGIN        0x80            // This value is used when (b)egin bit is set in MP header
+#define MP_END          0x40            // This value is used when (e)nd bit is set in MP header
+#define MP_BOTH_BITS    0xC0            // This value is used when both bits (begin and end) are set in MP header
+
+#define MINFRAGLEN     64              // Minumum fragment length
+#define MAXFRAGLEN     750             // Maximum length for Multilink fragment (MTU / 2 sessions)
+#define MAXFRAGNUM     128             // Maximum number of Multilink fragment in a bundle (must be in the form of 2^X)
+                                       // it's not expected to have a space for more than 10 unassembled packets = 10 * MAXBUNDLESES
+#define        MAXFRAGNUM_MASK 127             // Must be equal to MAXFRAGNUM-1

 
 // Constants
 #ifndef ETCDIR
 
 // Constants
 #ifndef ETCDIR


@@ -248,8 +252,11 @@ typedef struct {
 } epdist;
 
 typedef struct {
 } epdist;
 
 typedef struct {

-       uint16_t length;                // Fragment length
-       uint8_t data[MAXFRAGLEN];       // Fragment data
+       sessionidt sid;                 // Fragment originating session
+       uint8_t flags;                  // MP frame flags
+       uint32_t seq;                   // fragment seq num
+        uint16_t length;                // Fragment length
+        uint8_t data[MAXFRAGLEN];       // Fragment data

 } fragmentt;
 
 typedef struct
 } fragmentt;
 
 typedef struct


@@ -297,10 +304,11 @@ typedef struct
        char calling[MAXTEL];           // calling number
        uint32_t tx_connect_speed;
        uint32_t rx_connect_speed;
        char calling[MAXTEL];           // calling number
        uint32_t tx_connect_speed;
        uint32_t rx_connect_speed;

-       uint32_t mrru;                  // Multilink Max-Receive-Reconstructed-Unit
-       uint8_t mssf;                   // Multilink Short Sequence Number Header Format
-       epdist epdis;                   // Multilink Endpoint Discriminator
-       bundleidt bundle;               // Multilink Bundle Identifier
+       clockt timeout;                 // Session timeout
+        uint32_t mrru;                  // Multilink Max-Receive-Reconstructed-Unit
+        uint8_t mssf;                   // Multilink Short Sequence Number Header Format
+        epdist epdis;                   // Multilink Endpoint Discriminator
+        bundleidt bundle;               // Multilink Bundle Identifier

        in_addr_t snoop_ip;             // Interception destination IP
        uint16_t snoop_port;            // Interception destination port
        uint8_t walled_garden;          // is this session gardened?
        in_addr_t snoop_ip;             // Interception destination IP
        uint16_t snoop_port;            // Interception destination port
        uint8_t walled_garden;          // is this session gardened?


@@ -312,28 +320,31 @@ sessiont;
 
 typedef struct
 {
 
 typedef struct
 {

-       int state;                              // current state (bundlestate enum)
-       uint32_t seq_num_t;                     // Sequence Number (transmission)
-       uint32_t seq_num_m;                     // Last received frame sequence number (bearing B bit)
-       uint32_t offset;                        // Offset between sequence number and array index
-       uint8_t pending_frag;                   // Indicate that there is pending fragments to reassemble
-       uint8_t num_of_links;                   // Number of links joint to this bundle
-       uint32_t online_time;                   // The time this bundle is online
-       clockt last_check;                      // Last time the timeout is checked
-       uint32_t mrru;                          // Multilink Max-Receive-Reconstructed-Unit
-       uint8_t mssf;                           // Multilink Short Sequence Number Header Format
-       epdist epdis;                           // Multilink Endpoint Discriminator
-       char user[MAXUSER];                     // Needed for matching member links
-       sessionidt current_ses;                 // Current session to use for sending (used in RR load-balancing)
-       sessionidt members[MAXBUNDLESES];       // Array for member links sessions
+        int state;                              // current state (bundlestate enum)
+        uint32_t seq_num_t;                     // Sequence Number (transmission)
+        uint32_t timeout;                       // Session-Timeout for bundle
+       uint32_t max_seq;                       // Max value of sequence number field
+        uint8_t num_of_links;                   // Number of links joint to this bundle
+        uint32_t online_time;                   // The time this bundle is online
+        clockt last_check;                      // Last time the timeout is checked
+        uint32_t mrru;                          // Multilink Max-Receive-Reconstructed-Unit
+        uint8_t mssf;                           // Multilink Short Sequence Number Header Format
+        epdist epdis;                           // Multilink Endpoint Discriminator
+        char user[MAXUSER];                     // Needed for matching member links
+        sessionidt current_ses;                 // Current session to use for sending (used in RR load-balancing)
+        sessionidt members[MAXBUNDLESES];       // Array for member links sessions

 }
 bundlet;
 
 typedef struct
 {
 }
 bundlet;
 
 typedef struct
 {

-       fragmentt fragment[MAXFRAGNUM];
-       uint8_t reassembled_frame[MAXETHER];    // The reassembled frame
-       uint16_t re_frame_len;                  // The reassembled frame length
+        fragmentt fragment[MAXFRAGNUM];
+        uint8_t reassembled_frame[MAXETHER];    // The reassembled frame
+        uint16_t re_frame_len;                  // The reassembled frame length
+       uint16_t re_frame_begin_index, re_frame_end_index;      // reassembled frame begin index, end index respectively
+       uint16_t start_index, end_index;        // start and end sequence numbers available on the fragments array respectively
+       uint32_t M;                             // Minumum frame sequence number received over all bundle members
+       uint32_t start_seq;                     // Last received frame sequence number (bearing B bit)

 }
 fragmentationt;
 
 }
 fragmentationt;
 


@@ -388,6 +399,9 @@ typedef struct
 
        // last LCP Echo
        time_t last_echo;
 
        // last LCP Echo
        time_t last_echo;

+
+       // Last Multilink frame sequence number received
+       uint32_t last_seq;

 } sessionlocalt;
 
 // session flags
 } sessionlocalt;
 
 // session flags


@@ -497,6 +511,7 @@ enum
        RADIUSSTOP,             // sending stop accounting to RADIUS server
        RADIUSINTERIM,          // sending interim accounting to RADIUS server
        RADIUSWAIT,             // waiting timeout before available, in case delayed replies
        RADIUSSTOP,             // sending stop accounting to RADIUS server
        RADIUSINTERIM,          // sending interim accounting to RADIUS server
        RADIUSWAIT,             // waiting timeout before available, in case delayed replies

+       RADIUSJUSTAUTH,         // sending auth to RADIUS server, just authentication, no ip assigning

 };
 
 struct Tstats
 };
 
 struct Tstats


@@ -644,7 +659,7 @@ typedef struct
        int             radius_authprefer;
 
        int             allow_duplicate_users;          // allow multiple logins with the same username
        int             radius_authprefer;
 
        int             allow_duplicate_users;          // allow multiple logins with the same username

-       char            guest_user[MAXUSER];            // allow multiple logins to guest account username
+       int             kill_timedout_sessions;         // kill authenticated sessions with "session_timeout == 0"

 
        in_addr_t       default_dns1, default_dns2;
 
 
        in_addr_t       default_dns1, default_dns2;
 


@@ -691,11 +706,15 @@ typedef struct
        int             cluster_hb_interval;            // How often to send a heartbeat.
        int             cluster_hb_timeout;             // How many missed heartbeats trigger an election.
        uint64_t        cluster_table_version;          // # state changes processed by cluster
        int             cluster_hb_interval;            // How often to send a heartbeat.
        int             cluster_hb_timeout;             // How many missed heartbeats trigger an election.
        uint64_t        cluster_table_version;          // # state changes processed by cluster

-       int             cluster_master_min_adv;         // Master advertises routes while the number of up to date
-                                                       // slaves is less than this value.

 
        struct in6_addr ipv6_prefix;                    // Our IPv6 network pool.
 
 
        struct in6_addr ipv6_prefix;                    // Our IPv6 network pool.
 

+
+       int             cluster_master_min_adv;         // Master advertises routes while the number of up to date
+                                                       // slaves is less than this value.
+       // Guest change
+       char            guest_user[MAXUSER];            // Guest account username
+

 #ifdef BGP
 #define BGP_NUM_PEERS  2
        uint16_t as_number;
 #ifdef BGP
 #define BGP_NUM_PEERS  2
        uint16_t as_number;

diff --git a/ppp.c b/ppp.c
index c76d6da..94cc5fa 100644 (file)
--- a/ppp.c
+++ b/ppp.c
@@ -1,6 +1,6 @@
 // L2TPNS PPP Stuff
 
 // L2TPNS PPP Stuff
 

-char const *cvs_id_ppp = "$Id: ppp.c,v 1.103 2007-01-25 12:36:48 bodea Exp $";
+char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009-12-08 14:49:28 bodea Exp $";

 
 #include <stdio.h>
 #include <string.h>
 
 #include <stdio.h>
 #include <string.h>


@@ -31,6 +31,16 @@ static int epdiscmp(epdist, epdist);
 static void setepdis(epdist *, epdist);
 static void ipcp_open(sessionidt s, tunnelidt t);
 
 static void setepdis(epdist *, epdist);
 static void ipcp_open(sessionidt s, tunnelidt t);
 

+static int first_session_in_bundle(sessionidt s)
+{
+       bundleidt i;
+       for (i = 1; i < MAXBUNDLE; i++)
+               if (bundle[i].state != BUNDLEFREE)
+                       if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
+                               return 0;
+       return 1;       
+}
+

 // Process PAP messages
 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {
 // Process PAP messages
 void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {


@@ -140,7 +150,10 @@ void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
                radius[r].id = p[1];
                LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
 
                radius[r].id = p[1];
                LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);

-               radiussend(r, RADIUSAUTH);
+               if ((session[s].mrru) && (!first_session_in_bundle(s)))
+                       radiussend(r, RADIUSJUSTAUTH);
+               else
+                       radiussend(r, RADIUSAUTH);

        }
 }
 
        }
 }
 


@@ -257,7 +270,10 @@ void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 
        radius[r].chap = 1;
        LOG(3, s, t, "CHAP login %s\n", session[s].user);
 
        radius[r].chap = 1;
        LOG(3, s, t, "CHAP login %s\n", session[s].user);

-       radiussend(r, RADIUSAUTH);
+       if ((session[s].mrru) && (!first_session_in_bundle(s)))
+               radiussend(r, RADIUSJUSTAUTH);
+       else
+               radiussend(r, RADIUSAUTH);

 }
 
 static void dumplcp(uint8_t *p, int l)
 }
 
 static void dumplcp(uint8_t *p, int l)


@@ -366,17 +382,7 @@ void lcp_open(sessionidt s, tunnelidt t)
        }
        else
        {
        }
        else
        {

-               if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1)
-               {
-                       sessionidt first_ses = bundle[session[s].bundle].members[0];
-                       LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n", s, first_ses);
-                       session[s].ip = session[first_ses].ip;
-                       session[s].dns1 = session[first_ses].dns1;
-                       session[s].dns2 = session[first_ses].dns2;
-                       session[s].session_timeout = session[first_ses].session_timeout;
-                       ipcp_open(s, t);
-               }
-               else
+               if(session[s].bundle == 0 || bundle[session[s].bundle].num_of_links == 1)

                {
                        // This-Layer-Up
                        sendipcp(s, t);
                {
                        // This-Layer-Up
                        sendipcp(s, t);


@@ -389,6 +395,12 @@ void lcp_open(sessionidt s, tunnelidt t)
 
                        change_state(s, ccp, Stopped);
                }
 
                        change_state(s, ccp, Stopped);
                }

+               else
+               {
+                       sessionidt first_ses = bundle[session[s].bundle].members[0];
+                       LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n",s,first_ses);
+                       ipcp_open(s, t);
+                }

        }
 }
 
        }
 }
 


@@ -1091,10 +1103,20 @@ int join_bundle(sessionidt s)
                {
                        if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
                        {
                {
                        if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
                        {

+                               sessionidt first_ses = bundle[i].members[0];
+                               if (bundle[i].mssf != session[s].mssf)
+                               {
+                                       // uniformity of sequence number format must be insured
+                                       LOG(3, s, session[s].tunnel, "MPPP: unable to bundle session %d in bundle %d cause of different mssf\n", s, i);
+                                       return -1;
+                               }

                                session[s].bundle = i;
                                session[s].bundle = i;

-                               bundle[i].mrru = session[s].mrru;
-                               bundle[i].mssf = session[s].mssf;
-                               if (session[s].epdis.length > 0)
+                               session[s].ip = session[first_ses].ip;
+                               session[s].dns1 = session[first_ses].dns1;
+                               session[s].dns2 = session[first_ses].dns2;
+                               session[s].timeout = session[first_ses].timeout;
+
+                               if(session[s].epdis.length > 0)

                                        setepdis(&bundle[i].epdis, session[s].epdis);
 
                                strcpy(bundle[i].user, session[s].user);
                                        setepdis(&bundle[i].epdis, session[s].epdis);
 
                                strcpy(bundle[i].user, session[s].user);


@@ -1112,11 +1134,19 @@ int join_bundle(sessionidt s)
        session[s].bundle = b;
        bundle[b].mrru = session[s].mrru;
        bundle[b].mssf = session[s].mssf;
        session[s].bundle = b;
        bundle[b].mrru = session[s].mrru;
        bundle[b].mssf = session[s].mssf;

-       if (session[s].epdis.length > 0)
+       // FIXME !!! to enable l2tpns reading mssf frames receiver_max_seq, sender_max_seq must be introduce
+       // now session[s].mssf flag indecates that the receiver wish to receive frames in mssf, so max_seq (i.e. recv_max_seq) = 1<<24
+       /*
+       if (bundle[b].mssf)
+               bundle[b].max_seq = 1 << 12;
+       else */
+               bundle[b].max_seq = 1 << 24;
+       if(session[s].epdis.length > 0)

                setepdis(&bundle[b].epdis, session[s].epdis);
 
        strcpy(bundle[b].user, session[s].user);
        bundle[b].members[0] = s;
                setepdis(&bundle[b].epdis, session[s].epdis);
 
        strcpy(bundle[b].user, session[s].user);
        bundle[b].members[0] = s;

+       bundle[b].timeout = session[s].timeout;

        LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b);
        return b;
 }
        LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b);
        return b;
 }


@@ -1148,23 +1178,24 @@ static void setepdis(epdist *ep1, epdist ep2)
 
 static bundleidt new_bundle()
 {
 
 static bundleidt new_bundle()
 {

-       bundleidt i;
-       for (i = 1; i < MAXBUNDLE; i++)
-       {
-               if (bundle[i].state == BUNDLEFREE)
-               {
-                       LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
-                       bundle[i].num_of_links = 1;
-                       bundle[i].last_check = time_now;        // Initialize last_check value
-                       bundle[i].state = BUNDLEOPEN;
-                       bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first
-                       if (i > config->cluster_highest_bundleid)
-                               config->cluster_highest_bundleid = i;
-                       return i;
-               }
-       }
-       LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
-       return 0;
+        bundleidt i;
+        for (i = 1; i < MAXBUNDLE; i++)
+        {
+                if (bundle[i].state == BUNDLEFREE)
+                {
+                        LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
+                        bundle[i].num_of_links = 1;
+                        bundle[i].last_check = time_now;        // Initialize last_check value
+                        bundle[i].state = BUNDLEOPEN;
+                        bundle[i].current_ses = -1;     // This is to enforce the first session 0 to be used at first
+                       memset(&frag[i], 0, sizeof(fragmentationt));
+                        if (i > config->cluster_highest_bundleid)
+                                config->cluster_highest_bundleid = i;
+                        return i;
+                }
+        }
+        LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
+        return 0;

 }
 
 static void ipcp_open(sessionidt s, tunnelidt t)
 }
 
 static void ipcp_open(sessionidt s, tunnelidt t)


@@ -1645,6 +1676,39 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
        }
 }
 
        }
 }
 

+static void update_sessions_in_stat(sessionidt s, uint16_t l)
+{
+       bundleidt b = session[s].bundle;
+       if (!b)
+       {
+               increment_counter(&session[s].cin, &session[s].cin_wrap, l);
+               session[s].cin_delta += l;
+                       session[s].pin++;
+
+               sess_local[s].cin += l;
+               sess_local[s].pin++;
+       }
+       else
+       {
+               int i = frag[b].re_frame_begin_index;
+               int end = frag[b].re_frame_end_index;
+               for (;;)
+               {
+                       l = frag[b].fragment[i].length;
+                       s = frag[b].fragment[i].sid;
+                       increment_counter(&session[s].cin, &session[s].cin_wrap, l);
+                       session[s].cin_delta += l;
+                               session[s].pin++;
+
+                       sess_local[s].cin += l;
+                       sess_local[s].pin++;
+                       if (i == end)
+                               return;
+                       i = (i + 1) & MAXFRAGNUM_MASK;
+               }
+       }
+}
+

 // process IP packet received
 //
 // This MUST be called with at least 4 byte behind 'p'.
 // process IP packet received
 //
 // This MUST be called with at least 4 byte behind 'p'.


@@ -1732,12 +1796,7 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
        }
 
                snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
        }
 

-       increment_counter(&session[s].cin, &session[s].cin_wrap, l);
-       session[s].cin_delta += l;
-       session[s].pin++;
-
-       sess_local[s].cin += l;
-       sess_local[s].pin++;
+       update_sessions_in_stat(s, l);

 
        eth_tx += l;
 
 
        eth_tx += l;
 


@@ -1748,162 +1807,190 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 // process Multilink PPP packet received
 void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {
 // process Multilink PPP packet received
 void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
 {

-       bundleidt b = session[s].bundle;
-       uint8_t begin_frame;
-       uint8_t end_frame;
-       uint32_t seq_num;
-       uint32_t offset;
-
-       if (!b)
-       {
-               LOG(3, s, t, "MPPP: Invalid bundle id: 0\n");
-               return;
-       }
+        bundleidt b = session[s].bundle;
+       bundlet * this_bundle = &bundle[b];
+       uint32_t frag_offset, M_offset;
+       uint16_t frag_index, M_index;
+       fragmentationt *this_fragmentation = &frag[b];
+       uint8_t begin_frame = (*p & MP_BEGIN);
+        uint8_t end_frame = (*p & MP_END);
+        uint32_t seq_num;
+       uint8_t flags = *p;
+       uint16_t begin_index, end_index;
+
+       // Perform length checking
+        if(l > MAXFRAGLEN)
+        {
+               LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
+               return;
+        }

 
 

-       begin_frame = (*p & 0x80);
-       end_frame = (*p & 0x40);
-       if (session[s].mssf)
-       {
-               // Get 12 bit for seq number
-               uint16_t short_seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
-               uint16_t short_seq_num2 = short_seq_num >> 4;
-               p += 2;
-               l -= 2;
-               seq_num = short_seq_num2;
-               // After this point the pointer should be advanced 2 bytes
-               LOG(3, s, t, "MPPP: 12 bits, sequence number: %d, short1: %d, short2: %d\n",seq_num, short_seq_num, short_seq_num2);
-       }
+        if(!b)
+        {
+                LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
+                return;
+        }
+       // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf
+        /* if(session[s].mssf)
+        {
+                // Get 12 bit for seq number
+                seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
+                p += 2;
+                l -= 2;
+                // After this point the pointer should be advanced 2 bytes
+                LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
+        }
+        else */
+        {
+                // Get 24 bit for seq number
+                seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
+                p += 4;
+                l -= 4;
+                // After this point the pointer should be advanced 4 bytes
+                LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
+        }
+
+       // calculate this fragment's offset from the begin seq in the bundle
+       frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+
+       // discard this fragment if frag_offset is bigger that the fragmentation buffer size
+       if (frag_offset >= MAXFRAGNUM)
+        {
+               LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
+                return;
+        }
+       
+       // update M
+       sess_local[s].last_seq = seq_num;
+       if (seq_num < this_fragmentation->M)
+               this_fragmentation->M = seq_num;

        else
        {
        else
        {

-               // Get 24 bit for seq number
-               p++;
-               seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
-               seq_num = seq_num >> 8;
-               p += 3;
-               l -= 4;
-               // After this point the pointer should be advanced 4 bytes
-               LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
-       }
-
-       if (seq_num - bundle[b].offset < 0)
-       {
-               bundle[b].offset = 0;
-               bundle[b].pending_frag = 0;
+               uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;;
+               for (i = 1; i < this_bundle->num_of_links; i++)
+               {
+                       uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq; 
+                       if (s_seq < min)
+                               min = s_seq;
+               }
+               this_fragmentation->M = min;
+       }
+
+       LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M); 
+       //calculate M's offset from the begin seq in the bundle
+       M_offset = (this_fragmentation->M + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+
+       //caculate M's index in the fragment array
+       M_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
+       
+       //caculate received fragment's index in the fragment array
+       frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
+
+       //frame with a single fragment
+       if (begin_frame && end_frame)
+       {
+               // process and reset fragmentation
+                LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
+               this_fragmentation->fragment[frag_index].length = l;
+               this_fragmentation->fragment[frag_index].sid = s;
+               this_fragmentation->fragment[frag_index].flags = flags;
+               this_fragmentation->fragment[frag_index].seq = seq_num;
+               this_fragmentation->re_frame_begin_index = frag_index;
+               this_fragmentation->re_frame_end_index = frag_index;
+               processmpframe(s, t, p, l, 0);
+               this_fragmentation->fragment[frag_index].length = 0;
+               this_fragmentation->fragment[frag_index].flags = 0;
+               end_index = frag_index;

        }
        }

-
-       offset = bundle[b].offset;
-       if (begin_frame)
+       else

        {
        {

-               // Check for previous non-assembled frames
-               int error = 0;
-               if (bundle[b].pending_frag)
+               // insert the frame in it's place
+               fragmentt *this_frag = &this_fragmentation->fragment[frag_index];
+               this_frag->length = l;
+               this_frag->sid = s;
+               this_frag->flags = flags;
+               this_frag->seq = seq_num;
+                memcpy(this_frag->data, p, l);
+
+               // try to assemble the frame that has the received fragment as a member         
+               // get the beginning of this frame
+               begin_index = end_index = frag_index;
+               while (this_fragmentation->fragment[begin_index].length)

                {
                {

-                       uint32_t fn = bundle[b].seq_num_m - offset;
-                       uint16_t cur_len;
-                       bundle[b].pending_frag = 0;
-                       // Check for array indexes
-                       if (fn < 0 || fn > MAXFRAGNUM)
-                       {
-                               LOG(2, s, t, "ERROR: Index out of range fn:%d, bundle:%d\n",fn,b);
-                               return;
-                       }
-
-                       if (seq_num-offset < 0 || seq_num-offset > MAXFRAGNUM)
-                       {
-                               LOG(2, s, t, "ERROR: Index out of range fn(last):%d, bundle:%d\n",fn,b);
-                               return;
-                       }
-                       /////////////////////////////////////////////////////
-                       cur_len = 4;   // This is set to 4 to leave 4 bytes for function processipin
-                       for (fn = bundle[b].seq_num_m - offset; fn < seq_num - offset; fn++)
-                       {
-                               if (!frag[b].fragment[fn].length)
-                               {
-                                       LOG(4, s, t, "MPPP: Found lost fragment while reassembling frame %d in (%d,%d)\n",fn, bundle[b].seq_num_m-offset, seq_num-offset);
-                                       error = 1;
-                                       break;
-                               }
-
-                               if (cur_len + frag[b].fragment[fn].length > MAXETHER)
-                               {
-                                       LOG(2, s, t, "MPPP: ERROR: very long frame after assembling %d\n", frag[b].fragment[fn].length+cur_len);
-                                       error = 1;
-                                       break;
-                               }
-
-                               memcpy(frag[b].reassembled_frame+cur_len, frag[b].fragment[fn].data, frag[b].fragment[fn].length);
-                               cur_len += frag[b].fragment[fn].length; 
-                               frag[b].fragment[fn].length = 0;      // Indicates that this fragment has been consumed
-                               // This is usefull for compression
-                               memset(frag[b].fragment[fn].data, 0, sizeof(frag[b].fragment[fn].data));
-                       }
-
-                       if (!error)
-                       {
-                               frag[b].re_frame_len = cur_len;
-                               // Process the resassembled frame
-                               LOG(4, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
-                               processmpframe(s, t, frag[b].reassembled_frame, frag[b].re_frame_len, 1);
-                               // Set reassembled frame length to zero after processing it
-                               frag[b].re_frame_len = 0;
-                               memset(frag[b].reassembled_frame, 0, sizeof(frag[b].reassembled_frame));
-                       }
+                       if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN)
+                               break;
+                       begin_index = (begin_index ? (begin_index -1) : (MAXFRAGNUM -1)); 

                }
                }

-               //////////////////////////////////////////
-               bundle[b].seq_num_m = seq_num;
-               if (end_frame)
+
+               // return if a lost fragment is found
+               if (!(this_fragmentation->fragment[begin_index].length))
+                       return; // assembling frame failed
+               // get the end of his frame
+               while (this_fragmentation->fragment[end_index].length)

                {
                {

-                       // Both bits are set
-                       LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
-                       processmpframe(s, t, p, l, 0);
-                       // The maximum number of fragments is 1500
-                       if (seq_num - bundle[b].offset >= 1400)
-                       {
-                               bundle[b].offset = seq_num;
-                               LOG(4, s, t, "MPPP: Setting offset to: %d\n",bundle[b].offset);
-                       }
+                       if (this_fragmentation->fragment[end_index].flags & MP_END)
+                               break;
+                       end_index = (end_index +1) & MAXFRAGNUM_MASK; 

                }
                }

-               else
-               {
-                       bundle[b].pending_frag = 1;
-                       // End bit is clear
-                       LOG(4, s, t, "MPPP: Push to receive buffer\n");
-                       // Push to the receive buffer
-                       // Array indexes checking
-                       if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM)
-                       {
-                               LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(1) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b);
-                               return;
-                       }
-                       // Perform length checking
-                       if (l > MAXFRAGLEN)
+
+               // return if a lost fragment is found
+               if (!(this_fragmentation->fragment[end_index].length))
+                       return; // assembling frame failed
+
+               // assemble the packet
+               //assemble frame, process it, reset fragmentation
+               uint16_t cur_len = 4;   // This is set to 4 to leave 4 bytes for function processipin
+               uint32_t i;
+
+                       LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
+                       // Push to the receive buffer
+                                       
+               for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
+                {
+                       this_frag = &this_fragmentation->fragment[i];
+                        if(cur_len + this_frag->length > MAXETHER)
+                        {
+                                LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");                            
+                                break;
+                        }
+                        memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
+                       LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
+                        cur_len += this_frag->length;
+                       if (i == end_index)

                        {
                        {

-                               LOG(2, s, t, "MPPP: ERROR: very long fragment length (1)\n");
-                               return;
+                               this_fragmentation->re_frame_len = cur_len;
+                               this_fragmentation->re_frame_begin_index = begin_index;
+                               this_fragmentation->re_frame_end_index = end_index;
+                               // Process the resassembled frame
+                               LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
+                               processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
+                               break;

                        }
                        }

-                       frag[b].fragment[seq_num - offset].length = l;
-                       memcpy(frag[b].fragment[seq_num - offset].data, p, l);
-               }
-       }
-       else
-       {
-               LOG(4, s, t, "MPPP: Push to receive buffer\n");
-               // Push to the receive buffer
-               // Array indexes checking
-               if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM)
-               {
-                       LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(2) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b);
-                       return;
-               }
-               // Perform length checking
-               if (l > MAXFRAGLEN)
+                }
+                // Set reassembled frame length to zero after processing it
+                this_fragmentation->re_frame_len = 0;
+               for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)

                {
                {

-                       LOG(2, s, t, "MPPP: ERROR: very long fragment length (2).\n");
-                       return;
+                       this_fragmentation->fragment[i].length = 0;      // Indicates that this fragment has been consumed
+                       this_fragmentation->fragment[i].flags = 0;
+                       if (i == end_index)
+                               break;

                }
                }

-               frag[b].fragment[seq_num - offset].length = l;
-               memcpy(frag[b].fragment[seq_num - offset].data, p, l);

        }
        }

+       //discard fragments received before the recently assembled frame
+       begin_index = this_fragmentation->start_index;
+       this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
+        this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
+       //clear length and flags of the discarded fragments
+       while (begin_index != this_fragmentation->start_index)
+        {
+                this_fragmentation->fragment[begin_index].flags = 0;
+               this_fragmentation->fragment[begin_index].length = 0;
+                begin_index = (begin_index + 1) & MAXFRAGNUM_MASK;
+        }
+
+       LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq);     
+       return;

 }
 
 // process IPv6 packet received
 }
 
 // process IPv6 packet received


@@ -1989,12 +2076,7 @@ void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
                snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
        }
 
                snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
        }
 

-       increment_counter(&session[s].cin, &session[s].cin_wrap, l);
-       session[s].cin_delta += l;
-       session[s].pin++;
-
-       sess_local[s].cin += l;
-       sess_local[s].pin++;
+       update_sessions_in_stat(s, l);

 
        eth_tx += l;
 
 
        eth_tx += l;
 


@@ -2265,7 +2347,7 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
                {
                        // Set the multilink bits
                        uint16_t bits_send = mp_bits;
                {
                        // Set the multilink bits
                        uint16_t bits_send = mp_bits;

-                       *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0xFF0F)|bits_send);
+                       *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0x0FFF)|bits_send);

                        b += 2;
                }
                else
                        b += 2;
                }
                else

diff --git a/radius.c b/radius.c
index 3da31f8..9c28157 100644 (file)
--- a/radius.c
+++ b/radius.c
@@ -1,6 +1,6 @@
 // L2TPNS Radius Stuff
 
 // L2TPNS Radius Stuff
 

-char const *cvs_id_radius = "$Id: radius.c,v 1.55 2006-08-02 14:17:30 bodea Exp $";
+char const *cvs_id_radius = "$Id: radius.c,v 1.56 2009-12-08 14:49:28 bodea Exp $";

 
 #include <time.h>
 #include <stdio.h>
 
 #include <time.h>
 #include <stdio.h>


@@ -177,7 +177,7 @@ void radiussend(uint16_t r, uint8_t state)
                return;
        }
 
                return;
        }
 

-       if (state != RADIUSAUTH && !config->radius_accounting)
+       if (state != RADIUSAUTH && state != RADIUSJUSTAUTH && !config->radius_accounting)

        {
                // Radius accounting is turned off
                radiusclear(r, s);
        {
                // Radius accounting is turned off
                radiusclear(r, s);


@@ -197,7 +197,7 @@ void radiussend(uint16_t r, uint8_t state)
        {
                if (s)
                {
        {
                if (s)
                {

-                       if (state == RADIUSAUTH)
+                       if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)

                                sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
                        else
                        {
                                sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
                        else
                        {


@@ -219,6 +219,7 @@ void radiussend(uint16_t r, uint8_t state)
        switch (state)
        {
                case RADIUSAUTH:
        switch (state)
        {
                case RADIUSAUTH:

+               case RADIUSJUSTAUTH:

                        b[0] = AccessRequest;               // access request
                        break;
                case RADIUSSTART:
                        b[0] = AccessRequest;               // access request
                        break;
                case RADIUSSTART:


@@ -239,7 +240,7 @@ void radiussend(uint16_t r, uint8_t state)
                strcpy((char *) p + 2, session[s].user);
                p += p[1];
        }
                strcpy((char *) p + 2, session[s].user);
                p += p[1];
        }

-       if (state == RADIUSAUTH)
+       if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)

        {
                if (radius[r].chap)
                {
        {
                if (radius[r].chap)
                {


@@ -380,12 +381,12 @@ void radiussend(uint16_t r, uint8_t state)
 
                *p = 6;         // Service-Type
                p[1] = 6;
 
                *p = 6;         // Service-Type
                p[1] = 6;

-               *(uint32_t *) (p + 2) = htonl(2); // Framed-User
+               *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 8 : 2)); // Authenticate only or Framed-User respectevily

                p += p[1];
                   
                *p = 7;         // Framed-Protocol
                p += p[1];
                   
                *p = 7;         // Framed-Protocol

-               p[1] = 6;
-               *(uint32_t *) (p + 2) = htonl(1); // PPP
+               p[1] = htonl((state == RADIUSJUSTAUTH ? 0 : 6));
+               *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 0 : 1)); // PPP

                p += p[1];
 
                if (session[s].ip)
                p += p[1];
 
                if (session[s].ip)


@@ -462,7 +463,7 @@ void radiussend(uint16_t r, uint8_t state)
 
        // All AVpairs added
        *(uint16_t *) (b + 2) = htons(p - b);
 
        // All AVpairs added
        *(uint16_t *) (b + 2) = htons(p - b);

-       if (state != RADIUSAUTH)
+       if (state != RADIUSAUTH && state != RADIUSJUSTAUTH)

        {
                // Build auth for accounting packet
                calc_auth(b, p - b, zero, b + 4);
        {
                // Build auth for accounting packet
                calc_auth(b, p - b, zero, b + 4);


@@ -475,7 +476,7 @@ void radiussend(uint16_t r, uint8_t state)
                // get radius port
                uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers];
                // assume RADIUS accounting port is the authentication port +1
                // get radius port
                uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers];
                // assume RADIUS accounting port is the authentication port +1

-               addr.sin_port = htons((state == RADIUSAUTH) ? port : port+1);
+               addr.sin_port = htons((state == RADIUSAUTH || state == RADIUSJUSTAUTH) ? port : port+1);

        }
 
        LOG_HEX(5, "RADIUS Send", b, (p - b));
        }
 
        LOG_HEX(5, "RADIUS Send", b, (p - b));


@@ -558,7 +559,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
                LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");
                return;
        }
                LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");
                return;
        }

-       if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSSTART
+       if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSJUSTAUTH && radius[r].state != RADIUSSTART

            && radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM)
        {
                LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");
            && radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM)
        {
                LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response\n");


@@ -573,7 +574,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
                        return; // Do nothing. On timeout, it will try the next radius server.
                }
 
                        return; // Do nothing. On timeout, it will try the next radius server.
                }
 

-               if ((radius[r].state == RADIUSAUTH && r_code != AccessAccept && r_code != AccessReject) ||
+               if (((radius[r].state == RADIUSAUTH ||radius[r].state == RADIUSJUSTAUTH) && r_code != AccessAccept && r_code != AccessReject) ||

                        ((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse))
                {
                        LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response %s\n", radius_code(r_code));
                        ((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse))
                {
                        LOG(1, s, session[s].tunnel, "   Unexpected RADIUS response %s\n", radius_code(r_code));


@@ -581,7 +582,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
                                // care off finishing the radius session if that's really correct.
                }
 
                                // care off finishing the radius session if that's really correct.
                }
 

-               if (radius[r].state == RADIUSAUTH)
+               if (radius[r].state == RADIUSAUTH || radius[r].state == RADIUSJUSTAUTH)

                {
                        // run post-auth plugin
                        struct param_post_auth packet = {
                {
                        // run post-auth plugin
                        struct param_post_auth packet = {


@@ -783,6 +784,8 @@ void processrad(uint8_t *buf, int len, char socket_index)
                                                if (p[1] < 6) continue;
                                                session[s].session_timeout = ntohl(*(uint32_t *)(p + 2));
                                                LOG(3, s, session[s].tunnel, "   Radius reply contains Session-Timeout = %u\n", session[s].session_timeout);
                                                if (p[1] < 6) continue;
                                                session[s].session_timeout = ntohl(*(uint32_t *)(p + 2));
                                                LOG(3, s, session[s].tunnel, "   Radius reply contains Session-Timeout = %u\n", session[s].session_timeout);

+                                               if(!session[s].session_timeout && config->kill_timedout_sessions)
+                                                        sessionshutdown(s, "Session timeout is zero", CDN_ADMIN_DISC, 0);

                                        }
                                        else if (*p == 28)
                                        {
                                        }
                                        else if (*p == 28)
                                        {


@@ -869,6 +872,7 @@ void radiusretry(uint16_t r)
                        sendchap(s, t);
                        break;
                case RADIUSAUTH:        // sending auth to RADIUS server
                        sendchap(s, t);
                        break;
                case RADIUSAUTH:        // sending auth to RADIUS server

+               case RADIUSJUSTAUTH:    // sending auth to RADIUS server

                case RADIUSSTART:       // sending start accounting to RADIUS server
                case RADIUSSTOP:        // sending stop accounting to RADIUS server
                case RADIUSINTERIM:     // sending interim accounting to RADIUS server
                case RADIUSSTART:       // sending start accounting to RADIUS server
                case RADIUSSTOP:        // sending stop accounting to RADIUS server
                case RADIUSINTERIM:     // sending interim accounting to RADIUS server