+Wed Dec 9 2009 Brendan O'Dea <bod@optus.net> 2.2.x
+- Apply MLPPP patch from Muhammad Tayseer Alquoatli.
+
* Mon Dec 18 2006 Brendan O'Dea <bod@optus.net> 2.2.0
- Only poll clifd if successfully bound.
- Add "Practical VPNs" document from Liran Tal as Docs/vpn .
Khaled Al Hamwi <kh.alhamwi@gmail.com>
Graham Maltby <gmaltby+l2tpns@iig.com.au>
Rhys Kidd <rhys.kidd@staff.westnet.com.au>
+Muhammad Tayseer Alquoatli <idoit.ief@gmail.com>
// L2TPNS Clustering Stuff
-char const *cvs_id_cluster = "$Id: cluster.c,v 1.54 2006/12/04 20:50:02 bodea Exp $";
+char const *cvs_id_cluster = "$Id: cluster.c,v 1.55 2009/12/08 14:49:28 bodea Exp $";
#include <stdio.h>
#include <stdlib.h>
x.ver = 1;
x.addr = config->bind_address;
- x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels;
+ x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels + config->cluster_undefined_bundles;
x.basetime = basetime;
add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x));
if (bcount >= config->cluster_highest_bundleid)
break;
- hb_add_type(&p, C_CTUNNEL, walk_bundle_number);
- walk_tunnel_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero.
-
+ hb_add_type(&p, C_CBUNDLE, walk_bundle_number);
+ walk_bundle_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero.
++bcount;
}
// L2TPNS: constants
-char const *cvs_id_constants = "$Id: constants.c,v 1.7 2005/07/31 10:04:10 bodea Exp $";
+char const *cvs_id_constants = "$Id: constants.c,v 1.8 2009/12/08 14:49:28 bodea Exp $";
#include <stdio.h>
#include "constants.h"
"RADIUSSTART", // 3
"RADIUSSTOP", // 4
"RADIUSINTERIM", // 5
- "RADIUSWAIT" // 6
+ "RADIUSWAIT", // 6
+ "RADIUSJUSTAUTH" // 7
)
CONSTANT(radius_code,
# Allow multiple logins for the same username
#set allow_duplicate_users no
+# Kill timedout sessions ? (default yes)
+#set kill_timedout_sessions no
+
# Allow multiple logins for specific username
#set guest_account ""
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8
-char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.172 2006/12/18 12:05:36 bodea Exp $";
+char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.173 2009/12/08 14:49:28 bodea Exp $";
#include <arpa/inet.h>
#include <assert.h>
static int syslog_log = 0; // are we logging to syslog
static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog).
uint32_t last_id = 0; // Unique ID for radius accounting
+// Guest change
+char guest_users[10][32]; // Array of guest users
+int guest_accounts_num = 0; // Number of guest users
// calculated from config->l2tp_mtu
uint16_t MRU = 0; // PPP MRU
CONFIG("radius_bind_min", radius_bind_min, SHORT),
CONFIG("radius_bind_max", radius_bind_max, SHORT),
CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL),
+ CONFIG("kill_timedout_sessions", kill_timedout_sessions, BOOL),
CONFIG("guest_account", guest_user, STRING),
CONFIG("bind_address", bind_address, IPv4),
CONFIG("peer_address", peer_address, IPv4),
l -= 4;
}
- // Process this frame
- if (*p & 1)
- {
- proto = *p++;
- l--;
- }
- else
- {
- proto = ntohs(*(uint16_t *) p);
- p += 2;
- l -= 2;
- }
-
- if (proto == PPPIP)
- {
- if (session[s].die)
- {
- LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s);
- return; // closing session, PPP not processed
- }
+ if (*p & 1)
+ {
+ proto = *p++;
+ l--;
+ }
+ else
+ {
+ proto = ntohs(*(uint16_t *) p);
+ p += 2;
+ l -= 2;
+ }
+ if (proto == PPPIP)
+ {
+ if (session[s].die)
+ {
+ LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
+ return; // closing session, PPP not processed
+ }
+ session[s].last_packet = session[s].last_data = time_now;
+ processipin(s, t, p, l);
+ }
+ else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
+ {
+ if (session[s].die)
+ {
+ LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
+ return; // closing session, PPP not processed
+ }
+
+ session[s].last_packet = session[s].last_data = time_now;
+ processipv6in(s, t, p, l);
+ }
+ else if (proto == PPPIPCP)
+ {
+ session[s].last_packet = session[s].last_data = time_now;
+ processipcp(s, t, p, l);
+ }
+ else if (proto == PPPCCP)
+ {
+ session[s].last_packet = session[s].last_data = time_now;
+ processccp(s, t, p, l);
+ }
+ else
+ {
+ LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
+ }
+}
- session[s].last_packet = session[s].last_data = time_now;
- processipin(s, t, p, l);
- }
- else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
- {
- if (session[s].die)
- {
- LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s);
- return; // closing session, PPP not processed
- }
+static void update_session_out_stat(sessionidt s, sessiont *sp, int len)
+{
+ increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
+ sp->cout_delta += len;
+ sp->pout++;
+ sp->last_data = time_now;
- session[s].last_packet = session[s].last_data = time_now;
- processipv6in(s, t, p, l);
- }
- else
- {
- LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
- }
+ sess_local[s].cout += len; // To send to master..
+ sess_local[s].pout++;
}
// process outgoing (to tunnel) IP
uint8_t *data = buf; // Keep a copy of the originals.
int size = len;
- uint8_t b1[MAXETHER + 20];
- uint8_t b2[MAXETHER + 20];
+ uint8_t fragbuf[MAXETHER + 20];
CSTAT(processipout);
}
return;
}
+
t = session[s].tunnel;
+ if (len > session[s].mru || (session[s].mrru && len > session[s].mrru))
+ {
+ LOG(3, s, t, "Packet size more than session MRU\n");
+ return;
+ }
+
sp = &session[s];
- sp->last_data = time_now;
// DoS prevention: enforce a maximum number of packets per 0.1s for a session
if (config->max_packets > 0)
}
// Add on L2TP header
- {
- bundleidt bid = 0;
- if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1)
- {
- bid = session[s].bundle;
- s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
- LOG(4, s, t, "MPPP: (1)Session number becomes: %u\n", s);
- if (len > 256)
- {
- // Partition the packet to 2 fragments
- uint32_t frag1len = len / 2;
- uint32_t frag2len = len - frag1len;
- uint8_t *p = makeppp(b1, sizeof(b1), buf, frag1len, s, t, PPPIP, 0, bid, MP_BEGIN);
- uint8_t *q;
-
- if (!p) return;
- tunnelsend(b1, frag1len + (p-b1), t); // send it...
- s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
- LOG(4, s, t, "MPPP: (2)Session number becomes: %u\n", s);
- q = makeppp(b2, sizeof(b2), buf+frag1len, frag2len, s, t, PPPIP, 0, bid, MP_END);
- if (!q) return;
- tunnelsend(b2, frag2len + (q-b2), t); // send it...
- }
- else {
- // Send it as one frame
- uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
- if (!p) return;
- tunnelsend(b1, len + (p-b1), t); // send it...
- }
- }
- else
- {
- uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, 0, 0);
- if (!p) return;
- tunnelsend(b1, len + (p-b1), t); // send it...
- }
- }
+ {
+ bundleidt bid = 0;
+ if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1)
+ {
+ bid = session[s].bundle;
+ s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
+ t = session[s].tunnel;
+ sp = &session[s];
+ LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s);
+ if(len > MINFRAGLEN)
+ {
+ // Partition the packet to "bundle[b].num_of_links" fragments
+ bundlet *b = &bundle[bid];
+ uint32_t num_of_links = b->num_of_links;
+ uint32_t fraglen = len / num_of_links;
+ fraglen = (fraglen > session[s].mru ? session[s].mru : fraglen);
+ uint32_t last_fraglen = fraglen + len % num_of_links;
+ last_fraglen = (last_fraglen > session[s].mru ? len % num_of_links : last_fraglen);
+ uint32_t remain = len;
+
+ // send the first packet
+ uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
+ if (!p) return;
+ tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+ // statistics
+ update_session_out_stat(s, sp, fraglen);
+ remain -= fraglen;
+ while (remain > last_fraglen)
+ {
+ s = b->members[b->current_ses = ++b->current_ses % num_of_links];
+ t = session[s].tunnel;
+ sp = &session[s];
+ LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
+ p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
+ if (!p) return;
+ tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
+ update_session_out_stat(s, sp, fraglen);
+ remain -= fraglen;
+ }
+ // send the last fragment
+ s = b->members[b->current_ses = ++b->current_ses % num_of_links];
+ t = session[s].tunnel;
+ sp = &session[s];
+ LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
+ p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
+ if (!p) return;
+ tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
+ update_session_out_stat(s, sp, remain);
+ if (remain != last_fraglen)
+ LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
+ }
+ else {
+ // Send it as one frame
+ uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
+ if (!p) return;
+ tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+ LOG(4, s, t, "MPPP: packet sent as one frame\n");
+ update_session_out_stat(s, sp, len);
+ }
+ }
+ else
+ {
+ uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
+ if (!p) return;
+ tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
+ update_session_out_stat(s, sp, len);
+ }
+ }
// Snooping this session, send it to intercept box
if (sp->snoop_ip && sp->snoop_port)
snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
- increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
- sp->cout_delta += len;
- sp->pout++;
udp_tx += len;
-
- sess_local[s].cout += len; // To send to master..
- sess_local[s].pout++;
}
// process outgoing (to tunnel) IPv6
void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause)
{
int walled_garden = session[s].walled_garden;
-
+ bundleidt b = session[s].bundle;
+ //delete routes only for last session in bundle (in case of MPPP)
+ int del_routes = !b || (bundle[b].num_of_links == 1);
CSTAT(sessionshutdown);
(session[s].route[r].ip & session[s].route[r].mask))
routed++;
- routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0);
+ if (del_routes) routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0);
session[s].route[r].ip = 0;
}
if (session[s].ip_pool_index == -1) // static ip
{
- if (!routed) routeset(s, session[s].ip, 0, 0, 0);
+ if (!routed && del_routes) routeset(s, session[s].ip, 0, 0, 0);
session[s].ip = 0;
}
else
free_ip_address(s);
// unroute IPv6, if setup
- if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen)
+ if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes)
route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);
+
+ if (b)
+ {
+ // This session was part of a bundle
+ bundle[b].num_of_links--;
+ LOG(3, s, 0, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
+ if(bundle[b].num_of_links == 0)
+ {
+ bundleclear(b);
+ LOG(3, s, 0, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
+ }
+ else
+ {
+ // Adjust the members array to accomodate the new change
+ uint8_t mem_num = 0;
+ // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
+ if(bundle[b].members[bundle[b].num_of_links] != s)
+ {
+ uint8_t ml;
+ for(ml = 0; ml<bundle[b].num_of_links; ml++)
+ if(bundle[b].members[ml] == s)
+ {
+ mem_num = ml;
+ break;
+ }
+ bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
+ LOG(3, s, 0, "MPPP: Adjusted member links array\n");
+ }
+ }
+ cluster_send_bundle(b);
+ }
}
if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
// kill a session now
void sessionkill(sessionidt s, char *reason)
{
- bundleidt b;
-
CSTAT(sessionkill);
if (!session[s].opened) // not alive
if (sess_local[s].radius)
radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
- LOG(2, s, session[s].tunnel, "Kill session %u (%s): %s\n", s, session[s].user, reason);
- if ((b = session[s].bundle))
- {
- // This session was part of a bundle
- bundle[b].num_of_links--;
- LOG(3, s, 0, "MPPP: Dropping member link: %u from bundle %u\n", s, b);
- if (bundle[b].num_of_links == 0)
- {
- bundleclear(b);
- LOG(3, s, 0, "MPPP: Kill bundle: %u (No remaing member links)\n", b);
- }
- else
- {
- // Adjust the members array to accomodate the new change
- uint8_t mem_num = 0;
- // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
- if (bundle[b].members[bundle[b].num_of_links] != s)
- {
- uint8_t ml;
- for (ml = 0; ml<bundle[b].num_of_links; ml++)
- {
- if (bundle[b].members[ml] == s)
- {
- mem_num = ml;
- break;
- }
- }
- bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
- LOG(3, s, 0, "MPPP: Adjusted member links array\n");
- }
- }
- cluster_send_bundle(b);
- }
+ LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
sessionclear(s);
cluster_send_session(s);
}
config->ppp_restart_time = 3;
config->ppp_max_configure = 10;
config->ppp_max_failure = 5;
+ config->kill_timedout_sessions = 1;
strcpy(config->random_device, RANDOMDEVICE);
log_stream = stderr;
}
}
+ // Guest change
+ guest_accounts_num = 0;
+ char *p2 = config->guest_user;
+ while (p2 && *p2)
+ {
+ char *s = strpbrk(p2, " \t,");
+ if (s)
+ {
+ *s++ = 0;
+ while (*s == ' ' || *s == '\t')
+ s++;
+
+ if (!*s)
+ s = 0;
+ }
+
+ strcpy(guest_users[guest_accounts_num], p2);
+ LOG(1, 0, 0, "Guest account[%d]: %s\n", guest_accounts_num, guest_users[guest_accounts_num]);
+ guest_accounts_num++;
+ p2 = s;
+ }
+ // Rebuild the guest_user array
+ strcpy(config->guest_user, "");
+ int ui = 0;
+ for (ui=0; ui<guest_accounts_num; ui++)
+ {
+ strcat(config->guest_user, guest_users[ui]);
+ if (ui<guest_accounts_num-1)
+ {
+ strcat(config->guest_user, ",");
+ }
+ }
+
+
memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
if (!config->multi_read_count) config->multi_read_count = 10;
if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);
LOG(3, s, t, "Doing session setup for session\n");
+ // Join a bundle if the MRRU option is accepted
+ if(session[s].mrru > 0 && session[s].bundle == 0)
+ {
+ LOG(3, s, t, "This session can be part of multilink bundle\n");
+ if (join_bundle(s) > 0)
+ cluster_send_bundle(session[s].bundle);
+ else
+ {
+ LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n");
+ sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE);
+ return 0;
+ }
+ }
+
if (!session[s].ip)
{
assign_ip_address(s);
// Make sure this is right
session[s].tunnel = t;
- // Join a bundle if the MRRU option is accepted
- if (session[s].mrru > 0 && !session[s].bundle)
- {
- LOG(3, s, t, "This session can be part of multilink bundle\n");
- if (join_bundle(s))
- cluster_send_bundle(session[s].bundle);
- }
-
// zap old sessions with same IP and/or username
// Don't kill gardened sessions - doing so leads to a DoS
// from someone who doesn't need to know the password
{
if (i == s) continue;
if (!session[s].opened) continue;
+ // Allow duplicate sessions for multilink ones of the same bundle.
+ if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
+ continue;
if (ip == session[i].ip)
{
sessionkill(i, "Duplicate IP address");
continue;
}
- if (config->allow_duplicate_users)
- continue;
-
- if (session[s].walled_garden || session[i].walled_garden)
- continue;
-
- // Allow duplicate sessions for guest account.
- if (*config->guest_user && !strcasecmp(user, config->guest_user))
- continue;
-
- // Allow duplicate sessions for multilink ones of the same bundle.
- if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
- continue;
+ if (config->allow_duplicate_users) continue;
+ if (session[s].walled_garden || session[i].walled_garden) continue;
+ // Guest change
+ int found = 0;
+ int gu;
+ for (gu = 0; gu < guest_accounts_num; gu++)
+ {
+ if (!strcasecmp(user, guest_users[gu]))
+ {
+ found = 1;
+ break;
+ }
+ }
+ if (found) continue;
// Drop the new session in case of duplicate sessionss, not the old one.
if (!strcasecmp(user, session[i].user))
}
}
+ // no need to set a route for the same IP address of the bundle
+ if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1))
{
int routed = 0;
// L2TPNS Global Stuff
-// $Id: l2tpns.h,v 1.120 2006/10/23 02:51:53 bodea Exp $
+// $Id: l2tpns.h,v 1.121 2009/12/08 14:49:28 bodea Exp $
#ifndef __L2TPNS_H__
#define __L2TPNS_H__
// Limits
#define MAXTUNNEL 500 // could be up to 65535
#define MAXBUNDLE 300 // could be up to 65535
-#define MAXBUNDLESES 10 // Maximum number of member links in bundle
+#define MAXBUNDLESES 12 // Maximum number of member links in bundle
#define MAXADDRESS 20 // Maximum length for the Endpoint Discrminiator address
-#define MAXFRAGNUM 1500 // Maximum number of Multilink fragment in a bundle
-#define MAXFRAGLEN 1000 // Maximum length for Multilink fragment
#define MAXSESSION 60000 // could be up to 65535
#define MAXTBFS 6000 // Maximum token bucket filters. Might need up to 2 * session.
#define IDLE_TIMEOUT 240 // Time between last packet seen and session shutdown
#define BUSY_WAIT_TIME 3000 // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown
-#define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header
-#define MP_END 0x40 // This value is used when (e)nd bit is set in MP header
-#define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header
+#define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header
+#define MP_END 0x40 // This value is used when (e)nd bit is set in MP header
+#define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header
+
+#define MINFRAGLEN 64 // Minumum fragment length
+#define MAXFRAGLEN 750 // Maximum length for Multilink fragment (MTU / 2 sessions)
+#define MAXFRAGNUM 128 // Maximum number of Multilink fragment in a bundle (must be in the form of 2^X)
+ // it's not expected to have a space for more than 10 unassembled packets = 10 * MAXBUNDLESES
+#define MAXFRAGNUM_MASK 127 // Must be equal to MAXFRAGNUM-1
// Constants
#ifndef ETCDIR
} epdist;
typedef struct {
- uint16_t length; // Fragment length
- uint8_t data[MAXFRAGLEN]; // Fragment data
+ sessionidt sid; // Fragment originating session
+ uint8_t flags; // MP frame flags
+ uint32_t seq; // fragment seq num
+ uint16_t length; // Fragment length
+ uint8_t data[MAXFRAGLEN]; // Fragment data
} fragmentt;
typedef struct
char calling[MAXTEL]; // calling number
uint32_t tx_connect_speed;
uint32_t rx_connect_speed;
- uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
- uint8_t mssf; // Multilink Short Sequence Number Header Format
- epdist epdis; // Multilink Endpoint Discriminator
- bundleidt bundle; // Multilink Bundle Identifier
+ clockt timeout; // Session timeout
+ uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
+ uint8_t mssf; // Multilink Short Sequence Number Header Format
+ epdist epdis; // Multilink Endpoint Discriminator
+ bundleidt bundle; // Multilink Bundle Identifier
in_addr_t snoop_ip; // Interception destination IP
uint16_t snoop_port; // Interception destination port
uint8_t walled_garden; // is this session gardened?
typedef struct
{
- int state; // current state (bundlestate enum)
- uint32_t seq_num_t; // Sequence Number (transmission)
- uint32_t seq_num_m; // Last received frame sequence number (bearing B bit)
- uint32_t offset; // Offset between sequence number and array index
- uint8_t pending_frag; // Indicate that there is pending fragments to reassemble
- uint8_t num_of_links; // Number of links joint to this bundle
- uint32_t online_time; // The time this bundle is online
- clockt last_check; // Last time the timeout is checked
- uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
- uint8_t mssf; // Multilink Short Sequence Number Header Format
- epdist epdis; // Multilink Endpoint Discriminator
- char user[MAXUSER]; // Needed for matching member links
- sessionidt current_ses; // Current session to use for sending (used in RR load-balancing)
- sessionidt members[MAXBUNDLESES]; // Array for member links sessions
+ int state; // current state (bundlestate enum)
+ uint32_t seq_num_t; // Sequence Number (transmission)
+ uint32_t timeout; // Session-Timeout for bundle
+ uint32_t max_seq; // Max value of sequence number field
+ uint8_t num_of_links; // Number of links joint to this bundle
+ uint32_t online_time; // The time this bundle is online
+ clockt last_check; // Last time the timeout is checked
+ uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
+ uint8_t mssf; // Multilink Short Sequence Number Header Format
+ epdist epdis; // Multilink Endpoint Discriminator
+ char user[MAXUSER]; // Needed for matching member links
+ sessionidt current_ses; // Current session to use for sending (used in RR load-balancing)
+ sessionidt members[MAXBUNDLESES]; // Array for member links sessions
}
bundlet;
typedef struct
{
- fragmentt fragment[MAXFRAGNUM];
- uint8_t reassembled_frame[MAXETHER]; // The reassembled frame
- uint16_t re_frame_len; // The reassembled frame length
+ fragmentt fragment[MAXFRAGNUM];
+ uint8_t reassembled_frame[MAXETHER]; // The reassembled frame
+ uint16_t re_frame_len; // The reassembled frame length
+ uint16_t re_frame_begin_index, re_frame_end_index; // reassembled frame begin index, end index respectively
+ uint16_t start_index, end_index; // start and end sequence numbers available on the fragments array respectively
+ uint32_t M; // Minumum frame sequence number received over all bundle members
+ uint32_t start_seq; // Last received frame sequence number (bearing B bit)
}
fragmentationt;
// last LCP Echo
time_t last_echo;
+
+ // Last Multilink frame sequence number received
+ uint32_t last_seq;
} sessionlocalt;
// session flags
RADIUSSTOP, // sending stop accounting to RADIUS server
RADIUSINTERIM, // sending interim accounting to RADIUS server
RADIUSWAIT, // waiting timeout before available, in case delayed replies
+ RADIUSJUSTAUTH, // sending auth to RADIUS server, just authentication, no ip assigning
};
struct Tstats
int radius_authprefer;
int allow_duplicate_users; // allow multiple logins with the same username
- char guest_user[MAXUSER]; // allow multiple logins to guest account username
+ int kill_timedout_sessions; // kill authenticated sessions with "session_timeout == 0"
in_addr_t default_dns1, default_dns2;
int cluster_hb_interval; // How often to send a heartbeat.
int cluster_hb_timeout; // How many missed heartbeats trigger an election.
uint64_t cluster_table_version; // # state changes processed by cluster
- int cluster_master_min_adv; // Master advertises routes while the number of up to date
- // slaves is less than this value.
struct in6_addr ipv6_prefix; // Our IPv6 network pool.
+
+ int cluster_master_min_adv; // Master advertises routes while the number of up to date
+ // slaves is less than this value.
+ // Guest change
+ char guest_user[MAXUSER]; // Guest account username
+
#ifdef BGP
#define BGP_NUM_PEERS 2
uint16_t as_number;
// L2TPNS PPP Stuff
-char const *cvs_id_ppp = "$Id: ppp.c,v 1.103 2007/01/25 12:36:48 bodea Exp $";
+char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009/12/08 14:49:28 bodea Exp $";
#include <stdio.h>
#include <string.h>
static void setepdis(epdist *, epdist);
static void ipcp_open(sessionidt s, tunnelidt t);
+static int first_session_in_bundle(sessionidt s)
+{
+ bundleidt i;
+ for (i = 1; i < MAXBUNDLE; i++)
+ if (bundle[i].state != BUNDLEFREE)
+ if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
+ return 0;
+ return 1;
+}
+
// Process PAP messages
void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
{
radius[r].id = p[1];
LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
- radiussend(r, RADIUSAUTH);
+ if ((session[s].mrru) && (!first_session_in_bundle(s)))
+ radiussend(r, RADIUSJUSTAUTH);
+ else
+ radiussend(r, RADIUSAUTH);
}
}
radius[r].chap = 1;
LOG(3, s, t, "CHAP login %s\n", session[s].user);
- radiussend(r, RADIUSAUTH);
+ if ((session[s].mrru) && (!first_session_in_bundle(s)))
+ radiussend(r, RADIUSJUSTAUTH);
+ else
+ radiussend(r, RADIUSAUTH);
}
static void dumplcp(uint8_t *p, int l)
}
else
{
- if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1)
- {
- sessionidt first_ses = bundle[session[s].bundle].members[0];
- LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n", s, first_ses);
- session[s].ip = session[first_ses].ip;
- session[s].dns1 = session[first_ses].dns1;
- session[s].dns2 = session[first_ses].dns2;
- session[s].session_timeout = session[first_ses].session_timeout;
- ipcp_open(s, t);
- }
- else
+ if(session[s].bundle == 0 || bundle[session[s].bundle].num_of_links == 1)
{
// This-Layer-Up
sendipcp(s, t);
change_state(s, ccp, Stopped);
}
+ else
+ {
+ sessionidt first_ses = bundle[session[s].bundle].members[0];
+ LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n",s,first_ses);
+ ipcp_open(s, t);
+ }
}
}
{
if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
{
+ sessionidt first_ses = bundle[i].members[0];
+ if (bundle[i].mssf != session[s].mssf)
+ {
+ // uniformity of sequence number format must be insured
+ LOG(3, s, session[s].tunnel, "MPPP: unable to bundle session %d in bundle %d cause of different mssf\n", s, i);
+ return -1;
+ }
session[s].bundle = i;
- bundle[i].mrru = session[s].mrru;
- bundle[i].mssf = session[s].mssf;
- if (session[s].epdis.length > 0)
+ session[s].ip = session[first_ses].ip;
+ session[s].dns1 = session[first_ses].dns1;
+ session[s].dns2 = session[first_ses].dns2;
+ session[s].timeout = session[first_ses].timeout;
+
+ if(session[s].epdis.length > 0)
setepdis(&bundle[i].epdis, session[s].epdis);
strcpy(bundle[i].user, session[s].user);
session[s].bundle = b;
bundle[b].mrru = session[s].mrru;
bundle[b].mssf = session[s].mssf;
- if (session[s].epdis.length > 0)
+ // FIXME !!! to enable l2tpns reading mssf frames receiver_max_seq, sender_max_seq must be introduce
+ // now session[s].mssf flag indecates that the receiver wish to receive frames in mssf, so max_seq (i.e. recv_max_seq) = 1<<24
+ /*
+ if (bundle[b].mssf)
+ bundle[b].max_seq = 1 << 12;
+ else */
+ bundle[b].max_seq = 1 << 24;
+ if(session[s].epdis.length > 0)
setepdis(&bundle[b].epdis, session[s].epdis);
strcpy(bundle[b].user, session[s].user);
bundle[b].members[0] = s;
+ bundle[b].timeout = session[s].timeout;
LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b);
return b;
}
static bundleidt new_bundle()
{
- bundleidt i;
- for (i = 1; i < MAXBUNDLE; i++)
- {
- if (bundle[i].state == BUNDLEFREE)
- {
- LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
- bundle[i].num_of_links = 1;
- bundle[i].last_check = time_now; // Initialize last_check value
- bundle[i].state = BUNDLEOPEN;
- bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first
- if (i > config->cluster_highest_bundleid)
- config->cluster_highest_bundleid = i;
- return i;
- }
- }
- LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
- return 0;
+ bundleidt i;
+ for (i = 1; i < MAXBUNDLE; i++)
+ {
+ if (bundle[i].state == BUNDLEFREE)
+ {
+ LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
+ bundle[i].num_of_links = 1;
+ bundle[i].last_check = time_now; // Initialize last_check value
+ bundle[i].state = BUNDLEOPEN;
+ bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first
+ memset(&frag[i], 0, sizeof(fragmentationt));
+ if (i > config->cluster_highest_bundleid)
+ config->cluster_highest_bundleid = i;
+ return i;
+ }
+ }
+ LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
+ return 0;
}
static void ipcp_open(sessionidt s, tunnelidt t)
}
}
+static void update_sessions_in_stat(sessionidt s, uint16_t l)
+{
+ bundleidt b = session[s].bundle;
+ if (!b)
+ {
+ increment_counter(&session[s].cin, &session[s].cin_wrap, l);
+ session[s].cin_delta += l;
+ session[s].pin++;
+
+ sess_local[s].cin += l;
+ sess_local[s].pin++;
+ }
+ else
+ {
+ int i = frag[b].re_frame_begin_index;
+ int end = frag[b].re_frame_end_index;
+ for (;;)
+ {
+ l = frag[b].fragment[i].length;
+ s = frag[b].fragment[i].sid;
+ increment_counter(&session[s].cin, &session[s].cin_wrap, l);
+ session[s].cin_delta += l;
+ session[s].pin++;
+
+ sess_local[s].cin += l;
+ sess_local[s].pin++;
+ if (i == end)
+ return;
+ i = (i + 1) & MAXFRAGNUM_MASK;
+ }
+ }
+}
+
// process IP packet received
//
// This MUST be called with at least 4 byte behind 'p'.
snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
}
- increment_counter(&session[s].cin, &session[s].cin_wrap, l);
- session[s].cin_delta += l;
- session[s].pin++;
-
- sess_local[s].cin += l;
- sess_local[s].pin++;
+ update_sessions_in_stat(s, l);
eth_tx += l;
// process Multilink PPP packet received
void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
{
- bundleidt b = session[s].bundle;
- uint8_t begin_frame;
- uint8_t end_frame;
- uint32_t seq_num;
- uint32_t offset;
-
- if (!b)
- {
- LOG(3, s, t, "MPPP: Invalid bundle id: 0\n");
- return;
- }
+ bundleidt b = session[s].bundle;
+ bundlet * this_bundle = &bundle[b];
+ uint32_t frag_offset, M_offset;
+ uint16_t frag_index, M_index;
+ fragmentationt *this_fragmentation = &frag[b];
+ uint8_t begin_frame = (*p & MP_BEGIN);
+ uint8_t end_frame = (*p & MP_END);
+ uint32_t seq_num;
+ uint8_t flags = *p;
+ uint16_t begin_index, end_index;
+
+ // Perform length checking
+ if(l > MAXFRAGLEN)
+ {
+ LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
+ return;
+ }
- begin_frame = (*p & 0x80);
- end_frame = (*p & 0x40);
- if (session[s].mssf)
- {
- // Get 12 bit for seq number
- uint16_t short_seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
- uint16_t short_seq_num2 = short_seq_num >> 4;
- p += 2;
- l -= 2;
- seq_num = short_seq_num2;
- // After this point the pointer should be advanced 2 bytes
- LOG(3, s, t, "MPPP: 12 bits, sequence number: %d, short1: %d, short2: %d\n",seq_num, short_seq_num, short_seq_num2);
- }
+ if(!b)
+ {
+ LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
+ return;
+ }
+ // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf
+ /* if(session[s].mssf)
+ {
+ // Get 12 bit for seq number
+ seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
+ p += 2;
+ l -= 2;
+ // After this point the pointer should be advanced 2 bytes
+ LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
+ }
+ else */
+ {
+ // Get 24 bit for seq number
+ seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
+ p += 4;
+ l -= 4;
+ // After this point the pointer should be advanced 4 bytes
+ LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
+ }
+
+ // calculate this fragment's offset from the begin seq in the bundle
+ frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+
+ // discard this fragment if frag_offset is bigger that the fragmentation buffer size
+ if (frag_offset >= MAXFRAGNUM)
+ {
+ LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
+ return;
+ }
+
+ // update M
+ sess_local[s].last_seq = seq_num;
+ if (seq_num < this_fragmentation->M)
+ this_fragmentation->M = seq_num;
else
{
- // Get 24 bit for seq number
- p++;
- seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
- seq_num = seq_num >> 8;
- p += 3;
- l -= 4;
- // After this point the pointer should be advanced 4 bytes
- LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
- }
-
- if (seq_num - bundle[b].offset < 0)
- {
- bundle[b].offset = 0;
- bundle[b].pending_frag = 0;
+ uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;;
+ for (i = 1; i < this_bundle->num_of_links; i++)
+ {
+ uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq;
+ if (s_seq < min)
+ min = s_seq;
+ }
+ this_fragmentation->M = min;
+ }
+
+ LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M);
+ //calculate M's offset from the begin seq in the bundle
+ M_offset = (this_fragmentation->M + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
+
+ //caculate M's index in the fragment array
+ M_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
+
+ //caculate received fragment's index in the fragment array
+ frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
+
+ //frame with a single fragment
+ if (begin_frame && end_frame)
+ {
+ // process and reset fragmentation
+ LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
+ this_fragmentation->fragment[frag_index].length = l;
+ this_fragmentation->fragment[frag_index].sid = s;
+ this_fragmentation->fragment[frag_index].flags = flags;
+ this_fragmentation->fragment[frag_index].seq = seq_num;
+ this_fragmentation->re_frame_begin_index = frag_index;
+ this_fragmentation->re_frame_end_index = frag_index;
+ processmpframe(s, t, p, l, 0);
+ this_fragmentation->fragment[frag_index].length = 0;
+ this_fragmentation->fragment[frag_index].flags = 0;
+ end_index = frag_index;
}
-
- offset = bundle[b].offset;
- if (begin_frame)
+ else
{
- // Check for previous non-assembled frames
- int error = 0;
- if (bundle[b].pending_frag)
+ // insert the frame in it's place
+ fragmentt *this_frag = &this_fragmentation->fragment[frag_index];
+ this_frag->length = l;
+ this_frag->sid = s;
+ this_frag->flags = flags;
+ this_frag->seq = seq_num;
+ memcpy(this_frag->data, p, l);
+
+ // try to assemble the frame that has the received fragment as a member
+ // get the beginning of this frame
+ begin_index = end_index = frag_index;
+ while (this_fragmentation->fragment[begin_index].length)
{
- uint32_t fn = bundle[b].seq_num_m - offset;
- uint16_t cur_len;
- bundle[b].pending_frag = 0;
- // Check for array indexes
- if (fn < 0 || fn > MAXFRAGNUM)
- {
- LOG(2, s, t, "ERROR: Index out of range fn:%d, bundle:%d\n",fn,b);
- return;
- }
-
- if (seq_num-offset < 0 || seq_num-offset > MAXFRAGNUM)
- {
- LOG(2, s, t, "ERROR: Index out of range fn(last):%d, bundle:%d\n",fn,b);
- return;
- }
- /////////////////////////////////////////////////////
- cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin
- for (fn = bundle[b].seq_num_m - offset; fn < seq_num - offset; fn++)
- {
- if (!frag[b].fragment[fn].length)
- {
- LOG(4, s, t, "MPPP: Found lost fragment while reassembling frame %d in (%d,%d)\n",fn, bundle[b].seq_num_m-offset, seq_num-offset);
- error = 1;
- break;
- }
-
- if (cur_len + frag[b].fragment[fn].length > MAXETHER)
- {
- LOG(2, s, t, "MPPP: ERROR: very long frame after assembling %d\n", frag[b].fragment[fn].length+cur_len);
- error = 1;
- break;
- }
-
- memcpy(frag[b].reassembled_frame+cur_len, frag[b].fragment[fn].data, frag[b].fragment[fn].length);
- cur_len += frag[b].fragment[fn].length;
- frag[b].fragment[fn].length = 0; // Indicates that this fragment has been consumed
- // This is usefull for compression
- memset(frag[b].fragment[fn].data, 0, sizeof(frag[b].fragment[fn].data));
- }
-
- if (!error)
- {
- frag[b].re_frame_len = cur_len;
- // Process the resassembled frame
- LOG(4, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
- processmpframe(s, t, frag[b].reassembled_frame, frag[b].re_frame_len, 1);
- // Set reassembled frame length to zero after processing it
- frag[b].re_frame_len = 0;
- memset(frag[b].reassembled_frame, 0, sizeof(frag[b].reassembled_frame));
- }
+ if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN)
+ break;
+ begin_index = (begin_index ? (begin_index -1) : (MAXFRAGNUM -1));
}
- //////////////////////////////////////////
- bundle[b].seq_num_m = seq_num;
- if (end_frame)
+
+ // return if a lost fragment is found
+ if (!(this_fragmentation->fragment[begin_index].length))
+ return; // assembling frame failed
+ // get the end of his frame
+ while (this_fragmentation->fragment[end_index].length)
{
- // Both bits are set
- LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
- processmpframe(s, t, p, l, 0);
- // The maximum number of fragments is 1500
- if (seq_num - bundle[b].offset >= 1400)
- {
- bundle[b].offset = seq_num;
- LOG(4, s, t, "MPPP: Setting offset to: %d\n",bundle[b].offset);
- }
+ if (this_fragmentation->fragment[end_index].flags & MP_END)
+ break;
+ end_index = (end_index +1) & MAXFRAGNUM_MASK;
}
- else
- {
- bundle[b].pending_frag = 1;
- // End bit is clear
- LOG(4, s, t, "MPPP: Push to receive buffer\n");
- // Push to the receive buffer
- // Array indexes checking
- if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM)
- {
- LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(1) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b);
- return;
- }
- // Perform length checking
- if (l > MAXFRAGLEN)
+
+ // return if a lost fragment is found
+ if (!(this_fragmentation->fragment[end_index].length))
+ return; // assembling frame failed
+
+ // assemble the packet
+ //assemble frame, process it, reset fragmentation
+ uint16_t cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin
+ uint32_t i;
+
+ LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
+ // Push to the receive buffer
+
+ for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
+ {
+ this_frag = &this_fragmentation->fragment[i];
+ if(cur_len + this_frag->length > MAXETHER)
+ {
+ LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");
+ break;
+ }
+ memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
+ LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
+ cur_len += this_frag->length;
+ if (i == end_index)
{
- LOG(2, s, t, "MPPP: ERROR: very long fragment length (1)\n");
- return;
+ this_fragmentation->re_frame_len = cur_len;
+ this_fragmentation->re_frame_begin_index = begin_index;
+ this_fragmentation->re_frame_end_index = end_index;
+ // Process the resassembled frame
+ LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
+ processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
+ break;
}
- frag[b].fragment[seq_num - offset].length = l;
- memcpy(frag[b].fragment[seq_num - offset].data, p, l);
- }
- }
- else
- {
- LOG(4, s, t, "MPPP: Push to receive buffer\n");
- // Push to the receive buffer
- // Array indexes checking
- if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM)
- {
- LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(2) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b);
- return;
- }
- // Perform length checking
- if (l > MAXFRAGLEN)
+ }
+ // Set reassembled frame length to zero after processing it
+ this_fragmentation->re_frame_len = 0;
+ for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
{
- LOG(2, s, t, "MPPP: ERROR: very long fragment length (2).\n");
- return;
+ this_fragmentation->fragment[i].length = 0; // Indicates that this fragment has been consumed
+ this_fragmentation->fragment[i].flags = 0;
+ if (i == end_index)
+ break;
}
- frag[b].fragment[seq_num - offset].length = l;
- memcpy(frag[b].fragment[seq_num - offset].data, p, l);
}
+ //discard fragments received before the recently assembled frame
+ begin_index = this_fragmentation->start_index;
+ this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
+ this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
+ //clear length and flags of the discarded fragments
+ while (begin_index != this_fragmentation->start_index)
+ {
+ this_fragmentation->fragment[begin_index].flags = 0;
+ this_fragmentation->fragment[begin_index].length = 0;
+ begin_index = (begin_index + 1) & MAXFRAGNUM_MASK;
+ }
+
+ LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq);
+ return;
}
// process IPv6 packet received
snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
}
- increment_counter(&session[s].cin, &session[s].cin_wrap, l);
- session[s].cin_delta += l;
- session[s].pin++;
-
- sess_local[s].cin += l;
- sess_local[s].pin++;
+ update_sessions_in_stat(s, l);
eth_tx += l;
{
// Set the multilink bits
uint16_t bits_send = mp_bits;
- *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0xFF0F)|bits_send);
+ *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0x0FFF)|bits_send);
b += 2;
}
else
// L2TPNS Radius Stuff
-char const *cvs_id_radius = "$Id: radius.c,v 1.55 2006/08/02 14:17:30 bodea Exp $";
+char const *cvs_id_radius = "$Id: radius.c,v 1.56 2009/12/08 14:49:28 bodea Exp $";
#include <time.h>
#include <stdio.h>
return;
}
- if (state != RADIUSAUTH && !config->radius_accounting)
+ if (state != RADIUSAUTH && state != RADIUSJUSTAUTH && !config->radius_accounting)
{
// Radius accounting is turned off
radiusclear(r, s);
{
if (s)
{
- if (state == RADIUSAUTH)
+ if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
else
{
switch (state)
{
case RADIUSAUTH:
+ case RADIUSJUSTAUTH:
b[0] = AccessRequest; // access request
break;
case RADIUSSTART:
strcpy((char *) p + 2, session[s].user);
p += p[1];
}
- if (state == RADIUSAUTH)
+ if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
{
if (radius[r].chap)
{
*p = 6; // Service-Type
p[1] = 6;
- *(uint32_t *) (p + 2) = htonl(2); // Framed-User
+ *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 8 : 2)); // Authenticate only or Framed-User respectevily
p += p[1];
*p = 7; // Framed-Protocol
- p[1] = 6;
- *(uint32_t *) (p + 2) = htonl(1); // PPP
+ p[1] = htonl((state == RADIUSJUSTAUTH ? 0 : 6));
+ *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 0 : 1)); // PPP
p += p[1];
if (session[s].ip)
// All AVpairs added
*(uint16_t *) (b + 2) = htons(p - b);
- if (state != RADIUSAUTH)
+ if (state != RADIUSAUTH && state != RADIUSJUSTAUTH)
{
// Build auth for accounting packet
calc_auth(b, p - b, zero, b + 4);
// get radius port
uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers];
// assume RADIUS accounting port is the authentication port +1
- addr.sin_port = htons((state == RADIUSAUTH) ? port : port+1);
+ addr.sin_port = htons((state == RADIUSAUTH || state == RADIUSJUSTAUTH) ? port : port+1);
}
LOG_HEX(5, "RADIUS Send", b, (p - b));
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n");
return;
}
- if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSSTART
+ if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSJUSTAUTH && radius[r].state != RADIUSSTART
&& radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM)
{
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n");
return; // Do nothing. On timeout, it will try the next radius server.
}
- if ((radius[r].state == RADIUSAUTH && r_code != AccessAccept && r_code != AccessReject) ||
+ if (((radius[r].state == RADIUSAUTH ||radius[r].state == RADIUSJUSTAUTH) && r_code != AccessAccept && r_code != AccessReject) ||
((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse))
{
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response %s\n", radius_code(r_code));
// care off finishing the radius session if that's really correct.
}
- if (radius[r].state == RADIUSAUTH)
+ if (radius[r].state == RADIUSAUTH || radius[r].state == RADIUSJUSTAUTH)
{
// run post-auth plugin
struct param_post_auth packet = {
if (p[1] < 6) continue;
session[s].session_timeout = ntohl(*(uint32_t *)(p + 2));
LOG(3, s, session[s].tunnel, " Radius reply contains Session-Timeout = %u\n", session[s].session_timeout);
+ if(!session[s].session_timeout && config->kill_timedout_sessions)
+ sessionshutdown(s, "Session timeout is zero", CDN_ADMIN_DISC, 0);
}
else if (*p == 28)
{
sendchap(s, t);
break;
case RADIUSAUTH: // sending auth to RADIUS server
+ case RADIUSJUSTAUTH: // sending auth to RADIUS server
case RADIUSSTART: // sending start accounting to RADIUS server
case RADIUSSTOP: // sending stop accounting to RADIUS server
case RADIUSINTERIM: // sending interim accounting to RADIUS server
projects / l2tpns.git / commitdiff