From ac773ac88d9c79ef287975d46853189e6a2b3618 Mon Sep 17 00:00:00 2001 From: bodea Date: Tue, 8 Dec 2009 14:49:28 +0000 Subject: [PATCH] Apply MLPPP patch from Muhammad Tayseer Alquoatli, very belatedly, with thanks. Changes: - Handle session shutdown gracefully regarding leaving the bundle (bug that is caused when a all session leaves a bundle then another join) - IP assignment is done only for the first session in the bundle (save IP waste for multiple MLPPP sessions) - Route is being added only for the first session in the bundle (less routes on l2tpns system) - Fix route deletion problem for MLPPP sessions (bug that caused when a session leaves a bundle) - Uniformity of sequence number space satisfied (according to RFC1990) - Fix reassembling fragmented packets and handling lost fragments (according to RFC 1990) - FragmentatConnection to l2tpns.cvs.sourceforge.net closed by remote host.n across N session rather than two) - Sequence numbers extraction mask has been corrected (bug in extracting sequence numbers) - some clustering support fixes - Upload/Download statistics has been corrected - add "kill_timedout_sessions" config option --- Changes | 3 + THANKS | 1 + cluster.c | 9 +- constants.c | 5 +- etc/startup-config.default | 3 + l2tpns.c | 386 +++++++++++++++++++------------ l2tpns.h | 85 ++++--- ppp.c | 462 ++++++++++++++++++++++--------------- radius.c | 28 ++- 9 files changed, 596 insertions(+), 386 deletions(-) diff --git a/Changes b/Changes index 83b307a..16a2524 100644 --- a/Changes +++ b/Changes @@ -1,3 +1,6 @@ +Wed Dec 9 2009 Brendan O'Dea 2.2.x +- Apply MLPPP patch from Muhammad Tayseer Alquoatli. + * Mon Dec 18 2006 Brendan O'Dea 2.2.0 - Only poll clifd if successfully bound. - Add "Practical VPNs" document from Liran Tal as Docs/vpn . diff --git a/THANKS b/THANKS index bc38c6d..5483a89 100644 --- a/THANKS +++ b/THANKS @@ -29,3 +29,4 @@ Patrick Cole Khaled Al Hamwi Graham Maltby Rhys Kidd +Muhammad Tayseer Alquoatli diff --git a/cluster.c b/cluster.c index 015268a..8ac56f4 100644 --- a/cluster.c +++ b/cluster.c @@ -1,6 +1,6 @@ // L2TPNS Clustering Stuff -char const *cvs_id_cluster = "$Id: cluster.c,v 1.54 2006/12/04 20:50:02 bodea Exp $"; +char const *cvs_id_cluster = "$Id: cluster.c,v 1.55 2009/12/08 14:49:28 bodea Exp $"; #include #include @@ -402,7 +402,7 @@ void cluster_send_ping(time_t basetime) x.ver = 1; x.addr = config->bind_address; - x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels; + x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels + config->cluster_undefined_bundles; x.basetime = basetime; add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x)); @@ -940,9 +940,8 @@ void cluster_heartbeat() if (bcount >= config->cluster_highest_bundleid) break; - hb_add_type(&p, C_CTUNNEL, walk_bundle_number); - walk_tunnel_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero. - + hb_add_type(&p, C_CBUNDLE, walk_bundle_number); + walk_bundle_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero. ++bcount; } diff --git a/constants.c b/constants.c index 4efe717..155f2d1 100644 --- a/constants.c +++ b/constants.c @@ -1,6 +1,6 @@ // L2TPNS: constants -char const *cvs_id_constants = "$Id: constants.c,v 1.7 2005/07/31 10:04:10 bodea Exp $"; +char const *cvs_id_constants = "$Id: constants.c,v 1.8 2009/12/08 14:49:28 bodea Exp $"; #include #include "constants.h" @@ -197,7 +197,8 @@ CONSTANT(radius_state, "RADIUSSTART", // 3 "RADIUSSTOP", // 4 "RADIUSINTERIM", // 5 - "RADIUSWAIT" // 6 + "RADIUSWAIT", // 6 + "RADIUSJUSTAUTH" // 7 ) CONSTANT(radius_code, diff --git a/etc/startup-config.default b/etc/startup-config.default index c448de2..77425c8 100644 --- a/etc/startup-config.default +++ b/etc/startup-config.default @@ -41,6 +41,9 @@ set radius_secret "secret" # Allow multiple logins for the same username #set allow_duplicate_users no +# Kill timedout sessions ? (default yes) +#set kill_timedout_sessions no + # Allow multiple logins for specific username #set guest_account "" diff --git a/l2tpns.c b/l2tpns.c index 545a3cd..f47ae66 100644 --- a/l2tpns.c +++ b/l2tpns.c @@ -4,7 +4,7 @@ // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // vim: sw=8 ts=8 -char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.172 2006/12/18 12:05:36 bodea Exp $"; +char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.173 2009/12/08 14:49:28 bodea Exp $"; #include #include @@ -74,6 +74,9 @@ static int tunidx; // ifr_ifindex of tun device static int syslog_log = 0; // are we logging to syslog static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog). uint32_t last_id = 0; // Unique ID for radius accounting +// Guest change +char guest_users[10][32]; // Array of guest users +int guest_accounts_num = 0; // Number of guest users // calculated from config->l2tp_mtu uint16_t MRU = 0; // PPP MRU @@ -133,6 +136,7 @@ config_descriptt config_values[] = { CONFIG("radius_bind_min", radius_bind_min, SHORT), CONFIG("radius_bind_max", radius_bind_max, SHORT), CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL), + CONFIG("kill_timedout_sessions", kill_timedout_sessions, BOOL), CONFIG("guest_account", guest_user, STRING), CONFIG("bind_address", bind_address, IPv4), CONFIG("peer_address", peer_address, IPv4), @@ -1070,45 +1074,63 @@ void processmpframe(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint8_t e l -= 4; } - // Process this frame - if (*p & 1) - { - proto = *p++; - l--; - } - else - { - proto = ntohs(*(uint16_t *) p); - p += 2; - l -= 2; - } - - if (proto == PPPIP) - { - if (session[s].die) - { - LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s); - return; // closing session, PPP not processed - } + if (*p & 1) + { + proto = *p++; + l--; + } + else + { + proto = ntohs(*(uint16_t *) p); + p += 2; + l -= 2; + } + if (proto == PPPIP) + { + if (session[s].die) + { + LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s); + return; // closing session, PPP not processed + } + session[s].last_packet = session[s].last_data = time_now; + processipin(s, t, p, l); + } + else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0]) + { + if (session[s].die) + { + LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s); + return; // closing session, PPP not processed + } + + session[s].last_packet = session[s].last_data = time_now; + processipv6in(s, t, p, l); + } + else if (proto == PPPIPCP) + { + session[s].last_packet = session[s].last_data = time_now; + processipcp(s, t, p, l); + } + else if (proto == PPPCCP) + { + session[s].last_packet = session[s].last_data = time_now; + processccp(s, t, p, l); + } + else + { + LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto); + } +} - session[s].last_packet = session[s].last_data = time_now; - processipin(s, t, p, l); - } - else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0]) - { - if (session[s].die) - { - LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s); - return; // closing session, PPP not processed - } +static void update_session_out_stat(sessionidt s, sessiont *sp, int len) +{ + increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count + sp->cout_delta += len; + sp->pout++; + sp->last_data = time_now; - session[s].last_packet = session[s].last_data = time_now; - processipv6in(s, t, p, l); - } - else - { - LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto); - } + sess_local[s].cout += len; // To send to master.. + sess_local[s].pout++; } // process outgoing (to tunnel) IP @@ -1123,8 +1145,7 @@ static void processipout(uint8_t *buf, int len) uint8_t *data = buf; // Keep a copy of the originals. int size = len; - uint8_t b1[MAXETHER + 20]; - uint8_t b2[MAXETHER + 20]; + uint8_t fragbuf[MAXETHER + 20]; CSTAT(processipout); @@ -1173,9 +1194,15 @@ static void processipout(uint8_t *buf, int len) } return; } + t = session[s].tunnel; + if (len > session[s].mru || (session[s].mrru && len > session[s].mrru)) + { + LOG(3, s, t, "Packet size more than session MRU\n"); + return; + } + sp = &session[s]; - sp->last_data = time_now; // DoS prevention: enforce a maximum number of packets per 0.1s for a session if (config->max_packets > 0) @@ -1246,55 +1273,80 @@ static void processipout(uint8_t *buf, int len) } // Add on L2TP header - { - bundleidt bid = 0; - if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1) - { - bid = session[s].bundle; - s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links]; - LOG(4, s, t, "MPPP: (1)Session number becomes: %u\n", s); - if (len > 256) - { - // Partition the packet to 2 fragments - uint32_t frag1len = len / 2; - uint32_t frag2len = len - frag1len; - uint8_t *p = makeppp(b1, sizeof(b1), buf, frag1len, s, t, PPPIP, 0, bid, MP_BEGIN); - uint8_t *q; - - if (!p) return; - tunnelsend(b1, frag1len + (p-b1), t); // send it... - s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links]; - LOG(4, s, t, "MPPP: (2)Session number becomes: %u\n", s); - q = makeppp(b2, sizeof(b2), buf+frag1len, frag2len, s, t, PPPIP, 0, bid, MP_END); - if (!q) return; - tunnelsend(b2, frag2len + (q-b2), t); // send it... - } - else { - // Send it as one frame - uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS); - if (!p) return; - tunnelsend(b1, len + (p-b1), t); // send it... - } - } - else - { - uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, 0, 0); - if (!p) return; - tunnelsend(b1, len + (p-b1), t); // send it... - } - } + { + bundleidt bid = 0; + if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1) + { + bid = session[s].bundle; + s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links]; + t = session[s].tunnel; + sp = &session[s]; + LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s); + if(len > MINFRAGLEN) + { + // Partition the packet to "bundle[b].num_of_links" fragments + bundlet *b = &bundle[bid]; + uint32_t num_of_links = b->num_of_links; + uint32_t fraglen = len / num_of_links; + fraglen = (fraglen > session[s].mru ? session[s].mru : fraglen); + uint32_t last_fraglen = fraglen + len % num_of_links; + last_fraglen = (last_fraglen > session[s].mru ? len % num_of_links : last_fraglen); + uint32_t remain = len; + + // send the first packet + uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN); + if (!p) return; + tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it... + // statistics + update_session_out_stat(s, sp, fraglen); + remain -= fraglen; + while (remain > last_fraglen) + { + s = b->members[b->current_ses = ++b->current_ses % num_of_links]; + t = session[s].tunnel; + sp = &session[s]; + LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s); + p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0); + if (!p) return; + tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it... + update_session_out_stat(s, sp, fraglen); + remain -= fraglen; + } + // send the last fragment + s = b->members[b->current_ses = ++b->current_ses % num_of_links]; + t = session[s].tunnel; + sp = &session[s]; + LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s); + p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END); + if (!p) return; + tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it... + update_session_out_stat(s, sp, remain); + if (remain != last_fraglen) + LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen); + } + else { + // Send it as one frame + uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS); + if (!p) return; + tunnelsend(fragbuf, len + (p-fragbuf), t); // send it... + LOG(4, s, t, "MPPP: packet sent as one frame\n"); + update_session_out_stat(s, sp, len); + } + } + else + { + uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0); + if (!p) return; + tunnelsend(fragbuf, len + (p-fragbuf), t); // send it... + update_session_out_stat(s, sp, len); + } + } // Snooping this session, send it to intercept box if (sp->snoop_ip && sp->snoop_port) snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port); - increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count - sp->cout_delta += len; - sp->pout++; udp_tx += len; - - sess_local[s].cout += len; // To send to master.. - sess_local[s].pout++; } // process outgoing (to tunnel) IPv6 @@ -1661,7 +1713,9 @@ void filter_session(sessionidt s, int filter_in, int filter_out) void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause) { int walled_garden = session[s].walled_garden; - + bundleidt b = session[s].bundle; + //delete routes only for last session in bundle (in case of MPPP) + int del_routes = !b || (bundle[b].num_of_links == 1); CSTAT(sessionshutdown); @@ -1710,21 +1764,52 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e (session[s].route[r].ip & session[s].route[r].mask)) routed++; - routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0); + if (del_routes) routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0); session[s].route[r].ip = 0; } if (session[s].ip_pool_index == -1) // static ip { - if (!routed) routeset(s, session[s].ip, 0, 0, 0); + if (!routed && del_routes) routeset(s, session[s].ip, 0, 0, 0); session[s].ip = 0; } else free_ip_address(s); // unroute IPv6, if setup - if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen) + if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes) route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0); + + if (b) + { + // This session was part of a bundle + bundle[b].num_of_links--; + LOG(3, s, 0, "MPPP: Dropping member link: %d from bundle %d\n",s,b); + if(bundle[b].num_of_links == 0) + { + bundleclear(b); + LOG(3, s, 0, "MPPP: Kill bundle: %d (No remaing member links)\n",b); + } + else + { + // Adjust the members array to accomodate the new change + uint8_t mem_num = 0; + // It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--") + if(bundle[b].members[bundle[b].num_of_links] != s) + { + uint8_t ml; + for(ml = 0; mlppp_restart_time = 3; config->ppp_max_configure = 10; config->ppp_max_failure = 5; + config->kill_timedout_sessions = 1; strcpy(config->random_device, RANDOMDEVICE); log_stream = stderr; @@ -4737,6 +4789,40 @@ static void update_config() } } + // Guest change + guest_accounts_num = 0; + char *p2 = config->guest_user; + while (p2 && *p2) + { + char *s = strpbrk(p2, " \t,"); + if (s) + { + *s++ = 0; + while (*s == ' ' || *s == '\t') + s++; + + if (!*s) + s = 0; + } + + strcpy(guest_users[guest_accounts_num], p2); + LOG(1, 0, 0, "Guest account[%d]: %s\n", guest_accounts_num, guest_users[guest_accounts_num]); + guest_accounts_num++; + p2 = s; + } + // Rebuild the guest_user array + strcpy(config->guest_user, ""); + int ui = 0; + for (ui=0; uiguest_user, guest_users[ui]); + if (uiguest_user, ","); + } + } + + memcpy(config->old_plugins, config->plugins, sizeof(config->plugins)); if (!config->multi_read_count) config->multi_read_count = 10; if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR); @@ -4815,6 +4901,20 @@ int sessionsetup(sessionidt s, tunnelidt t) LOG(3, s, t, "Doing session setup for session\n"); + // Join a bundle if the MRRU option is accepted + if(session[s].mrru > 0 && session[s].bundle == 0) + { + LOG(3, s, t, "This session can be part of multilink bundle\n"); + if (join_bundle(s) > 0) + cluster_send_bundle(session[s].bundle); + else + { + LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n"); + sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE); + return 0; + } + } + if (!session[s].ip) { assign_ip_address(s); @@ -4832,14 +4932,6 @@ int sessionsetup(sessionidt s, tunnelidt t) // Make sure this is right session[s].tunnel = t; - // Join a bundle if the MRRU option is accepted - if (session[s].mrru > 0 && !session[s].bundle) - { - LOG(3, s, t, "This session can be part of multilink bundle\n"); - if (join_bundle(s)) - cluster_send_bundle(session[s].bundle); - } - // zap old sessions with same IP and/or username // Don't kill gardened sessions - doing so leads to a DoS // from someone who doesn't need to know the password @@ -4850,25 +4942,29 @@ int sessionsetup(sessionidt s, tunnelidt t) { if (i == s) continue; if (!session[s].opened) continue; + // Allow duplicate sessions for multilink ones of the same bundle. + if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle) + continue; if (ip == session[i].ip) { sessionkill(i, "Duplicate IP address"); continue; } - if (config->allow_duplicate_users) - continue; - - if (session[s].walled_garden || session[i].walled_garden) - continue; - - // Allow duplicate sessions for guest account. - if (*config->guest_user && !strcasecmp(user, config->guest_user)) - continue; - - // Allow duplicate sessions for multilink ones of the same bundle. - if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle) - continue; + if (config->allow_duplicate_users) continue; + if (session[s].walled_garden || session[i].walled_garden) continue; + // Guest change + int found = 0; + int gu; + for (gu = 0; gu < guest_accounts_num; gu++) + { + if (!strcasecmp(user, guest_users[gu])) + { + found = 1; + break; + } + } + if (found) continue; // Drop the new session in case of duplicate sessionss, not the old one. if (!strcasecmp(user, session[i].user)) @@ -4876,6 +4972,8 @@ int sessionsetup(sessionidt s, tunnelidt t) } } + // no need to set a route for the same IP address of the bundle + if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1)) { int routed = 0; diff --git a/l2tpns.h b/l2tpns.h index 628b8a1..6849be9 100644 --- a/l2tpns.h +++ b/l2tpns.h @@ -1,5 +1,5 @@ // L2TPNS Global Stuff -// $Id: l2tpns.h,v 1.120 2006/10/23 02:51:53 bodea Exp $ +// $Id: l2tpns.h,v 1.121 2009/12/08 14:49:28 bodea Exp $ #ifndef __L2TPNS_H__ #define __L2TPNS_H__ @@ -19,10 +19,8 @@ // Limits #define MAXTUNNEL 500 // could be up to 65535 #define MAXBUNDLE 300 // could be up to 65535 -#define MAXBUNDLESES 10 // Maximum number of member links in bundle +#define MAXBUNDLESES 12 // Maximum number of member links in bundle #define MAXADDRESS 20 // Maximum length for the Endpoint Discrminiator address -#define MAXFRAGNUM 1500 // Maximum number of Multilink fragment in a bundle -#define MAXFRAGLEN 1000 // Maximum length for Multilink fragment #define MAXSESSION 60000 // could be up to 65535 #define MAXTBFS 6000 // Maximum token bucket filters. Might need up to 2 * session. @@ -52,9 +50,15 @@ #define IDLE_TIMEOUT 240 // Time between last packet seen and session shutdown #define BUSY_WAIT_TIME 3000 // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown -#define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header -#define MP_END 0x40 // This value is used when (e)nd bit is set in MP header -#define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header +#define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header +#define MP_END 0x40 // This value is used when (e)nd bit is set in MP header +#define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header + +#define MINFRAGLEN 64 // Minumum fragment length +#define MAXFRAGLEN 750 // Maximum length for Multilink fragment (MTU / 2 sessions) +#define MAXFRAGNUM 128 // Maximum number of Multilink fragment in a bundle (must be in the form of 2^X) + // it's not expected to have a space for more than 10 unassembled packets = 10 * MAXBUNDLESES +#define MAXFRAGNUM_MASK 127 // Must be equal to MAXFRAGNUM-1 // Constants #ifndef ETCDIR @@ -248,8 +252,11 @@ typedef struct { } epdist; typedef struct { - uint16_t length; // Fragment length - uint8_t data[MAXFRAGLEN]; // Fragment data + sessionidt sid; // Fragment originating session + uint8_t flags; // MP frame flags + uint32_t seq; // fragment seq num + uint16_t length; // Fragment length + uint8_t data[MAXFRAGLEN]; // Fragment data } fragmentt; typedef struct @@ -297,10 +304,11 @@ typedef struct char calling[MAXTEL]; // calling number uint32_t tx_connect_speed; uint32_t rx_connect_speed; - uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit - uint8_t mssf; // Multilink Short Sequence Number Header Format - epdist epdis; // Multilink Endpoint Discriminator - bundleidt bundle; // Multilink Bundle Identifier + clockt timeout; // Session timeout + uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit + uint8_t mssf; // Multilink Short Sequence Number Header Format + epdist epdis; // Multilink Endpoint Discriminator + bundleidt bundle; // Multilink Bundle Identifier in_addr_t snoop_ip; // Interception destination IP uint16_t snoop_port; // Interception destination port uint8_t walled_garden; // is this session gardened? @@ -312,28 +320,31 @@ sessiont; typedef struct { - int state; // current state (bundlestate enum) - uint32_t seq_num_t; // Sequence Number (transmission) - uint32_t seq_num_m; // Last received frame sequence number (bearing B bit) - uint32_t offset; // Offset between sequence number and array index - uint8_t pending_frag; // Indicate that there is pending fragments to reassemble - uint8_t num_of_links; // Number of links joint to this bundle - uint32_t online_time; // The time this bundle is online - clockt last_check; // Last time the timeout is checked - uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit - uint8_t mssf; // Multilink Short Sequence Number Header Format - epdist epdis; // Multilink Endpoint Discriminator - char user[MAXUSER]; // Needed for matching member links - sessionidt current_ses; // Current session to use for sending (used in RR load-balancing) - sessionidt members[MAXBUNDLESES]; // Array for member links sessions + int state; // current state (bundlestate enum) + uint32_t seq_num_t; // Sequence Number (transmission) + uint32_t timeout; // Session-Timeout for bundle + uint32_t max_seq; // Max value of sequence number field + uint8_t num_of_links; // Number of links joint to this bundle + uint32_t online_time; // The time this bundle is online + clockt last_check; // Last time the timeout is checked + uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit + uint8_t mssf; // Multilink Short Sequence Number Header Format + epdist epdis; // Multilink Endpoint Discriminator + char user[MAXUSER]; // Needed for matching member links + sessionidt current_ses; // Current session to use for sending (used in RR load-balancing) + sessionidt members[MAXBUNDLESES]; // Array for member links sessions } bundlet; typedef struct { - fragmentt fragment[MAXFRAGNUM]; - uint8_t reassembled_frame[MAXETHER]; // The reassembled frame - uint16_t re_frame_len; // The reassembled frame length + fragmentt fragment[MAXFRAGNUM]; + uint8_t reassembled_frame[MAXETHER]; // The reassembled frame + uint16_t re_frame_len; // The reassembled frame length + uint16_t re_frame_begin_index, re_frame_end_index; // reassembled frame begin index, end index respectively + uint16_t start_index, end_index; // start and end sequence numbers available on the fragments array respectively + uint32_t M; // Minumum frame sequence number received over all bundle members + uint32_t start_seq; // Last received frame sequence number (bearing B bit) } fragmentationt; @@ -388,6 +399,9 @@ typedef struct // last LCP Echo time_t last_echo; + + // Last Multilink frame sequence number received + uint32_t last_seq; } sessionlocalt; // session flags @@ -497,6 +511,7 @@ enum RADIUSSTOP, // sending stop accounting to RADIUS server RADIUSINTERIM, // sending interim accounting to RADIUS server RADIUSWAIT, // waiting timeout before available, in case delayed replies + RADIUSJUSTAUTH, // sending auth to RADIUS server, just authentication, no ip assigning }; struct Tstats @@ -644,7 +659,7 @@ typedef struct int radius_authprefer; int allow_duplicate_users; // allow multiple logins with the same username - char guest_user[MAXUSER]; // allow multiple logins to guest account username + int kill_timedout_sessions; // kill authenticated sessions with "session_timeout == 0" in_addr_t default_dns1, default_dns2; @@ -691,11 +706,15 @@ typedef struct int cluster_hb_interval; // How often to send a heartbeat. int cluster_hb_timeout; // How many missed heartbeats trigger an election. uint64_t cluster_table_version; // # state changes processed by cluster - int cluster_master_min_adv; // Master advertises routes while the number of up to date - // slaves is less than this value. struct in6_addr ipv6_prefix; // Our IPv6 network pool. + + int cluster_master_min_adv; // Master advertises routes while the number of up to date + // slaves is less than this value. + // Guest change + char guest_user[MAXUSER]; // Guest account username + #ifdef BGP #define BGP_NUM_PEERS 2 uint16_t as_number; diff --git a/ppp.c b/ppp.c index f70bdf2..7942e6e 100644 --- a/ppp.c +++ b/ppp.c @@ -1,6 +1,6 @@ // L2TPNS PPP Stuff -char const *cvs_id_ppp = "$Id: ppp.c,v 1.103 2007/01/25 12:36:48 bodea Exp $"; +char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009/12/08 14:49:28 bodea Exp $"; #include #include @@ -31,6 +31,16 @@ static int epdiscmp(epdist, epdist); static void setepdis(epdist *, epdist); static void ipcp_open(sessionidt s, tunnelidt t); +static int first_session_in_bundle(sessionidt s) +{ + bundleidt i; + for (i = 1; i < MAXBUNDLE; i++) + if (bundle[i].state != BUNDLEFREE) + if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user)) + return 0; + return 1; +} + // Process PAP messages void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) { @@ -140,7 +150,10 @@ void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) radius[r].id = p[1]; LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass); - radiussend(r, RADIUSAUTH); + if ((session[s].mrru) && (!first_session_in_bundle(s))) + radiussend(r, RADIUSJUSTAUTH); + else + radiussend(r, RADIUSAUTH); } } @@ -257,7 +270,10 @@ void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) radius[r].chap = 1; LOG(3, s, t, "CHAP login %s\n", session[s].user); - radiussend(r, RADIUSAUTH); + if ((session[s].mrru) && (!first_session_in_bundle(s))) + radiussend(r, RADIUSJUSTAUTH); + else + radiussend(r, RADIUSAUTH); } static void dumplcp(uint8_t *p, int l) @@ -366,17 +382,7 @@ void lcp_open(sessionidt s, tunnelidt t) } else { - if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1) - { - sessionidt first_ses = bundle[session[s].bundle].members[0]; - LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n", s, first_ses); - session[s].ip = session[first_ses].ip; - session[s].dns1 = session[first_ses].dns1; - session[s].dns2 = session[first_ses].dns2; - session[s].session_timeout = session[first_ses].session_timeout; - ipcp_open(s, t); - } - else + if(session[s].bundle == 0 || bundle[session[s].bundle].num_of_links == 1) { // This-Layer-Up sendipcp(s, t); @@ -389,6 +395,12 @@ void lcp_open(sessionidt s, tunnelidt t) change_state(s, ccp, Stopped); } + else + { + sessionidt first_ses = bundle[session[s].bundle].members[0]; + LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n",s,first_ses); + ipcp_open(s, t); + } } } @@ -1091,10 +1103,20 @@ int join_bundle(sessionidt s) { if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user)) { + sessionidt first_ses = bundle[i].members[0]; + if (bundle[i].mssf != session[s].mssf) + { + // uniformity of sequence number format must be insured + LOG(3, s, session[s].tunnel, "MPPP: unable to bundle session %d in bundle %d cause of different mssf\n", s, i); + return -1; + } session[s].bundle = i; - bundle[i].mrru = session[s].mrru; - bundle[i].mssf = session[s].mssf; - if (session[s].epdis.length > 0) + session[s].ip = session[first_ses].ip; + session[s].dns1 = session[first_ses].dns1; + session[s].dns2 = session[first_ses].dns2; + session[s].timeout = session[first_ses].timeout; + + if(session[s].epdis.length > 0) setepdis(&bundle[i].epdis, session[s].epdis); strcpy(bundle[i].user, session[s].user); @@ -1112,11 +1134,19 @@ int join_bundle(sessionidt s) session[s].bundle = b; bundle[b].mrru = session[s].mrru; bundle[b].mssf = session[s].mssf; - if (session[s].epdis.length > 0) + // FIXME !!! to enable l2tpns reading mssf frames receiver_max_seq, sender_max_seq must be introduce + // now session[s].mssf flag indecates that the receiver wish to receive frames in mssf, so max_seq (i.e. recv_max_seq) = 1<<24 + /* + if (bundle[b].mssf) + bundle[b].max_seq = 1 << 12; + else */ + bundle[b].max_seq = 1 << 24; + if(session[s].epdis.length > 0) setepdis(&bundle[b].epdis, session[s].epdis); strcpy(bundle[b].user, session[s].user); bundle[b].members[0] = s; + bundle[b].timeout = session[s].timeout; LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b); return b; } @@ -1148,23 +1178,24 @@ static void setepdis(epdist *ep1, epdist ep2) static bundleidt new_bundle() { - bundleidt i; - for (i = 1; i < MAXBUNDLE; i++) - { - if (bundle[i].state == BUNDLEFREE) - { - LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i); - bundle[i].num_of_links = 1; - bundle[i].last_check = time_now; // Initialize last_check value - bundle[i].state = BUNDLEOPEN; - bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first - if (i > config->cluster_highest_bundleid) - config->cluster_highest_bundleid = i; - return i; - } - } - LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n"); - return 0; + bundleidt i; + for (i = 1; i < MAXBUNDLE; i++) + { + if (bundle[i].state == BUNDLEFREE) + { + LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i); + bundle[i].num_of_links = 1; + bundle[i].last_check = time_now; // Initialize last_check value + bundle[i].state = BUNDLEOPEN; + bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first + memset(&frag[i], 0, sizeof(fragmentationt)); + if (i > config->cluster_highest_bundleid) + config->cluster_highest_bundleid = i; + return i; + } + } + LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n"); + return 0; } static void ipcp_open(sessionidt s, tunnelidt t) @@ -1645,6 +1676,39 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) } } +static void update_sessions_in_stat(sessionidt s, uint16_t l) +{ + bundleidt b = session[s].bundle; + if (!b) + { + increment_counter(&session[s].cin, &session[s].cin_wrap, l); + session[s].cin_delta += l; + session[s].pin++; + + sess_local[s].cin += l; + sess_local[s].pin++; + } + else + { + int i = frag[b].re_frame_begin_index; + int end = frag[b].re_frame_end_index; + for (;;) + { + l = frag[b].fragment[i].length; + s = frag[b].fragment[i].sid; + increment_counter(&session[s].cin, &session[s].cin_wrap, l); + session[s].cin_delta += l; + session[s].pin++; + + sess_local[s].cin += l; + sess_local[s].pin++; + if (i == end) + return; + i = (i + 1) & MAXFRAGNUM_MASK; + } + } +} + // process IP packet received // // This MUST be called with at least 4 byte behind 'p'. @@ -1732,12 +1796,7 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port); } - increment_counter(&session[s].cin, &session[s].cin_wrap, l); - session[s].cin_delta += l; - session[s].pin++; - - sess_local[s].cin += l; - sess_local[s].pin++; + update_sessions_in_stat(s, l); eth_tx += l; @@ -1748,162 +1807,190 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) // process Multilink PPP packet received void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) { - bundleidt b = session[s].bundle; - uint8_t begin_frame; - uint8_t end_frame; - uint32_t seq_num; - uint32_t offset; - - if (!b) - { - LOG(3, s, t, "MPPP: Invalid bundle id: 0\n"); - return; - } + bundleidt b = session[s].bundle; + bundlet * this_bundle = &bundle[b]; + uint32_t frag_offset, M_offset; + uint16_t frag_index, M_index; + fragmentationt *this_fragmentation = &frag[b]; + uint8_t begin_frame = (*p & MP_BEGIN); + uint8_t end_frame = (*p & MP_END); + uint32_t seq_num; + uint8_t flags = *p; + uint16_t begin_index, end_index; + + // Perform length checking + if(l > MAXFRAGLEN) + { + LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n"); + return; + } - begin_frame = (*p & 0x80); - end_frame = (*p & 0x40); - if (session[s].mssf) - { - // Get 12 bit for seq number - uint16_t short_seq_num = ntohs((*(uint16_t *) p) & 0xFF0F); - uint16_t short_seq_num2 = short_seq_num >> 4; - p += 2; - l -= 2; - seq_num = short_seq_num2; - // After this point the pointer should be advanced 2 bytes - LOG(3, s, t, "MPPP: 12 bits, sequence number: %d, short1: %d, short2: %d\n",seq_num, short_seq_num, short_seq_num2); - } + if(!b) + { + LOG(2, s, t, "MPPP: Invalid bundle id: 0\n"); + return; + } + // FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf + /* if(session[s].mssf) + { + // Get 12 bit for seq number + seq_num = ntohs((*(uint16_t *) p) & 0xFF0F); + p += 2; + l -= 2; + // After this point the pointer should be advanced 2 bytes + LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num); + } + else */ + { + // Get 24 bit for seq number + seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00); + p += 4; + l -= 4; + // After this point the pointer should be advanced 4 bytes + LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num); + } + + // calculate this fragment's offset from the begin seq in the bundle + frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1); + + // discard this fragment if frag_offset is bigger that the fragmentation buffer size + if (frag_offset >= MAXFRAGNUM) + { + LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq); + return; + } + + // update M + sess_local[s].last_seq = seq_num; + if (seq_num < this_fragmentation->M) + this_fragmentation->M = seq_num; else { - // Get 24 bit for seq number - p++; - seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00); - seq_num = seq_num >> 8; - p += 3; - l -= 4; - // After this point the pointer should be advanced 4 bytes - LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num); - } - - if (seq_num - bundle[b].offset < 0) - { - bundle[b].offset = 0; - bundle[b].pending_frag = 0; + uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;; + for (i = 1; i < this_bundle->num_of_links; i++) + { + uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq; + if (s_seq < min) + min = s_seq; + } + this_fragmentation->M = min; + } + + LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M); + //calculate M's offset from the begin seq in the bundle + M_offset = (this_fragmentation->M + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1); + + //caculate M's index in the fragment array + M_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK; + + //caculate received fragment's index in the fragment array + frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK; + + //frame with a single fragment + if (begin_frame && end_frame) + { + // process and reset fragmentation + LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n"); + this_fragmentation->fragment[frag_index].length = l; + this_fragmentation->fragment[frag_index].sid = s; + this_fragmentation->fragment[frag_index].flags = flags; + this_fragmentation->fragment[frag_index].seq = seq_num; + this_fragmentation->re_frame_begin_index = frag_index; + this_fragmentation->re_frame_end_index = frag_index; + processmpframe(s, t, p, l, 0); + this_fragmentation->fragment[frag_index].length = 0; + this_fragmentation->fragment[frag_index].flags = 0; + end_index = frag_index; } - - offset = bundle[b].offset; - if (begin_frame) + else { - // Check for previous non-assembled frames - int error = 0; - if (bundle[b].pending_frag) + // insert the frame in it's place + fragmentt *this_frag = &this_fragmentation->fragment[frag_index]; + this_frag->length = l; + this_frag->sid = s; + this_frag->flags = flags; + this_frag->seq = seq_num; + memcpy(this_frag->data, p, l); + + // try to assemble the frame that has the received fragment as a member + // get the beginning of this frame + begin_index = end_index = frag_index; + while (this_fragmentation->fragment[begin_index].length) { - uint32_t fn = bundle[b].seq_num_m - offset; - uint16_t cur_len; - bundle[b].pending_frag = 0; - // Check for array indexes - if (fn < 0 || fn > MAXFRAGNUM) - { - LOG(2, s, t, "ERROR: Index out of range fn:%d, bundle:%d\n",fn,b); - return; - } - - if (seq_num-offset < 0 || seq_num-offset > MAXFRAGNUM) - { - LOG(2, s, t, "ERROR: Index out of range fn(last):%d, bundle:%d\n",fn,b); - return; - } - ///////////////////////////////////////////////////// - cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin - for (fn = bundle[b].seq_num_m - offset; fn < seq_num - offset; fn++) - { - if (!frag[b].fragment[fn].length) - { - LOG(4, s, t, "MPPP: Found lost fragment while reassembling frame %d in (%d,%d)\n",fn, bundle[b].seq_num_m-offset, seq_num-offset); - error = 1; - break; - } - - if (cur_len + frag[b].fragment[fn].length > MAXETHER) - { - LOG(2, s, t, "MPPP: ERROR: very long frame after assembling %d\n", frag[b].fragment[fn].length+cur_len); - error = 1; - break; - } - - memcpy(frag[b].reassembled_frame+cur_len, frag[b].fragment[fn].data, frag[b].fragment[fn].length); - cur_len += frag[b].fragment[fn].length; - frag[b].fragment[fn].length = 0; // Indicates that this fragment has been consumed - // This is usefull for compression - memset(frag[b].fragment[fn].data, 0, sizeof(frag[b].fragment[fn].data)); - } - - if (!error) - { - frag[b].re_frame_len = cur_len; - // Process the resassembled frame - LOG(4, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len); - processmpframe(s, t, frag[b].reassembled_frame, frag[b].re_frame_len, 1); - // Set reassembled frame length to zero after processing it - frag[b].re_frame_len = 0; - memset(frag[b].reassembled_frame, 0, sizeof(frag[b].reassembled_frame)); - } + if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN) + break; + begin_index = (begin_index ? (begin_index -1) : (MAXFRAGNUM -1)); } - ////////////////////////////////////////// - bundle[b].seq_num_m = seq_num; - if (end_frame) + + // return if a lost fragment is found + if (!(this_fragmentation->fragment[begin_index].length)) + return; // assembling frame failed + // get the end of his frame + while (this_fragmentation->fragment[end_index].length) { - // Both bits are set - LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n"); - processmpframe(s, t, p, l, 0); - // The maximum number of fragments is 1500 - if (seq_num - bundle[b].offset >= 1400) - { - bundle[b].offset = seq_num; - LOG(4, s, t, "MPPP: Setting offset to: %d\n",bundle[b].offset); - } + if (this_fragmentation->fragment[end_index].flags & MP_END) + break; + end_index = (end_index +1) & MAXFRAGNUM_MASK; } - else - { - bundle[b].pending_frag = 1; - // End bit is clear - LOG(4, s, t, "MPPP: Push to receive buffer\n"); - // Push to the receive buffer - // Array indexes checking - if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM) - { - LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(1) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b); - return; - } - // Perform length checking - if (l > MAXFRAGLEN) + + // return if a lost fragment is found + if (!(this_fragmentation->fragment[end_index].length)) + return; // assembling frame failed + + // assemble the packet + //assemble frame, process it, reset fragmentation + uint16_t cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin + uint32_t i; + + LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index); + // Push to the receive buffer + + for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK) + { + this_frag = &this_fragmentation->fragment[i]; + if(cur_len + this_frag->length > MAXETHER) + { + LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n"); + break; + } + memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length); + LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length); + cur_len += this_frag->length; + if (i == end_index) { - LOG(2, s, t, "MPPP: ERROR: very long fragment length (1)\n"); - return; + this_fragmentation->re_frame_len = cur_len; + this_fragmentation->re_frame_begin_index = begin_index; + this_fragmentation->re_frame_end_index = end_index; + // Process the resassembled frame + LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len); + processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1); + break; } - frag[b].fragment[seq_num - offset].length = l; - memcpy(frag[b].fragment[seq_num - offset].data, p, l); - } - } - else - { - LOG(4, s, t, "MPPP: Push to receive buffer\n"); - // Push to the receive buffer - // Array indexes checking - if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM) - { - LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(2) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b); - return; - } - // Perform length checking - if (l > MAXFRAGLEN) + } + // Set reassembled frame length to zero after processing it + this_fragmentation->re_frame_len = 0; + for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK) { - LOG(2, s, t, "MPPP: ERROR: very long fragment length (2).\n"); - return; + this_fragmentation->fragment[i].length = 0; // Indicates that this fragment has been consumed + this_fragmentation->fragment[i].flags = 0; + if (i == end_index) + break; } - frag[b].fragment[seq_num - offset].length = l; - memcpy(frag[b].fragment[seq_num - offset].data, p, l); } + //discard fragments received before the recently assembled frame + begin_index = this_fragmentation->start_index; + this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK; + this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1); + //clear length and flags of the discarded fragments + while (begin_index != this_fragmentation->start_index) + { + this_fragmentation->fragment[begin_index].flags = 0; + this_fragmentation->fragment[begin_index].length = 0; + begin_index = (begin_index + 1) & MAXFRAGNUM_MASK; + } + + LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq); + return; } // process IPv6 packet received @@ -1989,12 +2076,7 @@ void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port); } - increment_counter(&session[s].cin, &session[s].cin_wrap, l); - session[s].cin_delta += l; - session[s].pin++; - - sess_local[s].cin += l; - sess_local[s].pin++; + update_sessions_in_stat(s, l); eth_tx += l; @@ -2265,7 +2347,7 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid { // Set the multilink bits uint16_t bits_send = mp_bits; - *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0xFF0F)|bits_send); + *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0x0FFF)|bits_send); b += 2; } else diff --git a/radius.c b/radius.c index f35e78d..93a1cde 100644 --- a/radius.c +++ b/radius.c @@ -1,6 +1,6 @@ // L2TPNS Radius Stuff -char const *cvs_id_radius = "$Id: radius.c,v 1.55 2006/08/02 14:17:30 bodea Exp $"; +char const *cvs_id_radius = "$Id: radius.c,v 1.56 2009/12/08 14:49:28 bodea Exp $"; #include #include @@ -177,7 +177,7 @@ void radiussend(uint16_t r, uint8_t state) return; } - if (state != RADIUSAUTH && !config->radius_accounting) + if (state != RADIUSAUTH && state != RADIUSJUSTAUTH && !config->radius_accounting) { // Radius accounting is turned off radiusclear(r, s); @@ -197,7 +197,7 @@ void radiussend(uint16_t r, uint8_t state) { if (s) { - if (state == RADIUSAUTH) + if (state == RADIUSAUTH || state == RADIUSJUSTAUTH) sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE); else { @@ -219,6 +219,7 @@ void radiussend(uint16_t r, uint8_t state) switch (state) { case RADIUSAUTH: + case RADIUSJUSTAUTH: b[0] = AccessRequest; // access request break; case RADIUSSTART: @@ -239,7 +240,7 @@ void radiussend(uint16_t r, uint8_t state) strcpy((char *) p + 2, session[s].user); p += p[1]; } - if (state == RADIUSAUTH) + if (state == RADIUSAUTH || state == RADIUSJUSTAUTH) { if (radius[r].chap) { @@ -380,12 +381,12 @@ void radiussend(uint16_t r, uint8_t state) *p = 6; // Service-Type p[1] = 6; - *(uint32_t *) (p + 2) = htonl(2); // Framed-User + *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 8 : 2)); // Authenticate only or Framed-User respectevily p += p[1]; *p = 7; // Framed-Protocol - p[1] = 6; - *(uint32_t *) (p + 2) = htonl(1); // PPP + p[1] = htonl((state == RADIUSJUSTAUTH ? 0 : 6)); + *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 0 : 1)); // PPP p += p[1]; if (session[s].ip) @@ -462,7 +463,7 @@ void radiussend(uint16_t r, uint8_t state) // All AVpairs added *(uint16_t *) (b + 2) = htons(p - b); - if (state != RADIUSAUTH) + if (state != RADIUSAUTH && state != RADIUSJUSTAUTH) { // Build auth for accounting packet calc_auth(b, p - b, zero, b + 4); @@ -475,7 +476,7 @@ void radiussend(uint16_t r, uint8_t state) // get radius port uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers]; // assume RADIUS accounting port is the authentication port +1 - addr.sin_port = htons((state == RADIUSAUTH) ? port : port+1); + addr.sin_port = htons((state == RADIUSAUTH || state == RADIUSJUSTAUTH) ? port : port+1); } LOG_HEX(5, "RADIUS Send", b, (p - b)); @@ -558,7 +559,7 @@ void processrad(uint8_t *buf, int len, char socket_index) LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n"); return; } - if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSSTART + if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSJUSTAUTH && radius[r].state != RADIUSSTART && radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM) { LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n"); @@ -573,7 +574,7 @@ void processrad(uint8_t *buf, int len, char socket_index) return; // Do nothing. On timeout, it will try the next radius server. } - if ((radius[r].state == RADIUSAUTH && r_code != AccessAccept && r_code != AccessReject) || + if (((radius[r].state == RADIUSAUTH ||radius[r].state == RADIUSJUSTAUTH) && r_code != AccessAccept && r_code != AccessReject) || ((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse)) { LOG(1, s, session[s].tunnel, " Unexpected RADIUS response %s\n", radius_code(r_code)); @@ -581,7 +582,7 @@ void processrad(uint8_t *buf, int len, char socket_index) // care off finishing the radius session if that's really correct. } - if (radius[r].state == RADIUSAUTH) + if (radius[r].state == RADIUSAUTH || radius[r].state == RADIUSJUSTAUTH) { // run post-auth plugin struct param_post_auth packet = { @@ -783,6 +784,8 @@ void processrad(uint8_t *buf, int len, char socket_index) if (p[1] < 6) continue; session[s].session_timeout = ntohl(*(uint32_t *)(p + 2)); LOG(3, s, session[s].tunnel, " Radius reply contains Session-Timeout = %u\n", session[s].session_timeout); + if(!session[s].session_timeout && config->kill_timedout_sessions) + sessionshutdown(s, "Session timeout is zero", CDN_ADMIN_DISC, 0); } else if (*p == 28) { @@ -869,6 +872,7 @@ void radiusretry(uint16_t r) sendchap(s, t); break; case RADIUSAUTH: // sending auth to RADIUS server + case RADIUSJUSTAUTH: // sending auth to RADIUS server case RADIUSSTART: // sending start accounting to RADIUS server case RADIUSSTOP: // sending stop accounting to RADIUS server case RADIUSINTERIM: // sending interim accounting to RADIUS server -- 2.20.1