welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

- Drop sendccp. If client sends a CCP request for compression just NAK it.

Browse source 
- Don't copy the old buffer into Config{Nak,Rej} LCP responses (oops);
  add length checks when appending.
- Have makeppp print a backtrace on overflow.
This commit is contained in:
bodea 2004-11-25 02:45:27 +00:00
parent 2541947ccb
commit 6fbc46c03b
6 changed files with 106 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Changes
View file

@ -1,3 +1,9 @@
* Thu Nov 25 2004 Brendan O'Dea <bod@optusnet.com.au> 2.0.9
- Drop sendccp. If client sends a CCP request for compression just NAK it.
- Don't copy the old buffer into Config{Nak,Rej} LCP responses (oops);
add length checks when appending.
- Have makeppp print a backtrace on overflow.
* Sat Nov 20 2004 Brendan O'Dea <bod@optusnet.com.au> 2.0.8 * Sat Nov 20 2004 Brendan O'Dea <bod@optusnet.com.au> 2.0.8
- Ignore gateway address in Framed-Route (from Jonathan McDowell). - Ignore gateway address in Framed-Route (from Jonathan McDowell).
- Don't route Framed-IP-Address if contained in a Framed-Route. - Don't route Framed-IP-Address if contained in a Framed-Route.

27
l2tpns.c
View file

@ -4,7 +4,7 @@
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8 // vim: sw=8 ts=8
char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.54 2004/11/18 09:02:29 bodea Exp $"; char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.55 2004/11/25 02:45:27 bodea Exp $";
#include <arpa/inet.h> #include <arpa/inet.h>
#include <assert.h> #include <assert.h>
@ -657,6 +657,7 @@ void tunnelsend(u8 * buf, u16 l, tunnelidt t)
STAT(tunnel_tx_errors); STAT(tunnel_tx_errors);
return; return;
} }
memset(&addr, 0, sizeof(addr)); memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET; addr.sin_family = AF_INET;
*(u32 *) & addr.sin_addr = htonl(tunnel[t].ip); *(u32 *) & addr.sin_addr = htonl(tunnel[t].ip);
@ -783,11 +784,7 @@ static void processipout(u8 * buf, int len)
// Add on L2TP header // Add on L2TP header
{ {
u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP); u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP);
if (!p) if (!p) return;
{
LOG(3, session[s].ip, s, t, "failed to send packet in processipout.\n");
return;
}
tunnelsend(b, len + (p-b), t); // send it... tunnelsend(b, len + (p-b), t); // send it...
} }
@ -837,11 +834,7 @@ static void send_ipout(sessionidt s, u8 *buf, int len)
// Add on L2TP header // Add on L2TP header
{ {
u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP); u8 *p = makeppp(b, sizeof(b), buf, len, t, s, PPPIP);
if (!p) if (!p) return;
{
LOG(3, session[s].ip, s, t, "failed to send packet in send_ipout.\n");
return;
}
tunnelsend(b, len + (p-b), t); // send it... tunnelsend(b, len + (p-b), t); // send it...
} }
@ -1114,11 +1107,7 @@ void sendipcp(tunnelidt t, sessionidt s)
} }
q = makeppp(buf,sizeof(buf), 0, 0, t, s, PPPIPCP); q = makeppp(buf,sizeof(buf), 0, 0, t, s, PPPIPCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, "failed to send packet in sendipcp.\n");
return;
}
*q = ConfigReq; *q = ConfigReq;
q[1] = r << RADIUS_SHIFT; // ID, dont care, we only send one type of request q[1] = r << RADIUS_SHIFT; // ID, dont care, we only send one type of request
@ -2072,11 +2061,7 @@ static int regular_cleanups(void)
u8 b[MAXCONTROL] = {0}; u8 b[MAXCONTROL] = {0};
u8 *q = makeppp(b, sizeof(b), 0, 0, session[s].tunnel, s, PPPLCP); u8 *q = makeppp(b, sizeof(b), 0, 0, session[s].tunnel, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, "failed to send ECHO packet.\n");
continue;
}
*q = EchoReq; *q = EchoReq;
*(u8 *)(q + 1) = (time_now % 255); // ID *(u8 *)(q + 1) = (time_now % 255); // ID

4
l2tpns.h
View file

@ -1,5 +1,5 @@
// L2TPNS Global Stuff // L2TPNS Global Stuff
// $Id: l2tpns.h,v 1.35 2004/11/16 07:54:32 bodea Exp $ // $Id: l2tpns.h,v 1.36 2004/11/25 02:45:27 bodea Exp $
#ifndef __L2TPNS_H__ #ifndef __L2TPNS_H__
#define __L2TPNS_H__ #define __L2TPNS_H__
@ -15,7 +15,7 @@
#include <sys/types.h> #include <sys/types.h>
#include <libcli.h> #include <libcli.h>
#define VERSION "2.0.8" #define VERSION "2.0.9"
// Limits // Limits
#define MAXTUNNEL 500 // could be up to 65535 #define MAXTUNNEL 500 // could be up to 65535

6
l2tpns.spec
View file

@ -1,6 +1,6 @@
Summary: A high-speed clustered L2TP LNS Summary: A high-speed clustered L2TP LNS
Name: l2tpns Name: l2tpns
Version: 2.0.8 Version: 2.0.9
Release: 1 Release: 1
Copyright: GPL Copyright: GPL
Group: System Environment/Daemons Group: System Environment/Daemons
@ -43,5 +43,5 @@ rm -rf %{buildroot}
%attr(644,root,root) /usr/share/man/man[58]/* %attr(644,root,root) /usr/share/man/man[58]/*
%changelog %changelog
* Sat Nov 20 2004 Brendan O'Dea <bod@optusnet.com.au> 2.0.8-1 * Thu Nov 25 2004 Brendan O'Dea <bod@optusnet.com.au> 2.0.9-1
- 2.0.8 release, see /usr/share/doc/l2tpns-2.0.8/Changes - 2.0.9 release, see /usr/share/doc/l2tpns-2.0.9/Changes

185
ppp.c
View file

@ -1,6 +1,6 @@
// L2TPNS PPP Stuff // L2TPNS PPP Stuff
char const *cvs_id_ppp = "$Id: ppp.c,v 1.27 2004/11/18 13:15:28 bodea Exp $"; char const *cvs_id_ppp = "$Id: ppp.c,v 1.28 2004/11/25 02:45:27 bodea Exp $";
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
@ -23,8 +23,6 @@ extern u32 eth_tx;
extern time_t time_now; extern time_t time_now;
extern struct configt *config; extern struct configt *config;
static void sendccp(tunnelidt t, sessionidt s);
// Process PAP messages // Process PAP messages
void processpap(tunnelidt t, sessionidt s, u8 *p, u16 l) void processpap(tunnelidt t, sessionidt s, u8 *p, u16 l)
{ {
@ -75,10 +73,8 @@ void processpap(tunnelidt t, sessionidt s, u8 *p, u16 l)
u8 b[MAXCONTROL]; u8 b[MAXCONTROL];
u8 id = p[1]; u8 id = p[1];
u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP); u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP);
if (!p) { // Failed to make ppp header! if (!p) return;
LOG(1,0,0,0, "Failed to make PPP header in process pap!\n");
return;
}
if (session[s].ip) if (session[s].ip)
*p = 2; // ACK *p = 2; // ACK
else else
@ -384,14 +380,17 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
LOG(2, session[s].ip, s, t, " Remote requesting asyncmap. Rejecting.\n"); LOG(2, session[s].ip, s, t, " Remote requesting asyncmap. Rejecting.\n");
if (!response) if (!response)
{ {
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP);
if (!q) if (!q) break;
{
LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
break;
}
response = *q++ = ConfigNak; response = *q++ = ConfigNak;
} }
if ((q - b + 11) > sizeof(b))
{
LOG(2, session[s].ip, s, t, "LCP overflow for asyncmap ConfigNak.\n");
break;
}
*q++ = type; *q++ = type;
*q++ = 6; *q++ = 6;
memset(q, 0, 4); // asyncmap 0 memset(q, 0, 4); // asyncmap 0
@ -417,14 +416,17 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
if (!response) if (!response)
{ {
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP);
if (!q) if (!q) break;
{
LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
break;
}
response = *q++ = ConfigNak; response = *q++ = ConfigNak;
} }
if ((q - b + length) > sizeof(b))
{
LOG(2, session[s].ip, s, t, "LCP overflow for %s ConfigNak.\n", proto_name);
break;
}
memcpy(q, o, length); memcpy(q, o, length);
*(u16 *)(q += 2) = htons(PPPPAP); // NAK -> Use PAP instead *(u16 *)(q += 2) = htons(PPPPAP); // NAK -> Use PAP instead
q += length; q += length;
@ -444,15 +446,17 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
LOG(2, session[s].ip, s, t, " Rejecting PPP LCP Option type %d\n", type); LOG(2, session[s].ip, s, t, " Rejecting PPP LCP Option type %d\n", type);
if (!response || response != ConfigRej) // drop nak in favour of rej if (!response || response != ConfigRej) // drop nak in favour of rej
{ {
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(2, session[s].ip, s, t, " Failed to send packet.\n");
break;
}
response = *q++ = ConfigRej; response = *q++ = ConfigRej;
} }
if ((q - b + length) > sizeof(b))
{
LOG(2, session[s].ip, s, t, "LCP overflow for ConfigRej (type=%d).\n", type);
break;
}
memcpy(q, o, length); memcpy(q, o, length);
q += length; q += length;
} }
@ -464,11 +468,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
{ {
// Send back a ConfigAck // Send back a ConfigAck
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, " failed to create packet.\n");
return;
}
response = *q = ConfigAck; response = *q = ConfigAck;
} }
@ -486,16 +486,12 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
} }
else if (*p == TerminateReq) else if (*p == TerminateReq)
{ {
LOG(3, session[s].ip, s, t, "LCP: Received TerminateReq. Sending TerminateAck\n");
*p = TerminateAck; // close *p = TerminateAck; // close
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, "Failed to create PPP packet in processlcp.\n");
return;
}
LOG(3, session[s].ip, s, t, "LCP: Received TerminateReq. Sending TerminateAck\n");
sessionshutdown(s, "Remote end closed connection.");
tunnelsend(b, l + (q - b), t); // send it tunnelsend(b, l + (q - b), t); // send it
sessionshutdown(s, "Remote end closed connection.");
} }
else if (*p == TerminateAck) else if (*p == TerminateAck)
{ {
@ -503,15 +499,11 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
} }
else if (*p == EchoReq) else if (*p == EchoReq)
{ {
LOG(5, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
*p = EchoReply; // reply *p = EchoReply; // reply
*(u32 *) (p + 4) = htonl(session[s].magic); // our magic number *(u32 *) (p + 4) = htonl(session[s].magic); // our magic number
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, " failed to send EchoReply.\n");
return;
}
LOG(5, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
tunnelsend(b, l + (q - b), t); // send it tunnelsend(b, l + (q - b), t); // send it
} }
else if (*p == EchoReply) else if (*p == EchoReply)
@ -527,11 +519,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
l = 1400; l = 1400;
} }
q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP); q = makeppp(b, sizeof(b), p, l, t, s, PPPLCP);
if (!q) if (!q) return;
{
LOG(3, session[s].ip, s, t, "Failed to create IdentRej.\n");
return;
}
LOG_HEX(5, "LCPIdentRej", q, l + 4); LOG_HEX(5, "LCPIdentRej", q, l + 4);
tunnelsend(b, 12 + 4 + l, t); tunnelsend(b, 12 + 4 + l, t);
} }
@ -639,10 +627,8 @@ void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
u16 n = 4; u16 n = 4;
i = p + l; i = p + l;
if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP))) if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
{
LOG(2, 0, s, t, "Failed to send IPCP ConfigRej\n");
return; return;
}
*q = ConfigRej; *q = ConfigRej;
p += 4; p += 4;
while (p < i && p[1]) while (p < i && p[1])
@ -696,10 +682,8 @@ void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
inet_toa(htonl(session[s].ip))); inet_toa(htonl(session[s].ip)));
} }
if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP))) if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPIPCP)))
{
LOG(2, 0, s, t, " Failed to send IPCP packet.\n");
return; return;
}
tunnelsend(b, l + (q - b), t); // send it tunnelsend(b, l + (q - b), t); // send it
} }
} }
@ -814,42 +798,41 @@ void send_ipin(sessionidt s, u8 *buf, int len)
// Process CCP messages // Process CCP messages
void processccp(tunnelidt t, sessionidt s, u8 *p, u16 l) void processccp(tunnelidt t, sessionidt s, u8 *p, u16 l)
{ {
u8 b[MAXCONTROL];
u8 *q;
CSTAT(call_processccp); CSTAT(call_processccp);
LOG_HEX(5, "CCP", p, l); LOG_HEX(5, "CCP", p, l);
if (l < 2 || (*p != ConfigReq && *p != TerminateReq)) switch (l > 1 ? *p : 0)
{ {
case ConfigReq:
if (l < 6)
*p = ConfigAck; // accept no compression
else
*p = ConfigRej; // reject
break;
case TerminateReq:
*p = TerminateAck;
break;
default:
if (l > 1)
LOG(1, 0, s, t, "Unexpected CCP request code %d\n", *p); LOG(1, 0, s, t, "Unexpected CCP request code %d\n", *p);
else
LOG(1, 0, s, t, "Short CCP packet\n");
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return; return;
} }
// reject
{
u8 b[MAXCONTROL];
u8 *q;
if (*p == ConfigReq)
{
if (l < 6)
{
*p = ConfigAck; // accept no compression
}
else
{
*p = ConfigRej; // reject
sendccp(t, s);
}
}
else
*p = TerminateAck; // close
if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP))) if (!(q = makeppp(b, sizeof(b), p, l, t, s, PPPCCP)))
{
LOG(1,0,0,0, "Failed to send CCP packet.\n");
return; return;
}
tunnelsend(b, l + (q - b), t); // send it tunnelsend(b, l + (q - b), t); // send it
} }
}
// send a CHAP PP packet // send a CHAP PP packet
void sendchap(tunnelidt t, sessionidt s) void sendchap(tunnelidt t, sessionidt s)
@ -886,11 +869,8 @@ void sendchap(tunnelidt t, sessionidt s)
return ; return ;
} }
q = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP); q = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP);
if (!q) if (!q) return;
{
LOG(1, 0, s, t, "failed to send CHAP challenge.\n");
return;
}
*q = 1; // challenge *q = 1; // challenge
q[1] = radius[r].id; // ID q[1] = radius[r].id; // ID
q[4] = 16; // length q[4] = 16; // length
@ -905,8 +885,13 @@ void sendchap(tunnelidt t, sessionidt s)
// returns start of PPP frame // returns start of PPP frame
u8 *makeppp(u8 *b, int size, u8 *p, int l, tunnelidt t, sessionidt s, u16 mtype) u8 *makeppp(u8 *b, int size, u8 *p, int l, tunnelidt t, sessionidt s, u16 mtype)
{ {
if (size < 12) if (size < 12) // Need more space than this!!
return NULL; // Need more space than this!! {
static int backtrace_count = 0;
LOG(0, session[s].ip, s, t, "makeppp buffer too small for L2TP header (size=%d)\n", size);
log_backtrace(backtrace_count, 5)
return NULL;
}
*(u16 *) (b + 0) = htons(0x0002); // L2TP with no options *(u16 *) (b + 0) = htons(0x0002); // L2TP with no options
*(u16 *) (b + 2) = htons(tunnel[t].far); // tunnel *(u16 *) (b + 2) = htons(tunnel[t].far); // tunnel
@ -925,12 +910,17 @@ u8 *makeppp(u8 *b, int size, u8 *p, int l, tunnelidt t, sessionidt s, u16 mtype)
b += 2; b += 2;
} }
if (l + 12 > size) { if (l + 12 > size)
LOG(3,0,0,0, "Would have overflowed the buffer in makeppp: size %d, len %d.\n", size, l); {
return NULL; // Run out of room to hold the packet! static int backtrace_count = 0;
LOG(2, session[s].ip, s, t, "makeppp would overflow buffer (size=%d, header+payload=%d)\n", size, l + 12);
log_backtrace(backtrace_count, 5)
return NULL;
} }
if (p && l) if (p && l)
memcpy(b, p, l); memcpy(b, p, l);
return b; return b;
} }
@ -939,12 +929,9 @@ void initlcp(tunnelidt t, sessionidt s)
{ {
char b[500] = {0}, *q; char b[500] = {0}, *q;
q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP); if (!(q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPLCP)))
if (!q)
{
LOG(1, 0, s, t, "Failed to send LCP ConfigReq.\n");
return; return;
}
LOG(4, 0, s, t, "Sending LCP ConfigReq for PAP\n"); LOG(4, 0, s, t, "Sending LCP ConfigReq for PAP\n");
*q = ConfigReq; *q = ConfigReq;
*(u8 *)(q + 1) = (time_now % 255) + 1; // ID *(u8 *)(q + 1) = (time_now % 255) + 1; // ID
@ -957,17 +944,3 @@ void initlcp(tunnelidt t, sessionidt s)
*(u16 *)(q + 12) = htons(PPPPAP); // PAP *(u16 *)(q + 12) = htons(PPPPAP); // PAP
tunnelsend(b, 12 + 14, t); tunnelsend(b, 12 + 14, t);
} }
// Send CCP reply
static void sendccp(tunnelidt t, sessionidt s)
{
char *q, b[500] = {0};
q = makeppp(b, sizeof(b), NULL, 0, t, s, PPPCCP);
*q = ConfigReq;
*(u8 *)(q + 1) = (time_now % 255) + 1; // ID
*(u16 *)(q + 2) = htons(4); // Length
LOG_HEX(5, "PPPCCP", q, 4);
tunnelsend(b, (q - b) + 4 , t);
}

10
radius.c
View file

@ -1,6 +1,6 @@
// L2TPNS Radius Stuff // L2TPNS Radius Stuff
char const *cvs_id_radius = "$Id: radius.c,v 1.12 2004/11/16 07:54:32 bodea Exp $"; char const *cvs_id_radius = "$Id: radius.c,v 1.13 2004/11/25 02:45:27 bodea Exp $";
#include <time.h> #include <time.h>
#include <stdio.h> #include <stdio.h>
@ -426,9 +426,8 @@ void processrad(u8 *buf, int len, char socket_index)
{ {
// CHAP // CHAP
u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP); u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPCHAP);
if (!p) { if (!p) return; // Abort!
return; // Abort!
}
{ {
struct param_post_auth packet = { &tunnel[t], &session[s], session[s].user, (*buf == 2), PPPCHAP }; struct param_post_auth packet = { &tunnel[t], &session[s], session[s].user, (*buf == 2), PPPCHAP };
run_plugins(PLUGIN_POST_AUTH, &packet); run_plugins(PLUGIN_POST_AUTH, &packet);
@ -446,8 +445,7 @@ void processrad(u8 *buf, int len, char socket_index)
{ {
// PAP // PAP
u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP); u8 *p = makeppp(b, sizeof(b), 0, 0, t, s, PPPPAP);
if (!p) if (!p) return; // Abort!
return; // Abort!
{ {
struct param_post_auth packet = { &tunnel[t], &session[s], session[s].user, (*buf == 2), PPPPAP }; struct param_post_auth packet = { &tunnel[t], &session[s], session[s].user, (*buf == 2), PPPPAP };