welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply MLPPP patch from Muhammad Tayseer Alquoatli, very belatedly, with

Browse source 
thanks.  Changes:
- Handle session shutdown gracefully regarding leaving the bundle (bug that is
  caused when a all session leaves a bundle then another join)
- IP assignment is done only for the first session in the bundle (save IP
  waste for multiple MLPPP sessions)
- Route is being added only for the first session in the bundle (less routes
  on l2tpns system)
- Fix route deletion problem for MLPPP sessions (bug that caused when a
  session leaves a bundle)
- Uniformity of sequence number space satisfied (according to RFC1990)
- Fix reassembling fragmented packets and handling lost fragments (according
  to RFC 1990)
- FragmentatConnection to l2tpns.cvs.sourceforge.net closed by remote host.n
  across N session rather than two)
- Sequence numbers extraction mask has been corrected (bug in extracting
  sequence numbers)
- some clustering support fixes
- Upload/Download statistics has been corrected
- add "kill_timedout_sessions" config option
This commit is contained in:
Brendan O'Dea 2009-12-08 14:49:28 +00:00
parent 46e0772dfa
commit 845bb1f376
9 changed files with 592 additions and 382 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Changes
View file

@ -1,3 +1,6 @@
Wed Dec 9 2009 Brendan O'Dea <bod@optus.net> 2.2.x
- Apply MLPPP patch from Muhammad Tayseer Alquoatli.
* Mon Dec 18 2006 Brendan O'Dea <bod@optus.net> 2.2.0 * Mon Dec 18 2006 Brendan O'Dea <bod@optus.net> 2.2.0
- Only poll clifd if successfully bound. - Only poll clifd if successfully bound.
- Add "Practical VPNs" document from Liran Tal as Docs/vpn . - Add "Practical VPNs" document from Liran Tal as Docs/vpn .

1
THANKS
View file

@ -29,3 +29,4 @@ Patrick Cole <z@amused.net>
Khaled Al Hamwi <kh.alhamwi@gmail.com> Khaled Al Hamwi <kh.alhamwi@gmail.com>
Graham Maltby <gmaltby+l2tpns@iig.com.au> Graham Maltby <gmaltby+l2tpns@iig.com.au>
Rhys Kidd <rhys.kidd@staff.westnet.com.au> Rhys Kidd <rhys.kidd@staff.westnet.com.au>
Muhammad Tayseer Alquoatli <idoit.ief@gmail.com>

9
cluster.c
View file

@ -1,6 +1,6 @@
// L2TPNS Clustering Stuff // L2TPNS Clustering Stuff
char const *cvs_id_cluster = "$Id: cluster.c,v 1.54 2006-12-04 20:50:02 bodea Exp $"; char const *cvs_id_cluster = "$Id: cluster.c,v 1.55 2009-12-08 14:49:28 bodea Exp $";
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
@ -402,7 +402,7 @@ void cluster_send_ping(time_t basetime)
x.ver = 1; x.ver = 1;
x.addr = config->bind_address; x.addr = config->bind_address;
x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels; x.undef = config->cluster_undefined_sessions + config->cluster_undefined_tunnels + config->cluster_undefined_bundles;
x.basetime = basetime; x.basetime = basetime;
add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x)); add_type(&p, C_PING, basetime, (uint8_t *) &x, sizeof(x));
@ -940,9 +940,8 @@ void cluster_heartbeat()
if (bcount >= config->cluster_highest_bundleid) if (bcount >= config->cluster_highest_bundleid)
break; break;
hb_add_type(&p, C_CTUNNEL, walk_bundle_number); hb_add_type(&p, C_CBUNDLE, walk_bundle_number);
walk_tunnel_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero. walk_bundle_number = (1+walk_bundle_number)%(config->cluster_highest_bundleid+1); // +1 avoids divide by zero.
++bcount; ++bcount;
} }

5
constants.c
View file

@ -1,6 +1,6 @@
// L2TPNS: constants // L2TPNS: constants
char const *cvs_id_constants = "$Id: constants.c,v 1.7 2005-07-31 10:04:10 bodea Exp $"; char const *cvs_id_constants = "$Id: constants.c,v 1.8 2009-12-08 14:49:28 bodea Exp $";
#include <stdio.h> #include <stdio.h>
#include "constants.h" #include "constants.h"
@ -197,7 +197,8 @@ CONSTANT(radius_state,
"RADIUSSTART", // 3 "RADIUSSTART", // 3
"RADIUSSTOP", // 4 "RADIUSSTOP", // 4
"RADIUSINTERIM", // 5 "RADIUSINTERIM", // 5
"RADIUSWAIT" // 6 "RADIUSWAIT", // 6
"RADIUSJUSTAUTH" // 7
) )
CONSTANT(radius_code, CONSTANT(radius_code,

3
etc/startup-config.default
View file

@ -41,6 +41,9 @@ set radius_secret "secret"
# Allow multiple logins for the same username # Allow multiple logins for the same username
#set allow_duplicate_users no #set allow_duplicate_users no
# Kill timedout sessions ? (default yes)
#set kill_timedout_sessions no
# Allow multiple logins for specific username # Allow multiple logins for specific username
#set guest_account "" #set guest_account ""

382
l2tpns.c
View file

@ -4,7 +4,7 @@
// Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced // Copyright (c) 2002 FireBrick (Andrews & Arnold Ltd / Watchfront Ltd) - GPL licenced
// vim: sw=8 ts=8 // vim: sw=8 ts=8
char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.172 2006-12-18 12:05:36 bodea Exp $"; char const *cvs_id_l2tpns = "$Id: l2tpns.c,v 1.173 2009-12-08 14:49:28 bodea Exp $";
#include <arpa/inet.h> #include <arpa/inet.h>
#include <assert.h> #include <assert.h>
@ -74,6 +74,9 @@ static int tunidx; // ifr_ifindex of tun device
static int syslog_log = 0; // are we logging to syslog static int syslog_log = 0; // are we logging to syslog
static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog). static FILE *log_stream = 0; // file handle for direct logging (i.e. direct into file, not via syslog).
uint32_t last_id = 0; // Unique ID for radius accounting uint32_t last_id = 0; // Unique ID for radius accounting
// Guest change
char guest_users[10][32]; // Array of guest users
int guest_accounts_num = 0; // Number of guest users
// calculated from config->l2tp_mtu // calculated from config->l2tp_mtu
uint16_t MRU = 0; // PPP MRU uint16_t MRU = 0; // PPP MRU
@ -133,6 +136,7 @@ config_descriptt config_values[] = {
CONFIG("radius_bind_min", radius_bind_min, SHORT), CONFIG("radius_bind_min", radius_bind_min, SHORT),
CONFIG("radius_bind_max", radius_bind_max, SHORT), CONFIG("radius_bind_max", radius_bind_max, SHORT),
CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL), CONFIG("allow_duplicate_users", allow_duplicate_users, BOOL),
CONFIG("kill_timedout_sessions", kill_timedout_sessions, BOOL),
CONFIG("guest_account", guest_user, STRING), CONFIG("guest_account", guest_user, STRING),
CONFIG("bind_address", bind_address, IPv4), CONFIG("bind_address", bind_address, IPv4),
CONFIG("peer_address", peer_address, IPv4), CONFIG("peer_address", peer_address, IPv4),
@ -1070,45 +1074,63 @@ void processmpframe(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l, uint8_t e
l -= 4; l -= 4;
} }
// Process this frame if (*p & 1)
if (*p & 1) {
{ proto = *p++;
proto = *p++; l--;
l--; }
} else
else {
{ proto = ntohs(*(uint16_t *) p);
proto = ntohs(*(uint16_t *) p); p += 2;
p += 2; l -= 2;
l -= 2; }
} if (proto == PPPIP)
{
if (session[s].die)
{
LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
return; // closing session, PPP not processed
}
session[s].last_packet = session[s].last_data = time_now;
processipin(s, t, p, l);
}
else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0])
{
if (session[s].die)
{
LOG(4, s, t, "MPPP: Session %d is closing. Don't process PPP packets\n", s);
return; // closing session, PPP not processed
}
if (proto == PPPIP) session[s].last_packet = session[s].last_data = time_now;
{ processipv6in(s, t, p, l);
if (session[s].die) }
{ else if (proto == PPPIPCP)
LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s); {
return; // closing session, PPP not processed session[s].last_packet = session[s].last_data = time_now;
} processipcp(s, t, p, l);
}
else if (proto == PPPCCP)
{
session[s].last_packet = session[s].last_data = time_now;
processccp(s, t, p, l);
}
else
{
LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
}
}
session[s].last_packet = session[s].last_data = time_now; static void update_session_out_stat(sessionidt s, sessiont *sp, int len)
processipin(s, t, p, l); {
} increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
else if (proto == PPPIPV6 && config->ipv6_prefix.s6_addr[0]) sp->cout_delta += len;
{ sp->pout++;
if (session[s].die) sp->last_data = time_now;
{
LOG(4, s, t, "MPPP: Session %u is closing. Don't process PPP packets\n", s);
return; // closing session, PPP not processed
}
session[s].last_packet = session[s].last_data = time_now; sess_local[s].cout += len; // To send to master..
processipv6in(s, t, p, l); sess_local[s].pout++;
}
else
{
LOG(2, s, t, "MPPP: Unsupported MP protocol 0x%04X received\n",proto);
}
} }
// process outgoing (to tunnel) IP // process outgoing (to tunnel) IP
@ -1123,8 +1145,7 @@ static void processipout(uint8_t *buf, int len)
uint8_t *data = buf; // Keep a copy of the originals. uint8_t *data = buf; // Keep a copy of the originals.
int size = len; int size = len;
uint8_t b1[MAXETHER + 20]; uint8_t fragbuf[MAXETHER + 20];
uint8_t b2[MAXETHER + 20];
CSTAT(processipout); CSTAT(processipout);
@ -1173,9 +1194,15 @@ static void processipout(uint8_t *buf, int len)
} }
return; return;
} }
t = session[s].tunnel; t = session[s].tunnel;
if (len > session[s].mru || (session[s].mrru && len > session[s].mrru))
{
LOG(3, s, t, "Packet size more than session MRU\n");
return;
}
sp = &session[s]; sp = &session[s];
sp->last_data = time_now;
// DoS prevention: enforce a maximum number of packets per 0.1s for a session // DoS prevention: enforce a maximum number of packets per 0.1s for a session
if (config->max_packets > 0) if (config->max_packets > 0)
@ -1246,55 +1273,80 @@ static void processipout(uint8_t *buf, int len)
} }
// Add on L2TP header // Add on L2TP header
{ {
bundleidt bid = 0; bundleidt bid = 0;
if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1) if(session[s].bundle != 0 && bundle[session[s].bundle].num_of_links > 1)
{ {
bid = session[s].bundle; bid = session[s].bundle;
s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links]; s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links];
LOG(4, s, t, "MPPP: (1)Session number becomes: %u\n", s); t = session[s].tunnel;
if (len > 256) sp = &session[s];
{ LOG(4, s, t, "MPPP: (1)Session number becomes: %d\n", s);
// Partition the packet to 2 fragments if(len > MINFRAGLEN)
uint32_t frag1len = len / 2; {
uint32_t frag2len = len - frag1len; // Partition the packet to "bundle[b].num_of_links" fragments
uint8_t *p = makeppp(b1, sizeof(b1), buf, frag1len, s, t, PPPIP, 0, bid, MP_BEGIN); bundlet *b = &bundle[bid];
uint8_t *q; uint32_t num_of_links = b->num_of_links;
uint32_t fraglen = len / num_of_links;
fraglen = (fraglen > session[s].mru ? session[s].mru : fraglen);
uint32_t last_fraglen = fraglen + len % num_of_links;
last_fraglen = (last_fraglen > session[s].mru ? len % num_of_links : last_fraglen);
uint32_t remain = len;
if (!p) return; // send the first packet
tunnelsend(b1, frag1len + (p-b1), t); // send it... uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, fraglen, s, t, PPPIP, 0, bid, MP_BEGIN);
s = bundle[bid].members[bundle[bid].current_ses = ++bundle[bid].current_ses % bundle[bid].num_of_links]; if (!p) return;
LOG(4, s, t, "MPPP: (2)Session number becomes: %u\n", s); tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
q = makeppp(b2, sizeof(b2), buf+frag1len, frag2len, s, t, PPPIP, 0, bid, MP_END); // statistics
if (!q) return; update_session_out_stat(s, sp, fraglen);
tunnelsend(b2, frag2len + (q-b2), t); // send it... remain -= fraglen;
} while (remain > last_fraglen)
else { {
// Send it as one frame s = b->members[b->current_ses = ++b->current_ses % num_of_links];
uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS); t = session[s].tunnel;
if (!p) return; sp = &session[s];
tunnelsend(b1, len + (p-b1), t); // send it... LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
} p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), fraglen, s, t, PPPIP, 0, bid, 0);
} if (!p) return;
else tunnelsend(fragbuf, fraglen + (p-fragbuf), t); // send it...
{ update_session_out_stat(s, sp, fraglen);
uint8_t *p = makeppp(b1, sizeof(b1), buf, len, s, t, PPPIP, 0, 0, 0); remain -= fraglen;
if (!p) return; }
tunnelsend(b1, len + (p-b1), t); // send it... // send the last fragment
} s = b->members[b->current_ses = ++b->current_ses % num_of_links];
} t = session[s].tunnel;
sp = &session[s];
LOG(4, s, t, "MPPP: (2)Session number becomes: %d\n", s);
p = makeppp(fragbuf, sizeof(fragbuf), buf+(len - remain), remain, s, t, PPPIP, 0, bid, MP_END);
if (!p) return;
tunnelsend(fragbuf, remain + (p-fragbuf), t); // send it...
update_session_out_stat(s, sp, remain);
if (remain != last_fraglen)
LOG(3, s, t, "PROCESSIPOUT ERROR REMAIN != LAST_FRAGLEN, %d != %d\n", remain, last_fraglen);
}
else {
// Send it as one frame
uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, bid, MP_BOTH_BITS);
if (!p) return;
tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
LOG(4, s, t, "MPPP: packet sent as one frame\n");
update_session_out_stat(s, sp, len);
}
}
else
{
uint8_t *p = makeppp(fragbuf, sizeof(fragbuf), buf, len, s, t, PPPIP, 0, 0, 0);
if (!p) return;
tunnelsend(fragbuf, len + (p-fragbuf), t); // send it...
update_session_out_stat(s, sp, len);
}
}
// Snooping this session, send it to intercept box // Snooping this session, send it to intercept box
if (sp->snoop_ip && sp->snoop_port) if (sp->snoop_ip && sp->snoop_port)
snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port); snoop_send_packet(buf, len, sp->snoop_ip, sp->snoop_port);
increment_counter(&sp->cout, &sp->cout_wrap, len); // byte count
sp->cout_delta += len;
sp->pout++;
udp_tx += len; udp_tx += len;
sess_local[s].cout += len; // To send to master..
sess_local[s].pout++;
} }
// process outgoing (to tunnel) IPv6 // process outgoing (to tunnel) IPv6
@ -1661,7 +1713,9 @@ void filter_session(sessionidt s, int filter_in, int filter_out)
void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause) void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_error, int term_cause)
{ {
int walled_garden = session[s].walled_garden; int walled_garden = session[s].walled_garden;
bundleidt b = session[s].bundle;
//delete routes only for last session in bundle (in case of MPPP)
int del_routes = !b || (bundle[b].num_of_links == 1);
CSTAT(sessionshutdown); CSTAT(sessionshutdown);
@ -1710,21 +1764,52 @@ void sessionshutdown(sessionidt s, char const *reason, int cdn_result, int cdn_e
(session[s].route[r].ip & session[s].route[r].mask)) (session[s].route[r].ip & session[s].route[r].mask))
routed++; routed++;
routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0); if (del_routes) routeset(s, session[s].route[r].ip, session[s].route[r].mask, 0, 0);
session[s].route[r].ip = 0; session[s].route[r].ip = 0;
} }
if (session[s].ip_pool_index == -1) // static ip if (session[s].ip_pool_index == -1) // static ip
{ {
if (!routed) routeset(s, session[s].ip, 0, 0, 0); if (!routed && del_routes) routeset(s, session[s].ip, 0, 0, 0);
session[s].ip = 0; session[s].ip = 0;
} }
else else
free_ip_address(s); free_ip_address(s);
// unroute IPv6, if setup // unroute IPv6, if setup
if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen) if (session[s].ppp.ipv6cp == Opened && session[s].ipv6prefixlen && del_routes)
route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0); route6set(s, session[s].ipv6route, session[s].ipv6prefixlen, 0);
if (b)
{
// This session was part of a bundle
bundle[b].num_of_links--;
LOG(3, s, 0, "MPPP: Dropping member link: %d from bundle %d\n",s,b);
if(bundle[b].num_of_links == 0)
{
bundleclear(b);
LOG(3, s, 0, "MPPP: Kill bundle: %d (No remaing member links)\n",b);
}
else
{
// Adjust the members array to accomodate the new change
uint8_t mem_num = 0;
// It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
if(bundle[b].members[bundle[b].num_of_links] != s)
{
uint8_t ml;
for(ml = 0; ml<bundle[b].num_of_links; ml++)
if(bundle[b].members[ml] == s)
{
mem_num = ml;
break;
}
bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
LOG(3, s, 0, "MPPP: Adjusted member links array\n");
}
}
cluster_send_bundle(b);
}
} }
if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled. if (session[s].throttle_in || session[s].throttle_out) // Unthrottle if throttled.
@ -1834,8 +1919,6 @@ static void sessionclear(sessionidt s)
// kill a session now // kill a session now
void sessionkill(sessionidt s, char *reason) void sessionkill(sessionidt s, char *reason)
{ {
bundleidt b;
CSTAT(sessionkill); CSTAT(sessionkill);
if (!session[s].opened) // not alive if (!session[s].opened) // not alive
@ -1852,39 +1935,7 @@ void sessionkill(sessionidt s, char *reason)
if (sess_local[s].radius) if (sess_local[s].radius)
radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed radiusclear(sess_local[s].radius, s); // cant send clean accounting data, session is killed
LOG(2, s, session[s].tunnel, "Kill session %u (%s): %s\n", s, session[s].user, reason); LOG(2, s, session[s].tunnel, "Kill session %d (%s): %s\n", s, session[s].user, reason);
if ((b = session[s].bundle))
{
// This session was part of a bundle
bundle[b].num_of_links--;
LOG(3, s, 0, "MPPP: Dropping member link: %u from bundle %u\n", s, b);
if (bundle[b].num_of_links == 0)
{
bundleclear(b);
LOG(3, s, 0, "MPPP: Kill bundle: %u (No remaing member links)\n", b);
}
else
{
// Adjust the members array to accomodate the new change
uint8_t mem_num = 0;
// It should be here num_of_links instead of num_of_links-1 (previous instruction "num_of_links--")
if (bundle[b].members[bundle[b].num_of_links] != s)
{
uint8_t ml;
for (ml = 0; ml<bundle[b].num_of_links; ml++)
{
if (bundle[b].members[ml] == s)
{
mem_num = ml;
break;
}
}
bundle[b].members[mem_num] = bundle[b].members[bundle[b].num_of_links];
LOG(3, s, 0, "MPPP: Adjusted member links array\n");
}
}
cluster_send_bundle(b);
}
sessionclear(s); sessionclear(s);
cluster_send_session(s); cluster_send_session(s);
} }
@ -3911,6 +3962,7 @@ static void initdata(int optdebug, char *optconfig)
config->ppp_restart_time = 3; config->ppp_restart_time = 3;
config->ppp_max_configure = 10; config->ppp_max_configure = 10;
config->ppp_max_failure = 5; config->ppp_max_failure = 5;
config->kill_timedout_sessions = 1;
strcpy(config->random_device, RANDOMDEVICE); strcpy(config->random_device, RANDOMDEVICE);
log_stream = stderr; log_stream = stderr;
@ -4737,6 +4789,40 @@ static void update_config()
} }
} }
// Guest change
guest_accounts_num = 0;
char *p2 = config->guest_user;
while (p2 && *p2)
{
char *s = strpbrk(p2, " \t,");
if (s)
{
*s++ = 0;
while (*s == ' ' || *s == '\t')
s++;
if (!*s)
s = 0;
}
strcpy(guest_users[guest_accounts_num], p2);
LOG(1, 0, 0, "Guest account[%d]: %s\n", guest_accounts_num, guest_users[guest_accounts_num]);
guest_accounts_num++;
p2 = s;
}
// Rebuild the guest_user array
strcpy(config->guest_user, "");
int ui = 0;
for (ui=0; ui<guest_accounts_num; ui++)
{
strcat(config->guest_user, guest_users[ui]);
if (ui<guest_accounts_num-1)
{
strcat(config->guest_user, ",");
}
}
memcpy(config->old_plugins, config->plugins, sizeof(config->plugins)); memcpy(config->old_plugins, config->plugins, sizeof(config->plugins));
if (!config->multi_read_count) config->multi_read_count = 10; if (!config->multi_read_count) config->multi_read_count = 10;
if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR); if (!config->cluster_address) config->cluster_address = inet_addr(DEFAULT_MCAST_ADDR);
@ -4815,6 +4901,20 @@ int sessionsetup(sessionidt s, tunnelidt t)
LOG(3, s, t, "Doing session setup for session\n"); LOG(3, s, t, "Doing session setup for session\n");
// Join a bundle if the MRRU option is accepted
if(session[s].mrru > 0 && session[s].bundle == 0)
{
LOG(3, s, t, "This session can be part of multilink bundle\n");
if (join_bundle(s) > 0)
cluster_send_bundle(session[s].bundle);
else
{
LOG(0, s, t, "MPPP: Mismaching mssf option with other sessions in bundle\n");
sessionshutdown(s, "Mismaching mssf option.", CDN_NONE, TERM_SERVICE_UNAVAILABLE);
return 0;
}
}
if (!session[s].ip) if (!session[s].ip)
{ {
assign_ip_address(s); assign_ip_address(s);
@ -4832,14 +4932,6 @@ int sessionsetup(sessionidt s, tunnelidt t)
// Make sure this is right // Make sure this is right
session[s].tunnel = t; session[s].tunnel = t;
// Join a bundle if the MRRU option is accepted
if (session[s].mrru > 0 && !session[s].bundle)
{
LOG(3, s, t, "This session can be part of multilink bundle\n");
if (join_bundle(s))
cluster_send_bundle(session[s].bundle);
}
// zap old sessions with same IP and/or username // zap old sessions with same IP and/or username
// Don't kill gardened sessions - doing so leads to a DoS // Don't kill gardened sessions - doing so leads to a DoS
// from someone who doesn't need to know the password // from someone who doesn't need to know the password
@ -4850,25 +4942,29 @@ int sessionsetup(sessionidt s, tunnelidt t)
{ {
if (i == s) continue; if (i == s) continue;
if (!session[s].opened) continue; if (!session[s].opened) continue;
// Allow duplicate sessions for multilink ones of the same bundle.
if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle)
continue;
if (ip == session[i].ip) if (ip == session[i].ip)
{ {
sessionkill(i, "Duplicate IP address"); sessionkill(i, "Duplicate IP address");
continue; continue;
} }
if (config->allow_duplicate_users) if (config->allow_duplicate_users) continue;
continue; if (session[s].walled_garden || session[i].walled_garden) continue;
// Guest change
if (session[s].walled_garden || session[i].walled_garden) int found = 0;
continue; int gu;
for (gu = 0; gu < guest_accounts_num; gu++)
// Allow duplicate sessions for guest account. {
if (*config->guest_user && !strcasecmp(user, config->guest_user)) if (!strcasecmp(user, guest_users[gu]))
continue; {
found = 1;
// Allow duplicate sessions for multilink ones of the same bundle. break;
if (session[s].bundle && session[i].bundle && session[s].bundle == session[i].bundle) }
continue; }
if (found) continue;
// Drop the new session in case of duplicate sessionss, not the old one. // Drop the new session in case of duplicate sessionss, not the old one.
if (!strcasecmp(user, session[i].user)) if (!strcasecmp(user, session[i].user))
@ -4876,6 +4972,8 @@ int sessionsetup(sessionidt s, tunnelidt t)
} }
} }
// no need to set a route for the same IP address of the bundle
if (!session[s].bundle || (bundle[session[s].bundle].num_of_links == 1))
{ {
int routed = 0; int routed = 0;

85
l2tpns.h
View file

@ -1,5 +1,5 @@
// L2TPNS Global Stuff // L2TPNS Global Stuff
// $Id: l2tpns.h,v 1.120 2006-10-23 02:51:53 bodea Exp $ // $Id: l2tpns.h,v 1.121 2009-12-08 14:49:28 bodea Exp $
#ifndef __L2TPNS_H__ #ifndef __L2TPNS_H__
#define __L2TPNS_H__ #define __L2TPNS_H__
@ -19,10 +19,8 @@
// Limits // Limits
#define MAXTUNNEL 500 // could be up to 65535 #define MAXTUNNEL 500 // could be up to 65535
#define MAXBUNDLE 300 // could be up to 65535 #define MAXBUNDLE 300 // could be up to 65535
#define MAXBUNDLESES 10 // Maximum number of member links in bundle #define MAXBUNDLESES 12 // Maximum number of member links in bundle
#define MAXADDRESS 20 // Maximum length for the Endpoint Discrminiator address #define MAXADDRESS 20 // Maximum length for the Endpoint Discrminiator address
#define MAXFRAGNUM 1500 // Maximum number of Multilink fragment in a bundle
#define MAXFRAGLEN 1000 // Maximum length for Multilink fragment
#define MAXSESSION 60000 // could be up to 65535 #define MAXSESSION 60000 // could be up to 65535
#define MAXTBFS 6000 // Maximum token bucket filters. Might need up to 2 * session. #define MAXTBFS 6000 // Maximum token bucket filters. Might need up to 2 * session.
@ -52,9 +50,15 @@
#define IDLE_TIMEOUT 240 // Time between last packet seen and session shutdown #define IDLE_TIMEOUT 240 // Time between last packet seen and session shutdown
#define BUSY_WAIT_TIME 3000 // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown #define BUSY_WAIT_TIME 3000 // 5 minutes in 1/10th seconds to wait for radius to cleanup on shutdown
#define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header #define MP_BEGIN 0x80 // This value is used when (b)egin bit is set in MP header
#define MP_END 0x40 // This value is used when (e)nd bit is set in MP header #define MP_END 0x40 // This value is used when (e)nd bit is set in MP header
#define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header #define MP_BOTH_BITS 0xC0 // This value is used when both bits (begin and end) are set in MP header
#define MINFRAGLEN 64 // Minumum fragment length
#define MAXFRAGLEN 750 // Maximum length for Multilink fragment (MTU / 2 sessions)
#define MAXFRAGNUM 128 // Maximum number of Multilink fragment in a bundle (must be in the form of 2^X)
// it's not expected to have a space for more than 10 unassembled packets = 10 * MAXBUNDLESES
#define MAXFRAGNUM_MASK 127 // Must be equal to MAXFRAGNUM-1
// Constants // Constants
#ifndef ETCDIR #ifndef ETCDIR
@ -248,8 +252,11 @@ typedef struct {
} epdist; } epdist;
typedef struct { typedef struct {
uint16_t length; // Fragment length sessionidt sid; // Fragment originating session
uint8_t data[MAXFRAGLEN]; // Fragment data uint8_t flags; // MP frame flags
uint32_t seq; // fragment seq num
uint16_t length; // Fragment length
uint8_t data[MAXFRAGLEN]; // Fragment data
} fragmentt; } fragmentt;
typedef struct typedef struct
@ -297,10 +304,11 @@ typedef struct
char calling[MAXTEL]; // calling number char calling[MAXTEL]; // calling number
uint32_t tx_connect_speed; uint32_t tx_connect_speed;
uint32_t rx_connect_speed; uint32_t rx_connect_speed;
uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit clockt timeout; // Session timeout
uint8_t mssf; // Multilink Short Sequence Number Header Format uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
epdist epdis; // Multilink Endpoint Discriminator uint8_t mssf; // Multilink Short Sequence Number Header Format
bundleidt bundle; // Multilink Bundle Identifier epdist epdis; // Multilink Endpoint Discriminator
bundleidt bundle; // Multilink Bundle Identifier
in_addr_t snoop_ip; // Interception destination IP in_addr_t snoop_ip; // Interception destination IP
uint16_t snoop_port; // Interception destination port uint16_t snoop_port; // Interception destination port
uint8_t walled_garden; // is this session gardened? uint8_t walled_garden; // is this session gardened?
@ -312,28 +320,31 @@ sessiont;
typedef struct typedef struct
{ {
int state; // current state (bundlestate enum) int state; // current state (bundlestate enum)
uint32_t seq_num_t; // Sequence Number (transmission) uint32_t seq_num_t; // Sequence Number (transmission)
uint32_t seq_num_m; // Last received frame sequence number (bearing B bit) uint32_t timeout; // Session-Timeout for bundle
uint32_t offset; // Offset between sequence number and array index uint32_t max_seq; // Max value of sequence number field
uint8_t pending_frag; // Indicate that there is pending fragments to reassemble uint8_t num_of_links; // Number of links joint to this bundle
uint8_t num_of_links; // Number of links joint to this bundle uint32_t online_time; // The time this bundle is online
uint32_t online_time; // The time this bundle is online clockt last_check; // Last time the timeout is checked
clockt last_check; // Last time the timeout is checked uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit
uint32_t mrru; // Multilink Max-Receive-Reconstructed-Unit uint8_t mssf; // Multilink Short Sequence Number Header Format
uint8_t mssf; // Multilink Short Sequence Number Header Format epdist epdis; // Multilink Endpoint Discriminator
epdist epdis; // Multilink Endpoint Discriminator char user[MAXUSER]; // Needed for matching member links
char user[MAXUSER]; // Needed for matching member links sessionidt current_ses; // Current session to use for sending (used in RR load-balancing)
sessionidt current_ses; // Current session to use for sending (used in RR load-balancing) sessionidt members[MAXBUNDLESES]; // Array for member links sessions
sessionidt members[MAXBUNDLESES]; // Array for member links sessions
} }
bundlet; bundlet;
typedef struct typedef struct
{ {
fragmentt fragment[MAXFRAGNUM]; fragmentt fragment[MAXFRAGNUM];
uint8_t reassembled_frame[MAXETHER]; // The reassembled frame uint8_t reassembled_frame[MAXETHER]; // The reassembled frame
uint16_t re_frame_len; // The reassembled frame length uint16_t re_frame_len; // The reassembled frame length
uint16_t re_frame_begin_index, re_frame_end_index; // reassembled frame begin index, end index respectively
uint16_t start_index, end_index; // start and end sequence numbers available on the fragments array respectively
uint32_t M; // Minumum frame sequence number received over all bundle members
uint32_t start_seq; // Last received frame sequence number (bearing B bit)
} }
fragmentationt; fragmentationt;
@ -388,6 +399,9 @@ typedef struct
// last LCP Echo // last LCP Echo
time_t last_echo; time_t last_echo;
// Last Multilink frame sequence number received
uint32_t last_seq;
} sessionlocalt; } sessionlocalt;
// session flags // session flags
@ -497,6 +511,7 @@ enum
RADIUSSTOP, // sending stop accounting to RADIUS server RADIUSSTOP, // sending stop accounting to RADIUS server
RADIUSINTERIM, // sending interim accounting to RADIUS server RADIUSINTERIM, // sending interim accounting to RADIUS server
RADIUSWAIT, // waiting timeout before available, in case delayed replies RADIUSWAIT, // waiting timeout before available, in case delayed replies
RADIUSJUSTAUTH, // sending auth to RADIUS server, just authentication, no ip assigning
}; };
struct Tstats struct Tstats
@ -644,7 +659,7 @@ typedef struct
int radius_authprefer; int radius_authprefer;
int allow_duplicate_users; // allow multiple logins with the same username int allow_duplicate_users; // allow multiple logins with the same username
char guest_user[MAXUSER]; // allow multiple logins to guest account username int kill_timedout_sessions; // kill authenticated sessions with "session_timeout == 0"
in_addr_t default_dns1, default_dns2; in_addr_t default_dns1, default_dns2;
@ -691,11 +706,15 @@ typedef struct
int cluster_hb_interval; // How often to send a heartbeat. int cluster_hb_interval; // How often to send a heartbeat.
int cluster_hb_timeout; // How many missed heartbeats trigger an election. int cluster_hb_timeout; // How many missed heartbeats trigger an election.
uint64_t cluster_table_version; // # state changes processed by cluster uint64_t cluster_table_version; // # state changes processed by cluster
int cluster_master_min_adv; // Master advertises routes while the number of up to date
// slaves is less than this value.
struct in6_addr ipv6_prefix; // Our IPv6 network pool. struct in6_addr ipv6_prefix; // Our IPv6 network pool.
int cluster_master_min_adv; // Master advertises routes while the number of up to date
// slaves is less than this value.
// Guest change
char guest_user[MAXUSER]; // Guest account username
#ifdef BGP #ifdef BGP
#define BGP_NUM_PEERS 2 #define BGP_NUM_PEERS 2
uint16_t as_number; uint16_t as_number;

458
ppp.c
View file

@ -1,6 +1,6 @@
// L2TPNS PPP Stuff // L2TPNS PPP Stuff
char const *cvs_id_ppp = "$Id: ppp.c,v 1.103 2007-01-25 12:36:48 bodea Exp $"; char const *cvs_id_ppp = "$Id: ppp.c,v 1.104 2009-12-08 14:49:28 bodea Exp $";
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
@ -31,6 +31,16 @@ static int epdiscmp(epdist, epdist);
static void setepdis(epdist *, epdist); static void setepdis(epdist *, epdist);
static void ipcp_open(sessionidt s, tunnelidt t); static void ipcp_open(sessionidt s, tunnelidt t);
static int first_session_in_bundle(sessionidt s)
{
bundleidt i;
for (i = 1; i < MAXBUNDLE; i++)
if (bundle[i].state != BUNDLEFREE)
if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
return 0;
return 1;
}
// Process PAP messages // Process PAP messages
void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
{ {
@ -140,7 +150,10 @@ void processpap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
radius[r].id = p[1]; radius[r].id = p[1];
LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass); LOG(3, s, t, "Sending login for %s/%s to RADIUS\n", user, pass);
radiussend(r, RADIUSAUTH); if ((session[s].mrru) && (!first_session_in_bundle(s)))
radiussend(r, RADIUSJUSTAUTH);
else
radiussend(r, RADIUSAUTH);
} }
} }
@ -257,7 +270,10 @@ void processchap(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
radius[r].chap = 1; radius[r].chap = 1;
LOG(3, s, t, "CHAP login %s\n", session[s].user); LOG(3, s, t, "CHAP login %s\n", session[s].user);
radiussend(r, RADIUSAUTH); if ((session[s].mrru) && (!first_session_in_bundle(s)))
radiussend(r, RADIUSJUSTAUTH);
else
radiussend(r, RADIUSAUTH);
} }
static void dumplcp(uint8_t *p, int l) static void dumplcp(uint8_t *p, int l)
@ -366,17 +382,7 @@ void lcp_open(sessionidt s, tunnelidt t)
} }
else else
{ {
if (session[s].bundle && bundle[session[s].bundle].num_of_links > 1) if(session[s].bundle == 0 || bundle[session[s].bundle].num_of_links == 1)
{
sessionidt first_ses = bundle[session[s].bundle].members[0];
LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n", s, first_ses);
session[s].ip = session[first_ses].ip;
session[s].dns1 = session[first_ses].dns1;
session[s].dns2 = session[first_ses].dns2;
session[s].session_timeout = session[first_ses].session_timeout;
ipcp_open(s, t);
}
else
{ {
// This-Layer-Up // This-Layer-Up
sendipcp(s, t); sendipcp(s, t);
@ -389,6 +395,12 @@ void lcp_open(sessionidt s, tunnelidt t)
change_state(s, ccp, Stopped); change_state(s, ccp, Stopped);
} }
else
{
sessionidt first_ses = bundle[session[s].bundle].members[0];
LOG(3, s, t, "MPPP: Skipping IPCP negotiation for session:%d, first session of bundle is:%d\n",s,first_ses);
ipcp_open(s, t);
}
} }
} }
@ -1091,10 +1103,20 @@ int join_bundle(sessionidt s)
{ {
if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user)) if (epdiscmp(session[s].epdis,bundle[i].epdis) && !strcmp(session[s].user, bundle[i].user))
{ {
sessionidt first_ses = bundle[i].members[0];
if (bundle[i].mssf != session[s].mssf)
{
// uniformity of sequence number format must be insured
LOG(3, s, session[s].tunnel, "MPPP: unable to bundle session %d in bundle %d cause of different mssf\n", s, i);
return -1;
}
session[s].bundle = i; session[s].bundle = i;
bundle[i].mrru = session[s].mrru; session[s].ip = session[first_ses].ip;
bundle[i].mssf = session[s].mssf; session[s].dns1 = session[first_ses].dns1;
if (session[s].epdis.length > 0) session[s].dns2 = session[first_ses].dns2;
session[s].timeout = session[first_ses].timeout;
if(session[s].epdis.length > 0)
setepdis(&bundle[i].epdis, session[s].epdis); setepdis(&bundle[i].epdis, session[s].epdis);
strcpy(bundle[i].user, session[s].user); strcpy(bundle[i].user, session[s].user);
@ -1112,11 +1134,19 @@ int join_bundle(sessionidt s)
session[s].bundle = b; session[s].bundle = b;
bundle[b].mrru = session[s].mrru; bundle[b].mrru = session[s].mrru;
bundle[b].mssf = session[s].mssf; bundle[b].mssf = session[s].mssf;
if (session[s].epdis.length > 0) // FIXME !!! to enable l2tpns reading mssf frames receiver_max_seq, sender_max_seq must be introduce
// now session[s].mssf flag indecates that the receiver wish to receive frames in mssf, so max_seq (i.e. recv_max_seq) = 1<<24
/*
if (bundle[b].mssf)
bundle[b].max_seq = 1 << 12;
else */
bundle[b].max_seq = 1 << 24;
if(session[s].epdis.length > 0)
setepdis(&bundle[b].epdis, session[s].epdis); setepdis(&bundle[b].epdis, session[s].epdis);
strcpy(bundle[b].user, session[s].user); strcpy(bundle[b].user, session[s].user);
bundle[b].members[0] = s; bundle[b].members[0] = s;
bundle[b].timeout = session[s].timeout;
LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b); LOG(3, s, session[s].tunnel, "MPPP: Created a new bundle (%d)\n", b);
return b; return b;
} }
@ -1148,23 +1178,24 @@ static void setepdis(epdist *ep1, epdist ep2)
static bundleidt new_bundle() static bundleidt new_bundle()
{ {
bundleidt i; bundleidt i;
for (i = 1; i < MAXBUNDLE; i++) for (i = 1; i < MAXBUNDLE; i++)
{ {
if (bundle[i].state == BUNDLEFREE) if (bundle[i].state == BUNDLEFREE)
{ {
LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i); LOG(4, 0, 0, "MPPP: Assigning bundle ID %d\n", i);
bundle[i].num_of_links = 1; bundle[i].num_of_links = 1;
bundle[i].last_check = time_now; // Initialize last_check value bundle[i].last_check = time_now; // Initialize last_check value
bundle[i].state = BUNDLEOPEN; bundle[i].state = BUNDLEOPEN;
bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first bundle[i].current_ses = -1; // This is to enforce the first session 0 to be used at first
if (i > config->cluster_highest_bundleid) memset(&frag[i], 0, sizeof(fragmentationt));
config->cluster_highest_bundleid = i; if (i > config->cluster_highest_bundleid)
return i; config->cluster_highest_bundleid = i;
} return i;
} }
LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n"); }
return 0; LOG(0, 0, 0, "MPPP: Can't find a free bundle! There shouldn't be this many in use!\n");
return 0;
} }
static void ipcp_open(sessionidt s, tunnelidt t) static void ipcp_open(sessionidt s, tunnelidt t)
@ -1645,6 +1676,39 @@ void processipv6cp(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
} }
} }
static void update_sessions_in_stat(sessionidt s, uint16_t l)
{
bundleidt b = session[s].bundle;
if (!b)
{
increment_counter(&session[s].cin, &session[s].cin_wrap, l);
session[s].cin_delta += l;
session[s].pin++;
sess_local[s].cin += l;
sess_local[s].pin++;
}
else
{
int i = frag[b].re_frame_begin_index;
int end = frag[b].re_frame_end_index;
for (;;)
{
l = frag[b].fragment[i].length;
s = frag[b].fragment[i].sid;
increment_counter(&session[s].cin, &session[s].cin_wrap, l);
session[s].cin_delta += l;
session[s].pin++;
sess_local[s].cin += l;
sess_local[s].pin++;
if (i == end)
return;
i = (i + 1) & MAXFRAGNUM_MASK;
}
}
}
// process IP packet received // process IP packet received
// //
// This MUST be called with at least 4 byte behind 'p'. // This MUST be called with at least 4 byte behind 'p'.
@ -1732,12 +1796,7 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port); snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
} }
increment_counter(&session[s].cin, &session[s].cin_wrap, l); update_sessions_in_stat(s, l);
session[s].cin_delta += l;
session[s].pin++;
sess_local[s].cin += l;
sess_local[s].pin++;
eth_tx += l; eth_tx += l;
@ -1748,162 +1807,190 @@ void processipin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
// process Multilink PPP packet received // process Multilink PPP packet received
void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l) void processmpin(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
{ {
bundleidt b = session[s].bundle; bundleidt b = session[s].bundle;
uint8_t begin_frame; bundlet * this_bundle = &bundle[b];
uint8_t end_frame; uint32_t frag_offset, M_offset;
uint32_t seq_num; uint16_t frag_index, M_index;
uint32_t offset; fragmentationt *this_fragmentation = &frag[b];
uint8_t begin_frame = (*p & MP_BEGIN);
uint8_t end_frame = (*p & MP_END);
uint32_t seq_num;
uint8_t flags = *p;
uint16_t begin_index, end_index;
if (!b) // Perform length checking
if(l > MAXFRAGLEN)
{
LOG(2, s, t, "MPPP: discarding fragment larger than MAXFRAGLEN\n");
return;
}
if(!b)
{
LOG(2, s, t, "MPPP: Invalid bundle id: 0\n");
return;
}
// FIXME !! session[s].mssf means that the receiver wants to receive frames in mssf not means the receiver will send frames in mssf
/* if(session[s].mssf)
{
// Get 12 bit for seq number
seq_num = ntohs((*(uint16_t *) p) & 0xFF0F);
p += 2;
l -= 2;
// After this point the pointer should be advanced 2 bytes
LOG(3, s, t, "MPPP: 12 bits, sequence number: %d\n",seq_num);
}
else */
{
// Get 24 bit for seq number
seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00);
p += 4;
l -= 4;
// After this point the pointer should be advanced 4 bytes
LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
}
// calculate this fragment's offset from the begin seq in the bundle
frag_offset = (seq_num + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
// discard this fragment if frag_offset is bigger that the fragmentation buffer size
if (frag_offset >= MAXFRAGNUM)
{
LOG(3, s, t, "MPPP: Index out of range, received more than MAXFRAGNUM fragment (lost frag) seq:%d, begin_seq:%d, bundle:%d, max:%d\n",seq_num, this_fragmentation->start_seq, b, this_bundle->max_seq);
return;
}
// update M
sess_local[s].last_seq = seq_num;
if (seq_num < this_fragmentation->M)
this_fragmentation->M = seq_num;
else
{ {
LOG(3, s, t, "MPPP: Invalid bundle id: 0\n"); uint32_t i, min = sess_local[(this_bundle->members[0])].last_seq;;
return; for (i = 1; i < this_bundle->num_of_links; i++)
{
uint32_t s_seq = sess_local[(this_bundle->members[i])].last_seq;
if (s_seq < min)
min = s_seq;
}
this_fragmentation->M = min;
} }
begin_frame = (*p & 0x80); LOG(4, s, t, "MPPP: Setting M to %d\n", this_fragmentation->M);
end_frame = (*p & 0x40); //calculate M's offset from the begin seq in the bundle
if (session[s].mssf) M_offset = (this_fragmentation->M + this_bundle->max_seq - this_fragmentation->start_seq) & (this_bundle->max_seq-1);
//caculate M's index in the fragment array
M_index = (M_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
//caculate received fragment's index in the fragment array
frag_index = (frag_offset + this_fragmentation->start_index) & MAXFRAGNUM_MASK;
//frame with a single fragment
if (begin_frame && end_frame)
{ {
// Get 12 bit for seq number // process and reset fragmentation
uint16_t short_seq_num = ntohs((*(uint16_t *) p) & 0xFF0F); LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n");
uint16_t short_seq_num2 = short_seq_num >> 4; this_fragmentation->fragment[frag_index].length = l;
p += 2; this_fragmentation->fragment[frag_index].sid = s;
l -= 2; this_fragmentation->fragment[frag_index].flags = flags;
seq_num = short_seq_num2; this_fragmentation->fragment[frag_index].seq = seq_num;
// After this point the pointer should be advanced 2 bytes this_fragmentation->re_frame_begin_index = frag_index;
LOG(3, s, t, "MPPP: 12 bits, sequence number: %d, short1: %d, short2: %d\n",seq_num, short_seq_num, short_seq_num2); this_fragmentation->re_frame_end_index = frag_index;
processmpframe(s, t, p, l, 0);
this_fragmentation->fragment[frag_index].length = 0;
this_fragmentation->fragment[frag_index].flags = 0;
end_index = frag_index;
} }
else else
{ {
// Get 24 bit for seq number // insert the frame in it's place
p++; fragmentt *this_frag = &this_fragmentation->fragment[frag_index];
seq_num = ntohl((*(uint32_t *) p) & 0xFFFFFF00); this_frag->length = l;
seq_num = seq_num >> 8; this_frag->sid = s;
p += 3; this_frag->flags = flags;
l -= 4; this_frag->seq = seq_num;
// After this point the pointer should be advanced 4 bytes memcpy(this_frag->data, p, l);
LOG(4, s, t, "MPPP: 24 bits sequence number:%d\n",seq_num);
}
if (seq_num - bundle[b].offset < 0) // try to assemble the frame that has the received fragment as a member
{ // get the beginning of this frame
bundle[b].offset = 0; begin_index = end_index = frag_index;
bundle[b].pending_frag = 0; while (this_fragmentation->fragment[begin_index].length)
}
offset = bundle[b].offset;
if (begin_frame)
{
// Check for previous non-assembled frames
int error = 0;
if (bundle[b].pending_frag)
{ {
uint32_t fn = bundle[b].seq_num_m - offset; if (this_fragmentation->fragment[begin_index].flags & MP_BEGIN)
uint16_t cur_len; break;
bundle[b].pending_frag = 0; begin_index = (begin_index ? (begin_index -1) : (MAXFRAGNUM -1));
// Check for array indexes
if (fn < 0 || fn > MAXFRAGNUM)
{
LOG(2, s, t, "ERROR: Index out of range fn:%d, bundle:%d\n",fn,b);
return;
}
if (seq_num-offset < 0 || seq_num-offset > MAXFRAGNUM)
{
LOG(2, s, t, "ERROR: Index out of range fn(last):%d, bundle:%d\n",fn,b);
return;
}
/////////////////////////////////////////////////////
cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin
for (fn = bundle[b].seq_num_m - offset; fn < seq_num - offset; fn++)
{
if (!frag[b].fragment[fn].length)
{
LOG(4, s, t, "MPPP: Found lost fragment while reassembling frame %d in (%d,%d)\n",fn, bundle[b].seq_num_m-offset, seq_num-offset);
error = 1;
break;
}
if (cur_len + frag[b].fragment[fn].length > MAXETHER)
{
LOG(2, s, t, "MPPP: ERROR: very long frame after assembling %d\n", frag[b].fragment[fn].length+cur_len);
error = 1;
break;
}
memcpy(frag[b].reassembled_frame+cur_len, frag[b].fragment[fn].data, frag[b].fragment[fn].length);
cur_len += frag[b].fragment[fn].length;
frag[b].fragment[fn].length = 0; // Indicates that this fragment has been consumed
// This is usefull for compression
memset(frag[b].fragment[fn].data, 0, sizeof(frag[b].fragment[fn].data));
}
if (!error)
{
frag[b].re_frame_len = cur_len;
// Process the resassembled frame
LOG(4, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
processmpframe(s, t, frag[b].reassembled_frame, frag[b].re_frame_len, 1);
// Set reassembled frame length to zero after processing it
frag[b].re_frame_len = 0;
memset(frag[b].reassembled_frame, 0, sizeof(frag[b].reassembled_frame));
}
} }
//////////////////////////////////////////
bundle[b].seq_num_m = seq_num; // return if a lost fragment is found
if (end_frame) if (!(this_fragmentation->fragment[begin_index].length))
return; // assembling frame failed
// get the end of his frame
while (this_fragmentation->fragment[end_index].length)
{ {
// Both bits are set if (this_fragmentation->fragment[end_index].flags & MP_END)
LOG(4, s, t, "MPPP: Both bits are set (Begin and End).\n"); break;
processmpframe(s, t, p, l, 0); end_index = (end_index +1) & MAXFRAGNUM_MASK;
// The maximum number of fragments is 1500
if (seq_num - bundle[b].offset >= 1400)
{
bundle[b].offset = seq_num;
LOG(4, s, t, "MPPP: Setting offset to: %d\n",bundle[b].offset);
}
} }
else
// return if a lost fragment is found
if (!(this_fragmentation->fragment[end_index].length))
return; // assembling frame failed
// assemble the packet
//assemble frame, process it, reset fragmentation
uint16_t cur_len = 4; // This is set to 4 to leave 4 bytes for function processipin
uint32_t i;
LOG(4, s, t, "MPPP: processing fragments from %d to %d\n", begin_index, end_index);
// Push to the receive buffer
for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
{
this_frag = &this_fragmentation->fragment[i];
if(cur_len + this_frag->length > MAXETHER)
{
LOG(2, s, t, "MPPP: discarding reassembled frames larger than MAXETHER\n");
break;
}
memcpy(this_fragmentation->reassembled_frame+cur_len, this_frag->data, this_frag->length);
LOG(5, s, t, "MPPP: processing frame at %d, with len %d\n", i, this_frag->length);
cur_len += this_frag->length;
if (i == end_index)
{
this_fragmentation->re_frame_len = cur_len;
this_fragmentation->re_frame_begin_index = begin_index;
this_fragmentation->re_frame_end_index = end_index;
// Process the resassembled frame
LOG(5, s, t, "MPPP: Process the reassembled frame, len=%d\n",cur_len);
processmpframe(s, t, this_fragmentation->reassembled_frame, this_fragmentation->re_frame_len, 1);
break;
}
}
// Set reassembled frame length to zero after processing it
this_fragmentation->re_frame_len = 0;
for (i = begin_index;; i = (i + 1) & MAXFRAGNUM_MASK)
{ {
bundle[b].pending_frag = 1; this_fragmentation->fragment[i].length = 0; // Indicates that this fragment has been consumed
// End bit is clear this_fragmentation->fragment[i].flags = 0;
LOG(4, s, t, "MPPP: Push to receive buffer\n"); if (i == end_index)
// Push to the receive buffer break;
// Array indexes checking
if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM)
{
LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(1) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b);
return;
}
// Perform length checking
if (l > MAXFRAGLEN)
{
LOG(2, s, t, "MPPP: ERROR: very long fragment length (1)\n");
return;
}
frag[b].fragment[seq_num - offset].length = l;
memcpy(frag[b].fragment[seq_num - offset].data, p, l);
} }
} }
else //discard fragments received before the recently assembled frame
{ begin_index = this_fragmentation->start_index;
LOG(4, s, t, "MPPP: Push to receive buffer\n"); this_fragmentation->start_index = (end_index + 1) & MAXFRAGNUM_MASK;
// Push to the receive buffer this_fragmentation->start_seq = (this_fragmentation->fragment[end_index].seq + 1) & (this_bundle->max_seq-1);
// Array indexes checking //clear length and flags of the discarded fragments
if (seq_num-offset < 0 || seq_num-offset >= MAXFRAGNUM) while (begin_index != this_fragmentation->start_index)
{ {
LOG(2, s, t, "ERROR: Index out of range, push to receive buffer(2) seq:%d, offset:%d, bundle:%d\n",seq_num,offset,b); this_fragmentation->fragment[begin_index].flags = 0;
return; this_fragmentation->fragment[begin_index].length = 0;
} begin_index = (begin_index + 1) & MAXFRAGNUM_MASK;
// Perform length checking }
if (l > MAXFRAGLEN)
{ LOG(4, s, t, "MPPP after assembling: M index is =%d, start index is = %d, start seq=%d\n",M_index, this_fragmentation->start_index, this_fragmentation->start_seq);
LOG(2, s, t, "MPPP: ERROR: very long fragment length (2).\n"); return;
return;
}
frag[b].fragment[seq_num - offset].length = l;
memcpy(frag[b].fragment[seq_num - offset].data, p, l);
}
} }
// process IPv6 packet received // process IPv6 packet received
@ -1989,12 +2076,7 @@ void processipv6in(sessionidt s, tunnelidt t, uint8_t *p, uint16_t l)
snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port); snoop_send_packet(p, l, session[s].snoop_ip, session[s].snoop_port);
} }
increment_counter(&session[s].cin, &session[s].cin_wrap, l); update_sessions_in_stat(s, l);
session[s].cin_delta += l;
session[s].pin++;
sess_local[s].cin += l;
sess_local[s].pin++;
eth_tx += l; eth_tx += l;
@ -2265,7 +2347,7 @@ uint8_t *makeppp(uint8_t *b, int size, uint8_t *p, int l, sessionidt s, tunnelid
{ {
// Set the multilink bits // Set the multilink bits
uint16_t bits_send = mp_bits; uint16_t bits_send = mp_bits;
*(uint16_t *) b = htons((bundle[bid].seq_num_t & 0xFF0F)|bits_send); *(uint16_t *) b = htons((bundle[bid].seq_num_t & 0x0FFF)|bits_send);
b += 2; b += 2;
} }
else else

28
radius.c
View file

@ -1,6 +1,6 @@
// L2TPNS Radius Stuff // L2TPNS Radius Stuff
char const *cvs_id_radius = "$Id: radius.c,v 1.55 2006-08-02 14:17:30 bodea Exp $"; char const *cvs_id_radius = "$Id: radius.c,v 1.56 2009-12-08 14:49:28 bodea Exp $";
#include <time.h> #include <time.h>
#include <stdio.h> #include <stdio.h>
@ -177,7 +177,7 @@ void radiussend(uint16_t r, uint8_t state)
return; return;
} }
if (state != RADIUSAUTH && !config->radius_accounting) if (state != RADIUSAUTH && state != RADIUSJUSTAUTH && !config->radius_accounting)
{ {
// Radius accounting is turned off // Radius accounting is turned off
radiusclear(r, s); radiusclear(r, s);
@ -197,7 +197,7 @@ void radiussend(uint16_t r, uint8_t state)
{ {
if (s) if (s)
{ {
if (state == RADIUSAUTH) if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE); sessionshutdown(s, "RADIUS timeout.", CDN_ADMIN_DISC, TERM_REAUTHENTICATION_FAILURE);
else else
{ {
@ -219,6 +219,7 @@ void radiussend(uint16_t r, uint8_t state)
switch (state) switch (state)
{ {
case RADIUSAUTH: case RADIUSAUTH:
case RADIUSJUSTAUTH:
b[0] = AccessRequest; // access request b[0] = AccessRequest; // access request
break; break;
case RADIUSSTART: case RADIUSSTART:
@ -239,7 +240,7 @@ void radiussend(uint16_t r, uint8_t state)
strcpy((char *) p + 2, session[s].user); strcpy((char *) p + 2, session[s].user);
p += p[1]; p += p[1];
} }
if (state == RADIUSAUTH) if (state == RADIUSAUTH || state == RADIUSJUSTAUTH)
{ {
if (radius[r].chap) if (radius[r].chap)
{ {
@ -380,12 +381,12 @@ void radiussend(uint16_t r, uint8_t state)
*p = 6; // Service-Type *p = 6; // Service-Type
p[1] = 6; p[1] = 6;
*(uint32_t *) (p + 2) = htonl(2); // Framed-User *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 8 : 2)); // Authenticate only or Framed-User respectevily
p += p[1]; p += p[1];
*p = 7; // Framed-Protocol *p = 7; // Framed-Protocol
p[1] = 6; p[1] = htonl((state == RADIUSJUSTAUTH ? 0 : 6));
*(uint32_t *) (p + 2) = htonl(1); // PPP *(uint32_t *) (p + 2) = htonl((state == RADIUSJUSTAUTH ? 0 : 1)); // PPP
p += p[1]; p += p[1];
if (session[s].ip) if (session[s].ip)
@ -462,7 +463,7 @@ void radiussend(uint16_t r, uint8_t state)
// All AVpairs added // All AVpairs added
*(uint16_t *) (b + 2) = htons(p - b); *(uint16_t *) (b + 2) = htons(p - b);
if (state != RADIUSAUTH) if (state != RADIUSAUTH && state != RADIUSJUSTAUTH)
{ {
// Build auth for accounting packet // Build auth for accounting packet
calc_auth(b, p - b, zero, b + 4); calc_auth(b, p - b, zero, b + 4);
@ -475,7 +476,7 @@ void radiussend(uint16_t r, uint8_t state)
// get radius port // get radius port
uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers]; uint16_t port = config->radiusport[(radius[r].try - 1) % config->numradiusservers];
// assume RADIUS accounting port is the authentication port +1 // assume RADIUS accounting port is the authentication port +1
addr.sin_port = htons((state == RADIUSAUTH) ? port : port+1); addr.sin_port = htons((state == RADIUSAUTH || state == RADIUSJUSTAUTH) ? port : port+1);
} }
LOG_HEX(5, "RADIUS Send", b, (p - b)); LOG_HEX(5, "RADIUS Send", b, (p - b));
@ -558,7 +559,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n"); LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n");
return; return;
} }
if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSSTART if (radius[r].state != RADIUSAUTH && radius[r].state != RADIUSJUSTAUTH && radius[r].state != RADIUSSTART
&& radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM) && radius[r].state != RADIUSSTOP && radius[r].state != RADIUSINTERIM)
{ {
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n"); LOG(1, s, session[s].tunnel, " Unexpected RADIUS response\n");
@ -573,7 +574,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
return; // Do nothing. On timeout, it will try the next radius server. return; // Do nothing. On timeout, it will try the next radius server.
} }
if ((radius[r].state == RADIUSAUTH && r_code != AccessAccept && r_code != AccessReject) || if (((radius[r].state == RADIUSAUTH ||radius[r].state == RADIUSJUSTAUTH) && r_code != AccessAccept && r_code != AccessReject) ||
((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse)) ((radius[r].state == RADIUSSTART || radius[r].state == RADIUSSTOP || radius[r].state == RADIUSINTERIM) && r_code != AccountingResponse))
{ {
LOG(1, s, session[s].tunnel, " Unexpected RADIUS response %s\n", radius_code(r_code)); LOG(1, s, session[s].tunnel, " Unexpected RADIUS response %s\n", radius_code(r_code));
@ -581,7 +582,7 @@ void processrad(uint8_t *buf, int len, char socket_index)
// care off finishing the radius session if that's really correct. // care off finishing the radius session if that's really correct.
} }
if (radius[r].state == RADIUSAUTH) if (radius[r].state == RADIUSAUTH || radius[r].state == RADIUSJUSTAUTH)
{ {
// run post-auth plugin // run post-auth plugin
struct param_post_auth packet = { struct param_post_auth packet = {
@ -783,6 +784,8 @@ void processrad(uint8_t *buf, int len, char socket_index)
if (p[1] < 6) continue; if (p[1] < 6) continue;
session[s].session_timeout = ntohl(*(uint32_t *)(p + 2)); session[s].session_timeout = ntohl(*(uint32_t *)(p + 2));
LOG(3, s, session[s].tunnel, " Radius reply contains Session-Timeout = %u\n", session[s].session_timeout); LOG(3, s, session[s].tunnel, " Radius reply contains Session-Timeout = %u\n", session[s].session_timeout);
if(!session[s].session_timeout && config->kill_timedout_sessions)
sessionshutdown(s, "Session timeout is zero", CDN_ADMIN_DISC, 0);
} }
else if (*p == 28) else if (*p == 28)
{ {
@ -869,6 +872,7 @@ void radiusretry(uint16_t r)
sendchap(s, t); sendchap(s, t);
break; break;
case RADIUSAUTH: // sending auth to RADIUS server case RADIUSAUTH: // sending auth to RADIUS server
case RADIUSJUSTAUTH: // sending auth to RADIUS server
case RADIUSSTART: // sending start accounting to RADIUS server case RADIUSSTART: // sending start accounting to RADIUS server
case RADIUSSTOP: // sending stop accounting to RADIUS server case RADIUSSTOP: // sending stop accounting to RADIUS server
case RADIUSINTERIM: // sending interim accounting to RADIUS server case RADIUSINTERIM: // sending interim accounting to RADIUS server