* Fri Mar 5 2004 David Parrish <david@dparrish.com> 1.1.0
- Change all strcpy() calls to strncpy() to avoid buffer overflow potential - Add ICMP host unreachable support - Logging to syslog if log_file = "syslog:facility" - Now requires libcli 1.5 - All configuration moves to a config structure - Ability to modify and write config on the fly through command-line interface - Config file support is removed, and now handled by the cli - Show hostname in cli prompt - Keep current state type for tunnels - Add uptime command do CLI, which also shows real-time bandwidth utilisation - Add goodbye command to cluster master, which forces droppping a slave - Cache IP address allocation, so that reconnecting users get the same address - Fix tunnel resend timeouts, so that dead tunnels will be cleaned up - Allocate tunnels and radius without using a linked list which had issues - Fix some off-by-one errors in tunnel and session and radius arrays - Save and reload ip address pool when dieing - Check version and size of reloaded data when restarting - Remove plugin_config support - Remove old support for TBF which didn't work anyway. HTB is required to do throttling now. - Add COPYING and Changes files
This commit is contained in:
fred_nerk
parent
b8ae54f127
commit
b43583c01d
22 changed files with 1731 additions and 1248 deletions
22
Changes
Normal file
22
Changes
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
* Fri Mar 5 2004 David Parrish <david@dparrish.com> 1.1.0
|
||||
- Change all strcpy() calls to strncpy() to avoid buffer overflow potential
|
||||
- Add ICMP host unreachable support
|
||||
- Logging to syslog if log_file = "syslog:facility"
|
||||
- Now requires libcli 1.5
|
||||
- All configuration moves to a config structure
|
||||
- Ability to modify and write config on the fly through command-line interface
|
||||
- Config file support is removed, and now handled by the cli
|
||||
- Show hostname in cli prompt
|
||||
- Keep current state type for tunnels
|
||||
- Add uptime command do CLI, which also shows real-time bandwidth utilisation
|
||||
- Add goodbye command to cluster master, which forces droppping a slave
|
||||
- Cache IP address allocation, so that reconnecting users get the same address
|
||||
- Fix tunnel resend timeouts, so that dead tunnels will be cleaned up
|
||||
- Allocate tunnels and radius without using a linked list which had issues
|
||||
- Fix some off-by-one errors in tunnel and session and radius arrays
|
||||
- Save and reload ip address pool when dieing
|
||||
- Check version and size of reloaded data when restarting
|
||||
- Remove plugin_config support
|
||||
- Remove old support for TBF which didn't work anyway. HTB is required to do throttling now.
|
||||
- Add COPYING and Changes files
|
||||
|
||||
5
INSTALL
5
INSTALL
|
|
@ -2,9 +2,8 @@ Brief Installation guide for L2TPNS
|
|||
|
||||
1. Requirements
|
||||
|
||||
* You must have libcli installed to enable the command-line
|
||||
interface. You can get it from http://sourceforge.net/projects/libcli.
|
||||
If you don't have it, command-line support will not be compiled in.
|
||||
* libcli 1.5.0 or greater
|
||||
You can get it from http://sourceforge.net/projects/libcli.
|
||||
|
||||
* A kernel with iptables support
|
||||
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ INSTALL = @INSTALL@
|
|||
DEFS = @DEFS@
|
||||
|
||||
OBJS= md5.o \
|
||||
icmp.o \
|
||||
cli.o \
|
||||
l2tpns.o \
|
||||
ppp.o \
|
||||
|
|
|
|||
3
arp.c
3
arp.c
|
|
@ -48,9 +48,10 @@ void sendarp(int ifr_idx, const unsigned char* mac, ipt ip)
|
|||
|
||||
memset(&sll, 0, sizeof(sll));
|
||||
sll.sll_family = AF_PACKET;
|
||||
strncpy(sll.sll_addr, mac, sizeof(sll.sll_addr)); /* Null-pad */
|
||||
strncpy(sll.sll_addr, mac, sizeof(sll.sll_addr) - 1);
|
||||
sll.sll_halen = ETH_ALEN;
|
||||
sll.sll_ifindex = ifr_idx;
|
||||
|
||||
sendto(fd, &buf, sizeof(buf), 0, (struct sockaddr*)&sll, sizeof(sll));
|
||||
close(fd);
|
||||
}
|
||||
|
|
|
|||
90
bounce.c
90
bounce.c
|
|
@ -1,90 +0,0 @@
|
|||
#include <arpa/inet.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <linux/if.h>
|
||||
#include <netdb.h>
|
||||
#include <netinet/in.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/types.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/udp.h>
|
||||
#include <pthread.h>
|
||||
#include <unistd.h>
|
||||
#include <signal.h>
|
||||
#include <getopt.h>
|
||||
|
||||
#define PORT 39000
|
||||
|
||||
void sigalarm(int junk);
|
||||
unsigned long long recv_count = 0;
|
||||
unsigned long pps = 0;
|
||||
unsigned long bytes = 0;
|
||||
unsigned port = PORT;
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int on = 1;
|
||||
struct sockaddr_in addr;
|
||||
int s;
|
||||
char *packet;
|
||||
|
||||
while ((s = getopt(argc, argv, "?p:")) > 0)
|
||||
{
|
||||
switch (s)
|
||||
{
|
||||
case 'p' :
|
||||
port = atoi(optarg);
|
||||
break;
|
||||
case '?' :
|
||||
printf("Options:\n");
|
||||
printf("\t-p port to listen on\n");
|
||||
return(0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
memset(&addr, 0, sizeof(addr));
|
||||
addr.sin_family = AF_INET;
|
||||
addr.sin_port = htons(port);
|
||||
|
||||
s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
|
||||
setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
|
||||
if (bind(s, (void *) &addr, sizeof(addr)) < 0)
|
||||
{
|
||||
perror("bind");
|
||||
return -1;
|
||||
}
|
||||
|
||||
signal(SIGALRM, sigalarm);
|
||||
alarm(1);
|
||||
|
||||
printf("Waiting on port %d\n", port);
|
||||
packet = (char *)malloc(65535);
|
||||
while (1)
|
||||
{
|
||||
struct sockaddr_in addr;
|
||||
int alen = sizeof(addr), l;
|
||||
|
||||
l = recvfrom(s, packet, 65535, 0, (void *) &addr, &alen);
|
||||
if (l < 0) continue;
|
||||
recv_count++;
|
||||
pps++;
|
||||
bytes += l;
|
||||
|
||||
sendto(s, packet, l, 0, (struct sockaddr *)&addr, alen);
|
||||
}
|
||||
|
||||
free(packet);
|
||||
}
|
||||
|
||||
void sigalarm(int junk)
|
||||
{
|
||||
printf("Recv: %10llu %0.1fMbits/s (%lu pps)\n", recv_count, (bytes / 1024.0 / 1024.0 * 8), pps);
|
||||
pps = bytes = 0;
|
||||
alarm(1);
|
||||
}
|
||||
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Clustering Stuff
|
||||
// $Id: cluster.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $ #include <stdio.h> #include <sys/file.h>
|
||||
// $Id: cluster.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $ #include <stdio.h> #include <sys/file.h>
|
||||
|
||||
#include <sys/stat.h>
|
||||
#include <sys/types.h>
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
// L2TPNS Clustering Stuff
|
||||
// $Id: cluster.h,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: cluster.h,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#define C_HELLO 1
|
||||
#define C_HELLO_RESPONSE 2
|
||||
#define C_PING 3
|
||||
#define C_TUNNEL 4
|
||||
#define C_SESSION 5
|
||||
#define C_GOODBYE 6
|
||||
|
||||
#define CLUSTERPORT 32792
|
||||
#define CLUSTERCLIENTPORT 32793
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Cluster Master
|
||||
// $Id: cluster_master.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: cluster_master.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <netinet/in.h>
|
||||
|
|
@ -51,6 +51,7 @@ int handle_hello(char *buf, int l, struct sockaddr_in *src_addr, uint32_t addr);
|
|||
int handle_tunnel(char *buf, int l, uint32_t addr);
|
||||
int handle_session(char *buf, int l, uint32_t addr);
|
||||
int handle_ping(char *buf, int l, uint32_t addr);
|
||||
int handle_goodbye(char *buf, int l, uint32_t addr);
|
||||
int backup_up(slave *s);
|
||||
int backup_down(slave *s);
|
||||
int return_state(slave *s);
|
||||
|
|
@ -91,7 +92,7 @@ int main(int argc, char *argv[])
|
|||
|
||||
signal(SIGCHLD, sigchild_handler);
|
||||
|
||||
log(0, "Cluster Manager $Id: cluster_master.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $ starting\n");
|
||||
log(0, "Cluster Manager $Id: cluster_master.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $ starting\n");
|
||||
|
||||
to.tv_sec = 1;
|
||||
to.tv_usec = 0;
|
||||
|
|
@ -156,6 +157,7 @@ int main(int argc, char *argv[])
|
|||
|
||||
int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
|
||||
{
|
||||
slave *s;
|
||||
char mtype;
|
||||
uint32_t addr;
|
||||
|
||||
|
|
@ -168,6 +170,16 @@ int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
|
|||
|
||||
mtype = *buf; buf++; l--;
|
||||
|
||||
if (mtype != C_GOODBYE && (s = find_slave(addr)) && s->down)
|
||||
{
|
||||
char *hostname;
|
||||
hostname = calloc(l + 1, 1);
|
||||
memcpy(hostname, buf, l);
|
||||
log(1, "Slave \"%s\" (for %s) has come back.\n", hostname, inet_toa(s->ip_address));
|
||||
backup_down(s);
|
||||
free(hostname);
|
||||
}
|
||||
|
||||
switch (mtype)
|
||||
{
|
||||
case C_HELLO:
|
||||
|
|
@ -187,6 +199,10 @@ int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
|
|||
if (!find_slave(addr)) handle_hello((char *)(buf + 1), *(char *)buf, src_addr, addr);
|
||||
handle_session(buf, l, addr);
|
||||
break;
|
||||
case C_GOODBYE:
|
||||
if (!find_slave(addr)) break;
|
||||
handle_goodbye(buf, l, addr);
|
||||
break;
|
||||
}
|
||||
return mtype;
|
||||
}
|
||||
|
|
@ -478,3 +494,24 @@ int backup_down(slave *s)
|
|||
return 0;
|
||||
}
|
||||
|
||||
int handle_goodbye(char *buf, int l, uint32_t addr)
|
||||
{
|
||||
int i;
|
||||
slave *s;
|
||||
|
||||
// Is this a slave we have state information for?
|
||||
if ((s = find_slave(addr)))
|
||||
{
|
||||
log(0, "Received goodbye for slave %s\n", s->hostname);
|
||||
ll_delete(slaves, s);
|
||||
for (i = 0; i < s->num_tunnels; i++)
|
||||
if (s->tunnels[i]) free(s->tunnels[i]);
|
||||
for (i = 0; i < s->num_sessions; i++)
|
||||
if (s->sessions[i]) free(s->sessions[i]);
|
||||
if (s->hostname) free(s->hostname);
|
||||
free(s);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Cluster Master
|
||||
// $Id: cluster_slave.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: cluster_slave.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <netinet/in.h>
|
||||
|
|
@ -19,16 +19,13 @@
|
|||
#include "ll.h"
|
||||
#include "util.h"
|
||||
|
||||
// vim: sw=4 ts=8
|
||||
|
||||
extern int cluster_sockfd;
|
||||
extern tunnelt *tunnel;
|
||||
extern sessiont *session;
|
||||
extern uint32_t cluster_address;
|
||||
extern char hostname[1000];
|
||||
extern int debug;
|
||||
extern ippoolt *ip_address_pool;
|
||||
extern uint32_t vip_address;
|
||||
extern tunnelidt tunnelfree;
|
||||
extern sessionidt sessionfree;
|
||||
extern struct configt *config;
|
||||
|
||||
int handle_tunnel(char *buf, int l);
|
||||
int handle_session(char *buf, int l);
|
||||
|
|
@ -78,6 +75,13 @@ int handle_tunnel(char *buf, int l)
|
|||
{
|
||||
int t;
|
||||
|
||||
// Ignore tunnel message if NOSTATEFILE exists
|
||||
if (config->ignore_cluster_updates)
|
||||
{
|
||||
log(1, 0, 0, 0, "Discarding tunnel message from cluster master.\n", l, sizeof(tunnelt));
|
||||
return 0;
|
||||
}
|
||||
|
||||
t = *(int *)buf;
|
||||
log(1, 0, 0, t, "Receiving tunnel %d from cluster master (%d bytes)\n", t, l);
|
||||
buf += sizeof(int); l -= sizeof(int);
|
||||
|
|
@ -94,16 +98,6 @@ int handle_tunnel(char *buf, int l)
|
|||
return 0;
|
||||
}
|
||||
|
||||
if (t > 1)
|
||||
{
|
||||
tunnel[t-1].next = tunnel[t].next;
|
||||
}
|
||||
|
||||
if (tunnelfree == t)
|
||||
{
|
||||
tunnelfree = tunnel[t].next;
|
||||
}
|
||||
|
||||
memcpy(&tunnel[t], buf, l);
|
||||
log(3, 0, 0, t, "Cluster master sent tunnel for %s\n", tunnel[t].hostname);
|
||||
|
||||
|
|
@ -117,6 +111,13 @@ int handle_session(char *buf, int l)
|
|||
{
|
||||
int s;
|
||||
|
||||
// Ignore tunnel message if NOSTATEFILE exists
|
||||
if (config->ignore_cluster_updates)
|
||||
{
|
||||
log(1, 0, 0, 0, "Discarding session message from cluster master.\n", l, sizeof(tunnelt));
|
||||
return 0;
|
||||
}
|
||||
|
||||
s = *(int *)buf;
|
||||
log(1, 0, s, 0, "Receiving session %d from cluster master (%d bytes)\n", s, l);
|
||||
buf += sizeof(int); l -= sizeof(int);
|
||||
|
|
@ -163,6 +164,10 @@ int handle_session(char *buf, int l)
|
|||
}
|
||||
}
|
||||
}
|
||||
/*
|
||||
if (session[s].servicenet)
|
||||
servicenet_session(s, 1);
|
||||
*/
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -214,7 +219,7 @@ int cluster_send_session(int s)
|
|||
memcpy((char *)(packet + len), &session[s], sizeof(sessiont));
|
||||
len += sizeof(sessiont);
|
||||
|
||||
cluster_send_message(cluster_address, vip_address, C_SESSION, packet, len);
|
||||
cluster_send_message(config->cluster_address, vip_address, C_SESSION, packet, len);
|
||||
free(packet);
|
||||
|
||||
return 1;
|
||||
|
|
@ -241,7 +246,27 @@ int cluster_send_tunnel(int t)
|
|||
memcpy((char *)(packet + len), &tunnel[t], sizeof(tunnelt));
|
||||
len += sizeof(tunnelt);
|
||||
|
||||
cluster_send_message(cluster_address, vip_address, C_TUNNEL, packet, len);
|
||||
cluster_send_message(config->cluster_address, vip_address, C_TUNNEL, packet, len);
|
||||
free(packet);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int cluster_send_goodbye()
|
||||
{
|
||||
char *packet;
|
||||
int len = 0;
|
||||
|
||||
packet = malloc(4096);
|
||||
|
||||
log(2, 0, 0, 0, "Sending goodbye to cluster master\n");
|
||||
// Hostname
|
||||
len = strlen(hostname);
|
||||
*(char *)packet = len;
|
||||
memcpy((char *)(packet + 1), hostname, len);
|
||||
len++;
|
||||
|
||||
cluster_send_message(config->cluster_address, vip_address, C_GOODBYE, packet, len);
|
||||
free(packet);
|
||||
|
||||
return 1;
|
||||
|
|
|
|||
67
garden.c
67
garden.c
|
|
@ -10,43 +10,43 @@
|
|||
int __plugin_api_version = 1;
|
||||
struct pluginfuncs p;
|
||||
|
||||
int garden_session(sessiont *s, int flag);
|
||||
|
||||
char *init_commands[] = {
|
||||
// This is for incoming connections to a gardened user
|
||||
"iptables -t nat -N garden_users 2>&1 >/dev/null",
|
||||
"iptables -t nat -F garden_users 2>&1 >/dev/null",
|
||||
"iptables -t nat -N garden 2>&1 >/dev/null",
|
||||
"iptables -t nat -F garden_users",
|
||||
"iptables -t nat -N garden 2>&1", /* Don't flush - init script sets this up */
|
||||
"iptables -t nat -A l2tpns -j garden_users",
|
||||
NULL
|
||||
};
|
||||
|
||||
char *done_commands[] = {
|
||||
"iptables -t nat -F garden_users 2>&1 >/dev/null",
|
||||
"iptables -t nat -D l2tpns -j garden_users 2>&1 >/dev/null",
|
||||
"iptables -t nat -D l2tpns -j garden_users",
|
||||
NULL
|
||||
};
|
||||
|
||||
int garden_session(sessiont *s, int flag);
|
||||
|
||||
int plugin_post_auth(struct param_post_auth *data)
|
||||
{
|
||||
// Ignore if user authentication was successful
|
||||
if (data->auth_allowed) return PLUGIN_RET_OK;
|
||||
|
||||
p.log(3, 0, 0, 0, "User allowed into walled garden\n");
|
||||
p.log(3, 0, 0, 0, "Walled Garden allowing login\n");
|
||||
data->auth_allowed = 1;
|
||||
data->s->walled_garden = 1;
|
||||
data->s->garden = 1;
|
||||
return PLUGIN_RET_OK;
|
||||
}
|
||||
|
||||
int plugin_new_session(struct param_new_session *data)
|
||||
{
|
||||
if (data->s->walled_garden) garden_session(data->s, 1);
|
||||
if (data->s->garden) garden_session(data->s, 1);
|
||||
return PLUGIN_RET_OK;
|
||||
}
|
||||
|
||||
int plugin_kill_session(struct param_new_session *data)
|
||||
{
|
||||
if (data->s->walled_garden) garden_session(data->s, 0);
|
||||
if (data->s->garden) garden_session(data->s, 0);
|
||||
return PLUGIN_RET_OK;
|
||||
}
|
||||
|
||||
|
|
@ -58,10 +58,7 @@ int plugin_control(struct param_control *data)
|
|||
if (data->type != PKT_GARDEN && data->type != PKT_UNGARDEN) return PLUGIN_RET_OK;
|
||||
if (!data->data && data->data_length) return PLUGIN_RET_OK;
|
||||
session = atoi((char*)(data->data));
|
||||
|
||||
if (!session)
|
||||
return PLUGIN_RET_OK;
|
||||
|
||||
if (!session) return PLUGIN_RET_OK; // Really?
|
||||
data->send_response = 1;
|
||||
s = p.get_session_by_id(session);
|
||||
if (!s || !s->ip)
|
||||
|
|
@ -86,11 +83,6 @@ int plugin_control(struct param_control *data)
|
|||
return PLUGIN_RET_STOP;
|
||||
}
|
||||
|
||||
int plugin_config(struct param_config *data)
|
||||
{
|
||||
return PLUGIN_RET_OK;
|
||||
}
|
||||
|
||||
int garden_session(sessiont *s, int flag)
|
||||
{
|
||||
char cmd[2048];
|
||||
|
|
@ -98,25 +90,48 @@ int garden_session(sessiont *s, int flag)
|
|||
if (!s) return 0;
|
||||
if (!s->opened) return 0;
|
||||
|
||||
/* Note that we don't handle throttling/snooping/etc here
|
||||
* To do that, we'd need to send an end accounting record
|
||||
* then a radius auth, then start accouting again.
|
||||
* That means that we need the password (which garden has)
|
||||
* and a lot of code to check that the new set of params
|
||||
* (routes, IP, ACLs, etc) 'matched' the old one in a
|
||||
* 'compatable' way. (ie user's system doesn't need to be told
|
||||
* of the change)
|
||||
*
|
||||
* Thats a lot of pain/code for very little gain.
|
||||
* If we want them redone from scratch, just sessionkill them -
|
||||
* a user on garden isn't going to have any open TCP
|
||||
* connections which are worth caring about, anyway.
|
||||
*
|
||||
* Note that the user will be rethrottled shortly by the scan
|
||||
* script thingy if appropriate.
|
||||
*
|
||||
* Currently, garden only directly ungardens someone if
|
||||
* they haven't paid their bill, and then subsequently do so
|
||||
* online. This isn't something which can be set up by a malicious
|
||||
* customer at will.
|
||||
*/
|
||||
if (flag == 1)
|
||||
{
|
||||
// Gardened User
|
||||
p.log(2, 0, 0, s->tunnel, "Trap user %s (%s) in walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
|
||||
snprintf(cmd, 2048, "iptables -t nat -A garden_users -s %s -j garden", p.inet_toa(ntohl(s->ip)));
|
||||
p.log(3, 0, 0, s->tunnel, "%s\n", cmd);
|
||||
system(cmd);
|
||||
s->walled_garden = 1;
|
||||
s->garden = 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
sessionidt other;
|
||||
int count = 10;
|
||||
int count = 40;
|
||||
|
||||
// Normal User
|
||||
p.log(2, 0, 0, s->tunnel, "Release user %s (%s) from walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
|
||||
// Kick off any duplicate usernames
|
||||
// but make sure not to kick off ourself
|
||||
if (s->ip && !s->die && (other = p.get_session_by_username(s->user)) && s != p.get_session_by_id(other)) {
|
||||
p.sessionkill(other, "Duplicate session when user ungardened");
|
||||
p.sessionkill(other, "Duplicate session when user un-gardened");
|
||||
}
|
||||
/* Clean up counters */
|
||||
s->cin = s->cout = 0;
|
||||
|
|
@ -130,7 +145,7 @@ int garden_session(sessiont *s, int flag)
|
|||
if (WEXITSTATUS(status) != 0) break;
|
||||
}
|
||||
|
||||
s->walled_garden = 0;
|
||||
s->garden = 0;
|
||||
|
||||
if (!s->die) {
|
||||
/* OK, we're up! */
|
||||
|
|
@ -138,7 +153,7 @@ int garden_session(sessiont *s, int flag)
|
|||
p.radiussend(r, RADIUSSTART);
|
||||
}
|
||||
}
|
||||
s->walled_garden = flag;
|
||||
s->garden = flag;
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
|
@ -149,11 +164,9 @@ int plugin_init(struct pluginfuncs *funcs)
|
|||
if (!funcs) return 0;
|
||||
memcpy(&p, funcs, sizeof(p));
|
||||
|
||||
p.log(1, 0, 0, 0, "Enabling walled garden service\n");
|
||||
|
||||
for (i = 0; init_commands[i] && *init_commands[i]; i++)
|
||||
{
|
||||
p.log(4, 0, 0, 0, "Running %s\n", init_commands[i]);
|
||||
p.log(3, 0, 0, 0, "Running %s\n", init_commands[i]);
|
||||
system(init_commands[i]);
|
||||
}
|
||||
|
||||
|
|
@ -165,7 +178,7 @@ void plugin_done()
|
|||
int i;
|
||||
for (i = 0; done_commands[i] && *done_commands[i]; i++)
|
||||
{
|
||||
p.log(4, 0, 0, 0, "Running %s\n", done_commands[i]);
|
||||
p.log(3, 0, 0, 0, "Running %s\n", done_commands[i]);
|
||||
system(done_commands[i]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
86
icmp.c
Normal file
86
icmp.c
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
#include <arpa/inet.h>
|
||||
#include <netdb.h>
|
||||
#include <netinet/in.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/icmp.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/socket.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/wait.h>
|
||||
#include <memory.h>
|
||||
#include "l2tpns.h"
|
||||
|
||||
extern ipt myip;
|
||||
|
||||
__u16 _checksum(unsigned char *addr, int count);
|
||||
|
||||
void host_unreachable(ipt destination, u16 id, ipt source, char *packet, int packet_len)
|
||||
{
|
||||
char buf[128] = {0};
|
||||
struct iphdr *iph;
|
||||
struct icmphdr *icmp;
|
||||
char *data;
|
||||
int len = 0, on = 1, icmp_socket;
|
||||
struct sockaddr_in whereto = {0};
|
||||
|
||||
if (!(icmp_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)))
|
||||
return;
|
||||
setsockopt(icmp_socket, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on));
|
||||
|
||||
whereto.sin_addr.s_addr = destination;
|
||||
whereto.sin_family = AF_INET;
|
||||
|
||||
iph = (struct iphdr *)(buf);
|
||||
len = sizeof(struct iphdr);
|
||||
icmp = (struct icmphdr *)(buf + len);
|
||||
len += sizeof(struct icmphdr);
|
||||
data = (char *)(buf + len);
|
||||
len += (packet_len < 64) ? packet_len : 64;
|
||||
memcpy(data, packet, (packet_len < 64) ? packet_len : 64);
|
||||
|
||||
iph->tos = 0;
|
||||
iph->id = id;
|
||||
iph->frag_off = 0;
|
||||
iph->ttl = 30;
|
||||
iph->check = 0;
|
||||
iph->version = 4;
|
||||
iph->ihl = 5;
|
||||
iph->protocol = 1;
|
||||
iph->check = 0;
|
||||
iph->daddr = destination;
|
||||
iph->saddr = source;
|
||||
|
||||
iph->tot_len = ntohs(len);
|
||||
|
||||
icmp->type = ICMP_DEST_UNREACH;
|
||||
icmp->code = ICMP_HOST_UNREACH;
|
||||
icmp->checksum = _checksum((char *)icmp, sizeof(struct icmphdr) + ((packet_len < 64) ? packet_len : 64));
|
||||
|
||||
iph->check = _checksum((char *)iph, sizeof(struct iphdr));
|
||||
|
||||
sendto(icmp_socket, (char *)buf, len, 0, (struct sockaddr *)&whereto, sizeof(struct sockaddr));
|
||||
close(icmp_socket);
|
||||
}
|
||||
|
||||
__u16 _checksum(unsigned char *addr, int count)
|
||||
{
|
||||
register long sum = 0;
|
||||
|
||||
for (; count > 1; count -= 2)
|
||||
{
|
||||
sum += ntohs(*(u32 *)addr);
|
||||
addr += 2;
|
||||
}
|
||||
|
||||
if (count > 1) sum += *(unsigned char *)addr;
|
||||
|
||||
// take only 16 bits out of the 32 bit sum and add up the carries
|
||||
while (sum >> 16)
|
||||
sum = (sum & 0xFFFF) + (sum >> 16);
|
||||
|
||||
// one's complement the result
|
||||
sum = ~sum;
|
||||
|
||||
return htons((u16) sum);
|
||||
}
|
||||
201
l2tpns.h
201
l2tpns.h
|
|
@ -1,12 +1,11 @@
|
|||
// L2TPNS Global Stuff
|
||||
// $Id: l2tpns.h,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: l2tpns.h,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#define VERSION "1.0"
|
||||
#define VERSION "1.1.0"
|
||||
|
||||
// Limits
|
||||
#define MAXTUNNEL 500 // could be up to 65535
|
||||
|
|
@ -15,6 +14,7 @@
|
|||
#define MAXCONTROL 1000 // max length control message we ever send...
|
||||
#define MAXETHER (1500+18) // max packet we try sending to tap
|
||||
#define MAXTEL 96 // telephone number
|
||||
#define MAXPLUGINS 20 // maximum number of plugins to load
|
||||
#define MAXRADSERVER 10 // max radius servers
|
||||
#define MAXROUTE 10 // max static routes per session
|
||||
#define MAXIPPOOL 131072 // max number of ip addresses in pool
|
||||
|
|
@ -27,17 +27,17 @@
|
|||
#define STATISTICS
|
||||
#define STAT_CALLS
|
||||
#define RINGBUFFER
|
||||
#define UDP 17
|
||||
#define TAPDEVICE "/dev/net/tun"
|
||||
#define CLIUSERS ETCDIR "l2tpns.users" // CLI Users file
|
||||
#define UDP 17
|
||||
#define HOMEDIR "/home/l2tpns/" // Base dir for data
|
||||
#define STATEFILE "/tmp/l2tpns.dump" // State dump file
|
||||
#define NOSTATEFILE "/tmp/l2tpns.no_state_reload" // If exists, state will not be reloaded
|
||||
#define CONFIGFILE ETCDIR "l2tpns.cfg" // Configuration file
|
||||
#define IPPOOLFILE ETCDIR "l2tpns.ip_pool" // Address pool configuration
|
||||
#define STATEFILE "/tmp/l2tpns.dump" // State dump file
|
||||
|
||||
#define CLIUSERS ETCDIR "l2tpns.users" // CLI Users file
|
||||
#define IPPOOLFILE ETCDIR "l2tpns.ip_pool" // Address pool configuration
|
||||
#ifndef LIBDIR
|
||||
#define LIBDIR "/usr/lib/l2tpns"
|
||||
#endif
|
||||
|
||||
#define ACCT_TIME 3000 // 5 minute accounting interval
|
||||
#define L2TPPORT 1701 // L2TP port
|
||||
#define RADPORT 1645 // old radius port...
|
||||
|
|
@ -52,20 +52,20 @@
|
|||
#define PPPCCP 0x80FD
|
||||
#define PPPIP 0x0021
|
||||
#define PPPMP 0x003D
|
||||
#define ConfigReq 1
|
||||
#define ConfigAck 2
|
||||
#define ConfigNak 3
|
||||
#define ConfigRej 4
|
||||
#define TerminateReq 5
|
||||
#define TerminateAck 6
|
||||
#define CodeRej 7
|
||||
#define ProtocolRej 8
|
||||
#define EchoReq 9
|
||||
#define EchoReply 10
|
||||
#define DiscardRequest 11
|
||||
|
||||
#undef TC_TBF
|
||||
#define TC_HTB
|
||||
enum
|
||||
{
|
||||
ConfigReq = 1,
|
||||
ConfigAck,
|
||||
ConfigNak,
|
||||
ConfigRej,
|
||||
TerminateReq,
|
||||
TerminateAck,
|
||||
CodeRej,
|
||||
ProtocolRej,
|
||||
EchoReq,
|
||||
EchoReply,
|
||||
DiscardRequest
|
||||
};
|
||||
|
||||
// Types
|
||||
typedef unsigned short u16;
|
||||
|
|
@ -78,6 +78,9 @@ typedef u16 tunnelidt;
|
|||
typedef u32 clockt;
|
||||
typedef u8 hasht[16];
|
||||
|
||||
// dump header: update number if internal format changes
|
||||
#define DUMP_MAGIC "L2TPNS#" VERSION "#"
|
||||
|
||||
// structures
|
||||
typedef struct routes // route
|
||||
{
|
||||
|
|
@ -88,7 +91,7 @@ routet;
|
|||
|
||||
typedef struct controls // control message
|
||||
{
|
||||
struct controls *next; // next in queue
|
||||
struct controls *next; // next in queue
|
||||
u16 length; // length
|
||||
u8 buf[MAXCONTROL];
|
||||
}
|
||||
|
|
@ -106,34 +109,37 @@ typedef struct stbft
|
|||
// 336 bytes per session
|
||||
typedef struct sessions
|
||||
{
|
||||
sessionidt next; // next session in linked list
|
||||
sessionidt far; // far end session ID
|
||||
tunnelidt tunnel; // tunnel ID
|
||||
ipt ip; // IP of session set by RADIUS response
|
||||
unsigned long sid; // session id for hsddb
|
||||
u16 nr; // next receive
|
||||
u16 ns; // next send
|
||||
u32 magic; // ppp magic number
|
||||
u32 cin, cout; // byte counts
|
||||
u32 pin, pout; // packet counts
|
||||
u32 id; // session id
|
||||
clockt opened; // when started
|
||||
clockt die; // being closed, when to finally free
|
||||
time_t last_packet; // Last packet from the user (used for idle timeouts)
|
||||
ipt dns1, dns2; // DNS servers
|
||||
routet route[MAXROUTE]; // static routes
|
||||
u8 radius; // which radius session is being used (0 for not waiting on authentication)
|
||||
u8 flags; // various bit flags
|
||||
u8 snoop; // are we snooping this session?
|
||||
u8 throttle; // is this session throttled?
|
||||
u8 walled_garden; // is this session stuck in the walled garden?
|
||||
u16 mru; // maximum receive unit
|
||||
u16 tbf; // filter bucket for throttling
|
||||
sessionidt next; // next session in linked list
|
||||
sessionidt far; // far end session ID
|
||||
tunnelidt tunnel; // tunnel ID
|
||||
ipt ip; // IP of session set by RADIUS response
|
||||
int ip_pool_index; // index to IP pool
|
||||
unsigned long sid; // session id for hsddb
|
||||
u16 nr; // next receive
|
||||
u16 ns; // next send
|
||||
u32 magic; // ppp magic number
|
||||
u32 cin, cout; // byte counts
|
||||
u32 pin, pout; // packet counts
|
||||
u32 total_cin; // This counter is never reset while a session is open
|
||||
u32 total_cout; // This counter is never reset while a session is open
|
||||
u32 id; // session id
|
||||
clockt opened; // when started
|
||||
clockt die; // being closed, when to finally free
|
||||
time_t last_packet; // Last packet from the user (used for idle timeouts)
|
||||
ipt dns1, dns2; // DNS servers
|
||||
routet route[MAXROUTE]; // static routes
|
||||
u8 radius; // which radius session is being used (0 for not waiting on authentication)
|
||||
u8 flags; // various bit flags
|
||||
u8 snoop; // are we snooping this session?
|
||||
u8 throttle; // is this session throttled?
|
||||
u8 servicenet; // is this session servicenetted?
|
||||
u16 mru; // maximum receive unit
|
||||
u16 tbf; // filter bucket for throttling
|
||||
char random_vector[MAXTEL];
|
||||
int random_vector_length;
|
||||
char user[129]; // user (needed in seesion for radius stop messages)
|
||||
char called[MAXTEL]; // called number
|
||||
char calling[MAXTEL]; // calling number
|
||||
char user[129]; // user (needed in seesion for radius stop messages)
|
||||
char called[MAXTEL]; // called number
|
||||
char calling[MAXTEL]; // calling number
|
||||
unsigned long tx_connect_speed;
|
||||
unsigned long rx_connect_speed;
|
||||
}
|
||||
|
|
@ -145,16 +151,17 @@ sessiont;
|
|||
// 168 bytes per tunnel
|
||||
typedef struct tunnels
|
||||
{
|
||||
tunnelidt next; // next tunnel in linked list
|
||||
tunnelidt far; // far end tunnel ID
|
||||
ipt ip; // Ip for far end
|
||||
portt port; // port for far end
|
||||
u16 window; // Rx window
|
||||
u16 nr; // next receive
|
||||
u16 ns; // next send
|
||||
int state; // current state (tunnelstate enum)
|
||||
clockt last; // when last control message sent (used for resend timeout)
|
||||
clockt retry; // when to try resenting pending control
|
||||
clockt die; // being closed, when to finally free
|
||||
clockt lastrec; // when the last control message was received
|
||||
char hostname[128]; // tunnel hostname
|
||||
char vendor[128]; // LAC vendor
|
||||
u8 try; // number of retrys on a control message
|
||||
|
|
@ -167,10 +174,9 @@ tunnelt;
|
|||
// 180 bytes per radius session
|
||||
typedef struct radiuss // outstanding RADIUS requests
|
||||
{
|
||||
u8 next; // next in free list
|
||||
sessionidt session; // which session this applies to
|
||||
hasht auth; // request authenticator
|
||||
clockt retry; // ehwne to try next
|
||||
clockt retry; // when to try next
|
||||
char calling[MAXTEL]; // calling number
|
||||
char pass[129]; // password
|
||||
u8 id; // ID for PPP response
|
||||
|
|
@ -184,6 +190,8 @@ typedef struct
|
|||
{
|
||||
ipt address;
|
||||
char assigned; // 1 if assigned, 0 if free
|
||||
clockt last; // last used
|
||||
char user[129]; // user (try to have ip addresses persistent)
|
||||
}
|
||||
ippoolt;
|
||||
|
||||
|
|
@ -202,15 +210,27 @@ struct Tringbuffer
|
|||
};
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Possible tunnel states
|
||||
* TUNNELFREE -> TUNNELOPEN -> TUNNELDIE -> TUNNELFREE
|
||||
*/
|
||||
enum
|
||||
{
|
||||
RADIUSNULL, // Not in use
|
||||
RADIUSCHAP, // sending CHAP down PPP
|
||||
RADIUSAUTH, // sending auth to RADIUS server
|
||||
RADIUSIPCP, // sending IPCP to end user
|
||||
RADIUSSTART, // sending start accounting to RADIUS server
|
||||
RADIUSSTOP, // sending stop accounting to RADIUS server
|
||||
RADIUSWAIT // waiting timeout before available, in case delayed replies
|
||||
TUNNELFREE, // Not in use
|
||||
TUNNELOPEN, // Active tunnel
|
||||
TUNNELDIE, // Currently closing
|
||||
TUNNELOPENING // Busy opening
|
||||
};
|
||||
|
||||
enum
|
||||
{
|
||||
RADIUSNULL, // Not in use
|
||||
RADIUSCHAP, // sending CHAP down PPP
|
||||
RADIUSAUTH, // sending auth to RADIUS server
|
||||
RADIUSIPCP, // sending IPCP to end user
|
||||
RADIUSSTART, // sending start accounting to RADIUS server
|
||||
RADIUSSTOP, // sending stop accounting to RADIUS server
|
||||
RADIUSWAIT // waiting timeout before available, in case delayed replies
|
||||
};
|
||||
|
||||
struct Tstats
|
||||
|
|
@ -297,6 +317,49 @@ struct Tstats
|
|||
#define SET_STAT(x, y)
|
||||
#endif
|
||||
|
||||
struct configt
|
||||
{
|
||||
int debug; // debugging level
|
||||
time_t start_time; // time when l2tpns was started
|
||||
char bandwidth[256]; // current bandwidth
|
||||
|
||||
char config_file[128];
|
||||
int reload_config; // flag to re-read config (set by cli)
|
||||
|
||||
char tapdevice[10]; // tap device name
|
||||
char log_filename[128];
|
||||
char l2tpsecret[64];
|
||||
|
||||
char radiussecret[64];
|
||||
int radius_accounting;
|
||||
ipt radiusserver[MAXRADSERVER]; // radius servers
|
||||
u8 numradiusservers; // radius server count
|
||||
|
||||
ipt default_dns1, default_dns2;
|
||||
|
||||
ipt snoop_destination_host;
|
||||
u16 snoop_destination_port;
|
||||
|
||||
unsigned long rl_rate;
|
||||
int save_state;
|
||||
uint32_t cluster_address;
|
||||
int ignore_cluster_updates;
|
||||
char accounting_dir[128];
|
||||
ipt bind_address;
|
||||
int target_uid;
|
||||
int dump_speed;
|
||||
char plugins[64][MAXPLUGINS];
|
||||
char old_plugins[64][MAXPLUGINS];
|
||||
};
|
||||
|
||||
struct config_descriptt
|
||||
{
|
||||
char *key;
|
||||
int offset;
|
||||
int size;
|
||||
enum { INT, STRING, UNSIGNED_LONG, SHORT, BOOL, IP } type;
|
||||
};
|
||||
|
||||
// arp.c
|
||||
void sendarp(int ifr_idx, const unsigned char* mac, ipt ip);
|
||||
|
||||
|
|
@ -321,6 +384,7 @@ void radiussend(u8 r, u8 state);
|
|||
void processrad(u8 *buf, int len);
|
||||
void radiusretry(u8 r);
|
||||
u8 radiusnew(sessionidt s);
|
||||
void radiusclear(u8 r, sessionidt s);
|
||||
|
||||
// throttle.c
|
||||
int throttle_session(sessionidt s, int throttle);
|
||||
|
|
@ -343,7 +407,6 @@ void initudp(void);
|
|||
void initdata(void);
|
||||
void initippool();
|
||||
sessionidt sessionbyip(ipt ip);
|
||||
/* NB - sessionbyuser ignores walled garden'd sessions */
|
||||
sessionidt sessionbyuser(char *username);
|
||||
void sessionshutdown(sessionidt s, char *reason);
|
||||
void sessionsendarp(sessionidt s);
|
||||
|
|
@ -365,14 +428,14 @@ void processarp(u8 * buf, int len);
|
|||
void processudp(u8 * buf, int len, struct sockaddr_in *addr);
|
||||
void processtap(u8 * buf, int len);
|
||||
void processcontrol(u8 * buf, int len, struct sockaddr_in *addr);
|
||||
ipt assign_ip_address();
|
||||
void free_ip_address(ipt address);
|
||||
int assign_ip_address(sessionidt s);
|
||||
void free_ip_address(sessionidt s);
|
||||
void snoop_send_packet(char *packet, u16 size);
|
||||
void dump_acct_info();
|
||||
void mainloop(void);
|
||||
#define log _log
|
||||
#ifndef log_hex
|
||||
#define log_hex(a,b,c,d) do{if (a <= debug) _log_hex(a,0,0,0,b,c,d);}while (0)
|
||||
#define log_hex(a,b,c,d) do{if (a <= config->debug) _log_hex(a,0,0,0,b,c,d);}while (0)
|
||||
#endif
|
||||
void _log(int level, ipt address, sessionidt s, tunnelidt t, const char *format, ...);
|
||||
void _log_hex(int level, ipt address, sessionidt s, tunnelidt t, const char *title, const char *data, int maxsize);
|
||||
|
|
@ -380,10 +443,10 @@ void build_chap_response(char *challenge, u8 id, u16 challenge_length, char **ch
|
|||
int sessionsetup(tunnelidt t, sessionidt s, u8 routes);
|
||||
int cluster_send_session(int s);
|
||||
int cluster_send_tunnel(int t);
|
||||
#ifdef HAVE_LIBCLI
|
||||
int cluster_send_goodbye();
|
||||
void init_cli();
|
||||
void cli_do_file(FILE *fh);
|
||||
void cli_do(int sockfd);
|
||||
#endif
|
||||
#ifdef RINGBUFFER
|
||||
void ringbuffer_dump(FILE *stream);
|
||||
#endif
|
||||
|
|
@ -391,3 +454,9 @@ void initplugins();
|
|||
int run_plugins(int plugin_type, void *data);
|
||||
void add_plugin(char *plugin_name);
|
||||
void remove_plugin(char *plugin_name);
|
||||
void tunnelclear(tunnelidt t);
|
||||
void host_unreachable(ipt destination, u16 id, ipt source, char *packet, int packet_len);
|
||||
|
||||
extern tunnelt *tunnel;
|
||||
extern sessiont *session;
|
||||
#define sessionfree (session[0].next)
|
||||
|
|
|
|||
2
ll.c
2
ll.c
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Linked List Stuff
|
||||
// $Id: ll.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: ll.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/file.h>
|
||||
|
|
|
|||
2
md5.h
2
md5.h
|
|
@ -1,8 +1,6 @@
|
|||
/* GLOBAL.H - RSAREF types and constants
|
||||
*/
|
||||
|
||||
#include "config.h"
|
||||
|
||||
/* PROTOTYPES should be set to one if and only if the compiler supports
|
||||
function argument prototyping.
|
||||
The following makes PROTOTYPES default to 0 if it has not already
|
||||
|
|
|
|||
2
nsctl.c
2
nsctl.c
|
|
@ -96,7 +96,7 @@ int main(int argc, char *argv[])
|
|||
}
|
||||
for (p = 0; p < commands[i].params; p++)
|
||||
{
|
||||
strncpy((packet + len), argv[p + 3], 1400 - len);
|
||||
strncpy((packet + len), argv[p + 3], 1400 - len - 1);
|
||||
len += strlen(argv[p + 3]) + 1;
|
||||
}
|
||||
break;
|
||||
|
|
|
|||
22
plugin.h
22
plugin.h
|
|
@ -4,16 +4,18 @@
|
|||
#define PLUGIN_API_VERSION 1
|
||||
#define MAX_PLUGIN_TYPES 30
|
||||
|
||||
#define PLUGIN_PRE_AUTH 1
|
||||
#define PLUGIN_POST_AUTH 2
|
||||
#define PLUGIN_PACKET_RX 3
|
||||
#define PLUGIN_PACKET_TX 4
|
||||
#define PLUGIN_TIMER 5
|
||||
#define PLUGIN_CONFIG 6
|
||||
#define PLUGIN_NEW_SESSION 7
|
||||
#define PLUGIN_KILL_SESSION 8
|
||||
#define PLUGIN_CONTROL 9
|
||||
#define PLUGIN_RADIUS_RESPONSE 10
|
||||
enum
|
||||
{
|
||||
PLUGIN_PRE_AUTH = 1,
|
||||
PLUGIN_POST_AUTH,
|
||||
PLUGIN_PACKET_RX,
|
||||
PLUGIN_PACKET_TX,
|
||||
PLUGIN_TIMER,
|
||||
PLUGIN_NEW_SESSION,
|
||||
PLUGIN_KILL_SESSION,
|
||||
PLUGIN_CONTROL,
|
||||
PLUGIN_RADIUS_RESPONSE
|
||||
};
|
||||
|
||||
#define PLUGIN_RET_ERROR 0
|
||||
#define PLUGIN_RET_OK 1
|
||||
|
|
|
|||
18
ppp.c
18
ppp.c
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS PPP Stuff
|
||||
// $Id: ppp.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: ppp.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
|
@ -11,16 +11,15 @@
|
|||
#include "plugin.h"
|
||||
#include "util.h"
|
||||
|
||||
extern char debug;
|
||||
extern tunnelt *tunnel;
|
||||
extern sessiont *session;
|
||||
extern radiust *radius;
|
||||
extern u16 tapmac[3];
|
||||
extern int tapfd;
|
||||
extern char hostname[1000];
|
||||
extern struct Tstats *_statistics;
|
||||
extern unsigned long eth_tx;
|
||||
extern time_t time_now;
|
||||
extern struct configt *config;
|
||||
|
||||
// Process PAP messages
|
||||
void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
||||
|
|
@ -77,7 +76,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
p[4] = 0; // no message
|
||||
if (session[s].ip)
|
||||
{
|
||||
log(3, session[s].ip, s, t, "%d Already an IP allocated: %s (%d)\n", getpid(), inet_toa(htonl(session[s].ip)), session[s].ip);
|
||||
log(3, session[s].ip, s, t, "%d Already an IP allocated: %s (%d)\n", getpid(), inet_toa(htonl(session[s].ip)), session[s].ip_pool_index);
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -101,8 +100,8 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
return;
|
||||
}
|
||||
|
||||
strncpy(session[s].user, packet.username, sizeof(session[s].user));
|
||||
strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass));
|
||||
strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
|
||||
strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
|
||||
|
||||
free(packet.username);
|
||||
free(packet.password);
|
||||
|
|
@ -180,7 +179,7 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
return;
|
||||
}
|
||||
|
||||
strncpy(session[s].user, packet.username, sizeof(session[s].user));
|
||||
strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
|
||||
memcpy(radius[r].pass, packet.password, 16);
|
||||
|
||||
free(packet.username);
|
||||
|
|
@ -408,7 +407,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
*p = EchoReply; // reply
|
||||
*(u32 *) (p + 4) = htonl(session[s].magic); // our magic number
|
||||
q = makeppp(b, p, l, t, s, PPPLCP);
|
||||
log(3, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
|
||||
log(4, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
|
||||
tunnelsend(b, l + (q - b), t); // send it
|
||||
}
|
||||
else if (*p == EchoReply)
|
||||
|
|
@ -439,7 +438,7 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
if (*p == ConfigAck)
|
||||
{ // happy with our IPCP
|
||||
u8 r = session[s].radius;
|
||||
if ((!r || radius[r].state == RADIUSIPCP) && !session[s].walled_garden)
|
||||
if ((!r || radius[r].state == RADIUSIPCP) && !session[s].servicenet)
|
||||
if (!r)
|
||||
r = radiusnew(s);
|
||||
if (r)
|
||||
|
|
@ -552,6 +551,7 @@ void processipin(tunnelidt t, sessionidt s, u8 * p, u16 l)
|
|||
}
|
||||
|
||||
session[s].cin += l;
|
||||
session[s].total_cin += l;
|
||||
session[s].pin++;
|
||||
eth_tx += l;
|
||||
|
||||
|
|
|
|||
98
radius.c
98
radius.c
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Radius Stuff
|
||||
// $Id: radius.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: radius.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <time.h>
|
||||
#include <stdio.h>
|
||||
|
|
@ -16,20 +16,13 @@
|
|||
#include "plugin.h"
|
||||
#include "util.h"
|
||||
|
||||
extern char *radiussecret;
|
||||
extern radiust *radius;
|
||||
extern sessiont *session;
|
||||
extern tunnelt *tunnel;
|
||||
extern ipt radiusserver[MAXRADSERVER]; // radius servers
|
||||
extern u32 sessionid;
|
||||
extern u8 radiusfree;
|
||||
extern int radfd;
|
||||
extern u8 numradiusservers;
|
||||
extern char debug;
|
||||
extern unsigned long default_dns1, default_dns2;
|
||||
extern struct Tstats *_statistics;
|
||||
extern int radius_accounting;
|
||||
extern uint32_t bind_address;
|
||||
extern struct configt *config;
|
||||
|
||||
const char *radius_state(int state)
|
||||
{
|
||||
|
|
@ -51,27 +44,35 @@ void initrad(void)
|
|||
|
||||
void radiusclear(u8 r, sessionidt s)
|
||||
{
|
||||
radius[r].state = RADIUSNULL;
|
||||
if (s) session[s].radius = 0;
|
||||
memset(&radius[r], 0, sizeof(radius[r]));
|
||||
radius[r].next = radiusfree;
|
||||
radiusfree = r;
|
||||
memset(&radius[r], 0, sizeof(radius[r])); // radius[r].state = RADIUSNULL;
|
||||
}
|
||||
|
||||
static u8 new_radius()
|
||||
{
|
||||
u8 i;
|
||||
for (i = 1; i < MAXRADIUS; i++)
|
||||
{
|
||||
if (radius[i].state == RADIUSNULL)
|
||||
return i;
|
||||
}
|
||||
log(0, 0, 0, 0, "Can't find a free radius session! This could be bad!\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
u8 radiusnew(sessionidt s)
|
||||
{
|
||||
u8 r;
|
||||
if (!radiusfree)
|
||||
if (!(r = new_radius()))
|
||||
{
|
||||
log(1, 0, s, session[s].tunnel, "No free RADIUS sessions\n");
|
||||
STAT(radius_overflow);
|
||||
return 0;
|
||||
};
|
||||
r = radiusfree;
|
||||
session[s].radius = r;
|
||||
radiusfree = radius[r].next;
|
||||
memset(&radius[r], 0, sizeof(radius[r]));
|
||||
session[s].radius = r;
|
||||
radius[r].session = s;
|
||||
radius[r].state = RADIUSWAIT;
|
||||
return r;
|
||||
}
|
||||
|
||||
|
|
@ -87,19 +88,19 @@ void radiussend(u8 r, u8 state)
|
|||
#ifdef STAT_CALLS
|
||||
STAT(call_radiussend);
|
||||
#endif
|
||||
if (!numradiusservers)
|
||||
{
|
||||
log(0, 0, 0, 0, "No RADIUS servers\n");
|
||||
return;
|
||||
}
|
||||
if (!radiussecret)
|
||||
{
|
||||
log(0, 0, 0, 0, "No RADIUS secret\n");
|
||||
return;
|
||||
}
|
||||
s = radius[r].session;
|
||||
if (!config->numradiusservers)
|
||||
{
|
||||
log(0, 0, s, session[s].tunnel, "No RADIUS servers\n");
|
||||
return;
|
||||
}
|
||||
if (!*config->radiussecret)
|
||||
{
|
||||
log(0, 0, s, session[s].tunnel, "No RADIUS secret\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (state != RADIUSAUTH && !radius_accounting)
|
||||
if (state != RADIUSAUTH && !config->radius_accounting)
|
||||
{
|
||||
// Radius accounting is turned off
|
||||
radiusclear(r, s);
|
||||
|
|
@ -111,7 +112,7 @@ void radiussend(u8 r, u8 state)
|
|||
radius[r].state = state;
|
||||
radius[r].retry = backoff(radius[r].try++);
|
||||
log(4, 0, s, session[s].tunnel, "Send RADIUS %d state %s try %d\n", r, radius_state(radius[r].state), radius[r].try);
|
||||
if (radius[r].try > numradiusservers * 2)
|
||||
if (radius[r].try > config->numradiusservers * 2)
|
||||
{
|
||||
if (s)
|
||||
{
|
||||
|
|
@ -177,7 +178,7 @@ void radiussend(u8 r, u8 state)
|
|||
{
|
||||
MD5_CTX ctx;
|
||||
MD5Init(&ctx);
|
||||
MD5Update(&ctx, radiussecret, strlen(radiussecret));
|
||||
MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
|
||||
if (p)
|
||||
MD5Update(&ctx, pass + p - 16, 16);
|
||||
else
|
||||
|
|
@ -280,7 +281,7 @@ void radiussend(u8 r, u8 state)
|
|||
// NAS-IP-Address
|
||||
*p = 4;
|
||||
p[1] = 6;
|
||||
*(u32 *)(p + 2) = bind_address;
|
||||
*(u32 *)(p + 2) = config->bind_address;
|
||||
p += p[1];
|
||||
|
||||
// All AVpairs added
|
||||
|
|
@ -295,14 +296,14 @@ void radiussend(u8 r, u8 state)
|
|||
MD5Update(&ctx, b, 4);
|
||||
MD5Update(&ctx, z, 16);
|
||||
MD5Update(&ctx, b + 20, (p - b) - 20);
|
||||
MD5Update(&ctx, radiussecret, strlen(radiussecret));
|
||||
MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
|
||||
MD5Final(hash, &ctx);
|
||||
memcpy(b + 4, hash, 16);
|
||||
memcpy(radius[r].auth, hash, 16);
|
||||
}
|
||||
memset(&addr, 0, sizeof(addr));
|
||||
addr.sin_family = AF_INET;
|
||||
*(u32 *) & addr.sin_addr = htonl(radiusserver[(radius[r].try - 1) % numradiusservers]);
|
||||
*(u32 *) & addr.sin_addr = config->radiusserver[(radius[r].try - 1) % config->numradiusservers];
|
||||
addr.sin_port = htons((state == RADIUSAUTH) ? RADPORT : RADAPORT);
|
||||
|
||||
log_hex(5, "RADIUS Send", b, (p - b));
|
||||
|
|
@ -348,7 +349,7 @@ void processrad(u8 * buf, int len)
|
|||
MD5Update(&ctx, buf, 4);
|
||||
MD5Update(&ctx, radius[r].auth, 16);
|
||||
MD5Update(&ctx, buf + 20, len - 20);
|
||||
MD5Update(&ctx, radiussecret, strlen(radiussecret));
|
||||
MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
|
||||
MD5Final(hash, &ctx);
|
||||
do {
|
||||
if (memcmp(hash, buf + 4, 16))
|
||||
|
|
@ -534,22 +535,22 @@ void processrad(u8 * buf, int len)
|
|||
// Check for Assign-IP-Address
|
||||
if (!session[s].ip || session[s].ip == 0xFFFFFFFE)
|
||||
{
|
||||
session[s].ip = assign_ip_address();
|
||||
assign_ip_address(s);
|
||||
if (session[s].ip)
|
||||
log(3, 0, s, t, " No IP allocated by radius. Assigned %s from pool\n",
|
||||
inet_toa(htonl(session[s].ip)));
|
||||
else
|
||||
log(3, 0, s, t, " No IP allocated by radius. None available in pool\n");
|
||||
}
|
||||
if (!session[s].dns1 && default_dns1)
|
||||
if (!session[s].dns1 && config->default_dns1)
|
||||
{
|
||||
session[s].dns1 = htonl(default_dns1);
|
||||
log(3, 0, s, t, " Sending dns1 = %s\n", inet_toa(default_dns1));
|
||||
session[s].dns1 = htonl(config->default_dns1);
|
||||
log(3, 0, s, t, " Sending dns1 = %s\n", inet_toa(config->default_dns1));
|
||||
}
|
||||
if (!session[s].dns2 && default_dns2)
|
||||
if (!session[s].dns2 && config->default_dns2)
|
||||
{
|
||||
session[s].dns2 = htonl(default_dns2);
|
||||
log(3, 0, s, t, " Sending dns2 = %s\n", inet_toa(default_dns2));
|
||||
session[s].dns2 = htonl(config->default_dns2);
|
||||
log(3, 0, s, t, " Sending dns2 = %s\n", inet_toa(config->default_dns2));
|
||||
}
|
||||
|
||||
if (session[s].ip)
|
||||
|
|
@ -612,3 +613,18 @@ void radiusretry(u8 r)
|
|||
}
|
||||
}
|
||||
|
||||
void radius_clean()
|
||||
{
|
||||
int i;
|
||||
|
||||
log(1, 0, 0, 0, "Cleaning radius session array\n");
|
||||
|
||||
for (i = 1; i < MAXRADIUS; i++)
|
||||
{
|
||||
if (radius[i].retry == 0
|
||||
|| !session[radius[i].session].opened
|
||||
|| session[radius[i].session].die
|
||||
|| session[radius[i].session].tunnel == 0)
|
||||
radiusclear(i, 0);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
72
rl.c
72
rl.c
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Rate Limiting Stuff
|
||||
// $Id: rl.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: rl.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/file.h>
|
||||
|
|
@ -11,47 +11,30 @@
|
|||
#include <malloc.h>
|
||||
#include "l2tpns.h"
|
||||
|
||||
extern char *radiussecret;
|
||||
extern radiust *radius;
|
||||
extern sessiont *session;
|
||||
extern ipt radiusserver[MAXRADSERVER]; // radius servers
|
||||
extern u32 sessionid;
|
||||
extern u8 radiusfree;
|
||||
extern int radfd;
|
||||
extern u8 numradiusservers;
|
||||
extern char debug;
|
||||
extern char *tapdevice;
|
||||
extern tbft *filter_buckets;
|
||||
extern struct configt *config;
|
||||
|
||||
#define DEVICE "tun0"
|
||||
|
||||
unsigned long rl_rate = 0;
|
||||
int next_tbf = 1;
|
||||
|
||||
void init_rl()
|
||||
{
|
||||
#ifdef TC_TBF
|
||||
system("tc qdisc del dev " DEVICE " root");
|
||||
system("tc qdisc add dev " DEVICE " root handle 1: cbq avpkt 10000 bandwidth 100mbit");
|
||||
system("tc filter del dev " DEVICE " protocol ip pref 1 fw");
|
||||
system("iptables -t mangle -N throttle 2>&1 > /dev/null");
|
||||
system("iptables -t mangle -F throttle");
|
||||
system("iptables -t mangle -A l2tpns -j throttle");
|
||||
#endif
|
||||
#ifdef TC_HTB
|
||||
char *commands[] = {
|
||||
"tc qdisc add dev " DEVICE " root handle 1: htb default 1",
|
||||
"tc class add dev " DEVICE " parent 1: classid 1:1 htb rate 100mbit burst 300k",
|
||||
"tc filter del dev " DEVICE " protocol ip pref 1 fw",
|
||||
"iptables -t mangle -N throttle 2>&1 > /dev/null",
|
||||
"iptables -t mangle -F throttle",
|
||||
"iptables -t mangle -A l2tpns -j throttle",
|
||||
"iptables -t mangle -N throttle 2>&1 >/dev/null",
|
||||
"iptables -t mangle -F throttle 2>&1 >/dev/null",
|
||||
"iptables -t mangle -A l2tpns -j throttle 2>&1 >/dev/null",
|
||||
NULL
|
||||
};
|
||||
int i;
|
||||
|
||||
if (!rl_rate) return;
|
||||
|
||||
log(2, 0, 0, 0, "Initializing HTB\n");
|
||||
for (i = 0; commands[i] && *commands[i]; i++)
|
||||
{
|
||||
|
|
@ -59,41 +42,21 @@ void init_rl()
|
|||
system(commands[i]);
|
||||
}
|
||||
log(2, 0, 0, 0, "Done initializing HTB\n");
|
||||
#endif
|
||||
}
|
||||
|
||||
u16 rl_create_tbf()
|
||||
{
|
||||
u16 t;
|
||||
char cmd[2048];
|
||||
if (!rl_rate) return 0;
|
||||
if (!config->rl_rate) return 0;
|
||||
|
||||
if (next_tbf >= MAXSESSION) return 0;
|
||||
t = next_tbf++;
|
||||
snprintf(filter_buckets[t].handle, 9, "1:%d0", t);
|
||||
|
||||
#ifdef TC_TBF
|
||||
log(2, 0, 0, 0, "Creating new tbf %s\n", filter_buckets[t].handle);
|
||||
snprintf(cmd, 2048, "tc class add dev " DEVICE " parent 1: classid 1:%d cbq bandwidth 100Mbit rate 100Mbit "
|
||||
"weight 1 prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded isolated",
|
||||
t);
|
||||
log(3, 0, 0, 0, "%s\n", cmd);
|
||||
system(cmd);
|
||||
|
||||
snprintf(cmd, 2048, "tc qdisc add dev " DEVICE " parent 1:%d handle %s tbf rate %dkbit buffer 1600 limit 3000",
|
||||
t, filter_buckets[t].handle, rl_rate);
|
||||
log(3, 0, 0, 0, "%s\n", cmd);
|
||||
system(cmd);
|
||||
|
||||
snprintf(cmd, 2048, "tc filter add dev " DEVICE " protocol ip parent 1:0 prio 1 handle %d fw flowid 1:%d",
|
||||
t, t);
|
||||
log(3, 0, 0, 0, "%s\n", cmd);
|
||||
system(cmd);
|
||||
#endif
|
||||
#ifdef TC_HTB
|
||||
log(2, 0, 0, 0, "Creating new htb %s\n", filter_buckets[t].handle);
|
||||
snprintf(cmd, 2048, "tc class add dev " DEVICE " parent 1: classid %s htb rate %lukbit burst 15k",
|
||||
filter_buckets[t].handle, rl_rate);
|
||||
filter_buckets[t].handle, config->rl_rate);
|
||||
log(3, 0, 0, 0, "%s\n", cmd);
|
||||
system(cmd);
|
||||
|
||||
|
|
@ -101,7 +64,6 @@ u16 rl_create_tbf()
|
|||
t, filter_buckets[t].handle);
|
||||
log(3, 0, 0, 0, "%s\n", cmd);
|
||||
system(cmd);
|
||||
#endif
|
||||
|
||||
next_tbf++;
|
||||
return t;
|
||||
|
|
@ -110,7 +72,7 @@ u16 rl_create_tbf()
|
|||
u16 rl_get_tbf()
|
||||
{
|
||||
int i;
|
||||
if (!rl_rate) return 0;
|
||||
if (!config->rl_rate) return 0;
|
||||
|
||||
for (i = 1; i < MAXSESSION; i++)
|
||||
{
|
||||
|
|
@ -129,30 +91,24 @@ u16 rl_get_tbf()
|
|||
void rl_done_tbf(u16 t)
|
||||
{
|
||||
if (!t) return;
|
||||
if (!rl_rate) return;
|
||||
log(2, 0, 0, 0, "Freeing up TBF %s\n", filter_buckets[t].handle);
|
||||
if (!config->rl_rate) return;
|
||||
log(2, 0, 0, 0, "Freeing up HTB %s\n", filter_buckets[t].handle);
|
||||
filter_buckets[t].in_use = 0;
|
||||
}
|
||||
|
||||
void rl_destroy_tbf(u16 t)
|
||||
{
|
||||
char cmd[2048];
|
||||
if (!rl_rate) return;
|
||||
if (!config->rl_rate) return;
|
||||
if (filter_buckets[t].in_use)
|
||||
{
|
||||
log(0, 0, 0, 0, "Trying to destroy an in-use TBF %s\n", filter_buckets[t].handle);
|
||||
log(0, 0, 0, 0, "Trying to destroy an in-use HTB %s\n", filter_buckets[t].handle);
|
||||
return;
|
||||
}
|
||||
#ifdef TC_TBF
|
||||
snprintf(cmd, 2048, "tc qdisc del dev " DEVICE " handle %s", filter_buckets[t].handle);
|
||||
system(cmd);
|
||||
#endif
|
||||
#ifdef TC_HTB
|
||||
snprintf(cmd, 2048, "tc qdisc del dev " DEVICE " handle %s", filter_buckets[t].handle);
|
||||
system(cmd);
|
||||
#endif
|
||||
system("iptables -t mangle -D l2tpns -j throttle");
|
||||
system("iptables -t mangle -X throttle");
|
||||
system("iptables -t mangle -D l2tpns -j throttle 2>&1 >/dev/null");
|
||||
system("iptables -t mangle -X throttle 2>&1 >/dev/null");
|
||||
memset(filter_buckets[t].handle, 0, sizeof(filter_buckets[t].handle));
|
||||
}
|
||||
|
||||
|
|
|
|||
21
throttle.c
21
throttle.c
|
|
@ -1,5 +1,5 @@
|
|||
// L2TPNS Throttle Stuff
|
||||
// $Id: throttle.c,v 1.1 2003/12/16 07:07:39 fred_nerk Exp $
|
||||
// $Id: throttle.c,v 1.2 2004/03/05 00:09:03 fred_nerk Exp $
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/file.h>
|
||||
|
|
@ -16,22 +16,17 @@
|
|||
#include "l2tpns.h"
|
||||
#include "util.h"
|
||||
|
||||
extern char *radiussecret;
|
||||
extern radiust *radius;
|
||||
extern sessiont *session;
|
||||
extern ipt radiusserver[MAXRADSERVER]; // radius servers
|
||||
extern u32 sessionid;
|
||||
extern u8 radiusfree;
|
||||
extern int radfd;
|
||||
extern u8 numradiusservers;
|
||||
extern char debug;
|
||||
extern unsigned long rl_rate;
|
||||
extern tbft *filter_buckets;
|
||||
extern struct configt *config;
|
||||
|
||||
// Throttle or Unthrottle a session
|
||||
int throttle_session(sessionidt s, int throttle)
|
||||
{
|
||||
if (!rl_rate) return 0;
|
||||
if (!config->rl_rate) return 0;
|
||||
|
||||
if (!*session[s].user)
|
||||
return 0; // User not logged in
|
||||
|
|
@ -40,9 +35,15 @@ int throttle_session(sessionidt s, int throttle)
|
|||
{
|
||||
// Throttle them
|
||||
char cmd[2048] = {0};
|
||||
log(2, 0, s, session[s].tunnel, "Throttling session %d for user %s\n", s, session[s].user);
|
||||
if (!session[s].tbf) session[s].tbf = rl_get_tbf();
|
||||
snprintf(cmd, 2048, "iptables -t mangle -A throttle -d %s -j MARK --set-mark %d", inet_toa(ntohl(session[s].ip)),
|
||||
if (!session[s].tbf)
|
||||
{
|
||||
log(1, 0, s, session[s].tunnel, "Error creating a filtering bucket for user %s\n", session[s].user);
|
||||
return 0;
|
||||
}
|
||||
log(2, 0, s, session[s].tunnel, "Throttling session %d for user %s\n", s, session[s].user);
|
||||
snprintf(cmd, 2048, "iptables -t mangle -A throttle -d %s -j MARK --set-mark %d",
|
||||
inet_toa(ntohl(session[s].ip)),
|
||||
session[s].tbf);
|
||||
log(4, 0, s, session[s].tunnel, "Running %s\n", cmd);
|
||||
system(cmd);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue