* Fri Mar 5 2004 David Parrish <david@dparrish.com> 1.1.0

- Change all strcpy() calls to strncpy() to avoid buffer overflow potential
- Add ICMP host unreachable support
- Logging to syslog if log_file = "syslog:facility"
- Now requires libcli 1.5
- All configuration moves to a config structure
- Ability to modify and write config on the fly through command-line interface
- Config file support is removed, and now handled by the cli
- Show hostname in cli prompt
- Keep current state type for tunnels
- Add uptime command do CLI, which also shows real-time bandwidth utilisation
- Add goodbye command to cluster master, which forces droppping a slave
- Cache IP address allocation, so that reconnecting users get the same address
- Fix tunnel resend timeouts, so that dead tunnels will be cleaned up
- Allocate tunnels and radius without using a linked list which had issues
- Fix some off-by-one errors in tunnel and session and radius arrays
- Save and reload ip address pool when dieing
- Check version and size of reloaded data when restarting
- Remove plugin_config support
- Remove old support for TBF which didn't work anyway. HTB is required to do throttling now.
- Add COPYING and Changes files

Changes

@@ -0,0 +1,22 @@
+* Fri Mar 5 2004 David Parrish <david@dparrish.com> 1.1.0
+- Change all strcpy() calls to strncpy() to avoid buffer overflow potential
+- Add ICMP host unreachable support
+- Logging to syslog if log_file = "syslog:facility"
+- Now requires libcli 1.5
+- All configuration moves to a config structure
+- Ability to modify and write config on the fly through command-line interface
+- Config file support is removed, and now handled by the cli
+- Show hostname in cli prompt
+- Keep current state type for tunnels
+- Add uptime command do CLI, which also shows real-time bandwidth utilisation
+- Add goodbye command to cluster master, which forces droppping a slave
+- Cache IP address allocation, so that reconnecting users get the same address
+- Fix tunnel resend timeouts, so that dead tunnels will be cleaned up
+- Allocate tunnels and radius without using a linked list which had issues
+- Fix some off-by-one errors in tunnel and session and radius arrays
+- Save and reload ip address pool when dieing
+- Check version and size of reloaded data when restarting
+- Remove plugin_config support
+- Remove old support for TBF which didn't work anyway. HTB is required to do throttling now.
+- Add COPYING and Changes files
+

INSTALL

@@ -2,9 +2,8 @@ Brief Installation guide for L2TPNS
 
 1. Requirements
 
-    * You must have libcli installed to enable the command-line
+    * libcli 1.5.0 or greater
-      interface. You can get it from http://sourceforge.net/projects/libcli.
+      You can get it from http://sourceforge.net/projects/libcli.
-      If you don't have it, command-line support will not be compiled in.
 
     * A kernel with iptables support
 

Makefile.in

@@ -16,6 +16,7 @@ INSTALL = @INSTALL@
 DEFS = @DEFS@
 
 OBJS=	md5.o \
+	icmp.o \
 	cli.o \
 	l2tpns.o \
 	ppp.o \

arp.c

@@ -48,9 +48,10 @@ void sendarp(int ifr_idx, const unsigned char* mac, ipt ip)
 
 	memset(&sll, 0, sizeof(sll));
 	sll.sll_family = AF_PACKET;
-	strncpy(sll.sll_addr, mac, sizeof(sll.sll_addr)); /* Null-pad */
+	strncpy(sll.sll_addr, mac, sizeof(sll.sll_addr) - 1);
 	sll.sll_halen = ETH_ALEN;
 	sll.sll_ifindex = ifr_idx;
 
 	sendto(fd, &buf, sizeof(buf), 0, (struct sockaddr*)&sll, sizeof(sll));
+	close(fd);
 }

bounce.c

@@ -1,90 +0,0 @@
-#include <arpa/inet.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/if.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <stdarg.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <linux/ip.h>
-#include <linux/udp.h>
-#include <pthread.h>
-#include <unistd.h>
-#include <signal.h>
-#include <getopt.h>
-
-#define PORT	39000
-
-void sigalarm(int junk);
-unsigned long long recv_count = 0;
-unsigned long pps = 0;
-unsigned long bytes = 0;
-unsigned port = PORT;
-
-int main(int argc, char *argv[])
-{
-	int on = 1;
-	struct sockaddr_in addr;
-	int s;
-	char *packet;
-
-	while ((s = getopt(argc, argv, "?p:")) > 0)
-	{
-		switch (s)
-		{
-			case 'p' :
-				port = atoi(optarg);
-				break;
-			case '?' :
-				printf("Options:\n");
-				printf("\t-p port to listen on\n");
-				return(0);
-				break;
-		}
-	}
-
-	memset(&addr, 0, sizeof(addr));
-	addr.sin_family = AF_INET;
-	addr.sin_port = htons(port);
-
-	s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-	setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
-	if (bind(s, (void *) &addr, sizeof(addr)) < 0)
-	{
-		perror("bind");
-		return -1;
-	}
-
-	signal(SIGALRM, sigalarm);
-	alarm(1);
-
-	printf("Waiting on port %d\n", port);
-	packet = (char *)malloc(65535);
-	while (1)
-	{
-		struct sockaddr_in addr;
-		int alen = sizeof(addr), l;
-
-		l = recvfrom(s, packet, 65535, 0, (void *) &addr, &alen);
-		if (l < 0) continue;
-		recv_count++;
-		pps++;
-		bytes += l;
-
-		sendto(s, packet, l, 0, (struct sockaddr *)&addr, alen);
-	}
-
-	free(packet);
-}
-
-void sigalarm(int junk)
-{
-	printf("Recv: %10llu %0.1fMbits/s (%lu pps)\n", recv_count, (bytes / 1024.0 / 1024.0 * 8), pps);
-	pps = bytes = 0;
-	alarm(1);
-}
-

cluster.c

@@ -1,5 +1,5 @@
 // L2TPNS Clustering Stuff
-// $Id: cluster.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $ #include <stdio.h> #include <sys/file.h>
+// $Id: cluster.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $ #include <stdio.h> #include <sys/file.h>
 
 #include <sys/stat.h>
 #include <sys/types.h>

cluster.h

@@ -1,11 +1,12 @@
 // L2TPNS Clustering Stuff
-// $Id: cluster.h,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: cluster.h,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #define C_HELLO			1
 #define C_HELLO_RESPONSE	2
 #define C_PING			3
 #define C_TUNNEL		4
 #define C_SESSION		5
+#define C_GOODBYE		6
 
 #define CLUSTERPORT		32792
 #define CLUSTERCLIENTPORT	32793

cluster_master.c

@@ -1,5 +1,5 @@
 // L2TPNS Cluster Master
-// $Id: cluster_master.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: cluster_master.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <netinet/in.h>
@@ -51,6 +51,7 @@ int handle_hello(char *buf, int l, struct sockaddr_in *src_addr, uint32_t addr);
 int handle_tunnel(char *buf, int l, uint32_t addr);
 int handle_session(char *buf, int l, uint32_t addr);
 int handle_ping(char *buf, int l, uint32_t addr);
+int handle_goodbye(char *buf, int l, uint32_t addr);
 int backup_up(slave *s);
 int backup_down(slave *s);
 int return_state(slave *s);
@@ -91,7 +92,7 @@ int main(int argc, char *argv[])
 
     signal(SIGCHLD, sigchild_handler);
 
-    log(0, "Cluster Manager $Id: cluster_master.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $ starting\n");
+    log(0, "Cluster Manager $Id: cluster_master.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $ starting\n");
 
     to.tv_sec = 1;
     to.tv_usec = 0;
@@ -156,6 +157,7 @@ int main(int argc, char *argv[])
 
 int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
 {
+    slave *s;
     char mtype;
     uint32_t addr;
 
@@ -168,6 +170,16 @@ int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
 
     mtype = *buf; buf++; l--;
 
+    if (mtype != C_GOODBYE && (s = find_slave(addr)) && s->down)
+    {
+	char *hostname;
+	hostname = calloc(l + 1, 1);
+	memcpy(hostname, buf, l);
+	log(1, "Slave \"%s\" (for %s) has come back.\n", hostname, inet_toa(s->ip_address));
+	backup_down(s);
+	free(hostname);
+    }
+
     switch (mtype)
     {
 	case C_HELLO:
@@ -187,6 +199,10 @@ int processmsg(char *buf, int l, struct sockaddr_in *src_addr)
 	    if (!find_slave(addr)) handle_hello((char *)(buf + 1), *(char *)buf, src_addr, addr);
 	    handle_session(buf, l, addr);
 	    break;
+	case C_GOODBYE:
+	    if (!find_slave(addr)) break;
+	    handle_goodbye(buf, l, addr);
+	    break;
     }
     return mtype;
 }
@@ -478,3 +494,24 @@ int backup_down(slave *s)
     return 0;
 }
 
+int handle_goodbye(char *buf, int l, uint32_t addr)
+{
+    int i;
+    slave *s;
+
+    // Is this a slave we have state information for?
+    if ((s = find_slave(addr)))
+    {
+        log(0, "Received goodbye for slave %s\n", s->hostname);
+	ll_delete(slaves, s);
+	for (i = 0; i < s->num_tunnels; i++)
+	    if (s->tunnels[i]) free(s->tunnels[i]);
+	for (i = 0; i < s->num_sessions; i++)
+	    if (s->sessions[i]) free(s->sessions[i]);
+	if (s->hostname) free(s->hostname);
+	free(s);
+    }
+
+    return 0;
+}
+

cluster_slave.c

@@ -1,5 +1,5 @@
 // L2TPNS Cluster Master
-// $Id: cluster_slave.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: cluster_slave.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <netinet/in.h>
@@ -19,16 +19,13 @@
 #include "ll.h"
 #include "util.h"
 
+// vim: sw=4 ts=8
+
 extern int cluster_sockfd;
-extern tunnelt *tunnel;
-extern sessiont *session;
-extern uint32_t cluster_address;
 extern char hostname[1000];
-extern int debug;
 extern ippoolt *ip_address_pool;
 extern uint32_t vip_address;
-extern tunnelidt tunnelfree;
+extern struct configt *config;
-extern sessionidt sessionfree;
 
 int handle_tunnel(char *buf, int l);
 int handle_session(char *buf, int l);
@@ -78,6 +75,13 @@ int handle_tunnel(char *buf, int l)
 {
     int t;
 
+    // Ignore tunnel message if NOSTATEFILE exists
+    if (config->ignore_cluster_updates)
+    {
+	log(1, 0, 0, 0, "Discarding tunnel message from cluster master.\n", l, sizeof(tunnelt));
+	return 0;
+    }
+
     t = *(int *)buf;
     log(1, 0, 0, t, "Receiving tunnel %d from cluster master (%d bytes)\n", t, l);
     buf += sizeof(int); l -= sizeof(int);
@@ -94,16 +98,6 @@ int handle_tunnel(char *buf, int l)
 	return 0;
     }
 
-    if (t > 1)
-    {
-	tunnel[t-1].next = tunnel[t].next;
-    }
-
-    if (tunnelfree == t)
-    {
-	tunnelfree = tunnel[t].next;
-    }
-
     memcpy(&tunnel[t], buf, l);
     log(3, 0, 0, t, "Cluster master sent tunnel for %s\n", tunnel[t].hostname);
 
@@ -117,6 +111,13 @@ int handle_session(char *buf, int l)
 {
     int s;
 
+    // Ignore tunnel message if NOSTATEFILE exists
+    if (config->ignore_cluster_updates)
+    {
+	log(1, 0, 0, 0, "Discarding session message from cluster master.\n", l, sizeof(tunnelt));
+	return 0;
+    }
+
     s = *(int *)buf;
     log(1, 0, s, 0, "Receiving session %d from cluster master (%d bytes)\n", s, l);
     buf += sizeof(int); l -= sizeof(int);
@@ -163,6 +164,10 @@ int handle_session(char *buf, int l)
 	    }
 	}
     }
+    /*
+    if (session[s].servicenet)
+	servicenet_session(s, 1);
+    */
     return 0;
 }
 
@@ -214,7 +219,7 @@ int cluster_send_session(int s)
 	memcpy((char *)(packet + len), &session[s], sizeof(sessiont));
 	len += sizeof(sessiont);
 
-	cluster_send_message(cluster_address, vip_address, C_SESSION, packet, len);
+	cluster_send_message(config->cluster_address, vip_address, C_SESSION, packet, len);
 	free(packet);
 
 	return 1;
@@ -241,7 +246,27 @@ int cluster_send_tunnel(int t)
 	memcpy((char *)(packet + len), &tunnel[t], sizeof(tunnelt));
 	len += sizeof(tunnelt);
 
-	cluster_send_message(cluster_address, vip_address, C_TUNNEL, packet, len);
+	cluster_send_message(config->cluster_address, vip_address, C_TUNNEL, packet, len);
+	free(packet);
+
+	return 1;
+}
+
+int cluster_send_goodbye()
+{
+	char *packet;
+	int len = 0;
+
+	packet = malloc(4096);
+
+	log(2, 0, 0, 0, "Sending goodbye to cluster master\n");
+	// Hostname
+	len = strlen(hostname);
+	*(char *)packet = len;
+	memcpy((char *)(packet + 1), hostname, len);
+	len++;
+
+	cluster_send_message(config->cluster_address, vip_address, C_GOODBYE, packet, len);
 	free(packet);
 
 	return 1;

garden.c

@@ -10,43 +10,43 @@
 int __plugin_api_version = 1;
 struct pluginfuncs p;
 
-int garden_session(sessiont *s, int flag);
-
 char *init_commands[] = {
 	// This is for incoming connections to a gardened user
 	"iptables -t nat -N garden_users 2>&1 >/dev/null",
-	"iptables -t nat -F garden_users 2>&1 >/dev/null",
+	"iptables -t nat -F garden_users",
-	"iptables -t nat -N garden 2>&1 >/dev/null",
+	"iptables -t nat -N garden 2>&1", /* Don't flush - init script sets this up */
 	"iptables -t nat -A l2tpns -j garden_users",
 	NULL
 };
 
 char *done_commands[] = {
 	"iptables -t nat -F garden_users 2>&1 >/dev/null",
-	"iptables -t nat -D l2tpns -j garden_users 2>&1 >/dev/null",
+	"iptables -t nat -D l2tpns -j garden_users",
 	NULL
 };
 
+int garden_session(sessiont *s, int flag);
+
 int plugin_post_auth(struct param_post_auth *data)
 {
 	// Ignore if user authentication was successful
 	if (data->auth_allowed) return PLUGIN_RET_OK;
 
-	p.log(3, 0, 0, 0, "User allowed into walled garden\n");
+	p.log(3, 0, 0, 0, "Walled Garden allowing login\n");
 	data->auth_allowed = 1;
-	data->s->walled_garden = 1;
+	data->s->garden = 1;
 	return PLUGIN_RET_OK;
 }
 
 int plugin_new_session(struct param_new_session *data)
 {
-	if (data->s->walled_garden) garden_session(data->s, 1);
+	if (data->s->garden) garden_session(data->s, 1);
 	return PLUGIN_RET_OK;
 }
 
 int plugin_kill_session(struct param_new_session *data)
 {
-	if (data->s->walled_garden) garden_session(data->s, 0);
+	if (data->s->garden) garden_session(data->s, 0);
 	return PLUGIN_RET_OK;
 }
 
@@ -58,10 +58,7 @@ int plugin_control(struct param_control *data)
 	if (data->type != PKT_GARDEN && data->type != PKT_UNGARDEN) return PLUGIN_RET_OK;
 	if (!data->data && data->data_length) return PLUGIN_RET_OK;
 	session = atoi((char*)(data->data));
-
+	if (!session) return PLUGIN_RET_OK; // Really?
-	if (!session)
-		return PLUGIN_RET_OK;
-
 	data->send_response = 1;
 	s = p.get_session_by_id(session);
 	if (!s || !s->ip)
@@ -86,11 +83,6 @@ int plugin_control(struct param_control *data)
 	return PLUGIN_RET_STOP;
 }
 
-int plugin_config(struct param_config *data)
-{
-	return PLUGIN_RET_OK;
-}
-
 int garden_session(sessiont *s, int flag)
 {
 	char cmd[2048];
@@ -98,25 +90,48 @@ int garden_session(sessiont *s, int flag)
 	if (!s) return 0;
 	if (!s->opened) return 0;
 
+	/* Note that we don't handle throttling/snooping/etc here
+	 * To do that, we'd need to send an end accounting record
+	 * then a radius auth, then start accouting again.
+	 * That means that we need the password (which garden has)
+	 * and a lot of code to check that the new set of params
+	 * (routes, IP, ACLs, etc) 'matched' the old one in a
+	 * 'compatable' way. (ie user's system doesn't need to be told
+	 * of the change)
+	 *
+	 * Thats a lot of pain/code for very little gain.
+	 * If we want them redone from scratch, just sessionkill them -
+	 * a user on garden isn't going to have any open TCP
+	 * connections which are worth caring about, anyway.
+	 *
+	 * Note that the user will be rethrottled shortly by the scan
+	 * script thingy if appropriate.
+	 *
+	 * Currently, garden only directly ungardens someone if
+	 * they haven't paid their bill, and then subsequently do so
+	 * online. This isn't something which can be set up by a malicious
+	 * customer at will.
+	 */
 	if (flag == 1)
 	{
+		// Gardened User
 		p.log(2, 0, 0, s->tunnel, "Trap user %s (%s) in walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
 		snprintf(cmd, 2048, "iptables -t nat -A garden_users -s %s -j garden", p.inet_toa(ntohl(s->ip)));
 		p.log(3, 0, 0, s->tunnel, "%s\n", cmd);
 		system(cmd);
-		s->walled_garden = 1;
+		s->garden = 1;
 	}
 	else
 	{
 		sessionidt other;
-		int count = 10;
+		int count = 40;
 
 		// Normal User
 		p.log(2, 0, 0, s->tunnel, "Release user %s (%s) from walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
 		// Kick off any duplicate usernames
 		// but make sure not to kick off ourself
 		if (s->ip && !s->die && (other = p.get_session_by_username(s->user)) && s != p.get_session_by_id(other)) {
-			p.sessionkill(other, "Duplicate session when user ungardened");
+			p.sessionkill(other, "Duplicate session when user un-gardened");
 		}
 		/* Clean up counters */
 		s->cin = s->cout = 0;
@@ -130,7 +145,7 @@ int garden_session(sessiont *s, int flag)
 			if (WEXITSTATUS(status) != 0) break;
 		}
 
-		s->walled_garden = 0;
+		s->garden = 0;
 
 		if (!s->die) {
 			/* OK, we're up! */
@@ -138,7 +153,7 @@ int garden_session(sessiont *s, int flag)
 			p.radiussend(r, RADIUSSTART);
 		}
 	}
-	s->walled_garden = flag;
+	s->garden = flag;
 	return 1;
 }
 
@@ -149,11 +164,9 @@ int plugin_init(struct pluginfuncs *funcs)
 	if (!funcs) return 0;
 	memcpy(&p, funcs, sizeof(p));
 
-	p.log(1, 0, 0, 0, "Enabling walled garden service\n");
-
 	for (i = 0; init_commands[i] && *init_commands[i]; i++)
 	{
-		p.log(4, 0, 0, 0, "Running %s\n", init_commands[i]);
+		p.log(3, 0, 0, 0, "Running %s\n", init_commands[i]);
 		system(init_commands[i]);
 	}
 
@@ -165,7 +178,7 @@ void plugin_done()
 	int i;
 	for (i = 0; done_commands[i] && *done_commands[i]; i++)
 	{
-		p.log(4, 0, 0, 0, "Running %s\n", done_commands[i]);
+		p.log(3, 0, 0, 0, "Running %s\n", done_commands[i]);
 		system(done_commands[i]);
 	}
 }

icmp.c

@@ -0,0 +1,86 @@
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <linux/ip.h>
+#include <linux/icmp.h>
+#include <stdio.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <memory.h>
+#include "l2tpns.h"
+
+extern ipt myip;
+
+__u16 _checksum(unsigned char *addr, int count);
+
+void host_unreachable(ipt destination, u16 id, ipt source, char *packet, int packet_len)
+{
+	char buf[128] = {0};
+	struct iphdr *iph;
+	struct icmphdr *icmp;
+	char *data;
+	int len = 0, on = 1, icmp_socket;
+	struct sockaddr_in whereto = {0};
+
+	if (!(icmp_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)))
+		return;
+	setsockopt(icmp_socket, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on));
+
+	whereto.sin_addr.s_addr = destination;
+	whereto.sin_family = AF_INET;
+
+	iph = (struct iphdr *)(buf);
+	len = sizeof(struct iphdr);
+	icmp = (struct icmphdr *)(buf + len);
+	len += sizeof(struct icmphdr);
+	data = (char *)(buf + len);
+	len += (packet_len < 64) ? packet_len : 64;
+	memcpy(data, packet, (packet_len < 64) ? packet_len : 64);
+
+	iph->tos = 0;
+	iph->id = id;
+	iph->frag_off = 0;
+	iph->ttl = 30;
+	iph->check = 0;
+	iph->version = 4;
+	iph->ihl = 5;
+	iph->protocol = 1;
+	iph->check = 0;
+	iph->daddr = destination;
+	iph->saddr = source;
+
+	iph->tot_len = ntohs(len);
+
+	icmp->type = ICMP_DEST_UNREACH;
+	icmp->code = ICMP_HOST_UNREACH;
+	icmp->checksum = _checksum((char *)icmp, sizeof(struct icmphdr) + ((packet_len < 64) ? packet_len : 64));
+
+	iph->check = _checksum((char *)iph, sizeof(struct iphdr));
+
+	sendto(icmp_socket, (char *)buf, len, 0, (struct sockaddr *)&whereto, sizeof(struct sockaddr));
+	close(icmp_socket);
+}
+
+__u16 _checksum(unsigned char *addr, int count)
+{
+	register long sum = 0;
+
+	for (; count > 1; count -= 2)
+	{
+		sum += ntohs(*(u32 *)addr);
+		addr += 2;
+	}
+
+	if (count > 1) sum += *(unsigned char *)addr;
+
+	// take only 16 bits out of the 32 bit sum and add up the carries
+	while (sum >> 16)
+		sum = (sum & 0xFFFF) + (sum >> 16);
+
+	// one's complement the result
+	sum = ~sum;
+
+	return htons((u16) sum);
+}

l2tpns.h

@@ -1,12 +1,11 @@
 // L2TPNS Global Stuff
-// $Id: l2tpns.h,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: l2tpns.h,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <netinet/in.h>
 #include <stdio.h>
-
 #include "config.h"
 
-#define VERSION	"1.0"
+#define VERSION	"1.1.0"
 
 // Limits
 #define MAXTUNNEL	500		// could be up to 65535
@@ -15,6 +14,7 @@
 #define	MAXCONTROL	1000		// max length control message we ever send...
 #define	MAXETHER	(1500+18)	// max packet we try sending to tap
 #define	MAXTEL		96		// telephone number
+#define MAXPLUGINS	20		// maximum number of plugins to load
 #define MAXRADSERVER	10		// max radius servers
 #define	MAXROUTE	10		// max static routes per session
 #define MAXIPPOOL	131072		// max number of ip addresses in pool
@@ -27,17 +27,17 @@
 #define STATISTICS
 #define STAT_CALLS
 #define RINGBUFFER
-#define	UDP		17
 #define TAPDEVICE	"/dev/net/tun"
-#define CLIUSERS	ETCDIR "l2tpns.users"	// CLI Users file
+#define	UDP		17
-#define CONFIGFILE	ETCDIR "l2tpns.cfg"	// Configuration file
+#define HOMEDIR		"/home/l2tpns/"			// Base dir for data
-#define IPPOOLFILE	ETCDIR "l2tpns.ip_pool"	// Address pool configuration
 #define STATEFILE	"/tmp/l2tpns.dump"		// State dump file
-
+#define NOSTATEFILE	"/tmp/l2tpns.no_state_reload"	// If exists, state will not be reloaded
+#define CONFIGFILE	ETCDIR "l2tpns.cfg"	// Configuration file
+#define CLIUSERS	ETCDIR "l2tpns.users"		// CLI Users file
+#define IPPOOLFILE	ETCDIR "l2tpns.ip_pool"		// Address pool configuration
 #ifndef LIBDIR
 #define LIBDIR		"/usr/lib/l2tpns"
 #endif
-
 #define ACCT_TIME	3000		// 5 minute accounting interval
 #define	L2TPPORT	1701		// L2TP port
 #define RADPORT		1645		// old radius port...
@@ -52,20 +52,20 @@
 #define	PPPCCP		0x80FD
 #define PPPIP		0x0021
 #define PPPMP		0x003D
-#define ConfigReq	1
+enum
-#define ConfigAck	2
+{
-#define ConfigNak	3
+	ConfigReq = 1,
-#define ConfigRej	4
+	ConfigAck,
-#define TerminateReq	5
+	ConfigNak,
-#define TerminateAck	6
+	ConfigRej,
-#define CodeRej		7
+	TerminateReq,
-#define ProtocolRej	8
+	TerminateAck,
-#define EchoReq		9
+	CodeRej,
-#define EchoReply	10
+	ProtocolRej,
-#define DiscardRequest	11
+	EchoReq,
-
+	EchoReply,
-#undef TC_TBF
+	DiscardRequest
-#define TC_HTB
+};
 
 // Types
 typedef unsigned short u16;
@@ -78,6 +78,9 @@ typedef u16 tunnelidt;
 typedef u32 clockt;
 typedef u8 hasht[16];
 
+// dump header: update number if internal format changes
+#define DUMP_MAGIC "L2TPNS#" VERSION "#"
+
 // structures
 typedef struct routes           // route
 {
@@ -110,12 +113,15 @@ typedef struct sessions
 	sessionidt far;			// far end session ID
 	tunnelidt tunnel;		// tunnel ID
 	ipt ip;				// IP of session set by RADIUS response
+	int ip_pool_index;		// index to IP pool
 	unsigned long sid;		// session id for hsddb
 	u16 nr;				// next receive
 	u16 ns;				// next send
 	u32 magic;			// ppp magic number
 	u32 cin, cout;			// byte counts
 	u32 pin, pout;			// packet counts
+	u32 total_cin;			// This counter is never reset while a session is open
+	u32 total_cout;			// This counter is never reset while a session is open
 	u32 id;				// session id
 	clockt opened;			// when started
 	clockt die;			// being closed, when to finally free
@@ -126,7 +132,7 @@ typedef struct sessions
 	u8 flags;			// various bit flags
 	u8 snoop;			// are we snooping this session?
 	u8 throttle;			// is this session throttled?
-	u8 walled_garden;	// is this session stuck in the walled garden?
+	u8 servicenet;			// is this session servicenetted?
 	u16 mru;			// maximum receive unit
 	u16 tbf;			// filter bucket for throttling
 	char random_vector[MAXTEL];
@@ -145,16 +151,17 @@ sessiont;
 // 168 bytes per tunnel
 typedef struct tunnels
 {
-	tunnelidt next;		// next tunnel in linked list
 	tunnelidt far;		// far end tunnel ID
 	ipt ip;			// Ip for far end
 	portt port;		// port for far end
 	u16 window;		// Rx window
 	u16 nr;			// next receive
 	u16 ns;			// next send
+	int state;		// current state (tunnelstate enum)
 	clockt last;		// when last control message sent (used for resend timeout)
 	clockt retry;		// when to try resenting pending control
 	clockt die;		// being closed, when to finally free
+	clockt lastrec;		// when the last control message was received
 	char hostname[128];	// tunnel hostname
 	char vendor[128];	// LAC vendor
 	u8 try;			// number of retrys on a control message
@@ -167,10 +174,9 @@ tunnelt;
 // 180 bytes per radius session
 typedef struct radiuss          // outstanding RADIUS requests
 {
-	u8 next;               // next in free list
 	sessionidt session;          // which session this applies to
 	hasht auth;               // request authenticator
-	clockt retry;              // ehwne to try next
+	clockt retry;              // when to try next
 	char calling[MAXTEL];    // calling number
 	char pass[129];          // password
 	u8 id;                 // ID for PPP response
@@ -184,6 +190,8 @@ typedef struct
 {
 	ipt	address;
 	char	assigned;	// 1 if assigned, 0 if free
+	clockt	last;		// last used
+	char	user[129];      // user (try to have ip addresses persistent)
 }
 ippoolt;
 
@@ -202,6 +210,18 @@ struct Tringbuffer
 };
 #endif
 
+/*
+ * Possible tunnel states
+ * TUNNELFREE -> TUNNELOPEN -> TUNNELDIE -> TUNNELFREE
+ */
+enum
+{
+	TUNNELFREE,		// Not in use
+	TUNNELOPEN,		// Active tunnel
+	TUNNELDIE,		// Currently closing
+	TUNNELOPENING		// Busy opening
+};
+
 enum
 {
 	RADIUSNULL,             // Not in use
@@ -297,6 +317,49 @@ struct Tstats
 #define SET_STAT(x, y)
 #endif
 
+struct configt
+{
+	int		debug;				// debugging level
+	time_t		start_time;			// time when l2tpns was started
+	char		bandwidth[256];			// current bandwidth
+
+	char		config_file[128];
+	int		reload_config;			// flag to re-read config (set by cli)
+
+	char		tapdevice[10];			// tap device name
+	char		log_filename[128];
+	char		l2tpsecret[64];
+
+	char		radiussecret[64];
+	int		radius_accounting;
+	ipt		radiusserver[MAXRADSERVER];	// radius servers
+	u8		numradiusservers;		// radius server count
+
+	ipt		default_dns1, default_dns2;
+
+	ipt		snoop_destination_host;
+	u16		snoop_destination_port;
+
+	unsigned long	rl_rate;
+	int		save_state;
+	uint32_t	cluster_address;
+	int		ignore_cluster_updates;
+	char		accounting_dir[128];
+	ipt		bind_address;
+	int		target_uid;
+	int		dump_speed;
+	char		plugins[64][MAXPLUGINS];
+	char		old_plugins[64][MAXPLUGINS];
+};
+
+struct config_descriptt
+{
+	char *key;
+	int offset;
+	int size;
+	enum { INT, STRING, UNSIGNED_LONG, SHORT, BOOL, IP } type;
+};
+
 // arp.c
 void sendarp(int ifr_idx, const unsigned char* mac, ipt ip);
 
@@ -321,6 +384,7 @@ void radiussend(u8 r, u8 state);
 void processrad(u8 *buf, int len);
 void radiusretry(u8 r);
 u8 radiusnew(sessionidt s);
+void radiusclear(u8 r, sessionidt s);
 
 // throttle.c
 int throttle_session(sessionidt s, int throttle);
@@ -343,7 +407,6 @@ void initudp(void);
 void initdata(void);
 void initippool();
 sessionidt sessionbyip(ipt ip);
-/* NB - sessionbyuser ignores walled garden'd sessions */
 sessionidt sessionbyuser(char *username);
 void sessionshutdown(sessionidt s, char *reason);
 void sessionsendarp(sessionidt s);
@@ -365,14 +428,14 @@ void processarp(u8 * buf, int len);
 void processudp(u8 * buf, int len, struct sockaddr_in *addr);
 void processtap(u8 * buf, int len);
 void processcontrol(u8 * buf, int len, struct sockaddr_in *addr);
-ipt assign_ip_address();
+int assign_ip_address(sessionidt s);
-void free_ip_address(ipt address);
+void free_ip_address(sessionidt s);
 void snoop_send_packet(char *packet, u16 size);
 void dump_acct_info();
 void mainloop(void);
 #define log _log
 #ifndef log_hex
-#define log_hex(a,b,c,d) do{if (a <= debug) _log_hex(a,0,0,0,b,c,d);}while (0)
+#define log_hex(a,b,c,d) do{if (a <= config->debug) _log_hex(a,0,0,0,b,c,d);}while (0)
 #endif
 void _log(int level, ipt address, sessionidt s, tunnelidt t, const char *format, ...);
 void _log_hex(int level, ipt address, sessionidt s, tunnelidt t, const char *title, const char *data, int maxsize);
@@ -380,10 +443,10 @@ void build_chap_response(char *challenge, u8 id, u16 challenge_length, char **ch
 int sessionsetup(tunnelidt t, sessionidt s, u8 routes);
 int cluster_send_session(int s);
 int cluster_send_tunnel(int t);
-#ifdef HAVE_LIBCLI
+int cluster_send_goodbye();
 void init_cli();
+void cli_do_file(FILE *fh);
 void cli_do(int sockfd);
-#endif
 #ifdef RINGBUFFER
 void ringbuffer_dump(FILE *stream);
 #endif
@@ -391,3 +454,9 @@ void initplugins();
 int run_plugins(int plugin_type, void *data);
 void add_plugin(char *plugin_name);
 void remove_plugin(char *plugin_name);
+void tunnelclear(tunnelidt t);
+void host_unreachable(ipt destination, u16 id, ipt source, char *packet, int packet_len);
+
+extern tunnelt *tunnel;
+extern sessiont *session;
+#define sessionfree (session[0].next)

ll.c

@@ -1,5 +1,5 @@
 // L2TPNS Linked List Stuff
-// $Id: ll.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: ll.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <sys/file.h>

md5.h

@@ -1,8 +1,6 @@
 /* GLOBAL.H - RSAREF types and constants
  */
 
-#include "config.h"
-
 /* PROTOTYPES should be set to one if and only if the compiler supports
   function argument prototyping.
 The following makes PROTOTYPES default to 0 if it has not already

nsctl.c

@@ -96,7 +96,7 @@ int main(int argc, char *argv[])
 			}
 			for (p = 0; p < commands[i].params; p++)
 			{
-				strncpy((packet + len), argv[p + 3], 1400 - len);
+				strncpy((packet + len), argv[p + 3], 1400 - len - 1);
 				len += strlen(argv[p + 3]) + 1;
 			}
 			break;

plugin.h

@@ -4,16 +4,18 @@
 #define PLUGIN_API_VERSION	1
 #define MAX_PLUGIN_TYPES	30
 
-#define PLUGIN_PRE_AUTH		1
+enum
-#define PLUGIN_POST_AUTH	2
+{
-#define PLUGIN_PACKET_RX	3
+	PLUGIN_PRE_AUTH = 1,
-#define PLUGIN_PACKET_TX	4
+	PLUGIN_POST_AUTH,
-#define PLUGIN_TIMER		5
+	PLUGIN_PACKET_RX,
-#define PLUGIN_CONFIG		6
+	PLUGIN_PACKET_TX,
-#define PLUGIN_NEW_SESSION	7
+	PLUGIN_TIMER,
-#define PLUGIN_KILL_SESSION	8
+	PLUGIN_NEW_SESSION,
-#define PLUGIN_CONTROL		9
+	PLUGIN_KILL_SESSION,
-#define PLUGIN_RADIUS_RESPONSE	10
+	PLUGIN_CONTROL,
+	PLUGIN_RADIUS_RESPONSE
+};
 
 #define PLUGIN_RET_ERROR	0
 #define PLUGIN_RET_OK		1

ppp.c

@@ -1,5 +1,5 @@
 // L2TPNS PPP Stuff
-// $Id: ppp.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: ppp.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <string.h>
@@ -11,16 +11,15 @@
 #include "plugin.h"
 #include "util.h"
 
-extern char debug;
 extern tunnelt *tunnel;
 extern sessiont *session;
 extern radiust *radius;
-extern u16 tapmac[3];
 extern int tapfd;
 extern char hostname[1000];
 extern struct Tstats *_statistics;
 extern unsigned long eth_tx;
 extern time_t time_now;
+extern struct configt *config;
 
 // Process PAP messages
 void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
@@ -77,7 +76,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
 		p[4] = 0;               // no message
 		if (session[s].ip)
 		{
-		    log(3, session[s].ip, s, t, "%d Already an IP allocated: %s (%d)\n", getpid(), inet_toa(htonl(session[s].ip)), session[s].ip);
+		    log(3, session[s].ip, s, t, "%d Already an IP allocated: %s (%d)\n", getpid(), inet_toa(htonl(session[s].ip)), session[s].ip_pool_index);
 		}
 		else
 		{
@@ -101,8 +100,8 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
 			return;
 		}
 
-		strncpy(session[s].user, packet.username, sizeof(session[s].user));
+		strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
-		strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass));
+		strncpy(radius[r].pass, packet.password, sizeof(radius[r].pass) - 1);
 
 		free(packet.username);
 		free(packet.password);
@@ -180,7 +179,7 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
 			return;
 		}
 
-		strncpy(session[s].user, packet.username, sizeof(session[s].user));
+		strncpy(session[s].user, packet.username, sizeof(session[s].user) - 1);
 		memcpy(radius[r].pass, packet.password, 16);
 
 		free(packet.username);
@@ -408,7 +407,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
 		*p = EchoReply;      // reply
 		*(u32 *) (p + 4) = htonl(session[s].magic); // our magic number
 		q = makeppp(b, p, l, t, s, PPPLCP);
-		log(3, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
+		log(4, session[s].ip, s, t, "LCP: Received EchoReq. Sending EchoReply\n");
 		tunnelsend(b, l + (q - b), t); // send it
 	}
 	else if (*p == EchoReply)
@@ -439,7 +438,7 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
 	if (*p == ConfigAck)
 	{                          // happy with our IPCP
 		u8 r = session[s].radius;
-		if ((!r || radius[r].state == RADIUSIPCP) && !session[s].walled_garden)
+		if ((!r || radius[r].state == RADIUSIPCP) && !session[s].servicenet)
 			if (!r)
 				r = radiusnew(s);
 			if (r)
@@ -552,6 +551,7 @@ void processipin(tunnelidt t, sessionidt s, u8 * p, u16 l)
 	}
 
 	session[s].cin += l;
+	session[s].total_cin += l;
 	session[s].pin++;
 	eth_tx += l;
 

radius.c

@@ -1,5 +1,5 @@
 // L2TPNS Radius Stuff
-// $Id: radius.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: radius.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <time.h>
 #include <stdio.h>
@@ -16,20 +16,13 @@
 #include "plugin.h"
 #include "util.h"
 
-extern char *radiussecret;
 extern radiust *radius;
 extern sessiont *session;
 extern tunnelt *tunnel;
-extern ipt radiusserver[MAXRADSERVER]; // radius servers
 extern u32 sessionid;
-extern u8 radiusfree;
 extern int radfd;
-extern u8 numradiusservers;
-extern char debug;
-extern unsigned long default_dns1, default_dns2;
 extern struct Tstats *_statistics;
-extern int radius_accounting;
+extern struct configt *config;
-extern uint32_t bind_address;
 
 const char *radius_state(int state)
 {
@@ -51,27 +44,35 @@ void initrad(void)
 
 void radiusclear(u8 r, sessionidt s)
 {
-	radius[r].state = RADIUSNULL;
 	if (s) session[s].radius = 0;
-	memset(&radius[r], 0, sizeof(radius[r]));
+	memset(&radius[r], 0, sizeof(radius[r])); // radius[r].state = RADIUSNULL;
-	radius[r].next = radiusfree;
+}
-	radiusfree = r;
+
+static u8 new_radius()
+{
+	u8 i;
+	for (i = 1; i < MAXRADIUS; i++)
+	{
+		if (radius[i].state == RADIUSNULL)
+			return i;
+	}
+	log(0, 0, 0, 0, "Can't find a free radius session! This could be bad!\n");
+	return 0;
 }
 
 u8 radiusnew(sessionidt s)
 {
 	u8 r;
-	if (!radiusfree)
+	if (!(r = new_radius()))
 	{
 		log(1, 0, s, session[s].tunnel, "No free RADIUS sessions\n");
 		STAT(radius_overflow);
 		return 0;
 	};
-	r = radiusfree;
-	session[s].radius = r;
-	radiusfree = radius[r].next;
 	memset(&radius[r], 0, sizeof(radius[r]));
+	session[s].radius = r;
 	radius[r].session = s;
+	radius[r].state = RADIUSWAIT;
 	return r;
 }
 
@@ -87,19 +88,19 @@ void radiussend(u8 r, u8 state)
 #ifdef STAT_CALLS
 	STAT(call_radiussend);
 #endif
-	if (!numradiusservers)
-	{
-		log(0, 0, 0, 0, "No RADIUS servers\n");
-		return;
-	}
-	if (!radiussecret)
-	{
-		log(0, 0, 0, 0, "No RADIUS secret\n");
-		return;
-	}
 	s = radius[r].session;
+	if (!config->numradiusservers)
+	{
+		log(0, 0, s, session[s].tunnel, "No RADIUS servers\n");
+		return;
+	}
+	if (!*config->radiussecret)
+	{
+		log(0, 0, s, session[s].tunnel, "No RADIUS secret\n");
+		return;
+	}
 
-	if (state != RADIUSAUTH && !radius_accounting)
+	if (state != RADIUSAUTH && !config->radius_accounting)
 	{
 		// Radius accounting is turned off
 		radiusclear(r, s);
@@ -111,7 +112,7 @@ void radiussend(u8 r, u8 state)
 	radius[r].state = state;
 	radius[r].retry = backoff(radius[r].try++);
 	log(4, 0, s, session[s].tunnel, "Send RADIUS %d state %s try %d\n", r, radius_state(radius[r].state), radius[r].try);
-	if (radius[r].try > numradiusservers * 2)
+	if (radius[r].try > config->numradiusservers * 2)
 	{
 		if (s)
 		{
@@ -177,7 +178,7 @@ void radiussend(u8 r, u8 state)
 				{
 					MD5_CTX ctx;
 					MD5Init(&ctx);
-					MD5Update(&ctx, radiussecret, strlen(radiussecret));
+					MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
 					if (p)
 						MD5Update(&ctx, pass + p - 16, 16);
 					else
@@ -280,7 +281,7 @@ void radiussend(u8 r, u8 state)
 	// NAS-IP-Address
 	*p = 4;
 	p[1] = 6;
-	*(u32 *)(p + 2) = bind_address;
+	*(u32 *)(p + 2) = config->bind_address;
 	p += p[1];
 
 	// All AVpairs added
@@ -295,14 +296,14 @@ void radiussend(u8 r, u8 state)
 	    MD5Update(&ctx, b, 4);
 	    MD5Update(&ctx, z, 16);
 	    MD5Update(&ctx, b + 20, (p - b) - 20);
-	    MD5Update(&ctx, radiussecret, strlen(radiussecret));
+	    MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
 	    MD5Final(hash, &ctx);
 	    memcpy(b + 4, hash, 16);
 	    memcpy(radius[r].auth, hash, 16);
 	}
 	memset(&addr, 0, sizeof(addr));
 	addr.sin_family = AF_INET;
-	*(u32 *) & addr.sin_addr = htonl(radiusserver[(radius[r].try - 1) % numradiusservers]);
+	*(u32 *) & addr.sin_addr = config->radiusserver[(radius[r].try - 1) % config->numradiusservers];
 	addr.sin_port = htons((state == RADIUSAUTH) ? RADPORT : RADAPORT);
 
 	log_hex(5, "RADIUS Send", b, (p - b));
@@ -348,7 +349,7 @@ void processrad(u8 * buf, int len)
 	MD5Update(&ctx, buf, 4);
 	MD5Update(&ctx, radius[r].auth, 16);
 	MD5Update(&ctx, buf + 20, len - 20);
-	MD5Update(&ctx, radiussecret, strlen(radiussecret));
+	MD5Update(&ctx, config->radiussecret, strlen(config->radiussecret));
 	MD5Final(hash, &ctx);
 	do {
 		if (memcmp(hash, buf + 4, 16))
@@ -534,22 +535,22 @@ void processrad(u8 * buf, int len)
 			// Check for Assign-IP-Address
 			if (!session[s].ip || session[s].ip == 0xFFFFFFFE)
 			{
-				session[s].ip = assign_ip_address();
+				assign_ip_address(s);
 				if (session[s].ip)
 					log(3, 0, s, t, "   No IP allocated by radius. Assigned %s from pool\n",
 							inet_toa(htonl(session[s].ip)));
 				else
 					log(3, 0, s, t, "   No IP allocated by radius. None available in pool\n");
 			}
-			if (!session[s].dns1 && default_dns1)
+			if (!session[s].dns1 && config->default_dns1)
 			{
-				session[s].dns1 = htonl(default_dns1);
+				session[s].dns1 = htonl(config->default_dns1);
-				log(3, 0, s, t, "   Sending dns1 = %s\n", inet_toa(default_dns1));
+				log(3, 0, s, t, "   Sending dns1 = %s\n", inet_toa(config->default_dns1));
 			}
-			if (!session[s].dns2 && default_dns2)
+			if (!session[s].dns2 && config->default_dns2)
 			{
-				session[s].dns2 = htonl(default_dns2);
+				session[s].dns2 = htonl(config->default_dns2);
-				log(3, 0, s, t, "   Sending dns2 = %s\n", inet_toa(default_dns2));
+				log(3, 0, s, t, "   Sending dns2 = %s\n", inet_toa(config->default_dns2));
 			}
 
 			if (session[s].ip)
@@ -612,3 +613,18 @@ void radiusretry(u8 r)
 	}
 }
 
+void radius_clean()
+{
+	int i;
+
+	log(1, 0, 0, 0, "Cleaning radius session array\n");
+
+	for (i = 1; i < MAXRADIUS; i++)
+	{
+		if (radius[i].retry == 0
+				|| !session[radius[i].session].opened
+				|| session[radius[i].session].die
+				|| session[radius[i].session].tunnel == 0)
+			radiusclear(i, 0);
+	}
+}

rl.c

@@ -1,5 +1,5 @@
 // L2TPNS Rate Limiting Stuff
-// $Id: rl.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: rl.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <sys/file.h>
@@ -11,47 +11,30 @@
 #include <malloc.h>
 #include "l2tpns.h"
 
-extern char *radiussecret;
 extern radiust *radius;
 extern sessiont *session;
-extern ipt radiusserver[MAXRADSERVER]; // radius servers
 extern u32 sessionid;
-extern u8 radiusfree;
 extern int radfd;
-extern u8 numradiusservers;
-extern char debug;
-extern char *tapdevice;
 extern tbft *filter_buckets;
+extern struct configt *config;
 
 #define DEVICE "tun0"
 
-unsigned long rl_rate = 0;
 int next_tbf = 1;
 
 void init_rl()
 {
-#ifdef TC_TBF
-    system("tc qdisc del dev " DEVICE " root");
-    system("tc qdisc add dev " DEVICE " root handle 1: cbq avpkt 10000 bandwidth 100mbit");
-    system("tc filter del dev " DEVICE " protocol ip pref 1 fw");
-    system("iptables -t mangle -N throttle 2>&1 > /dev/null");
-    system("iptables -t mangle -F throttle");
-    system("iptables -t mangle -A l2tpns -j throttle");
-#endif
-#ifdef TC_HTB
     char *commands[] = {
 	"tc qdisc add dev " DEVICE " root handle 1: htb default 1",
 	"tc class add dev " DEVICE " parent 1: classid 1:1 htb rate 100mbit burst 300k",
 	"tc filter del dev " DEVICE " protocol ip pref 1 fw",
 	"iptables -t mangle -N throttle 2>&1 >/dev/null",
-	"iptables -t mangle -F throttle",
+	"iptables -t mangle -F throttle 2>&1 >/dev/null",
-	"iptables -t mangle -A l2tpns -j throttle",
+	"iptables -t mangle -A l2tpns -j throttle 2>&1 >/dev/null",
 	NULL
     };
     int i;
 
-    if (!rl_rate) return;
-
     log(2, 0, 0, 0, "Initializing HTB\n");
     for (i = 0; commands[i] && *commands[i]; i++)
     {
@@ -59,41 +42,21 @@ void init_rl()
 	system(commands[i]);
     }
     log(2, 0, 0, 0, "Done initializing HTB\n");
-#endif
 }
 
 u16 rl_create_tbf()
 {
     u16 t;
     char cmd[2048];
-    if (!rl_rate) return 0;
+    if (!config->rl_rate) return 0;
 
     if (next_tbf >= MAXSESSION) return 0;
     t = next_tbf++;
     snprintf(filter_buckets[t].handle, 9, "1:%d0", t);
 
-#ifdef TC_TBF
-    log(2, 0, 0, 0, "Creating new tbf %s\n", filter_buckets[t].handle);
-    snprintf(cmd, 2048, "tc class add dev " DEVICE " parent 1: classid 1:%d cbq bandwidth 100Mbit rate 100Mbit "
-	    "weight 1 prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded isolated",
-	    t);
-    log(3, 0, 0, 0, "%s\n", cmd);
-    system(cmd);
-
-    snprintf(cmd, 2048, "tc qdisc add dev " DEVICE " parent 1:%d handle %s tbf rate %dkbit buffer 1600 limit 3000",
-	    t, filter_buckets[t].handle, rl_rate);
-    log(3, 0, 0, 0, "%s\n", cmd);
-    system(cmd);
-
-    snprintf(cmd, 2048, "tc filter add dev " DEVICE " protocol ip parent 1:0 prio 1 handle %d fw flowid 1:%d",
-	    t, t);
-    log(3, 0, 0, 0, "%s\n", cmd);
-    system(cmd);
-#endif
-#ifdef TC_HTB
     log(2, 0, 0, 0, "Creating new htb %s\n", filter_buckets[t].handle);
     snprintf(cmd, 2048, "tc class add dev " DEVICE " parent 1: classid %s htb rate %lukbit burst 15k",
-	    filter_buckets[t].handle, rl_rate);
+	    filter_buckets[t].handle, config->rl_rate);
     log(3, 0, 0, 0, "%s\n", cmd);
     system(cmd);
 
@@ -101,7 +64,6 @@ u16 rl_create_tbf()
 	    t, filter_buckets[t].handle);
     log(3, 0, 0, 0, "%s\n", cmd);
     system(cmd);
-#endif
 
     next_tbf++;
     return t;
@@ -110,7 +72,7 @@ u16 rl_create_tbf()
 u16 rl_get_tbf()
 {
     int i;
-    if (!rl_rate) return 0;
+    if (!config->rl_rate) return 0;
 
     for (i = 1; i < MAXSESSION; i++)
     {
@@ -129,30 +91,24 @@ u16 rl_get_tbf()
 void rl_done_tbf(u16 t)
 {
     if (!t) return;
-    if (!rl_rate) return;
+    if (!config->rl_rate) return;
-    log(2, 0, 0, 0, "Freeing up TBF %s\n", filter_buckets[t].handle);
+    log(2, 0, 0, 0, "Freeing up HTB %s\n", filter_buckets[t].handle);
     filter_buckets[t].in_use = 0;
 }
 
 void rl_destroy_tbf(u16 t)
 {
     char cmd[2048];
-    if (!rl_rate) return;
+    if (!config->rl_rate) return;
     if (filter_buckets[t].in_use)
     {
-	log(0, 0, 0, 0, "Trying to destroy an in-use TBF %s\n", filter_buckets[t].handle);
+	log(0, 0, 0, 0, "Trying to destroy an in-use HTB %s\n", filter_buckets[t].handle);
 	return;
     }
-#ifdef TC_TBF
     snprintf(cmd, 2048, "tc qdisc del dev " DEVICE " handle %s", filter_buckets[t].handle);
     system(cmd);
-#endif
+    system("iptables -t mangle -D l2tpns -j throttle 2>&1 >/dev/null");
-#ifdef TC_HTB
+    system("iptables -t mangle -X throttle 2>&1 >/dev/null");
-    snprintf(cmd, 2048, "tc qdisc del dev " DEVICE " handle %s", filter_buckets[t].handle);
-    system(cmd);
-#endif
-    system("iptables -t mangle -D l2tpns -j throttle");
-    system("iptables -t mangle -X throttle");
     memset(filter_buckets[t].handle, 0, sizeof(filter_buckets[t].handle));
 }
 

throttle.c

@@ -1,5 +1,5 @@
 // L2TPNS Throttle Stuff
-// $Id: throttle.c,v 1.1 2003-12-16 07:07:39 fred_nerk Exp $
+// $Id: throttle.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
 
 #include <stdio.h>
 #include <sys/file.h>
@@ -16,22 +16,17 @@
 #include "l2tpns.h"
 #include "util.h"
 
-extern char *radiussecret;
 extern radiust *radius;
 extern sessiont *session;
-extern ipt radiusserver[MAXRADSERVER]; // radius servers
 extern u32 sessionid;
-extern u8 radiusfree;
 extern int radfd;
-extern u8 numradiusservers;
-extern char debug;
-extern unsigned long rl_rate;
 extern tbft *filter_buckets;
+extern struct configt *config;
 
 // Throttle or Unthrottle a session
 int throttle_session(sessionidt s, int throttle)
 {
-	if (!rl_rate) return 0;
+	if (!config->rl_rate) return 0;
 
 	if (!*session[s].user)
 		return 0; // User not logged in
@@ -40,9 +35,15 @@ int throttle_session(sessionidt s, int throttle)
 	{
 		// Throttle them
 		char cmd[2048] = {0};
-		log(2, 0, s, session[s].tunnel, "Throttling session %d for user %s\n", s, session[s].user);
 		if (!session[s].tbf) session[s].tbf = rl_get_tbf();
-		snprintf(cmd, 2048, "iptables -t mangle -A throttle -d %s -j MARK --set-mark %d", inet_toa(ntohl(session[s].ip)),
+		if (!session[s].tbf)
+		{
+			log(1, 0, s, session[s].tunnel, "Error creating a filtering bucket for user %s\n", session[s].user);
+			return 0;
+		}
+		log(2, 0, s, session[s].tunnel, "Throttling session %d for user %s\n", s, session[s].user);
+		snprintf(cmd, 2048, "iptables -t mangle -A throttle -d %s -j MARK --set-mark %d",
+				inet_toa(ntohl(session[s].ip)),
 				session[s].tbf);
 		log(4, 0, s, session[s].tunnel, "Running %s\n", cmd);
 		system(cmd);