pppol2tp.c

00001 /**
00002  * @file
00003  * Network Point to Point Protocol over Layer 2 Tunneling Protocol program file.
00004  *
00005  */
00006 
00007 /*
00008  * Redistribution and use in source and binary forms, with or without modification,
00009  * are permitted provided that the following conditions are met:
00010  *
00011  * 1. Redistributions of source code must retain the above copyright notice,
00012  *    this list of conditions and the following disclaimer.
00013  * 2. Redistributions in binary form must reproduce the above copyright notice,
00014  *    this list of conditions and the following disclaimer in the documentation
00015  *    and/or other materials provided with the distribution.
00016  * 3. The name of the author may not be used to endorse or promote products
00017  *    derived from this software without specific prior written permission.
00018  *
00019  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
00020  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
00021  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
00022  * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
00023  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
00024  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
00025  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
00026  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
00027  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
00028  * OF SUCH DAMAGE.
00029  *
00030  * This file is part of the lwIP TCP/IP stack.
00031  *
00032  */
00033 
00034 /*
00035  * L2TP Support status:
00036  *
00037  * Supported:
00038  * - L2TPv2 (PPP over L2TP, a.k.a. UDP tunnels)
00039  * - LAC
00040  *
00041  * Not supported:
00042  * - LNS (require PPP server support)
00043  * - L2TPv3 ethernet pseudowires
00044  * - L2TPv3 VLAN pseudowire
00045  * - L2TPv3 PPP pseudowires
00046  * - L2TPv3 IP encapsulation
00047  * - L2TPv3 IP pseudowire
00048  * - L2TP tunnel switching - http://tools.ietf.org/html/draft-ietf-l2tpext-tunnel-switching-08
00049  * - Multiple tunnels per UDP socket, as well as multiple sessions per tunnel
00050  * - Hidden AVPs
00051  */
00052 
00053 #include "ppp_opts.h"
00054 #if PPP_SUPPORT && PPPOL2TP_SUPPORT /* don't build if not configured for use in ppp_opts.h */
00055 
00056 #include "ppp_impl.h"
00057 #include "lcp.h"
00058 #include "ipcp.h"
00059 #include "pppol2tp.h"
00060 #include "pppcrypt.h"
00061 #include "magic.h"
00062 
00063 /* Memory pool */
00064 PPP_MEMPOOL_DECLARE(PPPOL2TP_PCB, MEMP_NUM_PPPOL2TP_INTERFACES, sizeof(pppol2tp_pcb), "PPPOL2TP_PCB")
00065 
00066 /* callbacks called from PPP core */
00067 static err_t pppol2tp_write(ppp_pcb *ppp, void *ctx, struct pbuf *p);
00068 static err_t pppol2tp_netif_output(ppp_pcb *ppp, void *ctx, struct pbuf *p, u_short protocol);
00069 static err_t pppol2tp_destroy(ppp_pcb *ppp, void *ctx);    /* Destroy a L2TP control block */
00070 static void pppol2tp_connect(ppp_pcb *ppp, void *ctx);    /* Be a LAC, connect to a LNS. */
00071 static void pppol2tp_disconnect(ppp_pcb *ppp, void *ctx);  /* Disconnect */
00072 
00073  /* Prototypes for procedures local to this file. */
00074 static void pppol2tp_input(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
00075 static void pppol2tp_dispatch_control_packet(pppol2tp_pcb *l2tp, u16_t port, struct pbuf *p, u16_t ns, u16_t nr);
00076 static void pppol2tp_timeout(void *arg);
00077 static void pppol2tp_abort_connect(pppol2tp_pcb *l2tp);
00078 static err_t pppol2tp_send_sccrq(pppol2tp_pcb *l2tp);
00079 static err_t pppol2tp_send_scccn(pppol2tp_pcb *l2tp, u16_t ns);
00080 static err_t pppol2tp_send_icrq(pppol2tp_pcb *l2tp, u16_t ns);
00081 static err_t pppol2tp_send_iccn(pppol2tp_pcb *l2tp, u16_t ns);
00082 static err_t pppol2tp_send_zlb(pppol2tp_pcb *l2tp, u16_t ns, u16_t nr);
00083 static err_t pppol2tp_send_stopccn(pppol2tp_pcb *l2tp, u16_t ns);
00084 static err_t pppol2tp_xmit(pppol2tp_pcb *l2tp, struct pbuf *pb);
00085 static err_t pppol2tp_udp_send(pppol2tp_pcb *l2tp, struct pbuf *pb);
00086 
00087 /* Callbacks structure for PPP core */
00088 static const struct link_callbacks pppol2tp_callbacks = {
00089   pppol2tp_connect,
00090 #if PPP_SERVER
00091   NULL,
00092 #endif /* PPP_SERVER */
00093   pppol2tp_disconnect,
00094   pppol2tp_destroy,
00095   pppol2tp_write,
00096   pppol2tp_netif_output,
00097   NULL,
00098   NULL
00099 };
00100 
00101 
00102 /* Create a new L2TP session. */
00103 ppp_pcb *pppol2tp_create(struct netif *pppif,
00104        struct netif *netif, const ip_addr_t *ipaddr, u16_t port,
00105        const u8_t *secret, u8_t secret_len,
00106        ppp_link_status_cb_fn link_status_cb, void *ctx_cb) {
00107   ppp_pcb *ppp;
00108   pppol2tp_pcb *l2tp;
00109   struct udp_pcb *udp;
00110 #if !PPPOL2TP_AUTH_SUPPORT
00111   UNUSED_ARG(secret);
00112   UNUSED_ARG(secret_len);
00113 #endif /* !PPPOL2TP_AUTH_SUPPORT */
00114 
00115   if (ipaddr == NULL) {
00116     goto ipaddr_check_failed;
00117   }
00118 
00119   l2tp = (pppol2tp_pcb *)MEMPOOL_ALLOC(PPPOL2TP_PCB);
00120   if (l2tp == NULL) {
00121     goto memp_malloc_l2tp_failed;
00122   }
00123 
00124   udp = udp_new_ip_type(IP_GET_TYPE(ipaddr));
00125   if (udp == NULL) {
00126     goto udp_new_failed;
00127   }
00128   udp_recv(udp, pppol2tp_input, l2tp);
00129 
00130   ppp = ppp_new(pppif, &pppol2tp_callbacks, l2tp, link_status_cb, ctx_cb);
00131   if (ppp == NULL) {
00132     goto ppp_new_failed;
00133   }
00134 
00135   memset(l2tp, 0, sizeof(pppol2tp_pcb));
00136   l2tp->phase = PPPOL2TP_STATE_INITIAL;
00137   l2tp->ppp = ppp;
00138   l2tp->udp = udp;
00139   l2tp->netif = netif;
00140   ip_addr_copy(l2tp->remote_ip, *ipaddr);
00141   l2tp->remote_port = port;
00142 #if PPPOL2TP_AUTH_SUPPORT
00143   l2tp->secret = secret;
00144   l2tp->secret_len = secret_len;
00145 #endif /* PPPOL2TP_AUTH_SUPPORT */
00146 
00147   return ppp;
00148 
00149 ppp_new_failed:
00150   udp_remove(udp);
00151 udp_new_failed:
00152   MEMPOOL_FREE(PPPOL2TP_PCB, l2tp);
00153 memp_malloc_l2tp_failed:
00154 ipaddr_check_failed:
00155   return NULL;
00156 }
00157 
00158 /* Called by PPP core */
00159 static err_t pppol2tp_write(ppp_pcb *ppp, void *ctx, struct pbuf *p) {
00160   pppol2tp_pcb *l2tp = (pppol2tp_pcb *)ctx;
00161   struct pbuf *ph; /* UDP + L2TP header */
00162   err_t ret;
00163 #if MIB2_STATS
00164   u16_t tot_len;
00165 #else /* MIB2_STATS */
00166   UNUSED_ARG(ppp);
00167 #endif /* MIB2_STATS */
00168 
00169   ph = ppp_memory_buffer_allocate(ppp->netif->memory_manager, (u16_t)(PPPOL2TP_OUTPUT_DATA_HEADER_LEN), PPP_BUF_HEAP);
00170   if(!ph) {
00171     LINK_STATS_INC(link.memerr);
00172     LINK_STATS_INC(link.proterr);
00173     MIB2_STATS_NETIF_INC(ppp->netif, ifoutdiscards);
00174     ppp_memory_buffer_free(p);
00175     return ERR_MEM;
00176   }
00177 
00178   pbuf_remove_header(ph, PPPOL2TP_OUTPUT_DATA_HEADER_LEN); /* hide L2TP header */
00179   pbuf_cat(ph, p);
00180 #if MIB2_STATS
00181   tot_len = ph->tot_len;
00182 #endif /* MIB2_STATS */
00183 
00184   ret = pppol2tp_xmit(l2tp, ph);
00185   if (ret != ERR_OK) {
00186     LINK_STATS_INC(link.err);
00187     MIB2_STATS_NETIF_INC(ppp->netif, ifoutdiscards);
00188     return ret;
00189   }
00190 
00191   MIB2_STATS_NETIF_ADD(ppp->netif, ifoutoctets, (u16_t)tot_len);
00192   MIB2_STATS_NETIF_INC(ppp->netif, ifoutucastpkts);
00193   LINK_STATS_INC(link.xmit);
00194   return ERR_OK;
00195 }
00196 
00197 /* Called by PPP core */
00198 static err_t pppol2tp_netif_output(ppp_pcb *ppp, void *ctx, struct pbuf *p, u_short protocol) {
00199   pppol2tp_pcb *l2tp = (pppol2tp_pcb *)ctx;
00200   struct pbuf *pb;
00201   u8_t *pl;
00202   err_t err;
00203 #if MIB2_STATS
00204   u16_t tot_len;
00205 #else /* MIB2_STATS */
00206   UNUSED_ARG(ppp);
00207 #endif /* MIB2_STATS */
00208 
00209   /* @todo: try to use pbuf_header() here! */
00210   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, PPPOL2TP_OUTPUT_DATA_HEADER_LEN + sizeof(protocol), PPP_BUF_HEAP);
00211   if(!pb) {
00212     LINK_STATS_INC(link.memerr);
00213     LINK_STATS_INC(link.proterr);
00214     MIB2_STATS_NETIF_INC(ppp->netif, ifoutdiscards);
00215     return ERR_MEM;
00216   }
00217 
00218   pbuf_remove_header(pb, PPPOL2TP_OUTPUT_DATA_HEADER_LEN);
00219 
00220   pl = (u8_t*)pb->payload;
00221   PUTSHORT(protocol, pl);
00222 
00223   pbuf_chain(pb, p);
00224 #if MIB2_STATS
00225   tot_len = pb->tot_len;
00226 #endif /* MIB2_STATS */
00227 
00228   if( (err = pppol2tp_xmit(l2tp, pb)) != ERR_OK) {
00229     LINK_STATS_INC(link.err);
00230     MIB2_STATS_NETIF_INC(ppp->netif, ifoutdiscards);
00231     return err;
00232   }
00233 
00234   MIB2_STATS_NETIF_ADD(ppp->netif, ifoutoctets, tot_len);
00235   MIB2_STATS_NETIF_INC(ppp->netif, ifoutucastpkts);
00236   LINK_STATS_INC(link.xmit);
00237   return ERR_OK;
00238 }
00239 
00240 /* Destroy a L2TP control block */
00241 static err_t pppol2tp_destroy(ppp_pcb *ppp, void *ctx) {
00242   pppol2tp_pcb *l2tp = (pppol2tp_pcb *)ctx;
00243   UNUSED_ARG(ppp);
00244 
00245   sys_untimeout(pppol2tp_timeout, l2tp);
00246   udp_remove(l2tp->udp);
00247   MEMPOOL_FREE(PPPOL2TP_PCB, l2tp);
00248   return ERR_OK;
00249 }
00250 
00251 /* Be a LAC, connect to a LNS. */
00252 static void pppol2tp_connect(ppp_pcb *ppp, void *ctx) {
00253   err_t err;
00254   pppol2tp_pcb *l2tp = (pppol2tp_pcb *)ctx;
00255   lcp_options *lcp_wo;
00256   lcp_options *lcp_ao;
00257 #if PPP_IPV4_SUPPORT && VJ_SUPPORT
00258   ipcp_options *ipcp_wo;
00259   ipcp_options *ipcp_ao;
00260 #endif /* PPP_IPV4_SUPPORT && VJ_SUPPORT */
00261 
00262   l2tp->tunnel_port = l2tp->remote_port;
00263   l2tp->our_ns = 0;
00264   l2tp->peer_nr = 0;
00265   l2tp->peer_ns = 0;
00266   l2tp->source_tunnel_id = 0;
00267   l2tp->remote_tunnel_id = 0;
00268   l2tp->source_session_id = 0;
00269   l2tp->remote_session_id = 0;
00270   /* l2tp->*_retried are cleared when used */
00271 
00272   lcp_wo = &ppp->lcp_wantoptions;
00273   lcp_wo->mru = PPPOL2TP_DEFMRU;
00274   lcp_wo->neg_asyncmap = 0;
00275   lcp_wo->neg_pcompression = 0;
00276   lcp_wo->neg_accompression = 0;
00277   lcp_wo->passive = 0;
00278   lcp_wo->silent = 0;
00279 
00280   lcp_ao = &ppp->lcp_allowoptions;
00281   lcp_ao->mru = PPPOL2TP_DEFMRU;
00282   lcp_ao->neg_asyncmap = 0;
00283   lcp_ao->neg_pcompression = 0;
00284   lcp_ao->neg_accompression = 0;
00285 
00286 #if PPP_IPV4_SUPPORT && VJ_SUPPORT
00287   ipcp_wo = &ppp->ipcp_wantoptions;
00288   ipcp_wo->neg_vj = 0;
00289   ipcp_wo->old_vj = 0;
00290 
00291   ipcp_ao = &ppp->ipcp_allowoptions;
00292   ipcp_ao->neg_vj = 0;
00293   ipcp_ao->old_vj = 0;
00294 #endif /* PPP_IPV4_SUPPORT && VJ_SUPPORT */
00295 
00296   /* Listen to a random source port, we need to do that instead of using udp_connect()
00297    * because the L2TP LNS might answer with its own random source port (!= 1701)
00298    */
00299 #if PPP_IPV6_SUPPORT
00300   if (IP_IS_V6_VAL(l2tp->udp->local_ip)) {
00301     udp_bind(l2tp->udp, IP6_ADDR_ANY, 0);
00302   } else
00303 #endif /* PPP_IPV6_SUPPORT */
00304   udp_bind(l2tp->udp, IP_ADDR_ANY, 0);
00305 
00306 #if PPPOL2TP_AUTH_SUPPORT
00307   /* Generate random vector */
00308   if (l2tp->secret != NULL) {
00309     magic_random_bytes(l2tp->secret_rv, sizeof(l2tp->secret_rv));
00310   }
00311 #endif /* PPPOL2TP_AUTH_SUPPORT */
00312 
00313   do {
00314     l2tp->remote_tunnel_id = magic();
00315   } while(l2tp->remote_tunnel_id == 0);
00316   /* save state, in case we fail to send SCCRQ */
00317   l2tp->sccrq_retried = 0;
00318   l2tp->phase = PPPOL2TP_STATE_SCCRQ_SENT;
00319   if ((err = pppol2tp_send_sccrq(l2tp)) != 0) {
00320     PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send SCCRQ, error=%d\n", err));
00321   }
00322   sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00323 }
00324 
00325 /* Disconnect */
00326 static void pppol2tp_disconnect(ppp_pcb *ppp, void *ctx) {
00327   pppol2tp_pcb *l2tp = (pppol2tp_pcb *)ctx;
00328 
00329   l2tp->our_ns++;
00330   pppol2tp_send_stopccn(l2tp, l2tp->our_ns);
00331 
00332   /* stop any timer, disconnect can be called while initiating is in progress */
00333   sys_untimeout(pppol2tp_timeout, l2tp);
00334   l2tp->phase = PPPOL2TP_STATE_INITIAL;
00335   ppp_link_end(ppp); /* notify upper layers */
00336 }
00337 
00338 /* UDP Callback for incoming IPv4 L2TP frames */
00339 static void pppol2tp_input(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) {
00340   pppol2tp_pcb *l2tp = (pppol2tp_pcb*)arg;
00341   u16_t hflags, hlen, len=0, tunnel_id=0, session_id=0, ns=0, nr=0, offset=0;
00342   u8_t *inp;
00343   UNUSED_ARG(pcb);
00344 
00345   /* we can't unbound a UDP pcb, thus we can still receive UDP frames after the link is closed */
00346   if (l2tp->phase < PPPOL2TP_STATE_SCCRQ_SENT) {
00347     goto free_and_return;
00348   }
00349 
00350   if (!ip_addr_cmp(&l2tp->remote_ip, addr)) {
00351     goto free_and_return;
00352   }
00353 
00354   /* discard packet if port mismatch, but only if we received a SCCRP */
00355   if (l2tp->phase > PPPOL2TP_STATE_SCCRQ_SENT && l2tp->tunnel_port != port) {
00356     goto free_and_return;
00357   }
00358 
00359   /* printf("-----------\nL2TP INPUT, %d\n", p->len); */
00360 
00361   /* L2TP header */
00362   if (p->len < sizeof(hflags) + sizeof(tunnel_id) + sizeof(session_id) ) {
00363     goto packet_too_short;
00364   }
00365 
00366   inp = (u8_t*)p->payload;
00367   GETSHORT(hflags, inp);
00368 
00369   if (hflags & PPPOL2TP_HEADERFLAG_CONTROL) {
00370     /* check mandatory flags for a control packet */
00371     if ( (hflags & PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY) != PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY ) {
00372       PPPDEBUG(LOG_DEBUG, ("pppol2tp: mandatory header flags for control packet not set\n"));
00373       goto free_and_return;
00374     }
00375     /* check forbidden flags for a control packet */
00376     if (hflags & PPPOL2TP_HEADERFLAG_CONTROL_FORBIDDEN) {
00377       PPPDEBUG(LOG_DEBUG, ("pppol2tp: forbidden header flags for control packet found\n"));
00378       goto free_and_return;
00379     }
00380   } else {
00381     /* check mandatory flags for a data packet */
00382     if ( (hflags & PPPOL2TP_HEADERFLAG_DATA_MANDATORY) != PPPOL2TP_HEADERFLAG_DATA_MANDATORY) {
00383       PPPDEBUG(LOG_DEBUG, ("pppol2tp: mandatory header flags for data packet not set\n"));
00384       goto free_and_return;
00385     }
00386   }
00387 
00388   /* Expected header size  */
00389   hlen = sizeof(hflags) + sizeof(tunnel_id) + sizeof(session_id);
00390   if (hflags & PPPOL2TP_HEADERFLAG_LENGTH) {
00391     hlen += sizeof(len);
00392   }
00393   if (hflags & PPPOL2TP_HEADERFLAG_SEQUENCE) {
00394     hlen += sizeof(ns) + sizeof(nr);
00395   }
00396   if (hflags & PPPOL2TP_HEADERFLAG_OFFSET) {
00397     hlen += sizeof(offset);
00398   }
00399   if (p->len < hlen) {
00400     goto packet_too_short;
00401   }
00402 
00403   if (hflags & PPPOL2TP_HEADERFLAG_LENGTH) {
00404     GETSHORT(len, inp);
00405     if (p->len < len || len < hlen) {
00406       goto packet_too_short;
00407     }
00408   }
00409   GETSHORT(tunnel_id, inp);
00410   GETSHORT(session_id, inp);
00411   if (hflags & PPPOL2TP_HEADERFLAG_SEQUENCE) {
00412     GETSHORT(ns, inp);
00413     GETSHORT(nr, inp);
00414   }
00415   if (hflags & PPPOL2TP_HEADERFLAG_OFFSET) {
00416     GETSHORT(offset, inp)
00417     if (offset > 4096) { /* don't be fooled with large offset which might overflow hlen */
00418       PPPDEBUG(LOG_DEBUG, ("pppol2tp: strange packet received, offset=%d\n", offset));
00419       goto free_and_return;
00420     }
00421     hlen += offset;
00422     if (p->len < hlen) {
00423       goto packet_too_short;
00424     }
00425     INCPTR(offset, inp);
00426   }
00427 
00428   /* printf("HLEN = %d\n", hlen); */
00429 
00430   /* skip L2TP header */
00431   if (pbuf_remove_header(p, hlen) != 0) {
00432     goto free_and_return;
00433   }
00434 
00435   /* printf("LEN=%d, TUNNEL_ID=%d, SESSION_ID=%d, NS=%d, NR=%d, OFFSET=%d\n", len, tunnel_id, session_id, ns, nr, offset); */
00436   PPPDEBUG(LOG_DEBUG, ("pppol2tp: input packet, len=%"U16_F", tunnel=%"U16_F", session=%"U16_F", ns=%"U16_F", nr=%"U16_F"\n",
00437     len, tunnel_id, session_id, ns, nr));
00438 
00439   /* Control packet */
00440   if (hflags & PPPOL2TP_HEADERFLAG_CONTROL) {
00441     pppol2tp_dispatch_control_packet(l2tp, port, p, ns, nr);
00442     goto free_and_return;
00443   }
00444 
00445   /* Data packet */
00446   if(l2tp->phase != PPPOL2TP_STATE_DATA) {
00447     goto free_and_return;
00448   }
00449   if(tunnel_id != l2tp->remote_tunnel_id) {
00450      PPPDEBUG(LOG_DEBUG, ("pppol2tp: tunnel ID mismatch, assigned=%d, received=%d\n", l2tp->remote_tunnel_id, tunnel_id));
00451      goto free_and_return;
00452   }
00453   if(session_id != l2tp->remote_session_id) {
00454      PPPDEBUG(LOG_DEBUG, ("pppol2tp: session ID mismatch, assigned=%d, received=%d\n", l2tp->remote_session_id, session_id));
00455      goto free_and_return;
00456   }
00457   /*
00458    * skip address & flags if necessary
00459    *
00460    * RFC 2661 does not specify whether the PPP frame in the L2TP payload should
00461    * have a HDLC header or not. We handle both cases for compatibility.
00462    */
00463   if (p->len >= 2) {
00464     GETSHORT(hflags, inp);
00465     if (hflags == 0xff03) {
00466       pbuf_remove_header(p, 2);
00467     }
00468   }
00469   /* Dispatch the packet thereby consuming it. */
00470   ppp_input(l2tp->ppp, p);
00471   return;
00472 
00473 packet_too_short:
00474   PPPDEBUG(LOG_DEBUG, ("pppol2tp: packet too short: %d\n", p->len));
00475 free_and_return:
00476   ppp_memory_buffer_free(p);
00477 }
00478 
00479 /* L2TP Control packet entry point */
00480 static void pppol2tp_dispatch_control_packet(pppol2tp_pcb *l2tp, u16_t port, struct pbuf *p, u16_t ns, u16_t nr) {
00481   u8_t *inp;
00482   u16_t avplen, avpflags, vendorid, attributetype, messagetype=0;
00483   err_t err;
00484 #if PPPOL2TP_AUTH_SUPPORT
00485   MD5_context md5_ctx;
00486   u8_t md5_hash[16];
00487   u8_t challenge_id = 0;
00488 #endif /* PPPOL2TP_AUTH_SUPPORT */
00489 
00490   /* printf("L2TP CTRL INPUT, ns=%d, nr=%d, len=%d\n", ns, nr, p->len); */
00491 
00492   /* Drop unexpected packet */
00493   if (ns != l2tp->peer_ns) {
00494     PPPDEBUG(LOG_DEBUG, ("pppol2tp: drop unexpected packet: received NS=%d, expected NS=%d\n", ns, l2tp->peer_ns));
00495     /*
00496      * In order to ensure that all messages are acknowledged properly
00497      * (particularly in the case of a lost ZLB ACK message), receipt
00498      * of duplicate messages MUST be acknowledged.
00499      *
00500      * In this very special case we Ack a packet we previously received.
00501      * Therefore our NS is the NR we just received. And our NR is the
00502      * NS we just received plus one.
00503      */
00504     if ((s16_t)(ns - l2tp->peer_ns) < 0) {
00505       pppol2tp_send_zlb(l2tp, nr, ns+1);
00506     }
00507     return;
00508   }
00509 
00510   l2tp->peer_nr = nr;
00511 
00512   /* Handle the special case of the ICCN acknowledge */
00513   if (l2tp->phase == PPPOL2TP_STATE_ICCN_SENT && (s16_t)(l2tp->peer_nr - l2tp->our_ns) > 0) {
00514     l2tp->phase = PPPOL2TP_STATE_DATA;
00515     sys_untimeout(pppol2tp_timeout, l2tp);
00516     ppp_start(l2tp->ppp); /* notify upper layers */
00517   }
00518 
00519   /* ZLB packets */
00520   if (p->tot_len == 0) {
00521     return;
00522   }
00523   /* A ZLB packet does not consume a NS slot thus we don't record the NS value for ZLB packets */
00524   l2tp->peer_ns = ns+1;
00525 
00526   p = pbuf_coalesce(p, PBUF_RAW);
00527   inp = (u8_t*)p->payload;
00528   /* Decode AVPs */
00529   while (p->len > 0) {
00530     if (p->len < sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype) ) {
00531       goto packet_too_short;
00532     }
00533     GETSHORT(avpflags, inp);
00534     avplen = avpflags & PPPOL2TP_AVPHEADERFLAG_LENGTHMASK;
00535     /* printf("AVPLEN = %d\n", avplen); */
00536     if (p->len < avplen || avplen < sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype)) {
00537       goto packet_too_short;
00538     }
00539     GETSHORT(vendorid, inp);
00540     GETSHORT(attributetype, inp);
00541     avplen -= sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype);
00542 
00543     /* Message type must be the first AVP */
00544     if (messagetype == 0) {
00545       if (attributetype != 0 || vendorid != 0 || avplen != sizeof(messagetype) ) {
00546         PPPDEBUG(LOG_DEBUG, ("pppol2tp: message type must be the first AVP\n"));
00547         return;
00548       }
00549       GETSHORT(messagetype, inp);
00550       /* printf("Message type = %d\n", messagetype); */
00551       switch(messagetype) {
00552         /* Start Control Connection Reply */
00553         case PPPOL2TP_MESSAGETYPE_SCCRP:
00554           /* Only accept SCCRP packet if we sent a SCCRQ */
00555           if (l2tp->phase != PPPOL2TP_STATE_SCCRQ_SENT) {
00556             goto send_zlb;
00557           }
00558           break;
00559         /* Incoming Call Reply */
00560         case PPPOL2TP_MESSAGETYPE_ICRP:
00561           /* Only accept ICRP packet if we sent a IRCQ */
00562           if (l2tp->phase != PPPOL2TP_STATE_ICRQ_SENT) {
00563             goto send_zlb;
00564           }
00565           break;
00566         /* Stop Control Connection Notification */
00567         case PPPOL2TP_MESSAGETYPE_STOPCCN:
00568           pppol2tp_send_zlb(l2tp, l2tp->our_ns+1, l2tp->peer_ns); /* Ack the StopCCN before we switch to down state */
00569           if (l2tp->phase < PPPOL2TP_STATE_DATA) {
00570             pppol2tp_abort_connect(l2tp);
00571           } else if (l2tp->phase == PPPOL2TP_STATE_DATA) {
00572             /* Don't disconnect here, we let the LCP Echo/Reply find the fact
00573              * that PPP session is down. Asking the PPP stack to end the session
00574              * require strict checking about the PPP phase to prevent endless
00575              * disconnection loops.
00576              */
00577           }
00578           return;
00579         default:
00580           break;
00581       }
00582       goto nextavp;
00583     }
00584 
00585     /* Skip proprietary L2TP extensions */
00586     if (vendorid != 0) {
00587       goto skipavp;
00588     }
00589 
00590     switch (messagetype) {
00591       /* Start Control Connection Reply */
00592       case PPPOL2TP_MESSAGETYPE_SCCRP:
00593        switch (attributetype) {
00594           case PPPOL2TP_AVPTYPE_TUNNELID:
00595             if (avplen != sizeof(l2tp->source_tunnel_id) ) {
00596                PPPDEBUG(LOG_DEBUG, ("pppol2tp: AVP Assign tunnel ID length check failed\n"));
00597                return;
00598             }
00599             GETSHORT(l2tp->source_tunnel_id, inp);
00600             PPPDEBUG(LOG_DEBUG, ("pppol2tp: Assigned tunnel ID %"U16_F"\n", l2tp->source_tunnel_id));
00601             goto nextavp;
00602 #if PPPOL2TP_AUTH_SUPPORT
00603           case PPPOL2TP_AVPTYPE_CHALLENGE:
00604             if (avplen == 0) {
00605                PPPDEBUG(LOG_DEBUG, ("pppol2tp: Challenge length check failed\n"));
00606                return;
00607             }
00608             if (l2tp->secret == NULL) {
00609               PPPDEBUG(LOG_DEBUG, ("pppol2tp: Received challenge from peer and no secret key available\n"));
00610               pppol2tp_abort_connect(l2tp);
00611               return;
00612             }
00613             /* Generate hash of ID, secret, challenge */
00614             MD5_init(&md5_ctx);
00615             MD5_starts(&md5_ctx);
00616             challenge_id = PPPOL2TP_MESSAGETYPE_SCCCN;
00617             MD5_update(&md5_ctx, &challenge_id, 1);
00618             MD5_update(&md5_ctx, l2tp->secret, l2tp->secret_len);
00619             MD5_update(&md5_ctx, inp, avplen);
00620             MD5_finish(&md5_ctx, l2tp->challenge_hash);
00621             MD5_free(&md5_ctx);
00622             l2tp->send_challenge = 1;
00623             goto skipavp;
00624           case PPPOL2TP_AVPTYPE_CHALLENGERESPONSE:
00625             if (avplen != PPPOL2TP_AVPTYPE_CHALLENGERESPONSE_SIZE) {
00626                PPPDEBUG(LOG_DEBUG, ("pppol2tp: AVP Challenge Response length check failed\n"));
00627                return;
00628             }
00629             /* Generate hash of ID, secret, challenge */
00630             MD5_init(&md5_ctx);
00631             MD5_starts(&md5_ctx);
00632             challenge_id = PPPOL2TP_MESSAGETYPE_SCCRP;
00633             MD5_update(&md5_ctx, &challenge_id, 1);
00634             MD5_update(&md5_ctx, l2tp->secret, l2tp->secret_len);
00635             MD5_update(&md5_ctx, l2tp->secret_rv, sizeof(l2tp->secret_rv));
00636             MD5_finish(&md5_ctx, md5_hash);
00637             MD5_free(&md5_ctx);
00638             if ( memcmp(inp, md5_hash, sizeof(md5_hash)) ) {
00639               PPPDEBUG(LOG_DEBUG, ("pppol2tp: Received challenge response from peer and secret key do not match\n"));
00640               pppol2tp_abort_connect(l2tp);
00641               return;
00642             }
00643             goto skipavp;
00644 #endif /* PPPOL2TP_AUTH_SUPPORT */
00645           default:
00646             break;
00647         }
00648         break;
00649       /* Incoming Call Reply */
00650       case PPPOL2TP_MESSAGETYPE_ICRP:
00651         switch (attributetype) {
00652          case PPPOL2TP_AVPTYPE_SESSIONID:
00653             if (avplen != sizeof(l2tp->source_session_id) ) {
00654                PPPDEBUG(LOG_DEBUG, ("pppol2tp: AVP Assign session ID length check failed\n"));
00655                return;
00656             }
00657             GETSHORT(l2tp->source_session_id, inp);
00658             PPPDEBUG(LOG_DEBUG, ("pppol2tp: Assigned session ID %"U16_F"\n", l2tp->source_session_id));
00659             goto nextavp;
00660           default:
00661             break;
00662         }
00663         break;
00664       default:
00665         break;
00666     }
00667 
00668 skipavp:
00669     INCPTR(avplen, inp);
00670 nextavp:
00671     /* printf("AVP Found, vendor=%d, attribute=%d, len=%d\n", vendorid, attributetype, avplen); */
00672     /* next AVP */
00673     if (pbuf_remove_header(p, avplen + sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype)) != 0) {
00674       return;
00675     }
00676   }
00677 
00678   switch(messagetype) {
00679     /* Start Control Connection Reply */
00680     case PPPOL2TP_MESSAGETYPE_SCCRP:
00681       do {
00682         l2tp->remote_session_id = magic();
00683       } while(l2tp->remote_session_id == 0);
00684       l2tp->tunnel_port = port; /* LNS server might have chosen its own local port */
00685       l2tp->icrq_retried = 0;
00686       l2tp->phase = PPPOL2TP_STATE_ICRQ_SENT;
00687       l2tp->our_ns++;
00688       if ((err = pppol2tp_send_scccn(l2tp, l2tp->our_ns)) != 0) {
00689         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send SCCCN, error=%d\n", err));
00690         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00691       }
00692       l2tp->our_ns++;
00693       if ((err = pppol2tp_send_icrq(l2tp, l2tp->our_ns)) != 0) {
00694         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send ICRQ, error=%d\n", err));
00695         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00696       }
00697       sys_untimeout(pppol2tp_timeout, l2tp);
00698       sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00699       break;
00700     /* Incoming Call Reply */
00701     case PPPOL2TP_MESSAGETYPE_ICRP:
00702       l2tp->iccn_retried = 0;
00703       l2tp->phase = PPPOL2TP_STATE_ICCN_SENT;
00704       l2tp->our_ns++;
00705       if ((err = pppol2tp_send_iccn(l2tp, l2tp->our_ns)) != 0) {
00706         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send ICCN, error=%d\n", err));
00707         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00708       }
00709       sys_untimeout(pppol2tp_timeout, l2tp);
00710       sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00711       break;
00712     /* Unhandled packet, send ZLB ACK */
00713     default:
00714       goto send_zlb;
00715   }
00716   return;
00717 
00718 send_zlb:
00719   pppol2tp_send_zlb(l2tp, l2tp->our_ns+1, l2tp->peer_ns);
00720   return;
00721 packet_too_short:
00722   PPPDEBUG(LOG_DEBUG, ("pppol2tp: packet too short: %d\n", p->len));
00723 }
00724 
00725 /* L2TP Timeout handler */
00726 static void pppol2tp_timeout(void *arg) {
00727   pppol2tp_pcb *l2tp = (pppol2tp_pcb*)arg;
00728   err_t err;
00729   u32_t retry_wait;
00730 
00731   PPPDEBUG(LOG_DEBUG, ("pppol2tp: timeout\n"));
00732 
00733   switch (l2tp->phase) {
00734     case PPPOL2TP_STATE_SCCRQ_SENT:
00735       /* backoff wait */
00736       if (l2tp->sccrq_retried < 0xff) {
00737         l2tp->sccrq_retried++;
00738       }
00739       if (!l2tp->ppp->settings.persist && l2tp->sccrq_retried >= PPPOL2TP_MAXSCCRQ) {
00740         pppol2tp_abort_connect(l2tp);
00741         return;
00742       }
00743       retry_wait = PPP_MIN(PPPOL2TP_CONTROL_TIMEOUT * l2tp->sccrq_retried, PPPOL2TP_SLOW_RETRY);
00744       PPPDEBUG(LOG_DEBUG, ("pppol2tp: sccrq_retried=%d\n", l2tp->sccrq_retried));
00745       if ((err = pppol2tp_send_sccrq(l2tp)) != 0) {
00746         l2tp->sccrq_retried--;
00747         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send SCCRQ, error=%d\n", err));
00748         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00749       }
00750       sys_timeout(retry_wait, pppol2tp_timeout, l2tp);
00751       break;
00752 
00753     case PPPOL2TP_STATE_ICRQ_SENT:
00754       l2tp->icrq_retried++;
00755       if (l2tp->icrq_retried >= PPPOL2TP_MAXICRQ) {
00756         pppol2tp_abort_connect(l2tp);
00757         return;
00758       }
00759       PPPDEBUG(LOG_DEBUG, ("pppol2tp: icrq_retried=%d\n", l2tp->icrq_retried));
00760       if ((s16_t)(l2tp->peer_nr - l2tp->our_ns) < 0) { /* the SCCCN was not acknowledged */
00761         if ((err = pppol2tp_send_scccn(l2tp, l2tp->our_ns -1)) != 0) {
00762           l2tp->icrq_retried--;
00763           PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send SCCCN, error=%d\n", err));
00764           UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00765           sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00766           break;
00767         }
00768       }
00769       if ((err = pppol2tp_send_icrq(l2tp, l2tp->our_ns)) != 0) {
00770         l2tp->icrq_retried--;
00771         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send ICRQ, error=%d\n", err));
00772         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00773       }
00774       sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00775       break;
00776 
00777     case PPPOL2TP_STATE_ICCN_SENT:
00778       l2tp->iccn_retried++;
00779       if (l2tp->iccn_retried >= PPPOL2TP_MAXICCN) {
00780         pppol2tp_abort_connect(l2tp);
00781         return;
00782       }
00783       PPPDEBUG(LOG_DEBUG, ("pppol2tp: iccn_retried=%d\n", l2tp->iccn_retried));
00784       if ((err = pppol2tp_send_iccn(l2tp, l2tp->our_ns)) != 0) {
00785         l2tp->iccn_retried--;
00786         PPPDEBUG(LOG_DEBUG, ("pppol2tp: failed to send ICCN, error=%d\n", err));
00787         UNUSED_ARG(err); /* if PPPDEBUG is disabled */
00788       }
00789       sys_timeout(PPPOL2TP_CONTROL_TIMEOUT, pppol2tp_timeout, l2tp);
00790       break;
00791 
00792     default:
00793       return;  /* all done, work in peace */
00794   }
00795 }
00796 
00797 /* Connection attempt aborted */
00798 static void pppol2tp_abort_connect(pppol2tp_pcb *l2tp) {
00799   PPPDEBUG(LOG_DEBUG, ("pppol2tp: could not establish connection\n"));
00800   l2tp->phase = PPPOL2TP_STATE_INITIAL;
00801   ppp_link_failed(l2tp->ppp); /* notify upper layers */
00802 }
00803 
00804 /* Initiate a new tunnel */
00805 static err_t pppol2tp_send_sccrq(pppol2tp_pcb *l2tp) {
00806   struct pbuf *pb;
00807   u8_t *p;
00808   u16_t len;
00809 
00810   /* calculate UDP packet length */
00811   len = 12 +8 +8 +10 +10 +6+sizeof(PPPOL2TP_HOSTNAME)-1 +6+sizeof(PPPOL2TP_VENDORNAME)-1 +8 +8;
00812 #if PPPOL2TP_AUTH_SUPPORT
00813   if (l2tp->secret != NULL) {
00814     len += 6 + sizeof(l2tp->secret_rv);
00815   }
00816 #endif /* PPPOL2TP_AUTH_SUPPORT */
00817 
00818   /* allocate a buffer */
00819   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
00820   if (pb == NULL) {
00821     return ERR_MEM;
00822   }
00823   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
00824 
00825   p = (u8_t*)pb->payload;
00826   /* fill in pkt */
00827   /* L2TP control header */
00828   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
00829   PUTSHORT(len, p); /* Length */
00830   PUTSHORT(0, p); /* Tunnel Id */
00831   PUTSHORT(0, p); /* Session Id */
00832   PUTSHORT(0, p); /* NS Sequence number - to peer */
00833   PUTSHORT(0, p); /* NR Sequence number - expected for peer */
00834 
00835   /* AVP - Message type */
00836   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00837   PUTSHORT(0, p); /* Vendor ID */
00838   PUTSHORT(PPPOL2TP_AVPTYPE_MESSAGE, p); /* Attribute type: Message Type */
00839   PUTSHORT(PPPOL2TP_MESSAGETYPE_SCCRQ, p); /* Attribute value: Message type: SCCRQ */
00840 
00841   /* AVP - L2TP Version */
00842   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00843   PUTSHORT(0, p); /* Vendor ID */
00844   PUTSHORT(PPPOL2TP_AVPTYPE_VERSION, p); /* Attribute type: Version */
00845   PUTSHORT(PPPOL2TP_VERSION, p); /* Attribute value: L2TP Version */
00846 
00847   /* AVP - Framing capabilities */
00848   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 10, p); /* Mandatory flag + len field */
00849   PUTSHORT(0, p); /* Vendor ID */
00850   PUTSHORT(PPPOL2TP_AVPTYPE_FRAMINGCAPABILITIES, p); /* Attribute type: Framing capabilities */
00851   PUTLONG(PPPOL2TP_FRAMINGCAPABILITIES, p); /* Attribute value: Framing capabilities */
00852 
00853   /* AVP - Bearer capabilities */
00854   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 10, p); /* Mandatory flag + len field */
00855   PUTSHORT(0, p); /* Vendor ID */
00856   PUTSHORT(PPPOL2TP_AVPTYPE_BEARERCAPABILITIES, p); /* Attribute type: Bearer capabilities */
00857   PUTLONG(PPPOL2TP_BEARERCAPABILITIES, p); /* Attribute value: Bearer capabilities */
00858 
00859   /* AVP - Host name */
00860   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 6+sizeof(PPPOL2TP_HOSTNAME)-1, p); /* Mandatory flag + len field */
00861   PUTSHORT(0, p); /* Vendor ID */
00862   PUTSHORT(PPPOL2TP_AVPTYPE_HOSTNAME, p); /* Attribute type: Hostname */
00863   MEMCPY(p, PPPOL2TP_HOSTNAME, sizeof(PPPOL2TP_HOSTNAME)-1); /* Attribute value: Hostname */
00864   INCPTR(sizeof(PPPOL2TP_HOSTNAME)-1, p);
00865 
00866   /* AVP - Vendor name */
00867   PUTSHORT(6+sizeof(PPPOL2TP_VENDORNAME)-1, p); /* len field */
00868   PUTSHORT(0, p); /* Vendor ID */
00869   PUTSHORT(PPPOL2TP_AVPTYPE_VENDORNAME, p); /* Attribute type: Vendor name */
00870   MEMCPY(p, PPPOL2TP_VENDORNAME, sizeof(PPPOL2TP_VENDORNAME)-1); /* Attribute value: Vendor name */
00871   INCPTR(sizeof(PPPOL2TP_VENDORNAME)-1, p);
00872 
00873   /* AVP - Assign tunnel ID */
00874   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00875   PUTSHORT(0, p); /* Vendor ID */
00876   PUTSHORT(PPPOL2TP_AVPTYPE_TUNNELID, p); /* Attribute type: Tunnel ID */
00877   PUTSHORT(l2tp->remote_tunnel_id, p); /* Attribute value: Tunnel ID */
00878 
00879   /* AVP - Receive window size */
00880   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00881   PUTSHORT(0, p); /* Vendor ID */
00882   PUTSHORT(PPPOL2TP_AVPTYPE_RECEIVEWINDOWSIZE, p); /* Attribute type: Receive window size */
00883   PUTSHORT(PPPOL2TP_RECEIVEWINDOWSIZE, p); /* Attribute value: Receive window size */
00884 
00885 #if PPPOL2TP_AUTH_SUPPORT
00886   /* AVP - Challenge */
00887   if (l2tp->secret != NULL) {
00888     PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 6 + sizeof(l2tp->secret_rv), p); /* Mandatory flag + len field */
00889     PUTSHORT(0, p); /* Vendor ID */
00890     PUTSHORT(PPPOL2TP_AVPTYPE_CHALLENGE, p); /* Attribute type: Challenge */
00891     MEMCPY(p, l2tp->secret_rv, sizeof(l2tp->secret_rv)); /* Attribute value: Random vector */
00892     INCPTR(sizeof(l2tp->secret_rv), p);
00893   }
00894 #endif /* PPPOL2TP_AUTH_SUPPORT */
00895 
00896   return pppol2tp_udp_send(l2tp, pb);
00897 }
00898 
00899 /* Complete tunnel establishment */
00900 static err_t pppol2tp_send_scccn(pppol2tp_pcb *l2tp, u16_t ns) {
00901   struct pbuf *pb;
00902   u8_t *p;
00903   u16_t len;
00904 
00905   /* calculate UDP packet length */
00906   len = 12 +8;
00907 #if PPPOL2TP_AUTH_SUPPORT
00908   if (l2tp->send_challenge) {
00909     len += 6 + sizeof(l2tp->challenge_hash);
00910   }
00911 #endif /* PPPOL2TP_AUTH_SUPPORT */
00912 
00913   /* allocate a buffer */
00914   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
00915   if (pb == NULL) {
00916     return ERR_MEM;
00917   }
00918   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
00919 
00920   p = (u8_t*)pb->payload;
00921   /* fill in pkt */
00922   /* L2TP control header */
00923   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
00924   PUTSHORT(len, p); /* Length */
00925   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
00926   PUTSHORT(0, p); /* Session Id */
00927   PUTSHORT(ns, p); /* NS Sequence number - to peer */
00928   PUTSHORT(l2tp->peer_ns, p); /* NR Sequence number - expected for peer */
00929 
00930   /* AVP - Message type */
00931   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00932   PUTSHORT(0, p); /* Vendor ID */
00933   PUTSHORT(PPPOL2TP_AVPTYPE_MESSAGE, p); /* Attribute type: Message Type */
00934   PUTSHORT(PPPOL2TP_MESSAGETYPE_SCCCN, p); /* Attribute value: Message type: SCCCN */
00935 
00936 #if PPPOL2TP_AUTH_SUPPORT
00937   /* AVP - Challenge response */
00938   if (l2tp->send_challenge) {
00939     PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 6 + sizeof(l2tp->challenge_hash), p); /* Mandatory flag + len field */
00940     PUTSHORT(0, p); /* Vendor ID */
00941     PUTSHORT(PPPOL2TP_AVPTYPE_CHALLENGERESPONSE, p); /* Attribute type: Challenge response */
00942     MEMCPY(p, l2tp->challenge_hash, sizeof(l2tp->challenge_hash)); /* Attribute value: Computed challenge */
00943     INCPTR(sizeof(l2tp->challenge_hash), p);
00944   }
00945 #endif /* PPPOL2TP_AUTH_SUPPORT */
00946 
00947   return pppol2tp_udp_send(l2tp, pb);
00948 }
00949 
00950 /* Initiate a new session */
00951 static err_t pppol2tp_send_icrq(pppol2tp_pcb *l2tp, u16_t ns) {
00952   struct pbuf *pb;
00953   u8_t *p;
00954   u16_t len;
00955   u32_t serialnumber;
00956 
00957   /* calculate UDP packet length */
00958   len = 12 +8 +8 +10;
00959 
00960   /* allocate a buffer */
00961   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
00962   if (pb == NULL) {
00963     return ERR_MEM;
00964   }
00965   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
00966 
00967   p = (u8_t*)pb->payload;
00968   /* fill in pkt */
00969   /* L2TP control header */
00970   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
00971   PUTSHORT(len, p); /* Length */
00972   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
00973   PUTSHORT(0, p); /* Session Id */
00974   PUTSHORT(ns, p); /* NS Sequence number - to peer */
00975   PUTSHORT(l2tp->peer_ns, p); /* NR Sequence number - expected for peer */
00976 
00977   /* AVP - Message type */
00978   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00979   PUTSHORT(0, p); /* Vendor ID */
00980   PUTSHORT(PPPOL2TP_AVPTYPE_MESSAGE, p); /* Attribute type: Message Type */
00981   PUTSHORT(PPPOL2TP_MESSAGETYPE_ICRQ, p); /* Attribute value: Message type: ICRQ */
00982 
00983   /* AVP - Assign session ID */
00984   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
00985   PUTSHORT(0, p); /* Vendor ID */
00986   PUTSHORT(PPPOL2TP_AVPTYPE_SESSIONID, p); /* Attribute type: Session ID */
00987   PUTSHORT(l2tp->remote_session_id, p); /* Attribute value: Session ID */
00988 
00989   /* AVP - Call Serial Number */
00990   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 10, p); /* Mandatory flag + len field */
00991   PUTSHORT(0, p); /* Vendor ID */
00992   PUTSHORT(PPPOL2TP_AVPTYPE_CALLSERIALNUMBER, p); /* Attribute type: Serial number */
00993   serialnumber = magic();
00994   PUTLONG(serialnumber, p); /* Attribute value: Serial number */
00995 
00996   return pppol2tp_udp_send(l2tp, pb);
00997 }
00998 
00999 /* Complete tunnel establishment */
01000 static err_t pppol2tp_send_iccn(pppol2tp_pcb *l2tp, u16_t ns) {
01001   struct pbuf *pb;
01002   u8_t *p;
01003   u16_t len;
01004 
01005   /* calculate UDP packet length */
01006   len = 12 +8 +10 +10;
01007 
01008   /* allocate a buffer */
01009   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
01010   if (pb == NULL) {
01011     return ERR_MEM;
01012   }
01013   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
01014 
01015   p = (u8_t*)pb->payload;
01016   /* fill in pkt */
01017   /* L2TP control header */
01018   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
01019   PUTSHORT(len, p); /* Length */
01020   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
01021   PUTSHORT(l2tp->source_session_id, p); /* Session Id */
01022   PUTSHORT(ns, p); /* NS Sequence number - to peer */
01023   PUTSHORT(l2tp->peer_ns, p); /* NR Sequence number - expected for peer */
01024 
01025   /* AVP - Message type */
01026   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
01027   PUTSHORT(0, p); /* Vendor ID */
01028   PUTSHORT(PPPOL2TP_AVPTYPE_MESSAGE, p); /* Attribute type: Message Type */
01029   PUTSHORT(PPPOL2TP_MESSAGETYPE_ICCN, p); /* Attribute value: Message type: ICCN */
01030 
01031   /* AVP - Framing type */
01032   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 10, p); /* Mandatory flag + len field */
01033   PUTSHORT(0, p); /* Vendor ID */
01034   PUTSHORT(PPPOL2TP_AVPTYPE_FRAMINGTYPE, p); /* Attribute type: Framing type */
01035   PUTLONG(PPPOL2TP_FRAMINGTYPE, p); /* Attribute value: Framing type */
01036 
01037   /* AVP - TX Connect speed */
01038   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 10, p); /* Mandatory flag + len field */
01039   PUTSHORT(0, p); /* Vendor ID */
01040   PUTSHORT(PPPOL2TP_AVPTYPE_TXCONNECTSPEED, p); /* Attribute type: TX Connect speed */
01041   PUTLONG(PPPOL2TP_TXCONNECTSPEED, p); /* Attribute value: TX Connect speed */
01042 
01043   return pppol2tp_udp_send(l2tp, pb);
01044 }
01045 
01046 /* Send a ZLB ACK packet */
01047 static err_t pppol2tp_send_zlb(pppol2tp_pcb *l2tp, u16_t ns, u16_t nr) {
01048   struct pbuf *pb;
01049   u8_t *p;
01050   u16_t len;
01051 
01052   /* calculate UDP packet length */
01053   len = 12;
01054 
01055   /* allocate a buffer */
01056   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
01057   if (pb == NULL) {
01058     return ERR_MEM;
01059   }
01060   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
01061 
01062   p = (u8_t*)pb->payload;
01063   /* fill in pkt */
01064   /* L2TP control header */
01065   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
01066   PUTSHORT(len, p); /* Length */
01067   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
01068   PUTSHORT(0, p); /* Session Id */
01069   PUTSHORT(ns, p); /* NS Sequence number - to peer */
01070   PUTSHORT(nr, p); /* NR Sequence number - expected for peer */
01071 
01072   return pppol2tp_udp_send(l2tp, pb);
01073 }
01074 
01075 /* Send a StopCCN packet */
01076 static err_t pppol2tp_send_stopccn(pppol2tp_pcb *l2tp, u16_t ns) {
01077   struct pbuf *pb;
01078   u8_t *p;
01079   u16_t len;
01080 
01081   /* calculate UDP packet length */
01082   len = 12 +8 +8 +8;
01083 
01084   /* allocate a buffer */
01085   pb = ppp_memory_buffer_allocate(ppp->netif->memory_manager, len, PPP_BUF_HEAP);
01086   if (pb == NULL) {
01087     return ERR_MEM;
01088   }
01089   PPP_ASSERT("pb->tot_len == pb->len", pb->tot_len == pb->len);
01090 
01091   p = (u8_t*)pb->payload;
01092   /* fill in pkt */
01093   /* L2TP control header */
01094   PUTSHORT(PPPOL2TP_HEADERFLAG_CONTROL_MANDATORY, p);
01095   PUTSHORT(len, p); /* Length */
01096   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
01097   PUTSHORT(0, p); /* Session Id */
01098   PUTSHORT(ns, p); /* NS Sequence number - to peer */
01099   PUTSHORT(l2tp->peer_ns, p); /* NR Sequence number - expected for peer */
01100 
01101   /* AVP - Message type */
01102   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
01103   PUTSHORT(0, p); /* Vendor ID */
01104   PUTSHORT(PPPOL2TP_AVPTYPE_MESSAGE, p); /* Attribute type: Message Type */
01105   PUTSHORT(PPPOL2TP_MESSAGETYPE_STOPCCN, p); /* Attribute value: Message type: StopCCN */
01106 
01107   /* AVP - Assign tunnel ID */
01108   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
01109   PUTSHORT(0, p); /* Vendor ID */
01110   PUTSHORT(PPPOL2TP_AVPTYPE_TUNNELID, p); /* Attribute type: Tunnel ID */
01111   PUTSHORT(l2tp->remote_tunnel_id, p); /* Attribute value: Tunnel ID */
01112 
01113   /* AVP - Result code */
01114   PUTSHORT(PPPOL2TP_AVPHEADERFLAG_MANDATORY + 8, p); /* Mandatory flag + len field */
01115   PUTSHORT(0, p); /* Vendor ID */
01116   PUTSHORT(PPPOL2TP_AVPTYPE_RESULTCODE, p); /* Attribute type: Result code */
01117   PUTSHORT(PPPOL2TP_RESULTCODE, p); /* Attribute value: Result code */
01118 
01119   return pppol2tp_udp_send(l2tp, pb);
01120 }
01121 
01122 static err_t pppol2tp_xmit(pppol2tp_pcb *l2tp, struct pbuf *pb) {
01123   u8_t *p;
01124 
01125   /* make room for L2TP header - should not fail */
01126   if (pbuf_add_header(pb, PPPOL2TP_OUTPUT_DATA_HEADER_LEN) != 0) {
01127     /* bail out */
01128     PPPDEBUG(LOG_ERR, ("pppol2tp: pppol2tp_pcb: could not allocate room for L2TP header\n"));
01129     LINK_STATS_INC(link.lenerr);
01130     ppp_memory_buffer_free(pb);
01131     return ERR_BUF;
01132   }
01133 
01134   p = (u8_t*)pb->payload;
01135   PUTSHORT(PPPOL2TP_HEADERFLAG_DATA_MANDATORY, p);
01136   PUTSHORT(l2tp->source_tunnel_id, p); /* Tunnel Id */
01137   PUTSHORT(l2tp->source_session_id, p); /* Session Id */
01138 
01139   return pppol2tp_udp_send(l2tp, pb);
01140 }
01141 
01142 static err_t pppol2tp_udp_send(pppol2tp_pcb *l2tp, struct pbuf *pb) {
01143   err_t err;
01144   if (l2tp->netif) {
01145     err = udp_sendto_if(l2tp->udp, pb, &l2tp->remote_ip, l2tp->tunnel_port, l2tp->netif);
01146   } else {
01147     err = udp_sendto(l2tp->udp, pb, &l2tp->remote_ip, l2tp->tunnel_port);
01148   }
01149   ppp_memory_buffer_free(pb);
01150   return err;
01151 }
01152 
01153 #endif /* PPP_SUPPORT && PPPOL2TP_SUPPORT */