]>
Commit | Line | Data |
---|---|---|
f09943fe PM |
1 | /* |
2 | * nf_nat_pptp.c | |
3 | * | |
4 | * NAT support for PPTP (Point to Point Tunneling Protocol). | |
5 | * PPTP is a a protocol for creating virtual private networks. | |
6 | * It is a specification defined by Microsoft and some vendors | |
7 | * working with Microsoft. PPTP is built on top of a modified | |
8 | * version of the Internet Generic Routing Encapsulation Protocol. | |
9 | * GRE is defined in RFC 1701 and RFC 1702. Documentation of | |
10 | * PPTP can be found in RFC 2637 | |
11 | * | |
12 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> | |
13 | * | |
14 | * Development of this code funded by Astaro AG (http://www.astaro.com/) | |
15 | * | |
16 | * TODO: - NAT to a unique tuple, not to TCP source port | |
17 | * (needs netfilter tuple reservation) | |
18 | */ | |
19 | ||
20 | #include <linux/module.h> | |
21 | #include <linux/tcp.h> | |
22 | ||
23 | #include <net/netfilter/nf_nat.h> | |
24 | #include <net/netfilter/nf_nat_helper.h> | |
25 | #include <net/netfilter/nf_nat_rule.h> | |
26 | #include <net/netfilter/nf_conntrack_helper.h> | |
27 | #include <net/netfilter/nf_conntrack_expect.h> | |
28 | #include <linux/netfilter/nf_conntrack_proto_gre.h> | |
29 | #include <linux/netfilter/nf_conntrack_pptp.h> | |
30 | ||
31 | #define NF_NAT_PPTP_VERSION "3.0" | |
32 | ||
33 | #define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off))) | |
34 | ||
35 | MODULE_LICENSE("GPL"); | |
36 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); | |
37 | MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP"); | |
38 | MODULE_ALIAS("ip_nat_pptp"); | |
39 | ||
f09943fe PM |
40 | static void pptp_nat_expected(struct nf_conn *ct, |
41 | struct nf_conntrack_expect *exp) | |
42 | { | |
43 | struct nf_conn *master = ct->master; | |
44 | struct nf_conntrack_expect *other_exp; | |
45 | struct nf_conntrack_tuple t; | |
46 | struct nf_ct_pptp_master *ct_pptp_info; | |
47 | struct nf_nat_pptp *nat_pptp_info; | |
587aa641 | 48 | struct nf_nat_range range; |
f09943fe PM |
49 | |
50 | ct_pptp_info = &nfct_help(master)->help.ct_pptp_info; | |
51 | nat_pptp_info = &nfct_nat(master)->help.nat_pptp_info; | |
52 | ||
53 | /* And here goes the grand finale of corrosion... */ | |
54 | if (exp->dir == IP_CT_DIR_ORIGINAL) { | |
0d53778e | 55 | pr_debug("we are PNS->PAC\n"); |
f09943fe PM |
56 | /* therefore, build tuple for PAC->PNS */ |
57 | t.src.l3num = AF_INET; | |
58 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; | |
59 | t.src.u.gre.key = ct_pptp_info->pac_call_id; | |
60 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; | |
61 | t.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
62 | t.dst.protonum = IPPROTO_GRE; | |
63 | } else { | |
0d53778e | 64 | pr_debug("we are PAC->PNS\n"); |
f09943fe PM |
65 | /* build tuple for PNS->PAC */ |
66 | t.src.l3num = AF_INET; | |
a46bf7d5 | 67 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; |
f09943fe | 68 | t.src.u.gre.key = nat_pptp_info->pns_call_id; |
a46bf7d5 | 69 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; |
f09943fe PM |
70 | t.dst.u.gre.key = nat_pptp_info->pac_call_id; |
71 | t.dst.protonum = IPPROTO_GRE; | |
72 | } | |
73 | ||
0d53778e | 74 | pr_debug("trying to unexpect other dir: "); |
f09943fe | 75 | NF_CT_DUMP_TUPLE(&t); |
6823645d | 76 | other_exp = nf_ct_expect_find_get(&t); |
f09943fe | 77 | if (other_exp) { |
6823645d PM |
78 | nf_ct_unexpect_related(other_exp); |
79 | nf_ct_expect_put(other_exp); | |
0d53778e | 80 | pr_debug("success\n"); |
f09943fe | 81 | } else { |
0d53778e | 82 | pr_debug("not found!\n"); |
f09943fe PM |
83 | } |
84 | ||
85 | /* This must be a fresh one. */ | |
86 | BUG_ON(ct->status & IPS_NAT_DONE_MASK); | |
87 | ||
88 | /* Change src to where master sends to */ | |
89 | range.flags = IP_NAT_RANGE_MAP_IPS; | |
90 | range.min_ip = range.max_ip | |
91 | = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip; | |
92 | if (exp->dir == IP_CT_DIR_ORIGINAL) { | |
93 | range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; | |
94 | range.min = range.max = exp->saved_proto; | |
95 | } | |
96 | /* hook doesn't matter, but it has to do source manip */ | |
97 | nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); | |
98 | ||
99 | /* For DST manip, map port here to where it's expected. */ | |
100 | range.flags = IP_NAT_RANGE_MAP_IPS; | |
101 | range.min_ip = range.max_ip | |
102 | = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip; | |
103 | if (exp->dir == IP_CT_DIR_REPLY) { | |
104 | range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; | |
105 | range.min = range.max = exp->saved_proto; | |
106 | } | |
107 | /* hook doesn't matter, but it has to do destination manip */ | |
108 | nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); | |
109 | } | |
110 | ||
111 | /* outbound packets == from PNS to PAC */ | |
112 | static int | |
3db05fea | 113 | pptp_outbound_pkt(struct sk_buff *skb, |
f09943fe PM |
114 | struct nf_conn *ct, |
115 | enum ip_conntrack_info ctinfo, | |
116 | struct PptpControlHeader *ctlh, | |
117 | union pptp_ctrl_union *pptpReq) | |
118 | ||
119 | { | |
120 | struct nf_ct_pptp_master *ct_pptp_info; | |
121 | struct nf_nat_pptp *nat_pptp_info; | |
122 | u_int16_t msg; | |
123 | __be16 new_callid; | |
124 | unsigned int cid_off; | |
125 | ||
126 | ct_pptp_info = &nfct_help(ct)->help.ct_pptp_info; | |
127 | nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info; | |
128 | ||
129 | new_callid = ct_pptp_info->pns_call_id; | |
130 | ||
131 | switch (msg = ntohs(ctlh->messageType)) { | |
132 | case PPTP_OUT_CALL_REQUEST: | |
133 | cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); | |
134 | /* FIXME: ideally we would want to reserve a call ID | |
135 | * here. current netfilter NAT core is not able to do | |
136 | * this :( For now we use TCP source port. This breaks | |
137 | * multiple calls within one control session */ | |
138 | ||
139 | /* save original call ID in nat_info */ | |
140 | nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; | |
141 | ||
142 | /* don't use tcph->source since we are at a DSTmanip | |
143 | * hook (e.g. PREROUTING) and pkt is not mangled yet */ | |
144 | new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; | |
145 | ||
146 | /* save new call ID in ct info */ | |
147 | ct_pptp_info->pns_call_id = new_callid; | |
148 | break; | |
149 | case PPTP_IN_CALL_REPLY: | |
150 | cid_off = offsetof(union pptp_ctrl_union, icack.callID); | |
151 | break; | |
152 | case PPTP_CALL_CLEAR_REQUEST: | |
153 | cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); | |
154 | break; | |
155 | default: | |
0d53778e PM |
156 | pr_debug("unknown outbound packet 0x%04x:%s\n", msg, |
157 | msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : | |
158 | pptp_msg_name[0]); | |
f09943fe PM |
159 | /* fall through */ |
160 | case PPTP_SET_LINK_INFO: | |
161 | /* only need to NAT in case PAC is behind NAT box */ | |
162 | case PPTP_START_SESSION_REQUEST: | |
163 | case PPTP_START_SESSION_REPLY: | |
164 | case PPTP_STOP_SESSION_REQUEST: | |
165 | case PPTP_STOP_SESSION_REPLY: | |
166 | case PPTP_ECHO_REQUEST: | |
167 | case PPTP_ECHO_REPLY: | |
168 | /* no need to alter packet */ | |
169 | return NF_ACCEPT; | |
170 | } | |
171 | ||
172 | /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass | |
173 | * down to here */ | |
0d53778e PM |
174 | pr_debug("altering call id from 0x%04x to 0x%04x\n", |
175 | ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); | |
f09943fe PM |
176 | |
177 | /* mangle packet */ | |
3db05fea | 178 | if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo, |
e905a9ed YH |
179 | cid_off + sizeof(struct pptp_pkt_hdr) + |
180 | sizeof(struct PptpControlHeader), | |
181 | sizeof(new_callid), (char *)&new_callid, | |
182 | sizeof(new_callid)) == 0) | |
f09943fe PM |
183 | return NF_DROP; |
184 | return NF_ACCEPT; | |
185 | } | |
186 | ||
187 | static void | |
188 | pptp_exp_gre(struct nf_conntrack_expect *expect_orig, | |
189 | struct nf_conntrack_expect *expect_reply) | |
190 | { | |
191 | struct nf_conn *ct = expect_orig->master; | |
192 | struct nf_ct_pptp_master *ct_pptp_info; | |
193 | struct nf_nat_pptp *nat_pptp_info; | |
194 | ||
195 | ct_pptp_info = &nfct_help(ct)->help.ct_pptp_info; | |
196 | nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info; | |
197 | ||
198 | /* save original PAC call ID in nat_info */ | |
199 | nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; | |
200 | ||
201 | /* alter expectation for PNS->PAC direction */ | |
202 | expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; | |
203 | expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; | |
204 | expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; | |
205 | expect_orig->dir = IP_CT_DIR_ORIGINAL; | |
206 | ||
207 | /* alter expectation for PAC->PNS direction */ | |
208 | expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; | |
209 | expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; | |
210 | expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
211 | expect_reply->dir = IP_CT_DIR_REPLY; | |
212 | } | |
213 | ||
214 | /* inbound packets == from PAC to PNS */ | |
215 | static int | |
3db05fea | 216 | pptp_inbound_pkt(struct sk_buff *skb, |
f09943fe PM |
217 | struct nf_conn *ct, |
218 | enum ip_conntrack_info ctinfo, | |
219 | struct PptpControlHeader *ctlh, | |
220 | union pptp_ctrl_union *pptpReq) | |
221 | { | |
222 | struct nf_nat_pptp *nat_pptp_info; | |
223 | u_int16_t msg; | |
224 | __be16 new_pcid; | |
225 | unsigned int pcid_off; | |
226 | ||
227 | nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info; | |
228 | new_pcid = nat_pptp_info->pns_call_id; | |
229 | ||
230 | switch (msg = ntohs(ctlh->messageType)) { | |
231 | case PPTP_OUT_CALL_REPLY: | |
232 | pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); | |
233 | break; | |
234 | case PPTP_IN_CALL_CONNECT: | |
235 | pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); | |
236 | break; | |
237 | case PPTP_IN_CALL_REQUEST: | |
238 | /* only need to nat in case PAC is behind NAT box */ | |
239 | return NF_ACCEPT; | |
240 | case PPTP_WAN_ERROR_NOTIFY: | |
241 | pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); | |
242 | break; | |
243 | case PPTP_CALL_DISCONNECT_NOTIFY: | |
244 | pcid_off = offsetof(union pptp_ctrl_union, disc.callID); | |
245 | break; | |
246 | case PPTP_SET_LINK_INFO: | |
247 | pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); | |
248 | break; | |
249 | default: | |
0d53778e PM |
250 | pr_debug("unknown inbound packet %s\n", |
251 | msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : | |
252 | pptp_msg_name[0]); | |
f09943fe PM |
253 | /* fall through */ |
254 | case PPTP_START_SESSION_REQUEST: | |
255 | case PPTP_START_SESSION_REPLY: | |
256 | case PPTP_STOP_SESSION_REQUEST: | |
257 | case PPTP_STOP_SESSION_REPLY: | |
258 | case PPTP_ECHO_REQUEST: | |
259 | case PPTP_ECHO_REPLY: | |
260 | /* no need to alter packet */ | |
261 | return NF_ACCEPT; | |
262 | } | |
263 | ||
264 | /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, | |
265 | * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ | |
266 | ||
267 | /* mangle packet */ | |
0d53778e PM |
268 | pr_debug("altering peer call id from 0x%04x to 0x%04x\n", |
269 | ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); | |
f09943fe | 270 | |
3db05fea | 271 | if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo, |
e905a9ed | 272 | pcid_off + sizeof(struct pptp_pkt_hdr) + |
f09943fe PM |
273 | sizeof(struct PptpControlHeader), |
274 | sizeof(new_pcid), (char *)&new_pcid, | |
275 | sizeof(new_pcid)) == 0) | |
276 | return NF_DROP; | |
277 | return NF_ACCEPT; | |
278 | } | |
279 | ||
280 | static int __init nf_nat_helper_pptp_init(void) | |
281 | { | |
282 | nf_nat_need_gre(); | |
283 | ||
284 | BUG_ON(rcu_dereference(nf_nat_pptp_hook_outbound)); | |
285 | rcu_assign_pointer(nf_nat_pptp_hook_outbound, pptp_outbound_pkt); | |
286 | ||
287 | BUG_ON(rcu_dereference(nf_nat_pptp_hook_inbound)); | |
288 | rcu_assign_pointer(nf_nat_pptp_hook_inbound, pptp_inbound_pkt); | |
289 | ||
290 | BUG_ON(rcu_dereference(nf_nat_pptp_hook_exp_gre)); | |
291 | rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, pptp_exp_gre); | |
292 | ||
293 | BUG_ON(rcu_dereference(nf_nat_pptp_hook_expectfn)); | |
294 | rcu_assign_pointer(nf_nat_pptp_hook_expectfn, pptp_nat_expected); | |
295 | return 0; | |
296 | } | |
297 | ||
298 | static void __exit nf_nat_helper_pptp_fini(void) | |
299 | { | |
300 | rcu_assign_pointer(nf_nat_pptp_hook_expectfn, NULL); | |
301 | rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, NULL); | |
302 | rcu_assign_pointer(nf_nat_pptp_hook_inbound, NULL); | |
303 | rcu_assign_pointer(nf_nat_pptp_hook_outbound, NULL); | |
304 | synchronize_rcu(); | |
305 | } | |
306 | ||
307 | module_init(nf_nat_helper_pptp_init); | |
308 | module_exit(nf_nat_helper_pptp_fini); |