Commit | Line | Data |
---|---|---|
926b50f9 HW |
1 | /* |
2 | * ip_nat_pptp.c - Version 3.0 | |
3 | * | |
4 | * NAT support for PPTP (Point to Point Tunneling Protocol). | |
5 | * PPTP is a a protocol for creating virtual private networks. | |
6 | * It is a specification defined by Microsoft and some vendors | |
7 | * working with Microsoft. PPTP is built on top of a modified | |
8 | * version of the Internet Generic Routing Encapsulation Protocol. | |
9 | * GRE is defined in RFC 1701 and RFC 1702. Documentation of | |
10 | * PPTP can be found in RFC 2637 | |
11 | * | |
12 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> | |
13 | * | |
14 | * Development of this code funded by Astaro AG (http://www.astaro.com/) | |
15 | * | |
16 | * TODO: - NAT to a unique tuple, not to TCP source port | |
17 | * (needs netfilter tuple reservation) | |
18 | * | |
19 | * Changes: | |
20 | * 2002-02-10 - Version 1.3 | |
21 | * - Use ip_nat_mangle_tcp_packet() because of cloned skb's | |
22 | * in local connections (Philip Craig <philipc@snapgear.com>) | |
23 | * - add checks for magicCookie and pptp version | |
24 | * - make argument list of pptp_{out,in}bound_packet() shorter | |
25 | * - move to C99 style initializers | |
26 | * - print version number at module loadtime | |
27 | * 2003-09-22 - Version 1.5 | |
28 | * - use SNATed tcp sourceport as callid, since we get called before | |
29 | * TCP header is mangled (Philip Craig <philipc@snapgear.com>) | |
30 | * 2004-10-22 - Version 2.0 | |
31 | * - kernel 2.6.x version | |
32 | * 2005-06-10 - Version 3.0 | |
33 | * - kernel >= 2.6.11 version, | |
34 | * funded by Oxcoda NetBox Blue (http://www.netboxblue.com/) | |
edd5a329 | 35 | * |
926b50f9 HW |
36 | */ |
37 | ||
926b50f9 HW |
38 | #include <linux/module.h> |
39 | #include <linux/ip.h> | |
40 | #include <linux/tcp.h> | |
41 | #include <net/tcp.h> | |
42 | ||
43 | #include <linux/netfilter_ipv4/ip_nat.h> | |
44 | #include <linux/netfilter_ipv4/ip_nat_rule.h> | |
45 | #include <linux/netfilter_ipv4/ip_nat_helper.h> | |
46 | #include <linux/netfilter_ipv4/ip_nat_pptp.h> | |
47 | #include <linux/netfilter_ipv4/ip_conntrack_core.h> | |
48 | #include <linux/netfilter_ipv4/ip_conntrack_helper.h> | |
49 | #include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h> | |
50 | #include <linux/netfilter_ipv4/ip_conntrack_pptp.h> | |
51 | ||
52 | #define IP_NAT_PPTP_VERSION "3.0" | |
53 | ||
f2ad52c9 HE |
54 | #define REQ_CID(req, off) (*(u_int16_t *)((char *)(req) + (off))) |
55 | ||
926b50f9 HW |
56 | MODULE_LICENSE("GPL"); |
57 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); | |
58 | MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP"); | |
59 | ||
60 | ||
61 | #if 0 | |
62 | extern const char *pptp_msg_name[]; | |
63 | #define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, \ | |
64 | __FUNCTION__, ## args) | |
65 | #else | |
66 | #define DEBUGP(format, args...) | |
67 | #endif | |
68 | ||
69 | static void pptp_nat_expected(struct ip_conntrack *ct, | |
70 | struct ip_conntrack_expect *exp) | |
71 | { | |
72 | struct ip_conntrack *master = ct->master; | |
73 | struct ip_conntrack_expect *other_exp; | |
74 | struct ip_conntrack_tuple t; | |
75 | struct ip_ct_pptp_master *ct_pptp_info; | |
76 | struct ip_nat_pptp *nat_pptp_info; | |
5978a9b8 | 77 | struct ip_nat_range range; |
926b50f9 HW |
78 | |
79 | ct_pptp_info = &master->help.ct_pptp_info; | |
80 | nat_pptp_info = &master->nat.help.nat_pptp_info; | |
81 | ||
82 | /* And here goes the grand finale of corrosion... */ | |
83 | ||
84 | if (exp->dir == IP_CT_DIR_ORIGINAL) { | |
85 | DEBUGP("we are PNS->PAC\n"); | |
86 | /* therefore, build tuple for PAC->PNS */ | |
87 | t.src.ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip; | |
955b9442 | 88 | t.src.u.gre.key = master->help.ct_pptp_info.pac_call_id; |
926b50f9 | 89 | t.dst.ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip; |
955b9442 | 90 | t.dst.u.gre.key = master->help.ct_pptp_info.pns_call_id; |
926b50f9 HW |
91 | t.dst.protonum = IPPROTO_GRE; |
92 | } else { | |
93 | DEBUGP("we are PAC->PNS\n"); | |
94 | /* build tuple for PNS->PAC */ | |
95 | t.src.ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip; | |
955b9442 | 96 | t.src.u.gre.key = master->nat.help.nat_pptp_info.pns_call_id; |
926b50f9 | 97 | t.dst.ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip; |
955b9442 | 98 | t.dst.u.gre.key = master->nat.help.nat_pptp_info.pac_call_id; |
926b50f9 HW |
99 | t.dst.protonum = IPPROTO_GRE; |
100 | } | |
101 | ||
102 | DEBUGP("trying to unexpect other dir: "); | |
103 | DUMP_TUPLE(&t); | |
104 | other_exp = ip_conntrack_expect_find(&t); | |
105 | if (other_exp) { | |
106 | ip_conntrack_unexpect_related(other_exp); | |
107 | ip_conntrack_expect_put(other_exp); | |
108 | DEBUGP("success\n"); | |
109 | } else { | |
110 | DEBUGP("not found!\n"); | |
111 | } | |
112 | ||
5978a9b8 PC |
113 | /* This must be a fresh one. */ |
114 | BUG_ON(ct->status & IPS_NAT_DONE_MASK); | |
115 | ||
116 | /* Change src to where master sends to */ | |
117 | range.flags = IP_NAT_RANGE_MAP_IPS; | |
118 | range.min_ip = range.max_ip | |
119 | = ct->master->tuplehash[!exp->dir].tuple.dst.ip; | |
120 | if (exp->dir == IP_CT_DIR_ORIGINAL) { | |
121 | range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; | |
122 | range.min = range.max = exp->saved_proto; | |
123 | } | |
124 | /* hook doesn't matter, but it has to do source manip */ | |
125 | ip_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); | |
126 | ||
127 | /* For DST manip, map port here to where it's expected. */ | |
128 | range.flags = IP_NAT_RANGE_MAP_IPS; | |
129 | range.min_ip = range.max_ip | |
130 | = ct->master->tuplehash[!exp->dir].tuple.src.ip; | |
131 | if (exp->dir == IP_CT_DIR_REPLY) { | |
132 | range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; | |
133 | range.min = range.max = exp->saved_proto; | |
134 | } | |
135 | /* hook doesn't matter, but it has to do destination manip */ | |
136 | ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); | |
926b50f9 HW |
137 | } |
138 | ||
139 | /* outbound packets == from PNS to PAC */ | |
140 | static int | |
141 | pptp_outbound_pkt(struct sk_buff **pskb, | |
142 | struct ip_conntrack *ct, | |
143 | enum ip_conntrack_info ctinfo, | |
144 | struct PptpControlHeader *ctlh, | |
145 | union pptp_ctrl_union *pptpReq) | |
146 | ||
147 | { | |
148 | struct ip_ct_pptp_master *ct_pptp_info = &ct->help.ct_pptp_info; | |
149 | struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info; | |
955b9442 PM |
150 | u_int16_t msg; |
151 | __be16 new_callid; | |
03b9feca | 152 | unsigned int cid_off; |
926b50f9 | 153 | |
955b9442 | 154 | new_callid = ct_pptp_info->pns_call_id; |
edd5a329 | 155 | |
926b50f9 | 156 | switch (msg = ntohs(ctlh->messageType)) { |
edd5a329 PM |
157 | case PPTP_OUT_CALL_REQUEST: |
158 | cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); | |
159 | /* FIXME: ideally we would want to reserve a call ID | |
160 | * here. current netfilter NAT core is not able to do | |
161 | * this :( For now we use TCP source port. This breaks | |
162 | * multiple calls within one control session */ | |
163 | ||
164 | /* save original call ID in nat_info */ | |
165 | nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; | |
166 | ||
167 | /* don't use tcph->source since we are at a DSTmanip | |
168 | * hook (e.g. PREROUTING) and pkt is not mangled yet */ | |
169 | new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; | |
170 | ||
171 | /* save new call ID in ct info */ | |
955b9442 | 172 | ct_pptp_info->pns_call_id = new_callid; |
edd5a329 PM |
173 | break; |
174 | case PPTP_IN_CALL_REPLY: | |
175 | cid_off = offsetof(union pptp_ctrl_union, icreq.callID); | |
176 | break; | |
177 | case PPTP_CALL_CLEAR_REQUEST: | |
178 | cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); | |
179 | break; | |
180 | default: | |
181 | DEBUGP("unknown outbound packet 0x%04x:%s\n", msg, | |
182 | (msg <= PPTP_MSG_MAX)? | |
183 | pptp_msg_name[msg]:pptp_msg_name[0]); | |
184 | /* fall through */ | |
185 | ||
186 | case PPTP_SET_LINK_INFO: | |
187 | /* only need to NAT in case PAC is behind NAT box */ | |
188 | case PPTP_START_SESSION_REQUEST: | |
189 | case PPTP_START_SESSION_REPLY: | |
190 | case PPTP_STOP_SESSION_REQUEST: | |
191 | case PPTP_STOP_SESSION_REPLY: | |
192 | case PPTP_ECHO_REQUEST: | |
193 | case PPTP_ECHO_REPLY: | |
194 | /* no need to alter packet */ | |
195 | return NF_ACCEPT; | |
926b50f9 HW |
196 | } |
197 | ||
198 | /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass | |
199 | * down to here */ | |
926b50f9 | 200 | DEBUGP("altering call id from 0x%04x to 0x%04x\n", |
f2ad52c9 | 201 | ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); |
926b50f9 HW |
202 | |
203 | /* mangle packet */ | |
204 | if (ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, | |
03b9feca PM |
205 | cid_off + sizeof(struct pptp_pkt_hdr) + |
206 | sizeof(struct PptpControlHeader), | |
207 | sizeof(new_callid), (char *)&new_callid, | |
208 | sizeof(new_callid)) == 0) | |
926b50f9 HW |
209 | return NF_DROP; |
210 | ||
211 | return NF_ACCEPT; | |
212 | } | |
213 | ||
214 | static int | |
215 | pptp_exp_gre(struct ip_conntrack_expect *expect_orig, | |
216 | struct ip_conntrack_expect *expect_reply) | |
217 | { | |
edd5a329 | 218 | struct ip_ct_pptp_master *ct_pptp_info = |
926b50f9 | 219 | &expect_orig->master->help.ct_pptp_info; |
edd5a329 | 220 | struct ip_nat_pptp *nat_pptp_info = |
926b50f9 HW |
221 | &expect_orig->master->nat.help.nat_pptp_info; |
222 | ||
223 | struct ip_conntrack *ct = expect_orig->master; | |
224 | ||
225 | struct ip_conntrack_tuple inv_t; | |
226 | struct ip_conntrack_tuple *orig_t, *reply_t; | |
227 | ||
228 | /* save original PAC call ID in nat_info */ | |
229 | nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; | |
230 | ||
231 | /* alter expectation */ | |
232 | orig_t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
233 | reply_t = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; | |
234 | ||
235 | /* alter expectation for PNS->PAC direction */ | |
236 | invert_tuplepr(&inv_t, &expect_orig->tuple); | |
955b9442 PM |
237 | expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; |
238 | expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; | |
239 | expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; | |
3428c209 | 240 | expect_orig->dir = IP_CT_DIR_ORIGINAL; |
926b50f9 HW |
241 | inv_t.src.ip = reply_t->src.ip; |
242 | inv_t.dst.ip = reply_t->dst.ip; | |
955b9442 PM |
243 | inv_t.src.u.gre.key = nat_pptp_info->pac_call_id; |
244 | inv_t.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
926b50f9 HW |
245 | |
246 | if (!ip_conntrack_expect_related(expect_orig)) { | |
247 | DEBUGP("successfully registered expect\n"); | |
248 | } else { | |
249 | DEBUGP("can't expect_related(expect_orig)\n"); | |
250 | return 1; | |
251 | } | |
252 | ||
253 | /* alter expectation for PAC->PNS direction */ | |
254 | invert_tuplepr(&inv_t, &expect_reply->tuple); | |
955b9442 PM |
255 | expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; |
256 | expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; | |
257 | expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
3428c209 | 258 | expect_reply->dir = IP_CT_DIR_REPLY; |
926b50f9 HW |
259 | inv_t.src.ip = orig_t->src.ip; |
260 | inv_t.dst.ip = orig_t->dst.ip; | |
955b9442 PM |
261 | inv_t.src.u.gre.key = nat_pptp_info->pns_call_id; |
262 | inv_t.dst.u.gre.key = ct_pptp_info->pac_call_id; | |
926b50f9 HW |
263 | |
264 | if (!ip_conntrack_expect_related(expect_reply)) { | |
265 | DEBUGP("successfully registered expect\n"); | |
266 | } else { | |
267 | DEBUGP("can't expect_related(expect_reply)\n"); | |
268 | ip_conntrack_unexpect_related(expect_orig); | |
269 | return 1; | |
270 | } | |
271 | ||
272 | if (ip_ct_gre_keymap_add(ct, &expect_reply->tuple, 0) < 0) { | |
273 | DEBUGP("can't register original keymap\n"); | |
274 | ip_conntrack_unexpect_related(expect_orig); | |
275 | ip_conntrack_unexpect_related(expect_reply); | |
276 | return 1; | |
277 | } | |
278 | ||
279 | if (ip_ct_gre_keymap_add(ct, &inv_t, 1) < 0) { | |
280 | DEBUGP("can't register reply keymap\n"); | |
281 | ip_conntrack_unexpect_related(expect_orig); | |
282 | ip_conntrack_unexpect_related(expect_reply); | |
283 | ip_ct_gre_keymap_destroy(ct); | |
284 | return 1; | |
285 | } | |
286 | ||
287 | return 0; | |
288 | } | |
289 | ||
290 | /* inbound packets == from PAC to PNS */ | |
291 | static int | |
292 | pptp_inbound_pkt(struct sk_buff **pskb, | |
293 | struct ip_conntrack *ct, | |
294 | enum ip_conntrack_info ctinfo, | |
295 | struct PptpControlHeader *ctlh, | |
296 | union pptp_ctrl_union *pptpReq) | |
297 | { | |
298 | struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info; | |
a1ad1dee | 299 | u_int16_t msg; |
955b9442 | 300 | __be16 new_pcid; |
a1ad1dee | 301 | unsigned int pcid_off; |
926b50f9 | 302 | |
955b9442 | 303 | new_pcid = nat_pptp_info->pns_call_id; |
926b50f9 HW |
304 | |
305 | switch (msg = ntohs(ctlh->messageType)) { | |
306 | case PPTP_OUT_CALL_REPLY: | |
03b9feca | 307 | pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); |
926b50f9 HW |
308 | break; |
309 | case PPTP_IN_CALL_CONNECT: | |
03b9feca | 310 | pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); |
926b50f9 HW |
311 | break; |
312 | case PPTP_IN_CALL_REQUEST: | |
313 | /* only need to nat in case PAC is behind NAT box */ | |
15db3470 | 314 | return NF_ACCEPT; |
926b50f9 | 315 | case PPTP_WAN_ERROR_NOTIFY: |
03b9feca | 316 | pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); |
926b50f9 HW |
317 | break; |
318 | case PPTP_CALL_DISCONNECT_NOTIFY: | |
03b9feca | 319 | pcid_off = offsetof(union pptp_ctrl_union, disc.callID); |
926b50f9 HW |
320 | break; |
321 | case PPTP_SET_LINK_INFO: | |
03b9feca | 322 | pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); |
926b50f9 HW |
323 | break; |
324 | ||
325 | default: | |
edd5a329 | 326 | DEBUGP("unknown inbound packet %s\n", (msg <= PPTP_MSG_MAX)? |
926b50f9 HW |
327 | pptp_msg_name[msg]:pptp_msg_name[0]); |
328 | /* fall through */ | |
329 | ||
330 | case PPTP_START_SESSION_REQUEST: | |
331 | case PPTP_START_SESSION_REPLY: | |
332 | case PPTP_STOP_SESSION_REQUEST: | |
333 | case PPTP_STOP_SESSION_REPLY: | |
334 | case PPTP_ECHO_REQUEST: | |
335 | case PPTP_ECHO_REPLY: | |
336 | /* no need to alter packet */ | |
337 | return NF_ACCEPT; | |
338 | } | |
339 | ||
340 | /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, | |
341 | * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ | |
342 | ||
343 | /* mangle packet */ | |
926b50f9 | 344 | DEBUGP("altering peer call id from 0x%04x to 0x%04x\n", |
f2ad52c9 | 345 | ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); |
c07bc1ff PM |
346 | |
347 | if (ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, | |
348 | pcid_off + sizeof(struct pptp_pkt_hdr) + | |
349 | sizeof(struct PptpControlHeader), | |
350 | sizeof(new_pcid), (char *)&new_pcid, | |
351 | sizeof(new_pcid)) == 0) | |
352 | return NF_DROP; | |
926b50f9 HW |
353 | return NF_ACCEPT; |
354 | } | |
355 | ||
356 | ||
357 | extern int __init ip_nat_proto_gre_init(void); | |
358 | extern void __exit ip_nat_proto_gre_fini(void); | |
359 | ||
65b4b4e8 | 360 | static int __init ip_nat_helper_pptp_init(void) |
926b50f9 HW |
361 | { |
362 | int ret; | |
363 | ||
364 | DEBUGP("%s: registering NAT helper\n", __FILE__); | |
365 | ||
366 | ret = ip_nat_proto_gre_init(); | |
367 | if (ret < 0) | |
368 | return ret; | |
369 | ||
370 | BUG_ON(ip_nat_pptp_hook_outbound); | |
371 | ip_nat_pptp_hook_outbound = &pptp_outbound_pkt; | |
372 | ||
373 | BUG_ON(ip_nat_pptp_hook_inbound); | |
374 | ip_nat_pptp_hook_inbound = &pptp_inbound_pkt; | |
375 | ||
376 | BUG_ON(ip_nat_pptp_hook_exp_gre); | |
377 | ip_nat_pptp_hook_exp_gre = &pptp_exp_gre; | |
378 | ||
379 | BUG_ON(ip_nat_pptp_hook_expectfn); | |
380 | ip_nat_pptp_hook_expectfn = &pptp_nat_expected; | |
381 | ||
382 | printk("ip_nat_pptp version %s loaded\n", IP_NAT_PPTP_VERSION); | |
383 | return 0; | |
384 | } | |
385 | ||
65b4b4e8 | 386 | static void __exit ip_nat_helper_pptp_fini(void) |
926b50f9 HW |
387 | { |
388 | DEBUGP("cleanup_module\n" ); | |
389 | ||
390 | ip_nat_pptp_hook_expectfn = NULL; | |
391 | ip_nat_pptp_hook_exp_gre = NULL; | |
392 | ip_nat_pptp_hook_inbound = NULL; | |
393 | ip_nat_pptp_hook_outbound = NULL; | |
394 | ||
395 | ip_nat_proto_gre_fini(); | |
396 | /* Make sure noone calls it, meanwhile */ | |
397 | synchronize_net(); | |
398 | ||
399 | printk("ip_nat_pptp version %s unloaded\n", IP_NAT_PPTP_VERSION); | |
400 | } | |
401 | ||
65b4b4e8 AM |
402 | module_init(ip_nat_helper_pptp_init); |
403 | module_exit(ip_nat_helper_pptp_fini); |