Commit | Line | Data |
---|---|---|
09c434b8 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
f09943fe PM |
2 | /* |
3 | * nf_nat_pptp.c | |
4 | * | |
5 | * NAT support for PPTP (Point to Point Tunneling Protocol). | |
6 | * PPTP is a a protocol for creating virtual private networks. | |
7 | * It is a specification defined by Microsoft and some vendors | |
8 | * working with Microsoft. PPTP is built on top of a modified | |
9 | * version of the Internet Generic Routing Encapsulation Protocol. | |
10 | * GRE is defined in RFC 1701 and RFC 1702. Documentation of | |
11 | * PPTP can be found in RFC 2637 | |
12 | * | |
13 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> | |
14 | * | |
15 | * Development of this code funded by Astaro AG (http://www.astaro.com/) | |
16 | * | |
f229f6ce PM |
17 | * (C) 2006-2012 Patrick McHardy <kaber@trash.net> |
18 | * | |
f09943fe PM |
19 | * TODO: - NAT to a unique tuple, not to TCP source port |
20 | * (needs netfilter tuple reservation) | |
21 | */ | |
22 | ||
23 | #include <linux/module.h> | |
24 | #include <linux/tcp.h> | |
25 | ||
26 | #include <net/netfilter/nf_nat.h> | |
27 | #include <net/netfilter/nf_nat_helper.h> | |
f09943fe PM |
28 | #include <net/netfilter/nf_conntrack_helper.h> |
29 | #include <net/netfilter/nf_conntrack_expect.h> | |
5d0aa2cc | 30 | #include <net/netfilter/nf_conntrack_zones.h> |
f09943fe PM |
31 | #include <linux/netfilter/nf_conntrack_proto_gre.h> |
32 | #include <linux/netfilter/nf_conntrack_pptp.h> | |
33 | ||
34 | #define NF_NAT_PPTP_VERSION "3.0" | |
35 | ||
36 | #define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off))) | |
37 | ||
38 | MODULE_LICENSE("GPL"); | |
39 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); | |
40 | MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP"); | |
e1f172e1 | 41 | MODULE_ALIAS_NF_NAT_HELPER("pptp"); |
f09943fe | 42 | |
f09943fe PM |
43 | static void pptp_nat_expected(struct nf_conn *ct, |
44 | struct nf_conntrack_expect *exp) | |
45 | { | |
cfd6e3d7 | 46 | struct net *net = nf_ct_net(ct); |
9ddd0ed0 | 47 | const struct nf_conn *master = ct->master; |
f09943fe | 48 | struct nf_conntrack_expect *other_exp; |
c255cb2e | 49 | struct nf_conntrack_tuple t = {}; |
9ddd0ed0 JE |
50 | const struct nf_ct_pptp_master *ct_pptp_info; |
51 | const struct nf_nat_pptp *nat_pptp_info; | |
2eb0f624 | 52 | struct nf_nat_range2 range; |
2fe7c321 | 53 | struct nf_conn_nat *nat; |
f09943fe | 54 | |
2fe7c321 FW |
55 | nat = nf_ct_nat_ext_add(ct); |
56 | if (WARN_ON_ONCE(!nat)) | |
57 | return; | |
58 | ||
59 | nat_pptp_info = &nat->help.nat_pptp_info; | |
1afc5679 | 60 | ct_pptp_info = nfct_help_data(master); |
f09943fe PM |
61 | |
62 | /* And here goes the grand finale of corrosion... */ | |
63 | if (exp->dir == IP_CT_DIR_ORIGINAL) { | |
0d53778e | 64 | pr_debug("we are PNS->PAC\n"); |
f09943fe PM |
65 | /* therefore, build tuple for PAC->PNS */ |
66 | t.src.l3num = AF_INET; | |
67 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; | |
68 | t.src.u.gre.key = ct_pptp_info->pac_call_id; | |
69 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; | |
70 | t.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
71 | t.dst.protonum = IPPROTO_GRE; | |
72 | } else { | |
0d53778e | 73 | pr_debug("we are PAC->PNS\n"); |
f09943fe PM |
74 | /* build tuple for PNS->PAC */ |
75 | t.src.l3num = AF_INET; | |
a46bf7d5 | 76 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; |
f09943fe | 77 | t.src.u.gre.key = nat_pptp_info->pns_call_id; |
a46bf7d5 | 78 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; |
f09943fe PM |
79 | t.dst.u.gre.key = nat_pptp_info->pac_call_id; |
80 | t.dst.protonum = IPPROTO_GRE; | |
81 | } | |
82 | ||
0d53778e | 83 | pr_debug("trying to unexpect other dir: "); |
3c9fba65 | 84 | nf_ct_dump_tuple_ip(&t); |
5d0aa2cc | 85 | other_exp = nf_ct_expect_find_get(net, nf_ct_zone(ct), &t); |
f09943fe | 86 | if (other_exp) { |
6823645d PM |
87 | nf_ct_unexpect_related(other_exp); |
88 | nf_ct_expect_put(other_exp); | |
0d53778e | 89 | pr_debug("success\n"); |
f09943fe | 90 | } else { |
0d53778e | 91 | pr_debug("not found!\n"); |
f09943fe PM |
92 | } |
93 | ||
94 | /* This must be a fresh one. */ | |
95 | BUG_ON(ct->status & IPS_NAT_DONE_MASK); | |
96 | ||
97 | /* Change src to where master sends to */ | |
cbc9f2f4 | 98 | range.flags = NF_NAT_RANGE_MAP_IPS; |
c7232c99 PM |
99 | range.min_addr = range.max_addr |
100 | = ct->master->tuplehash[!exp->dir].tuple.dst.u3; | |
f09943fe | 101 | if (exp->dir == IP_CT_DIR_ORIGINAL) { |
cbc9f2f4 | 102 | range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
c7232c99 | 103 | range.min_proto = range.max_proto = exp->saved_proto; |
f09943fe | 104 | } |
cbc9f2f4 | 105 | nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC); |
f09943fe PM |
106 | |
107 | /* For DST manip, map port here to where it's expected. */ | |
cbc9f2f4 | 108 | range.flags = NF_NAT_RANGE_MAP_IPS; |
c7232c99 PM |
109 | range.min_addr = range.max_addr |
110 | = ct->master->tuplehash[!exp->dir].tuple.src.u3; | |
f09943fe | 111 | if (exp->dir == IP_CT_DIR_REPLY) { |
cbc9f2f4 | 112 | range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
c7232c99 | 113 | range.min_proto = range.max_proto = exp->saved_proto; |
f09943fe | 114 | } |
cbc9f2f4 | 115 | nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST); |
f09943fe PM |
116 | } |
117 | ||
118 | /* outbound packets == from PNS to PAC */ | |
119 | static int | |
3db05fea | 120 | pptp_outbound_pkt(struct sk_buff *skb, |
f09943fe PM |
121 | struct nf_conn *ct, |
122 | enum ip_conntrack_info ctinfo, | |
051966c0 | 123 | unsigned int protoff, |
f09943fe PM |
124 | struct PptpControlHeader *ctlh, |
125 | union pptp_ctrl_union *pptpReq) | |
126 | ||
127 | { | |
128 | struct nf_ct_pptp_master *ct_pptp_info; | |
2fe7c321 | 129 | struct nf_conn_nat *nat = nfct_nat(ct); |
f09943fe PM |
130 | struct nf_nat_pptp *nat_pptp_info; |
131 | u_int16_t msg; | |
132 | __be16 new_callid; | |
133 | unsigned int cid_off; | |
134 | ||
2fe7c321 FW |
135 | if (WARN_ON_ONCE(!nat)) |
136 | return NF_DROP; | |
137 | ||
138 | nat_pptp_info = &nat->help.nat_pptp_info; | |
1afc5679 | 139 | ct_pptp_info = nfct_help_data(ct); |
f09943fe PM |
140 | |
141 | new_callid = ct_pptp_info->pns_call_id; | |
142 | ||
143 | switch (msg = ntohs(ctlh->messageType)) { | |
144 | case PPTP_OUT_CALL_REQUEST: | |
145 | cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); | |
146 | /* FIXME: ideally we would want to reserve a call ID | |
147 | * here. current netfilter NAT core is not able to do | |
148 | * this :( For now we use TCP source port. This breaks | |
149 | * multiple calls within one control session */ | |
150 | ||
151 | /* save original call ID in nat_info */ | |
152 | nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; | |
153 | ||
154 | /* don't use tcph->source since we are at a DSTmanip | |
155 | * hook (e.g. PREROUTING) and pkt is not mangled yet */ | |
156 | new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; | |
157 | ||
158 | /* save new call ID in ct info */ | |
159 | ct_pptp_info->pns_call_id = new_callid; | |
160 | break; | |
161 | case PPTP_IN_CALL_REPLY: | |
162 | cid_off = offsetof(union pptp_ctrl_union, icack.callID); | |
163 | break; | |
164 | case PPTP_CALL_CLEAR_REQUEST: | |
165 | cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); | |
166 | break; | |
167 | default: | |
0d53778e PM |
168 | pr_debug("unknown outbound packet 0x%04x:%s\n", msg, |
169 | msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : | |
170 | pptp_msg_name[0]); | |
f09943fe PM |
171 | /* fall through */ |
172 | case PPTP_SET_LINK_INFO: | |
173 | /* only need to NAT in case PAC is behind NAT box */ | |
174 | case PPTP_START_SESSION_REQUEST: | |
175 | case PPTP_START_SESSION_REPLY: | |
176 | case PPTP_STOP_SESSION_REQUEST: | |
177 | case PPTP_STOP_SESSION_REPLY: | |
178 | case PPTP_ECHO_REQUEST: | |
179 | case PPTP_ECHO_REPLY: | |
180 | /* no need to alter packet */ | |
181 | return NF_ACCEPT; | |
182 | } | |
183 | ||
184 | /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass | |
185 | * down to here */ | |
0d53778e PM |
186 | pr_debug("altering call id from 0x%04x to 0x%04x\n", |
187 | ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); | |
f09943fe PM |
188 | |
189 | /* mangle packet */ | |
cba81cc4 GF |
190 | if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, |
191 | cid_off + sizeof(struct pptp_pkt_hdr) + | |
192 | sizeof(struct PptpControlHeader), | |
193 | sizeof(new_callid), (char *)&new_callid, | |
194 | sizeof(new_callid))) | |
f09943fe PM |
195 | return NF_DROP; |
196 | return NF_ACCEPT; | |
197 | } | |
198 | ||
199 | static void | |
200 | pptp_exp_gre(struct nf_conntrack_expect *expect_orig, | |
201 | struct nf_conntrack_expect *expect_reply) | |
202 | { | |
9ddd0ed0 | 203 | const struct nf_conn *ct = expect_orig->master; |
2fe7c321 | 204 | struct nf_conn_nat *nat = nfct_nat(ct); |
f09943fe PM |
205 | struct nf_ct_pptp_master *ct_pptp_info; |
206 | struct nf_nat_pptp *nat_pptp_info; | |
207 | ||
2fe7c321 FW |
208 | if (WARN_ON_ONCE(!nat)) |
209 | return; | |
210 | ||
211 | nat_pptp_info = &nat->help.nat_pptp_info; | |
1afc5679 | 212 | ct_pptp_info = nfct_help_data(ct); |
f09943fe PM |
213 | |
214 | /* save original PAC call ID in nat_info */ | |
215 | nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; | |
216 | ||
217 | /* alter expectation for PNS->PAC direction */ | |
218 | expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; | |
219 | expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; | |
220 | expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; | |
221 | expect_orig->dir = IP_CT_DIR_ORIGINAL; | |
222 | ||
223 | /* alter expectation for PAC->PNS direction */ | |
224 | expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; | |
225 | expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; | |
226 | expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; | |
227 | expect_reply->dir = IP_CT_DIR_REPLY; | |
228 | } | |
229 | ||
230 | /* inbound packets == from PAC to PNS */ | |
231 | static int | |
3db05fea | 232 | pptp_inbound_pkt(struct sk_buff *skb, |
f09943fe PM |
233 | struct nf_conn *ct, |
234 | enum ip_conntrack_info ctinfo, | |
051966c0 | 235 | unsigned int protoff, |
f09943fe PM |
236 | struct PptpControlHeader *ctlh, |
237 | union pptp_ctrl_union *pptpReq) | |
238 | { | |
9ddd0ed0 | 239 | const struct nf_nat_pptp *nat_pptp_info; |
2fe7c321 | 240 | struct nf_conn_nat *nat = nfct_nat(ct); |
f09943fe PM |
241 | u_int16_t msg; |
242 | __be16 new_pcid; | |
243 | unsigned int pcid_off; | |
244 | ||
2fe7c321 FW |
245 | if (WARN_ON_ONCE(!nat)) |
246 | return NF_DROP; | |
247 | ||
248 | nat_pptp_info = &nat->help.nat_pptp_info; | |
f09943fe PM |
249 | new_pcid = nat_pptp_info->pns_call_id; |
250 | ||
251 | switch (msg = ntohs(ctlh->messageType)) { | |
252 | case PPTP_OUT_CALL_REPLY: | |
253 | pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); | |
254 | break; | |
255 | case PPTP_IN_CALL_CONNECT: | |
256 | pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); | |
257 | break; | |
258 | case PPTP_IN_CALL_REQUEST: | |
259 | /* only need to nat in case PAC is behind NAT box */ | |
260 | return NF_ACCEPT; | |
261 | case PPTP_WAN_ERROR_NOTIFY: | |
262 | pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); | |
263 | break; | |
264 | case PPTP_CALL_DISCONNECT_NOTIFY: | |
265 | pcid_off = offsetof(union pptp_ctrl_union, disc.callID); | |
266 | break; | |
267 | case PPTP_SET_LINK_INFO: | |
268 | pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); | |
269 | break; | |
270 | default: | |
0d53778e PM |
271 | pr_debug("unknown inbound packet %s\n", |
272 | msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : | |
273 | pptp_msg_name[0]); | |
f09943fe PM |
274 | /* fall through */ |
275 | case PPTP_START_SESSION_REQUEST: | |
276 | case PPTP_START_SESSION_REPLY: | |
277 | case PPTP_STOP_SESSION_REQUEST: | |
278 | case PPTP_STOP_SESSION_REPLY: | |
279 | case PPTP_ECHO_REQUEST: | |
280 | case PPTP_ECHO_REPLY: | |
281 | /* no need to alter packet */ | |
282 | return NF_ACCEPT; | |
283 | } | |
284 | ||
285 | /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, | |
286 | * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ | |
287 | ||
288 | /* mangle packet */ | |
0d53778e PM |
289 | pr_debug("altering peer call id from 0x%04x to 0x%04x\n", |
290 | ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); | |
f09943fe | 291 | |
cba81cc4 GF |
292 | if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, |
293 | pcid_off + sizeof(struct pptp_pkt_hdr) + | |
294 | sizeof(struct PptpControlHeader), | |
295 | sizeof(new_pcid), (char *)&new_pcid, | |
296 | sizeof(new_pcid))) | |
f09943fe PM |
297 | return NF_DROP; |
298 | return NF_ACCEPT; | |
299 | } | |
300 | ||
301 | static int __init nf_nat_helper_pptp_init(void) | |
302 | { | |
d1332e0a | 303 | BUG_ON(nf_nat_pptp_hook_outbound != NULL); |
a9b3cd7f | 304 | RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, pptp_outbound_pkt); |
f09943fe | 305 | |
d1332e0a | 306 | BUG_ON(nf_nat_pptp_hook_inbound != NULL); |
a9b3cd7f | 307 | RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, pptp_inbound_pkt); |
f09943fe | 308 | |
d1332e0a | 309 | BUG_ON(nf_nat_pptp_hook_exp_gre != NULL); |
a9b3cd7f | 310 | RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, pptp_exp_gre); |
f09943fe | 311 | |
d1332e0a | 312 | BUG_ON(nf_nat_pptp_hook_expectfn != NULL); |
a9b3cd7f | 313 | RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, pptp_nat_expected); |
f09943fe PM |
314 | return 0; |
315 | } | |
316 | ||
317 | static void __exit nf_nat_helper_pptp_fini(void) | |
318 | { | |
a9b3cd7f SH |
319 | RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, NULL); |
320 | RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, NULL); | |
321 | RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, NULL); | |
322 | RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, NULL); | |
f09943fe PM |
323 | synchronize_rcu(); |
324 | } | |
325 | ||
326 | module_init(nf_nat_helper_pptp_init); | |
327 | module_exit(nf_nat_helper_pptp_fini); |