1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20#include <linux/module.h>
21#include <linux/tcp.h>
22
23#include <net/netfilter/nf_nat.h>
24#include <net/netfilter/nf_nat_helper.h>
25#include <net/netfilter/nf_nat_rule.h>
26#include <net/netfilter/nf_conntrack_helper.h>
27#include <net/netfilter/nf_conntrack_expect.h>
28#include <linux/netfilter/nf_conntrack_proto_gre.h>
29#include <linux/netfilter/nf_conntrack_pptp.h>
30
31#define NF_NAT_PPTP_VERSION "3.0"
32
33#define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off)))
34
35MODULE_LICENSE("GPL");
36MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
37MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP");
38MODULE_ALIAS("ip_nat_pptp");
39
40static void pptp_nat_expected(struct nf_conn *ct,
41 struct nf_conntrack_expect *exp)
42{
43 struct net *net = nf_ct_net(ct);
44 const struct nf_conn *master = ct->master;
45 struct nf_conntrack_expect *other_exp;
46 struct nf_conntrack_tuple t;
47 const struct nf_ct_pptp_master *ct_pptp_info;
48 const struct nf_nat_pptp *nat_pptp_info;
49 struct nf_nat_range range;
50
51 ct_pptp_info = &nfct_help(master)->help.ct_pptp_info;
52 nat_pptp_info = &nfct_nat(master)->help.nat_pptp_info;
53
54
55 if (exp->dir == IP_CT_DIR_ORIGINAL) {
56 pr_debug("we are PNS->PAC\n");
57
58 t.src.l3num = AF_INET;
59 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip;
60 t.src.u.gre.key = ct_pptp_info->pac_call_id;
61 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip;
62 t.dst.u.gre.key = ct_pptp_info->pns_call_id;
63 t.dst.protonum = IPPROTO_GRE;
64 } else {
65 pr_debug("we are PAC->PNS\n");
66
67 t.src.l3num = AF_INET;
68 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip;
69 t.src.u.gre.key = nat_pptp_info->pns_call_id;
70 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip;
71 t.dst.u.gre.key = nat_pptp_info->pac_call_id;
72 t.dst.protonum = IPPROTO_GRE;
73 }
74
75 pr_debug("trying to unexpect other dir: ");
76 nf_ct_dump_tuple_ip(&t);
77 other_exp = nf_ct_expect_find_get(net, &t);
78 if (other_exp) {
79 nf_ct_unexpect_related(other_exp);
80 nf_ct_expect_put(other_exp);
81 pr_debug("success\n");
82 } else {
83 pr_debug("not found!\n");
84 }
85
86
87 BUG_ON(ct->status & IPS_NAT_DONE_MASK);
88
89
90 range.flags = IP_NAT_RANGE_MAP_IPS;
91 range.min_ip = range.max_ip
92 = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
93 if (exp->dir == IP_CT_DIR_ORIGINAL) {
94 range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
95 range.min = range.max = exp->saved_proto;
96 }
97 nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
98
99
100 range.flags = IP_NAT_RANGE_MAP_IPS;
101 range.min_ip = range.max_ip
102 = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
103 if (exp->dir == IP_CT_DIR_REPLY) {
104 range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
105 range.min = range.max = exp->saved_proto;
106 }
107 nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
108}
109
110
111static int
112pptp_outbound_pkt(struct sk_buff *skb,
113 struct nf_conn *ct,
114 enum ip_conntrack_info ctinfo,
115 struct PptpControlHeader *ctlh,
116 union pptp_ctrl_union *pptpReq)
117
118{
119 struct nf_ct_pptp_master *ct_pptp_info;
120 struct nf_nat_pptp *nat_pptp_info;
121 u_int16_t msg;
122 __be16 new_callid;
123 unsigned int cid_off;
124
125 ct_pptp_info = &nfct_help(ct)->help.ct_pptp_info;
126 nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info;
127
128 new_callid = ct_pptp_info->pns_call_id;
129
130 switch (msg = ntohs(ctlh->messageType)) {
131 case PPTP_OUT_CALL_REQUEST:
132 cid_off = offsetof(union pptp_ctrl_union, ocreq.callID);
133
134
135
136
137
138
139 nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id;
140
141
142
143 new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
144
145
146 ct_pptp_info->pns_call_id = new_callid;
147 break;
148 case PPTP_IN_CALL_REPLY:
149 cid_off = offsetof(union pptp_ctrl_union, icack.callID);
150 break;
151 case PPTP_CALL_CLEAR_REQUEST:
152 cid_off = offsetof(union pptp_ctrl_union, clrreq.callID);
153 break;
154 default:
155 pr_debug("unknown outbound packet 0x%04x:%s\n", msg,
156 msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
157 pptp_msg_name[0]);
158
159 case PPTP_SET_LINK_INFO:
160
161 case PPTP_START_SESSION_REQUEST:
162 case PPTP_START_SESSION_REPLY:
163 case PPTP_STOP_SESSION_REQUEST:
164 case PPTP_STOP_SESSION_REPLY:
165 case PPTP_ECHO_REQUEST:
166 case PPTP_ECHO_REPLY:
167
168 return NF_ACCEPT;
169 }
170
171
172
173 pr_debug("altering call id from 0x%04x to 0x%04x\n",
174 ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid));
175
176
177 if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
178 cid_off + sizeof(struct pptp_pkt_hdr) +
179 sizeof(struct PptpControlHeader),
180 sizeof(new_callid), (char *)&new_callid,
181 sizeof(new_callid)) == 0)
182 return NF_DROP;
183 return NF_ACCEPT;
184}
185
186static void
187pptp_exp_gre(struct nf_conntrack_expect *expect_orig,
188 struct nf_conntrack_expect *expect_reply)
189{
190 const struct nf_conn *ct = expect_orig->master;
191 struct nf_ct_pptp_master *ct_pptp_info;
192 struct nf_nat_pptp *nat_pptp_info;
193
194 ct_pptp_info = &nfct_help(ct)->help.ct_pptp_info;
195 nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info;
196
197
198 nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id;
199
200
201 expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id;
202 expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id;
203 expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id;
204 expect_orig->dir = IP_CT_DIR_ORIGINAL;
205
206
207 expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id;
208 expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id;
209 expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id;
210 expect_reply->dir = IP_CT_DIR_REPLY;
211}
212
213
214static int
215pptp_inbound_pkt(struct sk_buff *skb,
216 struct nf_conn *ct,
217 enum ip_conntrack_info ctinfo,
218 struct PptpControlHeader *ctlh,
219 union pptp_ctrl_union *pptpReq)
220{
221 const struct nf_nat_pptp *nat_pptp_info;
222 u_int16_t msg;
223 __be16 new_pcid;
224 unsigned int pcid_off;
225
226 nat_pptp_info = &nfct_nat(ct)->help.nat_pptp_info;
227 new_pcid = nat_pptp_info->pns_call_id;
228
229 switch (msg = ntohs(ctlh->messageType)) {
230 case PPTP_OUT_CALL_REPLY:
231 pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID);
232 break;
233 case PPTP_IN_CALL_CONNECT:
234 pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID);
235 break;
236 case PPTP_IN_CALL_REQUEST:
237
238 return NF_ACCEPT;
239 case PPTP_WAN_ERROR_NOTIFY:
240 pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID);
241 break;
242 case PPTP_CALL_DISCONNECT_NOTIFY:
243 pcid_off = offsetof(union pptp_ctrl_union, disc.callID);
244 break;
245 case PPTP_SET_LINK_INFO:
246 pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID);
247 break;
248 default:
249 pr_debug("unknown inbound packet %s\n",
250 msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
251 pptp_msg_name[0]);
252
253 case PPTP_START_SESSION_REQUEST:
254 case PPTP_START_SESSION_REPLY:
255 case PPTP_STOP_SESSION_REQUEST:
256 case PPTP_STOP_SESSION_REPLY:
257 case PPTP_ECHO_REQUEST:
258 case PPTP_ECHO_REPLY:
259
260 return NF_ACCEPT;
261 }
262
263
264
265
266
267 pr_debug("altering peer call id from 0x%04x to 0x%04x\n",
268 ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid));
269
270 if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
271 pcid_off + sizeof(struct pptp_pkt_hdr) +
272 sizeof(struct PptpControlHeader),
273 sizeof(new_pcid), (char *)&new_pcid,
274 sizeof(new_pcid)) == 0)
275 return NF_DROP;
276 return NF_ACCEPT;
277}
278
279static int __init nf_nat_helper_pptp_init(void)
280{
281 nf_nat_need_gre();
282
283 BUG_ON(nf_nat_pptp_hook_outbound != NULL);
284 rcu_assign_pointer(nf_nat_pptp_hook_outbound, pptp_outbound_pkt);
285
286 BUG_ON(nf_nat_pptp_hook_inbound != NULL);
287 rcu_assign_pointer(nf_nat_pptp_hook_inbound, pptp_inbound_pkt);
288
289 BUG_ON(nf_nat_pptp_hook_exp_gre != NULL);
290 rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, pptp_exp_gre);
291
292 BUG_ON(nf_nat_pptp_hook_expectfn != NULL);
293 rcu_assign_pointer(nf_nat_pptp_hook_expectfn, pptp_nat_expected);
294 return 0;
295}
296
297static void __exit nf_nat_helper_pptp_fini(void)
298{
299 rcu_assign_pointer(nf_nat_pptp_hook_expectfn, NULL);
300 rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, NULL);
301 rcu_assign_pointer(nf_nat_pptp_hook_inbound, NULL);
302 rcu_assign_pointer(nf_nat_pptp_hook_outbound, NULL);
303 synchronize_rcu();
304}
305
306module_init(nf_nat_helper_pptp_init);
307module_exit(nf_nat_helper_pptp_fini);
308