1 /* 2 * nf_nat_pptp.c 3 * 4 * NAT support for PPTP (Point to Point Tunneling Protocol). 5 * PPTP is a a protocol for creating virtual private networks. 6 * It is a specification defined by Microsoft and some vendors 7 * working with Microsoft. PPTP is built on top of a modified 8 * version of the Internet Generic Routing Encapsulation Protocol. 9 * GRE is defined in RFC 1701 and RFC 1702. Documentation of 10 * PPTP can be found in RFC 2637 11 * 12 * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> 13 * 14 * Development of this code funded by Astaro AG (http://www.astaro.com/) 15 * 16 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 17 * 18 * TODO: - NAT to a unique tuple, not to TCP source port 19 * (needs netfilter tuple reservation) 20 */ 21 22 #include <linux/module.h> 23 #include <linux/tcp.h> 24 25 #include <net/netfilter/nf_nat.h> 26 #include <net/netfilter/nf_nat_helper.h> 27 #include <net/netfilter/nf_conntrack_helper.h> 28 #include <net/netfilter/nf_conntrack_expect.h> 29 #include <net/netfilter/nf_conntrack_zones.h> 30 #include <linux/netfilter/nf_conntrack_proto_gre.h> 31 #include <linux/netfilter/nf_conntrack_pptp.h> 32 33 #define NF_NAT_PPTP_VERSION "3.0" 34 35 #define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off))) 36 37 MODULE_LICENSE("GPL"); 38 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); 39 MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP"); 40 MODULE_ALIAS("ip_nat_pptp"); 41 42 static void pptp_nat_expected(struct nf_conn *ct, 43 struct nf_conntrack_expect *exp) 44 { 45 struct net *net = nf_ct_net(ct); 46 const struct nf_conn *master = ct->master; 47 struct nf_conntrack_expect *other_exp; 48 struct nf_conntrack_tuple t = {}; 49 const struct nf_ct_pptp_master *ct_pptp_info; 50 const struct nf_nat_pptp *nat_pptp_info; 51 struct nf_nat_range2 range; 52 struct nf_conn_nat *nat; 53 54 nat = nf_ct_nat_ext_add(ct); 55 if (WARN_ON_ONCE(!nat)) 56 return; 57 58 nat_pptp_info = &nat->help.nat_pptp_info; 59 ct_pptp_info = nfct_help_data(master); 60 61 /* And here goes the grand finale of corrosion... */ 62 if (exp->dir == IP_CT_DIR_ORIGINAL) { 63 pr_debug("we are PNS->PAC\n"); 64 /* therefore, build tuple for PAC->PNS */ 65 t.src.l3num = AF_INET; 66 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; 67 t.src.u.gre.key = ct_pptp_info->pac_call_id; 68 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; 69 t.dst.u.gre.key = ct_pptp_info->pns_call_id; 70 t.dst.protonum = IPPROTO_GRE; 71 } else { 72 pr_debug("we are PAC->PNS\n"); 73 /* build tuple for PNS->PAC */ 74 t.src.l3num = AF_INET; 75 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; 76 t.src.u.gre.key = nat_pptp_info->pns_call_id; 77 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; 78 t.dst.u.gre.key = nat_pptp_info->pac_call_id; 79 t.dst.protonum = IPPROTO_GRE; 80 } 81 82 pr_debug("trying to unexpect other dir: "); 83 nf_ct_dump_tuple_ip(&t); 84 other_exp = nf_ct_expect_find_get(net, nf_ct_zone(ct), &t); 85 if (other_exp) { 86 nf_ct_unexpect_related(other_exp); 87 nf_ct_expect_put(other_exp); 88 pr_debug("success\n"); 89 } else { 90 pr_debug("not found!\n"); 91 } 92 93 /* This must be a fresh one. */ 94 BUG_ON(ct->status & IPS_NAT_DONE_MASK); 95 96 /* Change src to where master sends to */ 97 range.flags = NF_NAT_RANGE_MAP_IPS; 98 range.min_addr = range.max_addr 99 = ct->master->tuplehash[!exp->dir].tuple.dst.u3; 100 if (exp->dir == IP_CT_DIR_ORIGINAL) { 101 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 102 range.min_proto = range.max_proto = exp->saved_proto; 103 } 104 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC); 105 106 /* For DST manip, map port here to where it's expected. */ 107 range.flags = NF_NAT_RANGE_MAP_IPS; 108 range.min_addr = range.max_addr 109 = ct->master->tuplehash[!exp->dir].tuple.src.u3; 110 if (exp->dir == IP_CT_DIR_REPLY) { 111 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 112 range.min_proto = range.max_proto = exp->saved_proto; 113 } 114 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST); 115 } 116 117 /* outbound packets == from PNS to PAC */ 118 static int 119 pptp_outbound_pkt(struct sk_buff *skb, 120 struct nf_conn *ct, 121 enum ip_conntrack_info ctinfo, 122 unsigned int protoff, 123 struct PptpControlHeader *ctlh, 124 union pptp_ctrl_union *pptpReq) 125 126 { 127 struct nf_ct_pptp_master *ct_pptp_info; 128 struct nf_conn_nat *nat = nfct_nat(ct); 129 struct nf_nat_pptp *nat_pptp_info; 130 u_int16_t msg; 131 __be16 new_callid; 132 unsigned int cid_off; 133 134 if (WARN_ON_ONCE(!nat)) 135 return NF_DROP; 136 137 nat_pptp_info = &nat->help.nat_pptp_info; 138 ct_pptp_info = nfct_help_data(ct); 139 140 new_callid = ct_pptp_info->pns_call_id; 141 142 switch (msg = ntohs(ctlh->messageType)) { 143 case PPTP_OUT_CALL_REQUEST: 144 cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); 145 /* FIXME: ideally we would want to reserve a call ID 146 * here. current netfilter NAT core is not able to do 147 * this :( For now we use TCP source port. This breaks 148 * multiple calls within one control session */ 149 150 /* save original call ID in nat_info */ 151 nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; 152 153 /* don't use tcph->source since we are at a DSTmanip 154 * hook (e.g. PREROUTING) and pkt is not mangled yet */ 155 new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; 156 157 /* save new call ID in ct info */ 158 ct_pptp_info->pns_call_id = new_callid; 159 break; 160 case PPTP_IN_CALL_REPLY: 161 cid_off = offsetof(union pptp_ctrl_union, icack.callID); 162 break; 163 case PPTP_CALL_CLEAR_REQUEST: 164 cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); 165 break; 166 default: 167 pr_debug("unknown outbound packet 0x%04x:%s\n", msg, 168 msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : 169 pptp_msg_name[0]); 170 /* fall through */ 171 case PPTP_SET_LINK_INFO: 172 /* only need to NAT in case PAC is behind NAT box */ 173 case PPTP_START_SESSION_REQUEST: 174 case PPTP_START_SESSION_REPLY: 175 case PPTP_STOP_SESSION_REQUEST: 176 case PPTP_STOP_SESSION_REPLY: 177 case PPTP_ECHO_REQUEST: 178 case PPTP_ECHO_REPLY: 179 /* no need to alter packet */ 180 return NF_ACCEPT; 181 } 182 183 /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass 184 * down to here */ 185 pr_debug("altering call id from 0x%04x to 0x%04x\n", 186 ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); 187 188 /* mangle packet */ 189 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, 190 cid_off + sizeof(struct pptp_pkt_hdr) + 191 sizeof(struct PptpControlHeader), 192 sizeof(new_callid), (char *)&new_callid, 193 sizeof(new_callid))) 194 return NF_DROP; 195 return NF_ACCEPT; 196 } 197 198 static void 199 pptp_exp_gre(struct nf_conntrack_expect *expect_orig, 200 struct nf_conntrack_expect *expect_reply) 201 { 202 const struct nf_conn *ct = expect_orig->master; 203 struct nf_conn_nat *nat = nfct_nat(ct); 204 struct nf_ct_pptp_master *ct_pptp_info; 205 struct nf_nat_pptp *nat_pptp_info; 206 207 if (WARN_ON_ONCE(!nat)) 208 return; 209 210 nat_pptp_info = &nat->help.nat_pptp_info; 211 ct_pptp_info = nfct_help_data(ct); 212 213 /* save original PAC call ID in nat_info */ 214 nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; 215 216 /* alter expectation for PNS->PAC direction */ 217 expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; 218 expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; 219 expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; 220 expect_orig->dir = IP_CT_DIR_ORIGINAL; 221 222 /* alter expectation for PAC->PNS direction */ 223 expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; 224 expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; 225 expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; 226 expect_reply->dir = IP_CT_DIR_REPLY; 227 } 228 229 /* inbound packets == from PAC to PNS */ 230 static int 231 pptp_inbound_pkt(struct sk_buff *skb, 232 struct nf_conn *ct, 233 enum ip_conntrack_info ctinfo, 234 unsigned int protoff, 235 struct PptpControlHeader *ctlh, 236 union pptp_ctrl_union *pptpReq) 237 { 238 const struct nf_nat_pptp *nat_pptp_info; 239 struct nf_conn_nat *nat = nfct_nat(ct); 240 u_int16_t msg; 241 __be16 new_pcid; 242 unsigned int pcid_off; 243 244 if (WARN_ON_ONCE(!nat)) 245 return NF_DROP; 246 247 nat_pptp_info = &nat->help.nat_pptp_info; 248 new_pcid = nat_pptp_info->pns_call_id; 249 250 switch (msg = ntohs(ctlh->messageType)) { 251 case PPTP_OUT_CALL_REPLY: 252 pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); 253 break; 254 case PPTP_IN_CALL_CONNECT: 255 pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); 256 break; 257 case PPTP_IN_CALL_REQUEST: 258 /* only need to nat in case PAC is behind NAT box */ 259 return NF_ACCEPT; 260 case PPTP_WAN_ERROR_NOTIFY: 261 pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); 262 break; 263 case PPTP_CALL_DISCONNECT_NOTIFY: 264 pcid_off = offsetof(union pptp_ctrl_union, disc.callID); 265 break; 266 case PPTP_SET_LINK_INFO: 267 pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); 268 break; 269 default: 270 pr_debug("unknown inbound packet %s\n", 271 msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : 272 pptp_msg_name[0]); 273 /* fall through */ 274 case PPTP_START_SESSION_REQUEST: 275 case PPTP_START_SESSION_REPLY: 276 case PPTP_STOP_SESSION_REQUEST: 277 case PPTP_STOP_SESSION_REPLY: 278 case PPTP_ECHO_REQUEST: 279 case PPTP_ECHO_REPLY: 280 /* no need to alter packet */ 281 return NF_ACCEPT; 282 } 283 284 /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, 285 * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ 286 287 /* mangle packet */ 288 pr_debug("altering peer call id from 0x%04x to 0x%04x\n", 289 ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); 290 291 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, 292 pcid_off + sizeof(struct pptp_pkt_hdr) + 293 sizeof(struct PptpControlHeader), 294 sizeof(new_pcid), (char *)&new_pcid, 295 sizeof(new_pcid))) 296 return NF_DROP; 297 return NF_ACCEPT; 298 } 299 300 static int __init nf_nat_helper_pptp_init(void) 301 { 302 nf_nat_need_gre(); 303 304 BUG_ON(nf_nat_pptp_hook_outbound != NULL); 305 RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, pptp_outbound_pkt); 306 307 BUG_ON(nf_nat_pptp_hook_inbound != NULL); 308 RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, pptp_inbound_pkt); 309 310 BUG_ON(nf_nat_pptp_hook_exp_gre != NULL); 311 RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, pptp_exp_gre); 312 313 BUG_ON(nf_nat_pptp_hook_expectfn != NULL); 314 RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, pptp_nat_expected); 315 return 0; 316 } 317 318 static void __exit nf_nat_helper_pptp_fini(void) 319 { 320 RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, NULL); 321 RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, NULL); 322 RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, NULL); 323 RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, NULL); 324 synchronize_rcu(); 325 } 326 327 module_init(nf_nat_helper_pptp_init); 328 module_exit(nf_nat_helper_pptp_fini); 329