1 /*
2 * Copyright (C) 2002-2003 by Darren Reed
3 *
4 * Simple PPTP transparent proxy for in-kernel use. For use with the NAT
5 * code.
6 *
7 * $Id: ip_pptp_pxy.c,v 2.10.2.15 2006/10/31 12:11:23 darrenr Exp $
8 *
9 */
10 #define IPF_PPTP_PROXY
11
12 typedef struct pptp_hdr {
13 u_short pptph_len;
14 u_short pptph_type;
15 u_32_t pptph_cookie;
16 } pptp_hdr_t;
17
18 #define PPTP_MSGTYPE_CTL 1
19 #define PPTP_MTCTL_STARTREQ 1
20 #define PPTP_MTCTL_STARTREP 2
21 #define PPTP_MTCTL_STOPREQ 3
22 #define PPTP_MTCTL_STOPREP 4
23 #define PPTP_MTCTL_ECHOREQ 5
24 #define PPTP_MTCTL_ECHOREP 6
25 #define PPTP_MTCTL_OUTREQ 7
26 #define PPTP_MTCTL_OUTREP 8
27 #define PPTP_MTCTL_INREQ 9
28 #define PPTP_MTCTL_INREP 10
29 #define PPTP_MTCTL_INCONNECT 11
30 #define PPTP_MTCTL_CLEAR 12
31 #define PPTP_MTCTL_DISCONNECT 13
32 #define PPTP_MTCTL_WANERROR 14
33 #define PPTP_MTCTL_LINKINFO 15
34
35
36 int ippr_pptp_init __P((void));
37 void ippr_pptp_fini __P((void));
38 int ippr_pptp_new __P((fr_info_t *, ap_session_t *, nat_t *));
39 void ippr_pptp_del __P((ap_session_t *));
40 int ippr_pptp_inout __P((fr_info_t *, ap_session_t *, nat_t *));
41 void ippr_pptp_donatstate __P((fr_info_t *, nat_t *, pptp_pxy_t *));
42 int ippr_pptp_message __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
43 int ippr_pptp_nextmessage __P((fr_info_t *, nat_t *, pptp_pxy_t *, int));
44 int ippr_pptp_mctl __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
45
46 static frentry_t pptpfr;
47
48 int pptp_proxy_init = 0;
49 int ippr_pptp_debug = 0;
50 int ippr_pptp_gretimeout = IPF_TTLVAL(120); /* 2 minutes */
51
52
53 /*
54 * PPTP application proxy initialization.
55 */
ippr_pptp_init()56 int ippr_pptp_init()
57 {
58 bzero((char *)&pptpfr, sizeof(pptpfr));
59 pptpfr.fr_ref = 1;
60 pptpfr.fr_age[0] = ippr_pptp_gretimeout;
61 pptpfr.fr_age[1] = ippr_pptp_gretimeout;
62 pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
63 MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock");
64 pptp_proxy_init = 1;
65
66 return 0;
67 }
68
69
ippr_pptp_fini()70 void ippr_pptp_fini()
71 {
72 if (pptp_proxy_init == 1) {
73 MUTEX_DESTROY(&pptpfr.fr_lock);
74 pptp_proxy_init = 0;
75 }
76 }
77
78
79 /*
80 * Setup for a new PPTP proxy.
81 *
82 * NOTE: The printf's are broken up with %s in them to prevent them being
83 * optimised into puts statements on FreeBSD (this doesn't exist in the kernel)
84 */
ippr_pptp_new(fin,aps,nat)85 int ippr_pptp_new(fin, aps, nat)
86 fr_info_t *fin;
87 ap_session_t *aps;
88 nat_t *nat;
89 {
90 pptp_pxy_t *pptp;
91 ipnat_t *ipn;
92 ip_t *ip;
93
94 ip = fin->fin_ip;
95
96 if (nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_inip,
97 ip->ip_dst) != NULL) {
98 if (ippr_pptp_debug > 0)
99 printf("ippr_pptp_new: GRE session %s\n",
100 "already exists");
101 return -1;
102 }
103
104 aps->aps_psiz = sizeof(*pptp);
105 KMALLOCS(aps->aps_data, pptp_pxy_t *, sizeof(*pptp));
106 if (aps->aps_data == NULL) {
107 if (ippr_pptp_debug > 0)
108 printf("ippr_pptp_new: malloc for aps_data %s\n",
109 "failed");
110 return -1;
111 }
112
113 /*
114 * Create NAT rule against which the tunnel/transport mapping is
115 * created. This is required because the current NAT rule does not
116 * describe GRE but TCP instead.
117 */
118 pptp = aps->aps_data;
119 bzero((char *)pptp, sizeof(*pptp));
120 ipn = &pptp->pptp_rule;
121 ipn->in_ifps[0] = fin->fin_ifp;
122 ipn->in_apr = NULL;
123 ipn->in_use = 1;
124 ipn->in_hits = 1;
125 ipn->in_ippip = 1;
126 if (nat->nat_dir == NAT_OUTBOUND) {
127 ipn->in_nip = ntohl(nat->nat_outip.s_addr);
128 ipn->in_outip = fin->fin_saddr;
129 ipn->in_redir = NAT_MAP;
130 } else if (nat->nat_dir == NAT_INBOUND) {
131 ipn->in_nip = 0;
132 ipn->in_outip = nat->nat_outip.s_addr;
133 ipn->in_redir = NAT_REDIRECT;
134 }
135 ipn->in_inip = nat->nat_inip.s_addr;
136 ipn->in_inmsk = 0xffffffff;
137 ipn->in_outmsk = 0xffffffff;
138 ipn->in_srcip = fin->fin_saddr;
139 ipn->in_srcmsk = 0xffffffff;
140 bcopy(nat->nat_ptr->in_ifnames[0], ipn->in_ifnames[0],
141 sizeof(ipn->in_ifnames[0]));
142 ipn->in_p = IPPROTO_GRE;
143
144 pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer;
145 pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer;
146 return 0;
147 }
148
149
ippr_pptp_donatstate(fin,nat,pptp)150 void ippr_pptp_donatstate(fin, nat, pptp)
151 fr_info_t *fin;
152 nat_t *nat;
153 pptp_pxy_t *pptp;
154 {
155 fr_info_t fi;
156 grehdr_t gre;
157 nat_t *nat2;
158 u_char p;
159 ip_t *ip;
160
161 ip = fin->fin_ip;
162 p = ip->ip_p;
163
164 nat2 = pptp->pptp_nat;
165 if ((nat2 == NULL) || (pptp->pptp_state == NULL)) {
166 bcopy((char *)fin, (char *)&fi, sizeof(fi));
167 bzero((char *)&gre, sizeof(gre));
168 fi.fin_state = NULL;
169 fi.fin_nat = NULL;
170 fi.fin_fi.fi_p = IPPROTO_GRE;
171 fi.fin_fr = &pptpfr;
172 if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) ||
173 (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) {
174 fi.fin_data[0] = pptp->pptp_call[0];
175 fi.fin_data[1] = pptp->pptp_call[1];
176 } else {
177 fi.fin_data[0] = pptp->pptp_call[1];
178 fi.fin_data[1] = pptp->pptp_call[0];
179 }
180 ip = fin->fin_ip;
181 ip->ip_p = IPPROTO_GRE;
182 fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG);
183 fi.fin_flx |= FI_IGNORE;
184 fi.fin_dp = &gre;
185 gre.gr_flags = htons(1 << 13);
186 if (fin->fin_out && nat->nat_dir == NAT_INBOUND) {
187 fi.fin_fi.fi_saddr = fin->fin_fi.fi_daddr;
188 fi.fin_fi.fi_daddr = nat->nat_outip.s_addr;
189 } else if (!fin->fin_out && nat->nat_dir == NAT_OUTBOUND) {
190 fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
191 fi.fin_fi.fi_daddr = fin->fin_fi.fi_saddr;
192 }
193 }
194
195 /*
196 * Update NAT timeout/create NAT if missing.
197 */
198 if (nat2 != NULL)
199 fr_queueback(&nat2->nat_tqe);
200 else {
201 nat2 = nat_new(&fi, &pptp->pptp_rule, &pptp->pptp_nat,
202 NAT_SLAVE, nat->nat_dir);
203 pptp->pptp_nat = nat2;
204 if (nat2 != NULL) {
205 (void) nat_proto(&fi, nat2, 0);
206 nat_update(&fi, nat2, nat2->nat_ptr);
207 }
208 }
209
210 READ_ENTER(&ipf_state);
211 if (pptp->pptp_state != NULL) {
212 fr_queueback(&pptp->pptp_state->is_sti);
213 RWLOCK_EXIT(&ipf_state);
214 } else {
215 RWLOCK_EXIT(&ipf_state);
216 if (nat2 != NULL) {
217 if (nat->nat_dir == NAT_INBOUND)
218 fi.fin_fi.fi_daddr = nat2->nat_inip.s_addr;
219 else
220 fi.fin_fi.fi_saddr = nat2->nat_inip.s_addr;
221 }
222 fi.fin_ifp = NULL;
223 pptp->pptp_state = fr_addstate(&fi, &pptp->pptp_state,
224 0);
225 if (fi.fin_state != NULL)
226 fr_statederef((ipstate_t **)&fi.fin_state);
227 }
228 ip->ip_p = p;
229 return;
230 }
231
232
233 /*
234 * Try and build up the next PPTP message in the TCP stream and if we can
235 * build it up completely (fits in our buffer) then pass it off to the message
236 * parsing function.
237 */
ippr_pptp_nextmessage(fin,nat,pptp,rev)238 int ippr_pptp_nextmessage(fin, nat, pptp, rev)
239 fr_info_t *fin;
240 nat_t *nat;
241 pptp_pxy_t *pptp;
242 int rev;
243 {
244 static const char *funcname = "ippr_pptp_nextmessage";
245 pptp_side_t *pptps;
246 u_32_t start, end;
247 pptp_hdr_t *hdr;
248 tcphdr_t *tcp;
249 int dlen, off;
250 u_short len;
251 char *msg;
252
253 tcp = fin->fin_dp;
254 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
255 start = ntohl(tcp->th_seq);
256 pptps = &pptp->pptp_side[rev];
257 off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) +
258 fin->fin_ipoff;
259
260 if (dlen <= 0)
261 return 0;
262 /*
263 * If the complete data packet is before what we expect to see
264 * "next", just ignore it as the chances are we've already seen it.
265 * The next if statement following this one really just causes packets
266 * ahead of what we've seen to be dropped, implying that something in
267 * the middle went missing and we want to see that first.
268 */
269 end = start + dlen;
270 if (pptps->pptps_next > end && pptps->pptps_next > start)
271 return 0;
272
273 if (pptps->pptps_next != start) {
274 if (ippr_pptp_debug > 5)
275 printf("%s: next (%x) != start (%x)\n", funcname,
276 pptps->pptps_next, start);
277 return -1;
278 }
279
280 msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2);
281
282 while (dlen > 0) {
283 off += pptps->pptps_bytes;
284 if (pptps->pptps_gothdr == 0) {
285 /*
286 * PPTP has an 8 byte header that inclues the cookie.
287 * The start of every message should include one and
288 * it should match 1a2b3c4d. Byte order is ignored,
289 * deliberately, when printing out the error.
290 */
291 len = MIN(8 - pptps->pptps_bytes, dlen);
292 COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
293 pptps->pptps_bytes += len;
294 pptps->pptps_wptr += len;
295 hdr = (pptp_hdr_t *)pptps->pptps_buffer;
296 if (pptps->pptps_bytes == 8) {
297 pptps->pptps_next += 8;
298 if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) {
299 if (ippr_pptp_debug > 1)
300 printf("%s: bad cookie (%x)\n",
301 funcname,
302 hdr->pptph_cookie);
303 return -1;
304 }
305 }
306 dlen -= len;
307 msg += len;
308 off += len;
309
310 pptps->pptps_gothdr = 1;
311 len = ntohs(hdr->pptph_len);
312 pptps->pptps_len = len;
313 pptps->pptps_nexthdr += len;
314
315 /*
316 * If a message is too big for the buffer, just set
317 * the fields for the next message to come along.
318 * The messages defined in RFC 2637 will not exceed
319 * 512 bytes (in total length) so this is likely a
320 * bad data packet, anyway.
321 */
322 if (len > sizeof(pptps->pptps_buffer)) {
323 if (ippr_pptp_debug > 3)
324 printf("%s: message too big (%d)\n",
325 funcname, len);
326 pptps->pptps_next = pptps->pptps_nexthdr;
327 pptps->pptps_wptr = pptps->pptps_buffer;
328 pptps->pptps_gothdr = 0;
329 pptps->pptps_bytes = 0;
330 pptps->pptps_len = 0;
331 break;
332 }
333 }
334
335 len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
336 COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
337 pptps->pptps_bytes += len;
338 pptps->pptps_wptr += len;
339 pptps->pptps_next += len;
340
341 if (pptps->pptps_len > pptps->pptps_bytes)
342 break;
343
344 ippr_pptp_message(fin, nat, pptp, pptps);
345 pptps->pptps_wptr = pptps->pptps_buffer;
346 pptps->pptps_gothdr = 0;
347 pptps->pptps_bytes = 0;
348 pptps->pptps_len = 0;
349
350 start += len;
351 msg += len;
352 dlen -= len;
353 }
354
355 return 0;
356 }
357
358
359 /*
360 * handle a complete PPTP message
361 */
ippr_pptp_message(fin,nat,pptp,pptps)362 int ippr_pptp_message(fin, nat, pptp, pptps)
363 fr_info_t *fin;
364 nat_t *nat;
365 pptp_pxy_t *pptp;
366 pptp_side_t *pptps;
367 {
368 pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer;
369
370 switch (ntohs(hdr->pptph_type))
371 {
372 case PPTP_MSGTYPE_CTL :
373 ippr_pptp_mctl(fin, nat, pptp, pptps);
374 break;
375
376 default :
377 break;
378 }
379 return 0;
380 }
381
382
383 /*
384 * handle a complete PPTP control message
385 */
ippr_pptp_mctl(fin,nat,pptp,pptps)386 int ippr_pptp_mctl(fin, nat, pptp, pptps)
387 fr_info_t *fin;
388 nat_t *nat;
389 pptp_pxy_t *pptp;
390 pptp_side_t *pptps;
391 {
392 u_short *buffer = (u_short *)(pptps->pptps_buffer);
393 pptp_side_t *pptpo;
394
395 if (pptps == &pptp->pptp_side[0])
396 pptpo = &pptp->pptp_side[1];
397 else
398 pptpo = &pptp->pptp_side[0];
399
400 /*
401 * Breakout to handle all the various messages. Most are just state
402 * transition.
403 */
404 switch (ntohs(buffer[4]))
405 {
406 case PPTP_MTCTL_STARTREQ :
407 pptps->pptps_state = PPTP_MTCTL_STARTREQ;
408 break;
409 case PPTP_MTCTL_STARTREP :
410 if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ)
411 pptps->pptps_state = PPTP_MTCTL_STARTREP;
412 break;
413 case PPTP_MTCTL_STOPREQ :
414 pptps->pptps_state = PPTP_MTCTL_STOPREQ;
415 break;
416 case PPTP_MTCTL_STOPREP :
417 if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ)
418 pptps->pptps_state = PPTP_MTCTL_STOPREP;
419 break;
420 case PPTP_MTCTL_ECHOREQ :
421 pptps->pptps_state = PPTP_MTCTL_ECHOREQ;
422 break;
423 case PPTP_MTCTL_ECHOREP :
424 if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ)
425 pptps->pptps_state = PPTP_MTCTL_ECHOREP;
426 break;
427 case PPTP_MTCTL_OUTREQ :
428 pptps->pptps_state = PPTP_MTCTL_OUTREQ;
429 break;
430 case PPTP_MTCTL_OUTREP :
431 if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) {
432 pptps->pptps_state = PPTP_MTCTL_OUTREP;
433 pptp->pptp_call[0] = buffer[7];
434 pptp->pptp_call[1] = buffer[6];
435 ippr_pptp_donatstate(fin, nat, pptp);
436 }
437 break;
438 case PPTP_MTCTL_INREQ :
439 pptps->pptps_state = PPTP_MTCTL_INREQ;
440 break;
441 case PPTP_MTCTL_INREP :
442 if (pptpo->pptps_state == PPTP_MTCTL_INREQ) {
443 pptps->pptps_state = PPTP_MTCTL_INREP;
444 pptp->pptp_call[0] = buffer[7];
445 pptp->pptp_call[1] = buffer[6];
446 ippr_pptp_donatstate(fin, nat, pptp);
447 }
448 break;
449 case PPTP_MTCTL_INCONNECT :
450 pptps->pptps_state = PPTP_MTCTL_INCONNECT;
451 break;
452 case PPTP_MTCTL_CLEAR :
453 pptps->pptps_state = PPTP_MTCTL_CLEAR;
454 break;
455 case PPTP_MTCTL_DISCONNECT :
456 pptps->pptps_state = PPTP_MTCTL_DISCONNECT;
457 break;
458 case PPTP_MTCTL_WANERROR :
459 pptps->pptps_state = PPTP_MTCTL_WANERROR;
460 break;
461 case PPTP_MTCTL_LINKINFO :
462 pptps->pptps_state = PPTP_MTCTL_LINKINFO;
463 break;
464 }
465
466 return 0;
467 }
468
469
470 /*
471 * For outgoing PPTP packets. refresh timeouts for NAT & state entries, if
472 * we can. If they have disappeared, recreate them.
473 */
ippr_pptp_inout(fin,aps,nat)474 int ippr_pptp_inout(fin, aps, nat)
475 fr_info_t *fin;
476 ap_session_t *aps;
477 nat_t *nat;
478 {
479 pptp_pxy_t *pptp;
480 tcphdr_t *tcp;
481 int rev;
482
483 if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND))
484 rev = 1;
485 else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND))
486 rev = 1;
487 else
488 rev = 0;
489
490 tcp = (tcphdr_t *)fin->fin_dp;
491 if ((tcp->th_flags & TH_OPENING) == TH_OPENING) {
492 pptp = (pptp_pxy_t *)aps->aps_data;
493 pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack);
494 pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack);
495 pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1;
496 pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1;
497 }
498 return ippr_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data,
499 rev);
500 }
501
502
503 /*
504 * clean up after ourselves.
505 */
ippr_pptp_del(aps)506 void ippr_pptp_del(aps)
507 ap_session_t *aps;
508 {
509 pptp_pxy_t *pptp;
510
511 pptp = aps->aps_data;
512
513 if (pptp != NULL) {
514 /*
515 * Don't bother changing any of the NAT structure details,
516 * *_del() is on a callback from aps_free(), from nat_delete()
517 */
518
519 READ_ENTER(&ipf_state);
520 if (pptp->pptp_state != NULL) {
521 pptp->pptp_state->is_die = fr_ticks + 1;
522 pptp->pptp_state->is_me = NULL;
523 fr_queuefront(&pptp->pptp_state->is_sti);
524 }
525 RWLOCK_EXIT(&ipf_state);
526
527 pptp->pptp_state = NULL;
528 pptp->pptp_nat = NULL;
529 }
530 }
531