1 /*
2  * Copyright (C) 2002-2003 by Darren Reed
3  *
4  * Simple PPTP transparent proxy for in-kernel use.  For use with the NAT
5  * code.
6  *
7  * $Id: ip_pptp_pxy.c,v 2.10.2.15 2006/10/31 12:11:23 darrenr Exp $
8  *
9  */
10 #define	IPF_PPTP_PROXY
11 
12 typedef	struct pptp_hdr {
13 	u_short	pptph_len;
14 	u_short	pptph_type;
15 	u_32_t	pptph_cookie;
16 } pptp_hdr_t;
17 
18 #define	PPTP_MSGTYPE_CTL	1
19 #define	PPTP_MTCTL_STARTREQ	1
20 #define	PPTP_MTCTL_STARTREP	2
21 #define	PPTP_MTCTL_STOPREQ	3
22 #define	PPTP_MTCTL_STOPREP	4
23 #define	PPTP_MTCTL_ECHOREQ	5
24 #define	PPTP_MTCTL_ECHOREP	6
25 #define	PPTP_MTCTL_OUTREQ	7
26 #define	PPTP_MTCTL_OUTREP	8
27 #define	PPTP_MTCTL_INREQ	9
28 #define	PPTP_MTCTL_INREP	10
29 #define	PPTP_MTCTL_INCONNECT	11
30 #define	PPTP_MTCTL_CLEAR	12
31 #define	PPTP_MTCTL_DISCONNECT	13
32 #define	PPTP_MTCTL_WANERROR	14
33 #define	PPTP_MTCTL_LINKINFO	15
34 
35 
36 int ippr_pptp_init __P((void));
37 void ippr_pptp_fini __P((void));
38 int ippr_pptp_new __P((fr_info_t *, ap_session_t *, nat_t *));
39 void ippr_pptp_del __P((ap_session_t *));
40 int ippr_pptp_inout __P((fr_info_t *, ap_session_t *, nat_t *));
41 void ippr_pptp_donatstate __P((fr_info_t *, nat_t *, pptp_pxy_t *));
42 int ippr_pptp_message __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
43 int ippr_pptp_nextmessage __P((fr_info_t *, nat_t *, pptp_pxy_t *, int));
44 int ippr_pptp_mctl __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
45 
46 static	frentry_t	pptpfr;
47 
48 int	pptp_proxy_init = 0;
49 int	ippr_pptp_debug = 0;
50 int	ippr_pptp_gretimeout = IPF_TTLVAL(120);	/* 2 minutes */
51 
52 
53 /*
54  * PPTP application proxy initialization.
55  */
ippr_pptp_init()56 int ippr_pptp_init()
57 {
58 	bzero((char *)&pptpfr, sizeof(pptpfr));
59 	pptpfr.fr_ref = 1;
60 	pptpfr.fr_age[0] = ippr_pptp_gretimeout;
61 	pptpfr.fr_age[1] = ippr_pptp_gretimeout;
62 	pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
63 	MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock");
64 	pptp_proxy_init = 1;
65 
66 	return 0;
67 }
68 
69 
ippr_pptp_fini()70 void ippr_pptp_fini()
71 {
72 	if (pptp_proxy_init == 1) {
73 		MUTEX_DESTROY(&pptpfr.fr_lock);
74 		pptp_proxy_init = 0;
75 	}
76 }
77 
78 
79 /*
80  * Setup for a new PPTP proxy.
81  *
82  * NOTE: The printf's are broken up with %s in them to prevent them being
83  * optimised into puts statements on FreeBSD (this doesn't exist in the kernel)
84  */
ippr_pptp_new(fin,aps,nat)85 int ippr_pptp_new(fin, aps, nat)
86 fr_info_t *fin;
87 ap_session_t *aps;
88 nat_t *nat;
89 {
90 	pptp_pxy_t *pptp;
91 	ipnat_t *ipn;
92 	ip_t *ip;
93 
94 	ip = fin->fin_ip;
95 
96 	if (nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_inip,
97 			  ip->ip_dst) != NULL) {
98 		if (ippr_pptp_debug > 0)
99 			printf("ippr_pptp_new: GRE session %s\n",
100 			       "already exists");
101 		return -1;
102 	}
103 
104 	aps->aps_psiz = sizeof(*pptp);
105 	KMALLOCS(aps->aps_data, pptp_pxy_t *, sizeof(*pptp));
106 	if (aps->aps_data == NULL) {
107 		if (ippr_pptp_debug > 0)
108 			printf("ippr_pptp_new: malloc for aps_data %s\n",
109 			       "failed");
110 		return -1;
111 	}
112 
113 	/*
114 	 * Create NAT rule against which the tunnel/transport mapping is
115 	 * created.  This is required because the current NAT rule does not
116 	 * describe GRE but TCP instead.
117 	 */
118 	pptp = aps->aps_data;
119 	bzero((char *)pptp, sizeof(*pptp));
120 	ipn = &pptp->pptp_rule;
121 	ipn->in_ifps[0] = fin->fin_ifp;
122 	ipn->in_apr = NULL;
123 	ipn->in_use = 1;
124 	ipn->in_hits = 1;
125 	ipn->in_ippip = 1;
126 	if (nat->nat_dir == NAT_OUTBOUND) {
127 		ipn->in_nip = ntohl(nat->nat_outip.s_addr);
128 		ipn->in_outip = fin->fin_saddr;
129 		ipn->in_redir = NAT_MAP;
130 	} else if (nat->nat_dir == NAT_INBOUND) {
131 		ipn->in_nip = 0;
132 		ipn->in_outip = nat->nat_outip.s_addr;
133 		ipn->in_redir = NAT_REDIRECT;
134 	}
135 	ipn->in_inip = nat->nat_inip.s_addr;
136 	ipn->in_inmsk = 0xffffffff;
137 	ipn->in_outmsk = 0xffffffff;
138 	ipn->in_srcip = fin->fin_saddr;
139 	ipn->in_srcmsk = 0xffffffff;
140 	bcopy(nat->nat_ptr->in_ifnames[0], ipn->in_ifnames[0],
141 	      sizeof(ipn->in_ifnames[0]));
142 	ipn->in_p = IPPROTO_GRE;
143 
144 	pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer;
145 	pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer;
146 	return 0;
147 }
148 
149 
ippr_pptp_donatstate(fin,nat,pptp)150 void ippr_pptp_donatstate(fin, nat, pptp)
151 fr_info_t *fin;
152 nat_t *nat;
153 pptp_pxy_t *pptp;
154 {
155 	fr_info_t fi;
156 	grehdr_t gre;
157 	nat_t *nat2;
158 	u_char p;
159 	ip_t *ip;
160 
161 	ip = fin->fin_ip;
162 	p = ip->ip_p;
163 
164 	nat2 = pptp->pptp_nat;
165 	if ((nat2 == NULL) || (pptp->pptp_state == NULL)) {
166 		bcopy((char *)fin, (char *)&fi, sizeof(fi));
167 		bzero((char *)&gre, sizeof(gre));
168 		fi.fin_state = NULL;
169 		fi.fin_nat = NULL;
170 		fi.fin_fi.fi_p = IPPROTO_GRE;
171 		fi.fin_fr = &pptpfr;
172 		if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) ||
173 		    (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) {
174 			fi.fin_data[0] = pptp->pptp_call[0];
175 			fi.fin_data[1] = pptp->pptp_call[1];
176 		} else {
177 			fi.fin_data[0] = pptp->pptp_call[1];
178 			fi.fin_data[1] = pptp->pptp_call[0];
179 		}
180 		ip = fin->fin_ip;
181 		ip->ip_p = IPPROTO_GRE;
182 		fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG);
183 		fi.fin_flx |= FI_IGNORE;
184 		fi.fin_dp = &gre;
185 		gre.gr_flags = htons(1 << 13);
186 		if (fin->fin_out && nat->nat_dir == NAT_INBOUND) {
187 			fi.fin_fi.fi_saddr = fin->fin_fi.fi_daddr;
188 			fi.fin_fi.fi_daddr = nat->nat_outip.s_addr;
189 		} else if (!fin->fin_out && nat->nat_dir == NAT_OUTBOUND) {
190 			fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
191 			fi.fin_fi.fi_daddr = fin->fin_fi.fi_saddr;
192 		}
193 	}
194 
195 	/*
196 	 * Update NAT timeout/create NAT if missing.
197 	 */
198 	if (nat2 != NULL)
199 		fr_queueback(&nat2->nat_tqe);
200 	else {
201 		nat2 = nat_new(&fi, &pptp->pptp_rule, &pptp->pptp_nat,
202 			       NAT_SLAVE, nat->nat_dir);
203 		pptp->pptp_nat = nat2;
204 		if (nat2 != NULL) {
205 			(void) nat_proto(&fi, nat2, 0);
206 			nat_update(&fi, nat2, nat2->nat_ptr);
207 		}
208 	}
209 
210 	READ_ENTER(&ipf_state);
211 	if (pptp->pptp_state != NULL) {
212 		fr_queueback(&pptp->pptp_state->is_sti);
213 		RWLOCK_EXIT(&ipf_state);
214 	} else {
215 		RWLOCK_EXIT(&ipf_state);
216 		if (nat2 != NULL) {
217 			if (nat->nat_dir == NAT_INBOUND)
218 				fi.fin_fi.fi_daddr = nat2->nat_inip.s_addr;
219 			else
220 				fi.fin_fi.fi_saddr = nat2->nat_inip.s_addr;
221 		}
222 		fi.fin_ifp = NULL;
223 		pptp->pptp_state = fr_addstate(&fi, &pptp->pptp_state,
224 					       0);
225 		if (fi.fin_state != NULL)
226 			fr_statederef((ipstate_t **)&fi.fin_state);
227 	}
228 	ip->ip_p = p;
229 	return;
230 }
231 
232 
233 /*
234  * Try and build up the next PPTP message in the TCP stream and if we can
235  * build it up completely (fits in our buffer) then pass it off to the message
236  * parsing function.
237  */
ippr_pptp_nextmessage(fin,nat,pptp,rev)238 int ippr_pptp_nextmessage(fin, nat, pptp, rev)
239 fr_info_t *fin;
240 nat_t *nat;
241 pptp_pxy_t *pptp;
242 int rev;
243 {
244 	static const char *funcname = "ippr_pptp_nextmessage";
245 	pptp_side_t *pptps;
246 	u_32_t start, end;
247 	pptp_hdr_t *hdr;
248 	tcphdr_t *tcp;
249 	int dlen, off;
250 	u_short len;
251 	char *msg;
252 
253 	tcp = fin->fin_dp;
254 	dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
255 	start = ntohl(tcp->th_seq);
256 	pptps = &pptp->pptp_side[rev];
257 	off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) +
258 	      fin->fin_ipoff;
259 
260 	if (dlen <= 0)
261 		return 0;
262 	/*
263 	 * If the complete data packet is before what we expect to see
264 	 * "next", just ignore it as the chances are we've already seen it.
265 	 * The next if statement following this one really just causes packets
266 	 * ahead of what we've seen to be dropped, implying that something in
267 	 * the middle went missing and we want to see that first.
268 	 */
269 	end = start + dlen;
270 	if (pptps->pptps_next > end && pptps->pptps_next > start)
271 		return 0;
272 
273 	if (pptps->pptps_next != start) {
274 		if (ippr_pptp_debug > 5)
275 			printf("%s: next (%x) != start (%x)\n", funcname,
276 				pptps->pptps_next, start);
277 		return -1;
278 	}
279 
280 	msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2);
281 
282 	while (dlen > 0) {
283 		off += pptps->pptps_bytes;
284 		if (pptps->pptps_gothdr == 0) {
285 			/*
286 			 * PPTP has an 8 byte header that inclues the cookie.
287 			 * The start of every message should include one and
288 			 * it should match 1a2b3c4d.  Byte order is ignored,
289 			 * deliberately, when printing out the error.
290 			 */
291 			len = MIN(8 - pptps->pptps_bytes, dlen);
292 			COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
293 			pptps->pptps_bytes += len;
294 			pptps->pptps_wptr += len;
295 			hdr = (pptp_hdr_t *)pptps->pptps_buffer;
296 			if (pptps->pptps_bytes == 8) {
297 				pptps->pptps_next += 8;
298 				if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) {
299 					if (ippr_pptp_debug > 1)
300 						printf("%s: bad cookie (%x)\n",
301 						       funcname,
302 						       hdr->pptph_cookie);
303 					return -1;
304 				}
305 			}
306 			dlen -= len;
307 			msg += len;
308 			off += len;
309 
310 			pptps->pptps_gothdr = 1;
311 			len = ntohs(hdr->pptph_len);
312 			pptps->pptps_len = len;
313 			pptps->pptps_nexthdr += len;
314 
315 			/*
316 			 * If a message is too big for the buffer, just set
317 			 * the fields for the next message to come along.
318 			 * The messages defined in RFC 2637 will not exceed
319 			 * 512 bytes (in total length) so this is likely a
320 			 * bad data packet, anyway.
321 			 */
322 			if (len > sizeof(pptps->pptps_buffer)) {
323 				if (ippr_pptp_debug > 3)
324 					printf("%s: message too big (%d)\n",
325 					       funcname, len);
326 				pptps->pptps_next = pptps->pptps_nexthdr;
327 				pptps->pptps_wptr = pptps->pptps_buffer;
328 				pptps->pptps_gothdr = 0;
329 				pptps->pptps_bytes = 0;
330 				pptps->pptps_len = 0;
331 				break;
332 			}
333 		}
334 
335 		len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
336 		COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
337 		pptps->pptps_bytes += len;
338 		pptps->pptps_wptr += len;
339 		pptps->pptps_next += len;
340 
341 		if (pptps->pptps_len > pptps->pptps_bytes)
342 			break;
343 
344 		ippr_pptp_message(fin, nat, pptp, pptps);
345 		pptps->pptps_wptr = pptps->pptps_buffer;
346 		pptps->pptps_gothdr = 0;
347 		pptps->pptps_bytes = 0;
348 		pptps->pptps_len = 0;
349 
350 		start += len;
351 		msg += len;
352 		dlen -= len;
353 	}
354 
355 	return 0;
356 }
357 
358 
359 /*
360  * handle a complete PPTP message
361  */
ippr_pptp_message(fin,nat,pptp,pptps)362 int ippr_pptp_message(fin, nat, pptp, pptps)
363 fr_info_t *fin;
364 nat_t *nat;
365 pptp_pxy_t *pptp;
366 pptp_side_t *pptps;
367 {
368 	pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer;
369 
370 	switch (ntohs(hdr->pptph_type))
371 	{
372 	case PPTP_MSGTYPE_CTL :
373 		ippr_pptp_mctl(fin, nat, pptp, pptps);
374 		break;
375 
376 	default :
377 		break;
378 	}
379 	return 0;
380 }
381 
382 
383 /*
384  * handle a complete PPTP control message
385  */
ippr_pptp_mctl(fin,nat,pptp,pptps)386 int ippr_pptp_mctl(fin, nat, pptp, pptps)
387 fr_info_t *fin;
388 nat_t *nat;
389 pptp_pxy_t *pptp;
390 pptp_side_t *pptps;
391 {
392 	u_short *buffer = (u_short *)(pptps->pptps_buffer);
393 	pptp_side_t *pptpo;
394 
395 	if (pptps == &pptp->pptp_side[0])
396 		pptpo = &pptp->pptp_side[1];
397 	else
398 		pptpo = &pptp->pptp_side[0];
399 
400 	/*
401 	 * Breakout to handle all the various messages.  Most are just state
402 	 * transition.
403 	 */
404 	switch (ntohs(buffer[4]))
405 	{
406 	case PPTP_MTCTL_STARTREQ :
407 		pptps->pptps_state = PPTP_MTCTL_STARTREQ;
408 		break;
409 	case PPTP_MTCTL_STARTREP :
410 		if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ)
411 			pptps->pptps_state = PPTP_MTCTL_STARTREP;
412 		break;
413 	case PPTP_MTCTL_STOPREQ :
414 		pptps->pptps_state = PPTP_MTCTL_STOPREQ;
415 		break;
416 	case PPTP_MTCTL_STOPREP :
417 		if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ)
418 			pptps->pptps_state = PPTP_MTCTL_STOPREP;
419 		break;
420 	case PPTP_MTCTL_ECHOREQ :
421 		pptps->pptps_state = PPTP_MTCTL_ECHOREQ;
422 		break;
423 	case PPTP_MTCTL_ECHOREP :
424 		if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ)
425 			pptps->pptps_state = PPTP_MTCTL_ECHOREP;
426 		break;
427 	case PPTP_MTCTL_OUTREQ :
428 		pptps->pptps_state = PPTP_MTCTL_OUTREQ;
429 		break;
430 	case PPTP_MTCTL_OUTREP :
431 		if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) {
432 			pptps->pptps_state = PPTP_MTCTL_OUTREP;
433 			pptp->pptp_call[0] = buffer[7];
434 			pptp->pptp_call[1] = buffer[6];
435 			ippr_pptp_donatstate(fin, nat, pptp);
436 		}
437 		break;
438 	case PPTP_MTCTL_INREQ :
439 		pptps->pptps_state = PPTP_MTCTL_INREQ;
440 		break;
441 	case PPTP_MTCTL_INREP :
442 		if (pptpo->pptps_state == PPTP_MTCTL_INREQ) {
443 			pptps->pptps_state = PPTP_MTCTL_INREP;
444 			pptp->pptp_call[0] = buffer[7];
445 			pptp->pptp_call[1] = buffer[6];
446 			ippr_pptp_donatstate(fin, nat, pptp);
447 		}
448 		break;
449 	case PPTP_MTCTL_INCONNECT :
450 		pptps->pptps_state = PPTP_MTCTL_INCONNECT;
451 		break;
452 	case PPTP_MTCTL_CLEAR :
453 		pptps->pptps_state = PPTP_MTCTL_CLEAR;
454 		break;
455 	case PPTP_MTCTL_DISCONNECT :
456 		pptps->pptps_state = PPTP_MTCTL_DISCONNECT;
457 		break;
458 	case PPTP_MTCTL_WANERROR :
459 		pptps->pptps_state = PPTP_MTCTL_WANERROR;
460 		break;
461 	case PPTP_MTCTL_LINKINFO :
462 		pptps->pptps_state = PPTP_MTCTL_LINKINFO;
463 		break;
464 	}
465 
466 	return 0;
467 }
468 
469 
470 /*
471  * For outgoing PPTP packets.  refresh timeouts for NAT & state entries, if
472  * we can.  If they have disappeared, recreate them.
473  */
ippr_pptp_inout(fin,aps,nat)474 int ippr_pptp_inout(fin, aps, nat)
475 fr_info_t *fin;
476 ap_session_t *aps;
477 nat_t *nat;
478 {
479 	pptp_pxy_t *pptp;
480 	tcphdr_t *tcp;
481 	int rev;
482 
483 	if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND))
484 		rev = 1;
485 	else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND))
486 		rev = 1;
487 	else
488 		rev = 0;
489 
490 	tcp = (tcphdr_t *)fin->fin_dp;
491 	if ((tcp->th_flags & TH_OPENING) == TH_OPENING) {
492 		pptp = (pptp_pxy_t *)aps->aps_data;
493 		pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack);
494 		pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack);
495 		pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1;
496 		pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1;
497 	}
498 	return ippr_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data,
499 				     rev);
500 }
501 
502 
503 /*
504  * clean up after ourselves.
505  */
ippr_pptp_del(aps)506 void ippr_pptp_del(aps)
507 ap_session_t *aps;
508 {
509 	pptp_pxy_t *pptp;
510 
511 	pptp = aps->aps_data;
512 
513 	if (pptp != NULL) {
514 		/*
515 		 * Don't bother changing any of the NAT structure details,
516 		 * *_del() is on a callback from aps_free(), from nat_delete()
517 		 */
518 
519 		READ_ENTER(&ipf_state);
520 		if (pptp->pptp_state != NULL) {
521 			pptp->pptp_state->is_die = fr_ticks + 1;
522 			pptp->pptp_state->is_me = NULL;
523 			fr_queuefront(&pptp->pptp_state->is_sti);
524 		}
525 		RWLOCK_EXIT(&ipf_state);
526 
527 		pptp->pptp_state = NULL;
528 		pptp->pptp_nat = NULL;
529 	}
530 }
531