1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * nf_nat_pptp.c |
4 | * |
5 | * NAT support for PPTP (Point to Point Tunneling Protocol). |
6 | * PPTP is a protocol for creating virtual private networks. |
7 | * It is a specification defined by Microsoft and some vendors |
8 | * working with Microsoft. PPTP is built on top of a modified |
9 | * version of the Internet Generic Routing Encapsulation Protocol. |
10 | * GRE is defined in RFC 1701 and RFC 1702. Documentation of |
11 | * PPTP can be found in RFC 2637 |
12 | * |
13 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> |
14 | * |
15 | * Development of this code funded by Astaro AG (http://www.astaro.com/) |
16 | * |
17 | * (C) 2006-2012 Patrick McHardy <kaber@trash.net> |
18 | * |
19 | * TODO: - NAT to a unique tuple, not to TCP source port |
20 | * (needs netfilter tuple reservation) |
21 | */ |
22 | |
23 | #include <linux/module.h> |
24 | #include <linux/tcp.h> |
25 | |
26 | #include <net/netfilter/nf_nat.h> |
27 | #include <net/netfilter/nf_nat_helper.h> |
28 | #include <net/netfilter/nf_conntrack_helper.h> |
29 | #include <net/netfilter/nf_conntrack_expect.h> |
30 | #include <net/netfilter/nf_conntrack_zones.h> |
31 | #include <linux/netfilter/nf_conntrack_proto_gre.h> |
32 | #include <linux/netfilter/nf_conntrack_pptp.h> |
33 | |
34 | #define NF_NAT_PPTP_VERSION "3.0" |
35 | |
36 | #define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off))) |
37 | |
38 | MODULE_LICENSE("GPL" ); |
39 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>" ); |
40 | MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP" ); |
41 | MODULE_ALIAS_NF_NAT_HELPER("pptp" ); |
42 | |
43 | static void pptp_nat_expected(struct nf_conn *ct, |
44 | struct nf_conntrack_expect *exp) |
45 | { |
46 | struct net *net = nf_ct_net(ct); |
47 | const struct nf_conn *master = ct->master; |
48 | struct nf_conntrack_expect *other_exp; |
49 | struct nf_conntrack_tuple t = {}; |
50 | const struct nf_ct_pptp_master *ct_pptp_info; |
51 | const struct nf_nat_pptp *nat_pptp_info; |
52 | struct nf_nat_range2 range; |
53 | struct nf_conn_nat *nat; |
54 | |
55 | nat = nf_ct_nat_ext_add(ct); |
56 | if (WARN_ON_ONCE(!nat)) |
57 | return; |
58 | |
59 | nat_pptp_info = &nat->help.nat_pptp_info; |
60 | ct_pptp_info = nfct_help_data(ct: master); |
61 | |
62 | /* And here goes the grand finale of corrosion... */ |
63 | if (exp->dir == IP_CT_DIR_ORIGINAL) { |
64 | pr_debug("we are PNS->PAC\n" ); |
65 | /* therefore, build tuple for PAC->PNS */ |
66 | t.src.l3num = AF_INET; |
67 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; |
68 | t.src.u.gre.key = ct_pptp_info->pac_call_id; |
69 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; |
70 | t.dst.u.gre.key = ct_pptp_info->pns_call_id; |
71 | t.dst.protonum = IPPROTO_GRE; |
72 | } else { |
73 | pr_debug("we are PAC->PNS\n" ); |
74 | /* build tuple for PNS->PAC */ |
75 | t.src.l3num = AF_INET; |
76 | t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; |
77 | t.src.u.gre.key = nat_pptp_info->pns_call_id; |
78 | t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; |
79 | t.dst.u.gre.key = nat_pptp_info->pac_call_id; |
80 | t.dst.protonum = IPPROTO_GRE; |
81 | } |
82 | |
83 | pr_debug("trying to unexpect other dir: " ); |
84 | nf_ct_dump_tuple_ip(t: &t); |
85 | other_exp = nf_ct_expect_find_get(net, zone: nf_ct_zone(ct), tuple: &t); |
86 | if (other_exp) { |
87 | nf_ct_unexpect_related(exp: other_exp); |
88 | nf_ct_expect_put(exp: other_exp); |
89 | pr_debug("success\n" ); |
90 | } else { |
91 | pr_debug("not found!\n" ); |
92 | } |
93 | |
94 | /* This must be a fresh one. */ |
95 | BUG_ON(ct->status & IPS_NAT_DONE_MASK); |
96 | |
97 | /* Change src to where master sends to */ |
98 | range.flags = NF_NAT_RANGE_MAP_IPS; |
99 | range.min_addr = range.max_addr |
100 | = ct->master->tuplehash[!exp->dir].tuple.dst.u3; |
101 | if (exp->dir == IP_CT_DIR_ORIGINAL) { |
102 | range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
103 | range.min_proto = range.max_proto = exp->saved_proto; |
104 | } |
105 | nf_nat_setup_info(ct, range: &range, maniptype: NF_NAT_MANIP_SRC); |
106 | |
107 | /* For DST manip, map port here to where it's expected. */ |
108 | range.flags = NF_NAT_RANGE_MAP_IPS; |
109 | range.min_addr = range.max_addr |
110 | = ct->master->tuplehash[!exp->dir].tuple.src.u3; |
111 | if (exp->dir == IP_CT_DIR_REPLY) { |
112 | range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
113 | range.min_proto = range.max_proto = exp->saved_proto; |
114 | } |
115 | nf_nat_setup_info(ct, range: &range, maniptype: NF_NAT_MANIP_DST); |
116 | } |
117 | |
118 | /* outbound packets == from PNS to PAC */ |
119 | static int |
120 | pptp_outbound_pkt(struct sk_buff *skb, |
121 | struct nf_conn *ct, |
122 | enum ip_conntrack_info ctinfo, |
123 | unsigned int protoff, |
124 | struct PptpControlHeader *ctlh, |
125 | union pptp_ctrl_union *pptpReq) |
126 | |
127 | { |
128 | struct nf_ct_pptp_master *ct_pptp_info; |
129 | struct nf_conn_nat *nat = nfct_nat(ct); |
130 | struct nf_nat_pptp *nat_pptp_info; |
131 | u_int16_t msg; |
132 | __be16 new_callid; |
133 | unsigned int cid_off; |
134 | |
135 | if (WARN_ON_ONCE(!nat)) |
136 | return NF_DROP; |
137 | |
138 | nat_pptp_info = &nat->help.nat_pptp_info; |
139 | ct_pptp_info = nfct_help_data(ct); |
140 | |
141 | new_callid = ct_pptp_info->pns_call_id; |
142 | |
143 | switch (msg = ntohs(ctlh->messageType)) { |
144 | case PPTP_OUT_CALL_REQUEST: |
145 | cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); |
146 | /* FIXME: ideally we would want to reserve a call ID |
147 | * here. current netfilter NAT core is not able to do |
148 | * this :( For now we use TCP source port. This breaks |
149 | * multiple calls within one control session */ |
150 | |
151 | /* save original call ID in nat_info */ |
152 | nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; |
153 | |
154 | /* don't use tcph->source since we are at a DSTmanip |
155 | * hook (e.g. PREROUTING) and pkt is not mangled yet */ |
156 | new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; |
157 | |
158 | /* save new call ID in ct info */ |
159 | ct_pptp_info->pns_call_id = new_callid; |
160 | break; |
161 | case PPTP_IN_CALL_REPLY: |
162 | cid_off = offsetof(union pptp_ctrl_union, icack.callID); |
163 | break; |
164 | case PPTP_CALL_CLEAR_REQUEST: |
165 | cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); |
166 | break; |
167 | default: |
168 | pr_debug("unknown outbound packet 0x%04x:%s\n" , msg, |
169 | pptp_msg_name(msg)); |
170 | fallthrough; |
171 | case PPTP_SET_LINK_INFO: |
172 | /* only need to NAT in case PAC is behind NAT box */ |
173 | case PPTP_START_SESSION_REQUEST: |
174 | case PPTP_START_SESSION_REPLY: |
175 | case PPTP_STOP_SESSION_REQUEST: |
176 | case PPTP_STOP_SESSION_REPLY: |
177 | case PPTP_ECHO_REQUEST: |
178 | case PPTP_ECHO_REPLY: |
179 | /* no need to alter packet */ |
180 | return NF_ACCEPT; |
181 | } |
182 | |
183 | /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass |
184 | * down to here */ |
185 | pr_debug("altering call id from 0x%04x to 0x%04x\n" , |
186 | ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); |
187 | |
188 | /* mangle packet */ |
189 | if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, |
190 | match_offset: cid_off + sizeof(struct pptp_pkt_hdr) + |
191 | sizeof(struct PptpControlHeader), |
192 | match_len: sizeof(new_callid), rep_buffer: (char *)&new_callid, |
193 | rep_len: sizeof(new_callid))) |
194 | return NF_DROP; |
195 | return NF_ACCEPT; |
196 | } |
197 | |
198 | static void |
199 | pptp_exp_gre(struct nf_conntrack_expect *expect_orig, |
200 | struct nf_conntrack_expect *expect_reply) |
201 | { |
202 | const struct nf_conn *ct = expect_orig->master; |
203 | struct nf_conn_nat *nat = nfct_nat(ct); |
204 | struct nf_ct_pptp_master *ct_pptp_info; |
205 | struct nf_nat_pptp *nat_pptp_info; |
206 | |
207 | if (WARN_ON_ONCE(!nat)) |
208 | return; |
209 | |
210 | nat_pptp_info = &nat->help.nat_pptp_info; |
211 | ct_pptp_info = nfct_help_data(ct); |
212 | |
213 | /* save original PAC call ID in nat_info */ |
214 | nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; |
215 | |
216 | /* alter expectation for PNS->PAC direction */ |
217 | expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; |
218 | expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; |
219 | expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; |
220 | expect_orig->dir = IP_CT_DIR_ORIGINAL; |
221 | |
222 | /* alter expectation for PAC->PNS direction */ |
223 | expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; |
224 | expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; |
225 | expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; |
226 | expect_reply->dir = IP_CT_DIR_REPLY; |
227 | } |
228 | |
229 | /* inbound packets == from PAC to PNS */ |
230 | static int |
231 | pptp_inbound_pkt(struct sk_buff *skb, |
232 | struct nf_conn *ct, |
233 | enum ip_conntrack_info ctinfo, |
234 | unsigned int protoff, |
235 | struct PptpControlHeader *ctlh, |
236 | union pptp_ctrl_union *pptpReq) |
237 | { |
238 | const struct nf_nat_pptp *nat_pptp_info; |
239 | struct nf_conn_nat *nat = nfct_nat(ct); |
240 | u_int16_t msg; |
241 | __be16 new_pcid; |
242 | unsigned int pcid_off; |
243 | |
244 | if (WARN_ON_ONCE(!nat)) |
245 | return NF_DROP; |
246 | |
247 | nat_pptp_info = &nat->help.nat_pptp_info; |
248 | new_pcid = nat_pptp_info->pns_call_id; |
249 | |
250 | switch (msg = ntohs(ctlh->messageType)) { |
251 | case PPTP_OUT_CALL_REPLY: |
252 | pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); |
253 | break; |
254 | case PPTP_IN_CALL_CONNECT: |
255 | pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); |
256 | break; |
257 | case PPTP_IN_CALL_REQUEST: |
258 | /* only need to nat in case PAC is behind NAT box */ |
259 | return NF_ACCEPT; |
260 | case PPTP_WAN_ERROR_NOTIFY: |
261 | pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); |
262 | break; |
263 | case PPTP_CALL_DISCONNECT_NOTIFY: |
264 | pcid_off = offsetof(union pptp_ctrl_union, disc.callID); |
265 | break; |
266 | case PPTP_SET_LINK_INFO: |
267 | pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); |
268 | break; |
269 | default: |
270 | pr_debug("unknown inbound packet %s\n" , pptp_msg_name(msg)); |
271 | fallthrough; |
272 | case PPTP_START_SESSION_REQUEST: |
273 | case PPTP_START_SESSION_REPLY: |
274 | case PPTP_STOP_SESSION_REQUEST: |
275 | case PPTP_STOP_SESSION_REPLY: |
276 | case PPTP_ECHO_REQUEST: |
277 | case PPTP_ECHO_REPLY: |
278 | /* no need to alter packet */ |
279 | return NF_ACCEPT; |
280 | } |
281 | |
282 | /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, |
283 | * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ |
284 | |
285 | /* mangle packet */ |
286 | pr_debug("altering peer call id from 0x%04x to 0x%04x\n" , |
287 | ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); |
288 | |
289 | if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, |
290 | match_offset: pcid_off + sizeof(struct pptp_pkt_hdr) + |
291 | sizeof(struct PptpControlHeader), |
292 | match_len: sizeof(new_pcid), rep_buffer: (char *)&new_pcid, |
293 | rep_len: sizeof(new_pcid))) |
294 | return NF_DROP; |
295 | return NF_ACCEPT; |
296 | } |
297 | |
298 | static const struct nf_nat_pptp_hook pptp_hooks = { |
299 | .outbound = pptp_outbound_pkt, |
300 | .inbound = pptp_inbound_pkt, |
301 | .exp_gre = pptp_exp_gre, |
302 | .expectfn = pptp_nat_expected, |
303 | }; |
304 | |
305 | static int __init nf_nat_helper_pptp_init(void) |
306 | { |
307 | WARN_ON(nf_nat_pptp_hook != NULL); |
308 | RCU_INIT_POINTER(nf_nat_pptp_hook, &pptp_hooks); |
309 | |
310 | return 0; |
311 | } |
312 | |
313 | static void __exit nf_nat_helper_pptp_fini(void) |
314 | { |
315 | RCU_INIT_POINTER(nf_nat_pptp_hook, NULL); |
316 | synchronize_rcu(); |
317 | } |
318 | |
319 | module_init(nf_nat_helper_pptp_init); |
320 | module_exit(nf_nat_helper_pptp_fini); |
321 | |