1 /*
2 * Copyright (C) 2012 by Darren Reed.
3 *
4 * Simple PPTP transparent proxy for in-kernel use. For use with the NAT
5 * code.
6 *
7 * $Id$
8 *
9 */
10 #define IPF_PPTP_PROXY
11
12
13
14 /*
15 * PPTP proxy
16 */
17 typedef struct pptp_side {
18 u_32_t pptps_nexthdr;
19 u_32_t pptps_next;
20 int pptps_state;
21 int pptps_gothdr;
22 int pptps_len;
23 int pptps_bytes;
24 char *pptps_wptr;
25 char pptps_buffer[512];
26 } pptp_side_t;
27
28 typedef struct pptp_pxy {
29 nat_t *pptp_nat;
30 struct ipstate *pptp_state;
31 u_short pptp_call[2];
32 pptp_side_t pptp_side[2];
33 ipnat_t *pptp_rule;
34 } pptp_pxy_t;
35
36 typedef struct pptp_hdr {
37 u_short pptph_len;
38 u_short pptph_type;
39 u_32_t pptph_cookie;
40 } pptp_hdr_t;
41
42 #define PPTP_MSGTYPE_CTL 1
43 #define PPTP_MTCTL_STARTREQ 1
44 #define PPTP_MTCTL_STARTREP 2
45 #define PPTP_MTCTL_STOPREQ 3
46 #define PPTP_MTCTL_STOPREP 4
47 #define PPTP_MTCTL_ECHOREQ 5
48 #define PPTP_MTCTL_ECHOREP 6
49 #define PPTP_MTCTL_OUTREQ 7
50 #define PPTP_MTCTL_OUTREP 8
51 #define PPTP_MTCTL_INREQ 9
52 #define PPTP_MTCTL_INREP 10
53 #define PPTP_MTCTL_INCONNECT 11
54 #define PPTP_MTCTL_CLEAR 12
55 #define PPTP_MTCTL_DISCONNECT 13
56 #define PPTP_MTCTL_WANERROR 14
57 #define PPTP_MTCTL_LINKINFO 15
58
59
60 void ipf_p_pptp_main_load(void);
61 void ipf_p_pptp_main_unload(void);
62 int ipf_p_pptp_new(void *, fr_info_t *, ap_session_t *, nat_t *);
63 void ipf_p_pptp_del(ipf_main_softc_t *, ap_session_t *);
64 int ipf_p_pptp_inout(void *, fr_info_t *, ap_session_t *, nat_t *);
65 void ipf_p_pptp_donatstate(fr_info_t *, nat_t *, pptp_pxy_t *);
66 int ipf_p_pptp_message(fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *);
67 int ipf_p_pptp_nextmessage(fr_info_t *, nat_t *, pptp_pxy_t *, int);
68 int ipf_p_pptp_mctl(fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *);
69
70 static frentry_t pptpfr;
71
72 static int pptp_proxy_init = 0;
73 static int ipf_p_pptp_debug = 0;
74 static int ipf_p_pptp_gretimeout = IPF_TTLVAL(120); /* 2 minutes */
75
76
77 /*
78 * PPTP application proxy initialization.
79 */
80 void
ipf_p_pptp_main_load(void)81 ipf_p_pptp_main_load(void)
82 {
83 bzero((char *)&pptpfr, sizeof(pptpfr));
84 pptpfr.fr_ref = 1;
85 pptpfr.fr_age[0] = ipf_p_pptp_gretimeout;
86 pptpfr.fr_age[1] = ipf_p_pptp_gretimeout;
87 pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
88 MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock");
89 pptp_proxy_init = 1;
90 }
91
92
93 void
ipf_p_pptp_main_unload(void)94 ipf_p_pptp_main_unload(void)
95 {
96 if (pptp_proxy_init == 1) {
97 MUTEX_DESTROY(&pptpfr.fr_lock);
98 pptp_proxy_init = 0;
99 }
100 }
101
102
103 /*
104 * Setup for a new PPTP proxy.
105 *
106 * NOTE: The printf's are broken up with %s in them to prevent them being
107 * optimised into puts statements on FreeBSD (this doesn't exist in the kernel)
108 */
109 int
ipf_p_pptp_new(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)110 ipf_p_pptp_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
111 {
112 pptp_pxy_t *pptp;
113 ipnat_t *ipn;
114 ipnat_t *np;
115 int size;
116 ip_t *ip;
117
118 if (fin->fin_v != 4)
119 return (-1);
120
121 ip = fin->fin_ip;
122 np = nat->nat_ptr;
123 size = np->in_size;
124
125 if (ipf_nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_osrcip,
126 ip->ip_dst) != NULL) {
127 if (ipf_p_pptp_debug > 0)
128 printf("ipf_p_pptp_new: GRE session already exists\n");
129 return (-1);
130 }
131
132 KMALLOC(pptp, pptp_pxy_t *);
133 if (pptp == NULL) {
134 if (ipf_p_pptp_debug > 0)
135 printf("ipf_p_pptp_new: malloc for aps_data failed\n");
136 return (-1);
137 }
138 KMALLOCS(ipn, ipnat_t *, size);
139 if (ipn == NULL) {
140 KFREE(pptp);
141 return (-1);
142 }
143
144 aps->aps_data = pptp;
145 aps->aps_psiz = sizeof(*pptp);
146 bzero((char *)pptp, sizeof(*pptp));
147 bzero((char *)ipn, size);
148 pptp->pptp_rule = ipn;
149
150 /*
151 * Create NAT rule against which the tunnel/transport mapping is
152 * created. This is required because the current NAT rule does not
153 * describe GRE but TCP instead.
154 */
155 ipn->in_size = size;
156 ipn->in_ifps[0] = fin->fin_ifp;
157 ipn->in_apr = NULL;
158 ipn->in_use = 1;
159 ipn->in_hits = 1;
160 ipn->in_ippip = 1;
161 ipn->in_snip = ntohl(nat->nat_nsrcaddr);
162 ipn->in_nsrcaddr = fin->fin_saddr;
163 ipn->in_dnip = ntohl(nat->nat_ndstaddr);
164 ipn->in_ndstaddr = nat->nat_ndstaddr;
165 ipn->in_redir = np->in_redir;
166 ipn->in_osrcaddr = nat->nat_osrcaddr;
167 ipn->in_odstaddr = nat->nat_odstaddr;
168 ipn->in_osrcmsk = 0xffffffff;
169 ipn->in_nsrcmsk = 0xffffffff;
170 ipn->in_odstmsk = 0xffffffff;
171 ipn->in_ndstmsk = 0xffffffff;
172 ipn->in_flags = (np->in_flags | IPN_PROXYRULE);
173 MUTEX_INIT(&ipn->in_lock, "pptp proxy NAT rule");
174
175 ipn->in_namelen = np->in_namelen;
176 bcopy(np->in_names, ipn->in_ifnames, ipn->in_namelen);
177 ipn->in_ifnames[0] = np->in_ifnames[0];
178 ipn->in_ifnames[1] = np->in_ifnames[1];
179
180 ipn->in_pr[0] = IPPROTO_GRE;
181 ipn->in_pr[1] = IPPROTO_GRE;
182
183 pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer;
184 pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer;
185 return (0);
186 }
187
188
189 void
ipf_p_pptp_donatstate(fr_info_t * fin,nat_t * nat,pptp_pxy_t * pptp)190 ipf_p_pptp_donatstate(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp)
191 {
192 ipf_main_softc_t *softc = fin->fin_main_soft;
193 fr_info_t fi;
194 grehdr_t gre;
195 nat_t *nat2;
196 u_char p;
197 ip_t *ip;
198
199 ip = fin->fin_ip;
200 p = ip->ip_p;
201
202 nat2 = pptp->pptp_nat;
203 if ((nat2 == NULL) || (pptp->pptp_state == NULL)) {
204 bcopy((char *)fin, (char *)&fi, sizeof(fi));
205 bzero((char *)&gre, sizeof(gre));
206 fi.fin_fi.fi_p = IPPROTO_GRE;
207 fi.fin_fr = &pptpfr;
208 if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) ||
209 (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) {
210 fi.fin_data[0] = pptp->pptp_call[0];
211 fi.fin_data[1] = pptp->pptp_call[1];
212 } else {
213 fi.fin_data[0] = pptp->pptp_call[1];
214 fi.fin_data[1] = pptp->pptp_call[0];
215 }
216 ip = fin->fin_ip;
217 ip->ip_p = IPPROTO_GRE;
218 fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG);
219 fi.fin_flx |= FI_IGNORE;
220 fi.fin_dp = &gre;
221 gre.gr_flags = htons(1 << 13);
222
223 fi.fin_fi.fi_saddr = nat->nat_osrcaddr;
224 fi.fin_fi.fi_daddr = nat->nat_odstaddr;
225 }
226
227 /*
228 * Update NAT timeout/create NAT if missing.
229 */
230 if (nat2 != NULL)
231 ipf_queueback(softc->ipf_ticks, &nat2->nat_tqe);
232 else {
233 #ifdef USE_MUTEXES
234 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
235 #endif
236
237 MUTEX_ENTER(&softn->ipf_nat_new);
238 nat2 = ipf_nat_add(&fi, pptp->pptp_rule, &pptp->pptp_nat,
239 NAT_SLAVE, nat->nat_dir);
240 MUTEX_EXIT(&softn->ipf_nat_new);
241 if (nat2 != NULL) {
242 (void) ipf_nat_proto(&fi, nat2, 0);
243 MUTEX_ENTER(&nat2->nat_lock);
244 ipf_nat_update(&fi, nat2);
245 MUTEX_EXIT(&nat2->nat_lock);
246 }
247 }
248
249 READ_ENTER(&softc->ipf_state);
250 if (pptp->pptp_state != NULL) {
251 ipf_queueback(softc->ipf_ticks, &pptp->pptp_state->is_sti);
252 RWLOCK_EXIT(&softc->ipf_state);
253 } else {
254 RWLOCK_EXIT(&softc->ipf_state);
255 if (nat2 != NULL) {
256 if (nat->nat_dir == NAT_INBOUND)
257 fi.fin_fi.fi_daddr = nat2->nat_ndstaddr;
258 else
259 fi.fin_fi.fi_saddr = nat2->nat_osrcaddr;
260 }
261 fi.fin_ifp = NULL;
262 (void) ipf_state_add(softc, &fi, &pptp->pptp_state, 0);
263 }
264 ip->ip_p = p;
265 return;
266 }
267
268
269 /*
270 * Try and build up the next PPTP message in the TCP stream and if we can
271 * build it up completely (fits in our buffer) then pass it off to the message
272 * parsing function.
273 */
274 int
ipf_p_pptp_nextmessage(fr_info_t * fin,nat_t * nat,pptp_pxy_t * pptp,int rev)275 ipf_p_pptp_nextmessage(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp, int rev)
276 {
277 static const char *funcname = "ipf_p_pptp_nextmessage";
278 pptp_side_t *pptps;
279 u_32_t start, end;
280 pptp_hdr_t *hdr;
281 tcphdr_t *tcp;
282 int dlen, off;
283 u_short len;
284 char *msg;
285
286 tcp = fin->fin_dp;
287 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
288 start = ntohl(tcp->th_seq);
289 pptps = &pptp->pptp_side[rev];
290 off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) +
291 fin->fin_ipoff;
292
293 if (dlen <= 0)
294 return (0);
295 /*
296 * If the complete data packet is before what we expect to see
297 * "next", just ignore it as the chances are we've already seen it.
298 * The next if statement following this one really just causes packets
299 * ahead of what we've seen to be dropped, implying that something in
300 * the middle went missing and we want to see that first.
301 */
302 end = start + dlen;
303 if (pptps->pptps_next > end && pptps->pptps_next > start)
304 return (0);
305
306 if (pptps->pptps_next != start) {
307 if (ipf_p_pptp_debug > 5)
308 printf("%s: next (%x) != start (%x)\n", funcname,
309 pptps->pptps_next, start);
310 return (-1);
311 }
312
313 msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2);
314
315 while (dlen > 0) {
316 off += pptps->pptps_bytes;
317 if (pptps->pptps_gothdr == 0) {
318 /*
319 * PPTP has an 8 byte header that inclues the cookie.
320 * The start of every message should include one and
321 * it should match 1a2b3c4d. Byte order is ignored,
322 * deliberately, when printing out the error.
323 */
324 len = MIN(8 - pptps->pptps_bytes, dlen);
325 COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
326 pptps->pptps_bytes += len;
327 pptps->pptps_wptr += len;
328 hdr = (pptp_hdr_t *)pptps->pptps_buffer;
329 if (pptps->pptps_bytes == 8) {
330 pptps->pptps_next += 8;
331 if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) {
332 if (ipf_p_pptp_debug > 1)
333 printf("%s: bad cookie (%x)\n",
334 funcname,
335 hdr->pptph_cookie);
336 return (-1);
337 }
338 }
339 dlen -= len;
340 msg += len;
341 off += len;
342
343 pptps->pptps_gothdr = 1;
344 len = ntohs(hdr->pptph_len);
345 pptps->pptps_len = len;
346 pptps->pptps_nexthdr += len;
347
348 /*
349 * If a message is too big for the buffer, just set
350 * the fields for the next message to come along.
351 * The messages defined in RFC 2637 will not exceed
352 * 512 bytes (in total length) so this is likely a
353 * bad data packet, anyway.
354 */
355 if (len > sizeof(pptps->pptps_buffer)) {
356 if (ipf_p_pptp_debug > 3)
357 printf("%s: message too big (%d)\n",
358 funcname, len);
359 pptps->pptps_next = pptps->pptps_nexthdr;
360 pptps->pptps_wptr = pptps->pptps_buffer;
361 pptps->pptps_gothdr = 0;
362 pptps->pptps_bytes = 0;
363 pptps->pptps_len = 0;
364 break;
365 }
366 }
367
368 len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
369 COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
370 pptps->pptps_bytes += len;
371 pptps->pptps_wptr += len;
372 pptps->pptps_next += len;
373
374 if (pptps->pptps_len > pptps->pptps_bytes)
375 break;
376
377 ipf_p_pptp_message(fin, nat, pptp, pptps);
378 pptps->pptps_wptr = pptps->pptps_buffer;
379 pptps->pptps_gothdr = 0;
380 pptps->pptps_bytes = 0;
381 pptps->pptps_len = 0;
382
383 start += len;
384 msg += len;
385 dlen -= len;
386 }
387
388 return (0);
389 }
390
391
392 /*
393 * handle a complete PPTP message
394 */
395 int
ipf_p_pptp_message(fr_info_t * fin,nat_t * nat,pptp_pxy_t * pptp,pptp_side_t * pptps)396 ipf_p_pptp_message(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp,
397 pptp_side_t *pptps)
398 {
399 pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer;
400
401 switch (ntohs(hdr->pptph_type))
402 {
403 case PPTP_MSGTYPE_CTL :
404 ipf_p_pptp_mctl(fin, nat, pptp, pptps);
405 break;
406
407 default :
408 break;
409 }
410 return (0);
411 }
412
413
414 /*
415 * handle a complete PPTP control message
416 */
417 int
ipf_p_pptp_mctl(fr_info_t * fin,nat_t * nat,pptp_pxy_t * pptp,pptp_side_t * pptps)418 ipf_p_pptp_mctl(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp,
419 pptp_side_t *pptps)
420 {
421 u_short *buffer = (u_short *)(pptps->pptps_buffer);
422 pptp_side_t *pptpo;
423
424 if (pptps == &pptp->pptp_side[0])
425 pptpo = &pptp->pptp_side[1];
426 else
427 pptpo = &pptp->pptp_side[0];
428
429 /*
430 * Breakout to handle all the various messages. Most are just state
431 * transition.
432 */
433 switch (ntohs(buffer[4]))
434 {
435 case PPTP_MTCTL_STARTREQ :
436 pptps->pptps_state = PPTP_MTCTL_STARTREQ;
437 break;
438 case PPTP_MTCTL_STARTREP :
439 if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ)
440 pptps->pptps_state = PPTP_MTCTL_STARTREP;
441 break;
442 case PPTP_MTCTL_STOPREQ :
443 pptps->pptps_state = PPTP_MTCTL_STOPREQ;
444 break;
445 case PPTP_MTCTL_STOPREP :
446 if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ)
447 pptps->pptps_state = PPTP_MTCTL_STOPREP;
448 break;
449 case PPTP_MTCTL_ECHOREQ :
450 pptps->pptps_state = PPTP_MTCTL_ECHOREQ;
451 break;
452 case PPTP_MTCTL_ECHOREP :
453 if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ)
454 pptps->pptps_state = PPTP_MTCTL_ECHOREP;
455 break;
456 case PPTP_MTCTL_OUTREQ :
457 pptps->pptps_state = PPTP_MTCTL_OUTREQ;
458 break;
459 case PPTP_MTCTL_OUTREP :
460 if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) {
461 pptps->pptps_state = PPTP_MTCTL_OUTREP;
462 pptp->pptp_call[0] = buffer[7];
463 pptp->pptp_call[1] = buffer[6];
464 ipf_p_pptp_donatstate(fin, nat, pptp);
465 }
466 break;
467 case PPTP_MTCTL_INREQ :
468 pptps->pptps_state = PPTP_MTCTL_INREQ;
469 break;
470 case PPTP_MTCTL_INREP :
471 if (pptpo->pptps_state == PPTP_MTCTL_INREQ) {
472 pptps->pptps_state = PPTP_MTCTL_INREP;
473 pptp->pptp_call[0] = buffer[7];
474 pptp->pptp_call[1] = buffer[6];
475 ipf_p_pptp_donatstate(fin, nat, pptp);
476 }
477 break;
478 case PPTP_MTCTL_INCONNECT :
479 pptps->pptps_state = PPTP_MTCTL_INCONNECT;
480 break;
481 case PPTP_MTCTL_CLEAR :
482 pptps->pptps_state = PPTP_MTCTL_CLEAR;
483 break;
484 case PPTP_MTCTL_DISCONNECT :
485 pptps->pptps_state = PPTP_MTCTL_DISCONNECT;
486 break;
487 case PPTP_MTCTL_WANERROR :
488 pptps->pptps_state = PPTP_MTCTL_WANERROR;
489 break;
490 case PPTP_MTCTL_LINKINFO :
491 pptps->pptps_state = PPTP_MTCTL_LINKINFO;
492 break;
493 }
494
495 return (0);
496 }
497
498
499 /*
500 * For outgoing PPTP packets. refresh timeouts for NAT & state entries, if
501 * we can. If they have disappeared, recreate them.
502 */
503 int
ipf_p_pptp_inout(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)504 ipf_p_pptp_inout(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
505 {
506 pptp_pxy_t *pptp;
507 tcphdr_t *tcp;
508 int rev;
509
510 if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND))
511 rev = 1;
512 else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND))
513 rev = 1;
514 else
515 rev = 0;
516
517 tcp = (tcphdr_t *)fin->fin_dp;
518 if ((tcp_get_flags(tcp) & TH_OPENING) == TH_OPENING) {
519 pptp = (pptp_pxy_t *)aps->aps_data;
520 pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack);
521 pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack);
522 pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1;
523 pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1;
524 }
525 return (ipf_p_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data,
526 rev));
527 }
528
529
530 /*
531 * clean up after ourselves.
532 */
533 void
ipf_p_pptp_del(ipf_main_softc_t * softc,ap_session_t * aps)534 ipf_p_pptp_del(ipf_main_softc_t *softc, ap_session_t *aps)
535 {
536 pptp_pxy_t *pptp;
537
538 pptp = aps->aps_data;
539
540 if (pptp != NULL) {
541 /*
542 * Don't bother changing any of the NAT structure details,
543 * *_del() is on a callback from aps_free(), from nat_delete()
544 */
545
546 READ_ENTER(&softc->ipf_state);
547 if (pptp->pptp_state != NULL) {
548 ipf_state_setpending(softc, pptp->pptp_state);
549 }
550 RWLOCK_EXIT(&softc->ipf_state);
551
552 if (pptp->pptp_nat != NULL)
553 ipf_nat_setpending(softc, pptp->pptp_nat);
554 pptp->pptp_rule->in_flags |= IPN_DELETE;
555 ipf_nat_rule_deref(softc, &pptp->pptp_rule);
556 }
557 }
558