1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * nf_nat_pptp.c 4 * 5 * NAT support for PPTP (Point to Point Tunneling Protocol). 6 * PPTP is a protocol for creating virtual private networks. 7 * It is a specification defined by Microsoft and some vendors 8 * working with Microsoft. PPTP is built on top of a modified 9 * version of the Internet Generic Routing Encapsulation Protocol. 10 * GRE is defined in RFC 1701 and RFC 1702. Documentation of 11 * PPTP can be found in RFC 2637 12 * 13 * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> 14 * 15 * Development of this code funded by Astaro AG (http://www.astaro.com/) 16 * 17 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 18 * 19 * TODO: - NAT to a unique tuple, not to TCP source port 20 * (needs netfilter tuple reservation) 21 */ 22 23 #include <linux/module.h> 24 #include <linux/tcp.h> 25 26 #include <net/netfilter/nf_nat.h> 27 #include <net/netfilter/nf_nat_helper.h> 28 #include <net/netfilter/nf_conntrack_helper.h> 29 #include <net/netfilter/nf_conntrack_expect.h> 30 #include <net/netfilter/nf_conntrack_zones.h> 31 #include <linux/netfilter/nf_conntrack_proto_gre.h> 32 #include <linux/netfilter/nf_conntrack_pptp.h> 33 34 #define NF_NAT_PPTP_VERSION "3.0" 35 36 #define REQ_CID(req, off) (*(__be16 *)((char *)(req) + (off))) 37 38 MODULE_LICENSE("GPL"); 39 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); 40 MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP"); 41 MODULE_ALIAS_NF_NAT_HELPER("pptp"); 42 43 static void pptp_nat_expected(struct nf_conn *ct, 44 struct nf_conntrack_expect *exp) 45 { 46 struct net *net = nf_ct_net(ct); 47 const struct nf_conn *master = ct->master; 48 struct nf_conntrack_expect *other_exp; 49 struct nf_conntrack_tuple t = {}; 50 const struct nf_ct_pptp_master *ct_pptp_info; 51 const struct nf_nat_pptp *nat_pptp_info; 52 struct nf_nat_range2 range; 53 struct nf_conn_nat *nat; 54 55 nat = nf_ct_nat_ext_add(ct); 56 if (!nat) 57 return; 58 59 nat_pptp_info = &nat->help.nat_pptp_info; 60 ct_pptp_info = nfct_help_data(master); 61 if (!ct_pptp_info) 62 return; 63 64 /* And here goes the grand finale of corrosion... */ 65 if (exp->dir == IP_CT_DIR_ORIGINAL) { 66 pr_debug("we are PNS->PAC\n"); 67 /* therefore, build tuple for PAC->PNS */ 68 t.src.l3num = AF_INET; 69 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; 70 t.src.u.gre.key = ct_pptp_info->pac_call_id; 71 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; 72 t.dst.u.gre.key = ct_pptp_info->pns_call_id; 73 t.dst.protonum = IPPROTO_GRE; 74 } else { 75 pr_debug("we are PAC->PNS\n"); 76 /* build tuple for PNS->PAC */ 77 t.src.l3num = AF_INET; 78 t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip; 79 t.src.u.gre.key = nat_pptp_info->pns_call_id; 80 t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip; 81 t.dst.u.gre.key = nat_pptp_info->pac_call_id; 82 t.dst.protonum = IPPROTO_GRE; 83 } 84 85 pr_debug("trying to unexpect other dir: "); 86 nf_ct_dump_tuple_ip(&t); 87 other_exp = nf_ct_expect_find_get(net, nf_ct_zone(ct), &t); 88 if (other_exp) { 89 nf_ct_unexpect_related(other_exp); 90 nf_ct_expect_put(other_exp); 91 pr_debug("success\n"); 92 } else { 93 pr_debug("not found!\n"); 94 } 95 96 /* This must be a fresh one. */ 97 BUG_ON(ct->status & IPS_NAT_DONE_MASK); 98 99 /* Change src to where master sends to */ 100 range.flags = NF_NAT_RANGE_MAP_IPS; 101 range.min_addr = range.max_addr 102 = ct->master->tuplehash[!exp->dir].tuple.dst.u3; 103 if (exp->dir == IP_CT_DIR_ORIGINAL) { 104 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 105 range.min_proto = range.max_proto = exp->saved_proto; 106 } 107 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC); 108 109 /* For DST manip, map port here to where it's expected. */ 110 range.flags = NF_NAT_RANGE_MAP_IPS; 111 range.min_addr = range.max_addr 112 = ct->master->tuplehash[!exp->dir].tuple.src.u3; 113 if (exp->dir == IP_CT_DIR_REPLY) { 114 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; 115 range.min_proto = range.max_proto = exp->saved_proto; 116 } 117 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST); 118 } 119 120 /* outbound packets == from PNS to PAC */ 121 static int 122 pptp_outbound_pkt(struct sk_buff *skb, 123 struct nf_conn *ct, 124 enum ip_conntrack_info ctinfo, 125 unsigned int protoff, 126 struct PptpControlHeader *ctlh, 127 union pptp_ctrl_union *pptpReq) 128 129 { 130 struct nf_ct_pptp_master *ct_pptp_info; 131 struct nf_conn_nat *nat = nfct_nat(ct); 132 struct nf_nat_pptp *nat_pptp_info; 133 u_int16_t msg; 134 __be16 new_callid; 135 unsigned int cid_off; 136 137 if (!nat) 138 return NF_DROP; 139 140 nat_pptp_info = &nat->help.nat_pptp_info; 141 ct_pptp_info = nfct_help_data(ct); 142 if (!ct_pptp_info) 143 return NF_DROP; 144 145 new_callid = ct_pptp_info->pns_call_id; 146 147 switch (msg = ntohs(ctlh->messageType)) { 148 case PPTP_OUT_CALL_REQUEST: 149 cid_off = offsetof(union pptp_ctrl_union, ocreq.callID); 150 /* FIXME: ideally we would want to reserve a call ID 151 * here. current netfilter NAT core is not able to do 152 * this :( For now we use TCP source port. This breaks 153 * multiple calls within one control session */ 154 155 /* save original call ID in nat_info */ 156 nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id; 157 158 /* don't use tcph->source since we are at a DSTmanip 159 * hook (e.g. PREROUTING) and pkt is not mangled yet */ 160 new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port; 161 162 /* save new call ID in ct info */ 163 ct_pptp_info->pns_call_id = new_callid; 164 break; 165 case PPTP_IN_CALL_REPLY: 166 cid_off = offsetof(union pptp_ctrl_union, icack.callID); 167 break; 168 case PPTP_CALL_CLEAR_REQUEST: 169 cid_off = offsetof(union pptp_ctrl_union, clrreq.callID); 170 break; 171 default: 172 pr_debug("unknown outbound packet 0x%04x:%s\n", msg, 173 pptp_msg_name(msg)); 174 fallthrough; 175 case PPTP_SET_LINK_INFO: 176 /* only need to NAT in case PAC is behind NAT box */ 177 case PPTP_START_SESSION_REQUEST: 178 case PPTP_START_SESSION_REPLY: 179 case PPTP_STOP_SESSION_REQUEST: 180 case PPTP_STOP_SESSION_REPLY: 181 case PPTP_ECHO_REQUEST: 182 case PPTP_ECHO_REPLY: 183 /* no need to alter packet */ 184 return NF_ACCEPT; 185 } 186 187 /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass 188 * down to here */ 189 pr_debug("altering call id from 0x%04x to 0x%04x\n", 190 ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid)); 191 192 /* mangle packet */ 193 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, 194 cid_off + sizeof(struct pptp_pkt_hdr) + 195 sizeof(struct PptpControlHeader), 196 sizeof(new_callid), (char *)&new_callid, 197 sizeof(new_callid))) 198 return NF_DROP; 199 return NF_ACCEPT; 200 } 201 202 static void 203 pptp_exp_gre(struct nf_conntrack_expect *expect_orig, 204 struct nf_conntrack_expect *expect_reply) 205 { 206 const struct nf_conn *ct = expect_orig->master; 207 struct nf_conn_nat *nat = nfct_nat(ct); 208 struct nf_ct_pptp_master *ct_pptp_info; 209 struct nf_nat_pptp *nat_pptp_info; 210 211 if (!nat) 212 return; 213 214 nat_pptp_info = &nat->help.nat_pptp_info; 215 ct_pptp_info = nfct_help_data(ct); 216 if (!ct_pptp_info) 217 return; 218 219 /* save original PAC call ID in nat_info */ 220 nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id; 221 222 /* alter expectation for PNS->PAC direction */ 223 expect_orig->saved_proto.gre.key = ct_pptp_info->pns_call_id; 224 expect_orig->tuple.src.u.gre.key = nat_pptp_info->pns_call_id; 225 expect_orig->tuple.dst.u.gre.key = ct_pptp_info->pac_call_id; 226 expect_orig->dir = IP_CT_DIR_ORIGINAL; 227 228 /* alter expectation for PAC->PNS direction */ 229 expect_reply->saved_proto.gre.key = nat_pptp_info->pns_call_id; 230 expect_reply->tuple.src.u.gre.key = nat_pptp_info->pac_call_id; 231 expect_reply->tuple.dst.u.gre.key = ct_pptp_info->pns_call_id; 232 expect_reply->dir = IP_CT_DIR_REPLY; 233 } 234 235 /* inbound packets == from PAC to PNS */ 236 static int 237 pptp_inbound_pkt(struct sk_buff *skb, 238 struct nf_conn *ct, 239 enum ip_conntrack_info ctinfo, 240 unsigned int protoff, 241 struct PptpControlHeader *ctlh, 242 union pptp_ctrl_union *pptpReq) 243 { 244 const struct nf_nat_pptp *nat_pptp_info; 245 struct nf_conn_nat *nat = nfct_nat(ct); 246 u_int16_t msg; 247 __be16 new_pcid; 248 unsigned int pcid_off; 249 250 if (!nat) 251 return NF_DROP; 252 253 nat_pptp_info = &nat->help.nat_pptp_info; 254 new_pcid = nat_pptp_info->pns_call_id; 255 256 switch (msg = ntohs(ctlh->messageType)) { 257 case PPTP_OUT_CALL_REPLY: 258 pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID); 259 break; 260 case PPTP_IN_CALL_CONNECT: 261 pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID); 262 break; 263 case PPTP_IN_CALL_REQUEST: 264 /* only need to nat in case PAC is behind NAT box */ 265 return NF_ACCEPT; 266 case PPTP_WAN_ERROR_NOTIFY: 267 pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID); 268 break; 269 case PPTP_CALL_DISCONNECT_NOTIFY: 270 pcid_off = offsetof(union pptp_ctrl_union, disc.callID); 271 break; 272 case PPTP_SET_LINK_INFO: 273 pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID); 274 break; 275 default: 276 pr_debug("unknown inbound packet %s\n", pptp_msg_name(msg)); 277 fallthrough; 278 case PPTP_START_SESSION_REQUEST: 279 case PPTP_START_SESSION_REPLY: 280 case PPTP_STOP_SESSION_REQUEST: 281 case PPTP_STOP_SESSION_REPLY: 282 case PPTP_ECHO_REQUEST: 283 case PPTP_ECHO_REPLY: 284 /* no need to alter packet */ 285 return NF_ACCEPT; 286 } 287 288 /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST, 289 * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ 290 291 /* mangle packet */ 292 pr_debug("altering peer call id from 0x%04x to 0x%04x\n", 293 ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid)); 294 295 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, 296 pcid_off + sizeof(struct pptp_pkt_hdr) + 297 sizeof(struct PptpControlHeader), 298 sizeof(new_pcid), (char *)&new_pcid, 299 sizeof(new_pcid))) 300 return NF_DROP; 301 return NF_ACCEPT; 302 } 303 304 static const struct nf_nat_pptp_hook pptp_hooks = { 305 .outbound = pptp_outbound_pkt, 306 .inbound = pptp_inbound_pkt, 307 .exp_gre = pptp_exp_gre, 308 .expectfn = pptp_nat_expected, 309 }; 310 311 static int __init nf_nat_helper_pptp_init(void) 312 { 313 WARN_ON(nf_nat_pptp_hook != NULL); 314 RCU_INIT_POINTER(nf_nat_pptp_hook, &pptp_hooks); 315 316 return 0; 317 } 318 319 static void __exit nf_nat_helper_pptp_fini(void) 320 { 321 RCU_INIT_POINTER(nf_nat_pptp_hook, NULL); 322 synchronize_rcu(); 323 } 324 325 module_init(nf_nat_helper_pptp_init); 326 module_exit(nf_nat_helper_pptp_fini); 327