sys/contrib/ipfilter/netinet/ip_pptp_pxy.c

   1 /*
   2  * Copyright (C) 2002-2003 by Darren Reed
   3  *
   4  * Simple PPTP transparent proxy for in-kernel use.  For use with the NAT
   5  * code.
   6  *
   7  * $Id: ip_pptp_pxy.c,v 2.10.2.15 2006/10/31 12:11:23 darrenr Exp $
   8  *
   9  */
  10 #define IPF_PPTP_PROXY
  11
  12 typedef struct pptp_hdr {
  13         u_short pptph_len;
  14         u_short pptph_type;
  15         u_32_t  pptph_cookie;
  16 } pptp_hdr_t;
  17
  18 #define PPTP_MSGTYPE_CTL        1
  19 #define PPTP_MTCTL_STARTREQ     1
  20 #define PPTP_MTCTL_STARTREP     2
  21 #define PPTP_MTCTL_STOPREQ      3
  22 #define PPTP_MTCTL_STOPREP      4
  23 #define PPTP_MTCTL_ECHOREQ      5
  24 #define PPTP_MTCTL_ECHOREP      6
  25 #define PPTP_MTCTL_OUTREQ       7
  26 #define PPTP_MTCTL_OUTREP       8
  27 #define PPTP_MTCTL_INREQ        9
  28 #define PPTP_MTCTL_INREP        10
  29 #define PPTP_MTCTL_INCONNECT    11
  30 #define PPTP_MTCTL_CLEAR        12
  31 #define PPTP_MTCTL_DISCONNECT   13
  32 #define PPTP_MTCTL_WANERROR     14
  33 #define PPTP_MTCTL_LINKINFO     15
  34
  35
  36 int ippr_pptp_init __P((void));
  37 void ippr_pptp_fini __P((void));
  38 int ippr_pptp_new __P((fr_info_t *, ap_session_t *, nat_t *));
  39 void ippr_pptp_del __P((ap_session_t *));
  40 int ippr_pptp_inout __P((fr_info_t *, ap_session_t *, nat_t *));
  41 void ippr_pptp_donatstate __P((fr_info_t *, nat_t *, pptp_pxy_t *));
  42 int ippr_pptp_message __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
  43 int ippr_pptp_nextmessage __P((fr_info_t *, nat_t *, pptp_pxy_t *, int));
  44 int ippr_pptp_mctl __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
  45
  46 static  frentry_t       pptpfr;
  47
  48 int     pptp_proxy_init = 0;
  49 int     ippr_pptp_debug = 0;
  50 int     ippr_pptp_gretimeout = IPF_TTLVAL(120); /* 2 minutes */
  51
  52
  53 /*
  54  * PPTP application proxy initialization.
  55  */
  56 int ippr_pptp_init()
  57 {
  58         bzero((char *)&pptpfr, sizeof(pptpfr));
  59         pptpfr.fr_ref = 1;
  60         pptpfr.fr_age[0] = ippr_pptp_gretimeout;
  61         pptpfr.fr_age[1] = ippr_pptp_gretimeout;
  62         pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
  63         MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock");
  64         pptp_proxy_init = 1;
  65
  66         return 0;
  67 }
  68
  69
  70 void ippr_pptp_fini()
  71 {
  72         if (pptp_proxy_init == 1) {
  73                 MUTEX_DESTROY(&pptpfr.fr_lock);
  74                 pptp_proxy_init = 0;
  75         }
  76 }
  77
  78
  79 /*
  80  * Setup for a new PPTP proxy.
  81  *
  82  * NOTE: The printf's are broken up with %s in them to prevent them being
  83  * optimised into puts statements on FreeBSD (this doesn't exist in the kernel)
  84  */
  85 int ippr_pptp_new(fin, aps, nat)
  86 fr_info_t *fin;
  87 ap_session_t *aps;
  88 nat_t *nat;
  89 {
  90         pptp_pxy_t *pptp;
  91         ipnat_t *ipn;
  92         ip_t *ip;
  93
  94         ip = fin->fin_ip;
  95
  96         if (nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_inip,
  97                           ip->ip_dst) != NULL) {
  98                 if (ippr_pptp_debug > 0)
  99                         printf("ippr_pptp_new: GRE session %s\n",
 100                                "already exists");
 101                 return -1;
 102         }
 103
 104         aps->aps_psiz = sizeof(*pptp);
 105         KMALLOCS(aps->aps_data, pptp_pxy_t *, sizeof(*pptp));
 106         if (aps->aps_data == NULL) {
 107                 if (ippr_pptp_debug > 0)
 108                         printf("ippr_pptp_new: malloc for aps_data %s\n",
 109                                "failed");
 110                 return -1;
 111         }
 112
 113         /*
 114          * Create NAT rule against which the tunnel/transport mapping is
 115          * created.  This is required because the current NAT rule does not
 116          * describe GRE but TCP instead.
 117          */
 118         pptp = aps->aps_data;
 119         bzero((char *)pptp, sizeof(*pptp));
 120         ipn = &pptp->pptp_rule;
 121         ipn->in_ifps[0] = fin->fin_ifp;
 122         ipn->in_apr = NULL;
 123         ipn->in_use = 1;
 124         ipn->in_hits = 1;
 125         ipn->in_ippip = 1;
 126         if (nat->nat_dir == NAT_OUTBOUND) {
 127                 ipn->in_nip = ntohl(nat->nat_outip.s_addr);
 128                 ipn->in_outip = fin->fin_saddr;
 129                 ipn->in_redir = NAT_MAP;
 130         } else if (nat->nat_dir == NAT_INBOUND) {
 131                 ipn->in_nip = 0;
 132                 ipn->in_outip = nat->nat_outip.s_addr;
 133                 ipn->in_redir = NAT_REDIRECT;
 134         }
 135         ipn->in_inip = nat->nat_inip.s_addr;
 136         ipn->in_inmsk = 0xffffffff;
 137         ipn->in_outmsk = 0xffffffff;
 138         ipn->in_srcip = fin->fin_saddr;
 139         ipn->in_srcmsk = 0xffffffff;
 140         bcopy(nat->nat_ptr->in_ifnames[0], ipn->in_ifnames[0],
 141               sizeof(ipn->in_ifnames[0]));
 142         ipn->in_p = IPPROTO_GRE;
 143
 144         pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer;
 145         pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer;
 146         return 0;
 147 }
 148
 149
 150 void ippr_pptp_donatstate(fin, nat, pptp)
 151 fr_info_t *fin;
 152 nat_t *nat;
 153 pptp_pxy_t *pptp;
 154 {
 155         fr_info_t fi;
 156         grehdr_t gre;
 157         nat_t *nat2;
 158         u_char p;
 159         ip_t *ip;
 160
 161         ip = fin->fin_ip;
 162         p = ip->ip_p;
 163
 164         nat2 = pptp->pptp_nat;
 165         if ((nat2 == NULL) || (pptp->pptp_state == NULL)) {
 166                 bcopy((char *)fin, (char *)&fi, sizeof(fi));
 167                 bzero((char *)&gre, sizeof(gre));
 168                 fi.fin_state = NULL;
 169                 fi.fin_nat = NULL;
 170                 fi.fin_fi.fi_p = IPPROTO_GRE;
 171                 fi.fin_fr = &pptpfr;
 172                 if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) ||
 173                     (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) {
 174                         fi.fin_data[0] = pptp->pptp_call[0];
 175                         fi.fin_data[1] = pptp->pptp_call[1];
 176                 } else {
 177                         fi.fin_data[0] = pptp->pptp_call[1];
 178                         fi.fin_data[1] = pptp->pptp_call[0];
 179                 }
 180                 ip = fin->fin_ip;
 181                 ip->ip_p = IPPROTO_GRE;
 182                 fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG);
 183                 fi.fin_flx |= FI_IGNORE;
 184                 fi.fin_dp = &gre;
 185                 gre.gr_flags = htons(1 << 13);
 186                 if (fin->fin_out && nat->nat_dir == NAT_INBOUND) {
 187                         fi.fin_fi.fi_saddr = fin->fin_fi.fi_daddr;
 188                         fi.fin_fi.fi_daddr = nat->nat_outip.s_addr;
 189                 } else if (!fin->fin_out && nat->nat_dir == NAT_OUTBOUND) {
 190                         fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
 191                         fi.fin_fi.fi_daddr = fin->fin_fi.fi_saddr;
 192                 }
 193         }
 194
 195         /*
 196          * Update NAT timeout/create NAT if missing.
 197          */
 198         if (nat2 != NULL)
 199                 fr_queueback(&nat2->nat_tqe);
 200         else {
 201                 nat2 = nat_new(&fi, &pptp->pptp_rule, &pptp->pptp_nat,
 202                                NAT_SLAVE, nat->nat_dir);
 203                 pptp->pptp_nat = nat2;
 204                 if (nat2 != NULL) {
 205                         (void) nat_proto(&fi, nat2, 0);
 206                         nat_update(&fi, nat2, nat2->nat_ptr);
 207                 }
 208         }
 209
 210         READ_ENTER(&ipf_state);
 211         if (pptp->pptp_state != NULL) {
 212                 fr_queueback(&pptp->pptp_state->is_sti);
 213                 RWLOCK_EXIT(&ipf_state);
 214         } else {
 215                 RWLOCK_EXIT(&ipf_state);
 216                 if (nat2 != NULL) {
 217                         if (nat->nat_dir == NAT_INBOUND)
 218                                 fi.fin_fi.fi_daddr = nat2->nat_inip.s_addr;
 219                         else
 220                                 fi.fin_fi.fi_saddr = nat2->nat_inip.s_addr;
 221                 }
 222                 fi.fin_ifp = NULL;
 223                 pptp->pptp_state = fr_addstate(&fi, &pptp->pptp_state,
 224                                                0);
 225                 if (fi.fin_state != NULL)
 226                         fr_statederef((ipstate_t **)&fi.fin_state);
 227         }
 228         ip->ip_p = p;
 229         return;
 230 }
 231
 232
 233 /*
 234  * Try and build up the next PPTP message in the TCP stream and if we can
 235  * build it up completely (fits in our buffer) then pass it off to the message
 236  * parsing function.
 237  */
 238 int ippr_pptp_nextmessage(fin, nat, pptp, rev)
 239 fr_info_t *fin;
 240 nat_t *nat;
 241 pptp_pxy_t *pptp;
 242 int rev;
 243 {
 244         static const char *funcname = "ippr_pptp_nextmessage";
 245         pptp_side_t *pptps;
 246         u_32_t start, end;
 247         pptp_hdr_t *hdr;
 248         tcphdr_t *tcp;
 249         int dlen, off;
 250         u_short len;
 251         char *msg;
 252
 253         tcp = fin->fin_dp;
 254         dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
 255         start = ntohl(tcp->th_seq);
 256         pptps = &pptp->pptp_side[rev];
 257         off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) +
 258               fin->fin_ipoff;
 259
 260         if (dlen <= 0)
 261                 return 0;
 262         /*
 263          * If the complete data packet is before what we expect to see
 264          * "next", just ignore it as the chances are we've already seen it.
 265          * The next if statement following this one really just causes packets
 266          * ahead of what we've seen to be dropped, implying that something in
 267          * the middle went missing and we want to see that first.
 268          */
 269         end = start + dlen;
 270         if (pptps->pptps_next > end && pptps->pptps_next > start)
 271                 return 0;
 272
 273         if (pptps->pptps_next != start) {
 274                 if (ippr_pptp_debug > 5)
 275                         printf("%s: next (%x) != start (%x)\n", funcname,
 276                                 pptps->pptps_next, start);
 277                 return -1;
 278         }
 279
 280         msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2);
 281
 282         while (dlen > 0) {
 283                 off += pptps->pptps_bytes;
 284                 if (pptps->pptps_gothdr == 0) {
 285                         /*
 286                          * PPTP has an 8 byte header that inclues the cookie.
 287                          * The start of every message should include one and
 288                          * it should match 1a2b3c4d.  Byte order is ignored,
 289                          * deliberately, when printing out the error.
 290                          */
 291                         len = MIN(8 - pptps->pptps_bytes, dlen);
 292                         COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
 293                         pptps->pptps_bytes += len;
 294                         pptps->pptps_wptr += len;
 295                         hdr = (pptp_hdr_t *)pptps->pptps_buffer;
 296                         if (pptps->pptps_bytes == 8) {
 297                                 pptps->pptps_next += 8;
 298                                 if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) {
 299                                         if (ippr_pptp_debug > 1)
 300                                                 printf("%s: bad cookie (%x)\n",
 301                                                        funcname,
 302                                                        hdr->pptph_cookie);
 303                                         return -1;
 304                                 }
 305                         }
 306                         dlen -= len;
 307                         msg += len;
 308                         off += len;
 309
 310                         pptps->pptps_gothdr = 1;
 311                         len = ntohs(hdr->pptph_len);
 312                         pptps->pptps_len = len;
 313                         pptps->pptps_nexthdr += len;
 314
 315                         /*
 316                          * If a message is too big for the buffer, just set
 317                          * the fields for the next message to come along.
 318                          * The messages defined in RFC 2637 will not exceed
 319                          * 512 bytes (in total length) so this is likely a
 320                          * bad data packet, anyway.
 321                          */
 322                         if (len > sizeof(pptps->pptps_buffer)) {
 323                                 if (ippr_pptp_debug > 3)
 324                                         printf("%s: message too big (%d)\n",
 325                                                funcname, len);
 326                                 pptps->pptps_next = pptps->pptps_nexthdr;
 327                                 pptps->pptps_wptr = pptps->pptps_buffer;
 328                                 pptps->pptps_gothdr = 0;
 329                                 pptps->pptps_bytes = 0;
 330                                 pptps->pptps_len = 0;
 331                                 break;
 332                         }
 333                 }
 334
 335                 len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
 336                 COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
 337                 pptps->pptps_bytes += len;
 338                 pptps->pptps_wptr += len;
 339                 pptps->pptps_next += len;
 340
 341                 if (pptps->pptps_len > pptps->pptps_bytes)
 342                         break;
 343
 344                 ippr_pptp_message(fin, nat, pptp, pptps);
 345                 pptps->pptps_wptr = pptps->pptps_buffer;
 346                 pptps->pptps_gothdr = 0;
 347                 pptps->pptps_bytes = 0;
 348                 pptps->pptps_len = 0;
 349
 350                 start += len;
 351                 msg += len;
 352                 dlen -= len;
 353         }
 354
 355         return 0;
 356 }
 357
 358
 359 /*
 360  * handle a complete PPTP message
 361  */
 362 int ippr_pptp_message(fin, nat, pptp, pptps)
 363 fr_info_t *fin;
 364 nat_t *nat;
 365 pptp_pxy_t *pptp;
 366 pptp_side_t *pptps;
 367 {
 368         pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer;
 369
 370         switch (ntohs(hdr->pptph_type))
 371         {
 372         case PPTP_MSGTYPE_CTL :
 373                 ippr_pptp_mctl(fin, nat, pptp, pptps);
 374                 break;
 375
 376         default :
 377                 break;
 378         }
 379         return 0;
 380 }
 381
 382
 383 /*
 384  * handle a complete PPTP control message
 385  */
 386 int ippr_pptp_mctl(fin, nat, pptp, pptps)
 387 fr_info_t *fin;
 388 nat_t *nat;
 389 pptp_pxy_t *pptp;
 390 pptp_side_t *pptps;
 391 {
 392         u_short *buffer = (u_short *)(pptps->pptps_buffer);
 393         pptp_side_t *pptpo;
 394
 395         if (pptps == &pptp->pptp_side[0])
 396                 pptpo = &pptp->pptp_side[1];
 397         else
 398                 pptpo = &pptp->pptp_side[0];
 399
 400         /*
 401          * Breakout to handle all the various messages.  Most are just state
 402          * transition.
 403          */
 404         switch (ntohs(buffer[4]))
 405         {
 406         case PPTP_MTCTL_STARTREQ :
 407                 pptps->pptps_state = PPTP_MTCTL_STARTREQ;
 408                 break;
 409         case PPTP_MTCTL_STARTREP :
 410                 if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ)
 411                         pptps->pptps_state = PPTP_MTCTL_STARTREP;
 412                 break;
 413         case PPTP_MTCTL_STOPREQ :
 414                 pptps->pptps_state = PPTP_MTCTL_STOPREQ;
 415                 break;
 416         case PPTP_MTCTL_STOPREP :
 417                 if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ)
 418                         pptps->pptps_state = PPTP_MTCTL_STOPREP;
 419                 break;
 420         case PPTP_MTCTL_ECHOREQ :
 421                 pptps->pptps_state = PPTP_MTCTL_ECHOREQ;
 422                 break;
 423         case PPTP_MTCTL_ECHOREP :
 424                 if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ)
 425                         pptps->pptps_state = PPTP_MTCTL_ECHOREP;
 426                 break;
 427         case PPTP_MTCTL_OUTREQ :
 428                 pptps->pptps_state = PPTP_MTCTL_OUTREQ;
 429                 break;
 430         case PPTP_MTCTL_OUTREP :
 431                 if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) {
 432                         pptps->pptps_state = PPTP_MTCTL_OUTREP;
 433                         pptp->pptp_call[0] = buffer[7];
 434                         pptp->pptp_call[1] = buffer[6];
 435                         ippr_pptp_donatstate(fin, nat, pptp);
 436                 }
 437                 break;
 438         case PPTP_MTCTL_INREQ :
 439                 pptps->pptps_state = PPTP_MTCTL_INREQ;
 440                 break;
 441         case PPTP_MTCTL_INREP :
 442                 if (pptpo->pptps_state == PPTP_MTCTL_INREQ) {
 443                         pptps->pptps_state = PPTP_MTCTL_INREP;
 444                         pptp->pptp_call[0] = buffer[7];
 445                         pptp->pptp_call[1] = buffer[6];
 446                         ippr_pptp_donatstate(fin, nat, pptp);
 447                 }
 448                 break;
 449         case PPTP_MTCTL_INCONNECT :
 450                 pptps->pptps_state = PPTP_MTCTL_INCONNECT;
 451                 break;
 452         case PPTP_MTCTL_CLEAR :
 453                 pptps->pptps_state = PPTP_MTCTL_CLEAR;
 454                 break;
 455         case PPTP_MTCTL_DISCONNECT :
 456                 pptps->pptps_state = PPTP_MTCTL_DISCONNECT;
 457                 break;
 458         case PPTP_MTCTL_WANERROR :
 459                 pptps->pptps_state = PPTP_MTCTL_WANERROR;
 460                 break;
 461         case PPTP_MTCTL_LINKINFO :
 462                 pptps->pptps_state = PPTP_MTCTL_LINKINFO;
 463                 break;
 464         }
 465
 466         return 0;
 467 }
 468
 469
 470 /*
 471  * For outgoing PPTP packets.  refresh timeouts for NAT & state entries, if
 472  * we can.  If they have disappeared, recreate them.
 473  */
 474 int ippr_pptp_inout(fin, aps, nat)
 475 fr_info_t *fin;
 476 ap_session_t *aps;
 477 nat_t *nat;
 478 {
 479         pptp_pxy_t *pptp;
 480         tcphdr_t *tcp;
 481         int rev;
 482
 483         if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND))
 484                 rev = 1;
 485         else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND))
 486                 rev = 1;
 487         else
 488                 rev = 0;
 489
 490         tcp = (tcphdr_t *)fin->fin_dp;
 491         if ((tcp->th_flags & TH_OPENING) == TH_OPENING) {
 492                 pptp = (pptp_pxy_t *)aps->aps_data;
 493                 pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack);
 494                 pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack);
 495                 pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1;
 496                 pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1;
 497         }
 498         return ippr_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data,
 499                                      rev);
 500 }
 501
 502
 503 /*
 504  * clean up after ourselves.
 505  */
 506 void ippr_pptp_del(aps)
 507 ap_session_t *aps;
 508 {
 509         pptp_pxy_t *pptp;
 510
 511         pptp = aps->aps_data;
 512
 513         if (pptp != NULL) {
 514                 /*
 515                  * Don't bother changing any of the NAT structure details,
 516                  * *_del() is on a callback from aps_free(), from nat_delete()
 517                  */
 518
 519                 READ_ENTER(&ipf_state);
 520                 if (pptp->pptp_state != NULL) {
 521                         pptp->pptp_state->is_die = fr_ticks + 1;
 522                         pptp->pptp_state->is_me = NULL;
 523                         fr_queuefront(&pptp->pptp_state->is_sti);
 524                 }
 525                 RWLOCK_EXIT(&ipf_state);
 526
 527                 pptp->pptp_state = NULL;
 528                 pptp->pptp_nat = NULL;
 529         }
 530 }