1*ab25eeb5Syz /*
2*ab25eeb5Syz  * Copyright (C) 2002-2003 by Darren Reed
3*ab25eeb5Syz  *
4*ab25eeb5Syz  * Simple PPTP transparent proxy for in-kernel use.  For use with the NAT
5*ab25eeb5Syz  * code.
6*ab25eeb5Syz  *
7*ab25eeb5Syz  * $Id: ip_pptp_pxy.c,v 2.10.2.10 2005/07/15 21:56:52 darrenr Exp $
8*ab25eeb5Syz  *
9*ab25eeb5Syz  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
10*ab25eeb5Syz  * Use is subject to license terms.
11*ab25eeb5Syz  */
12*ab25eeb5Syz 
13*ab25eeb5Syz #pragma ident	"%Z%%M%	%I%	%E% SMI"
14*ab25eeb5Syz 
15*ab25eeb5Syz #define	IPF_PPTP_PROXY
16*ab25eeb5Syz 
17*ab25eeb5Syz typedef	struct pptp_hdr {
18*ab25eeb5Syz 	u_short	pptph_len;
19*ab25eeb5Syz 	u_short	pptph_type;
20*ab25eeb5Syz 	u_32_t	pptph_cookie;
21*ab25eeb5Syz } pptp_hdr_t;
22*ab25eeb5Syz 
23*ab25eeb5Syz #define	PPTP_MSGTYPE_CTL	1
24*ab25eeb5Syz #define	PPTP_MTCTL_STARTREQ	1
25*ab25eeb5Syz #define	PPTP_MTCTL_STARTREP	2
26*ab25eeb5Syz #define	PPTP_MTCTL_STOPREQ	3
27*ab25eeb5Syz #define	PPTP_MTCTL_STOPREP	4
28*ab25eeb5Syz #define	PPTP_MTCTL_ECHOREQ	5
29*ab25eeb5Syz #define	PPTP_MTCTL_ECHOREP	6
30*ab25eeb5Syz #define	PPTP_MTCTL_OUTREQ	7
31*ab25eeb5Syz #define	PPTP_MTCTL_OUTREP	8
32*ab25eeb5Syz #define	PPTP_MTCTL_INREQ	9
33*ab25eeb5Syz #define	PPTP_MTCTL_INREP	10
34*ab25eeb5Syz #define	PPTP_MTCTL_INCONNECT	11
35*ab25eeb5Syz #define	PPTP_MTCTL_CLEAR	12
36*ab25eeb5Syz #define	PPTP_MTCTL_DISCONNECT	13
37*ab25eeb5Syz #define	PPTP_MTCTL_WANERROR	14
38*ab25eeb5Syz #define	PPTP_MTCTL_LINKINFO	15
39*ab25eeb5Syz 
40*ab25eeb5Syz 
41*ab25eeb5Syz int ippr_pptp_init __P((void));
42*ab25eeb5Syz void ippr_pptp_fini __P((void));
43*ab25eeb5Syz int ippr_pptp_new __P((fr_info_t *, ap_session_t *, nat_t *));
44*ab25eeb5Syz void ippr_pptp_del __P((ap_session_t *));
45*ab25eeb5Syz int ippr_pptp_inout __P((fr_info_t *, ap_session_t *, nat_t *));
46*ab25eeb5Syz void ippr_pptp_donatstate __P((fr_info_t *, nat_t *, pptp_pxy_t *));
47*ab25eeb5Syz int ippr_pptp_message __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
48*ab25eeb5Syz int ippr_pptp_nextmessage __P((fr_info_t *, nat_t *, pptp_pxy_t *, int));
49*ab25eeb5Syz int ippr_pptp_mctl __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *));
50*ab25eeb5Syz 
51*ab25eeb5Syz static	frentry_t	pptpfr;
52*ab25eeb5Syz 
53*ab25eeb5Syz int	pptp_proxy_init = 0;
54*ab25eeb5Syz int	ippr_pptp_debug = 0;
55*ab25eeb5Syz int	ippr_pptp_gretimeout = IPF_TTLVAL(120);	/* 2 minutes */
56*ab25eeb5Syz 
57*ab25eeb5Syz 
58*ab25eeb5Syz /*
59*ab25eeb5Syz  * PPTP application proxy initialization.
60*ab25eeb5Syz  */
61*ab25eeb5Syz int ippr_pptp_init()
62*ab25eeb5Syz {
63*ab25eeb5Syz 	bzero((char *)&pptpfr, sizeof(pptpfr));
64*ab25eeb5Syz 	pptpfr.fr_ref = 1;
65*ab25eeb5Syz 	pptpfr.fr_age[0] = ippr_pptp_gretimeout;
66*ab25eeb5Syz 	pptpfr.fr_age[1] = ippr_pptp_gretimeout;
67*ab25eeb5Syz 	pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
68*ab25eeb5Syz 	MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock");
69*ab25eeb5Syz 	pptp_proxy_init = 1;
70*ab25eeb5Syz 
71*ab25eeb5Syz 	return 0;
72*ab25eeb5Syz }
73*ab25eeb5Syz 
74*ab25eeb5Syz 
75*ab25eeb5Syz void ippr_pptp_fini()
76*ab25eeb5Syz {
77*ab25eeb5Syz 	if (pptp_proxy_init == 1) {
78*ab25eeb5Syz 		MUTEX_DESTROY(&pptpfr.fr_lock);
79*ab25eeb5Syz 		pptp_proxy_init = 0;
80*ab25eeb5Syz 	}
81*ab25eeb5Syz }
82*ab25eeb5Syz 
83*ab25eeb5Syz 
84*ab25eeb5Syz /*
85*ab25eeb5Syz  * Setup for a new PPTP proxy.
86*ab25eeb5Syz  */
87*ab25eeb5Syz int ippr_pptp_new(fin, aps, nat)
88*ab25eeb5Syz fr_info_t *fin;
89*ab25eeb5Syz ap_session_t *aps;
90*ab25eeb5Syz nat_t *nat;
91*ab25eeb5Syz {
92*ab25eeb5Syz 	pptp_pxy_t *pptp;
93*ab25eeb5Syz 	ipnat_t *ipn;
94*ab25eeb5Syz 	ip_t *ip;
95*ab25eeb5Syz 
96*ab25eeb5Syz 	ip = fin->fin_ip;
97*ab25eeb5Syz 
98*ab25eeb5Syz 	if (nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_inip,
99*ab25eeb5Syz 			  ip->ip_dst) != NULL) {
100*ab25eeb5Syz 		if (ippr_pptp_debug > 0)
101*ab25eeb5Syz 			printf("ippr_pptp_new: GRE session already exists\n");
102*ab25eeb5Syz 		return -1;
103*ab25eeb5Syz 	}
104*ab25eeb5Syz 
105*ab25eeb5Syz 	aps->aps_psiz = sizeof(*pptp);
106*ab25eeb5Syz 	KMALLOCS(aps->aps_data, pptp_pxy_t *, sizeof(*pptp));
107*ab25eeb5Syz 	if (aps->aps_data == NULL) {
108*ab25eeb5Syz 		if (ippr_pptp_debug > 0)
109*ab25eeb5Syz 			printf("ippr_pptp_new: malloc for aps_data failed\n");
110*ab25eeb5Syz 		return -1;
111*ab25eeb5Syz 	}
112*ab25eeb5Syz 
113*ab25eeb5Syz 	/*
114*ab25eeb5Syz 	 * Create NAT rule against which the tunnel/transport mapping is
115*ab25eeb5Syz 	 * created.  This is required because the current NAT rule does not
116*ab25eeb5Syz 	 * describe GRE but TCP instead.
117*ab25eeb5Syz 	 */
118*ab25eeb5Syz 	pptp = aps->aps_data;
119*ab25eeb5Syz 	bzero((char *)pptp, sizeof(*pptp));
120*ab25eeb5Syz 	ipn = &pptp->pptp_rule;
121*ab25eeb5Syz 	ipn->in_ifps[0] = fin->fin_ifp;
122*ab25eeb5Syz 	ipn->in_apr = NULL;
123*ab25eeb5Syz 	ipn->in_use = 1;
124*ab25eeb5Syz 	ipn->in_hits = 1;
125*ab25eeb5Syz 	ipn->in_ippip = 1;
126*ab25eeb5Syz 	if (nat->nat_dir == NAT_OUTBOUND) {
127*ab25eeb5Syz 		ipn->in_nip = ntohl(nat->nat_outip.s_addr);
128*ab25eeb5Syz 		ipn->in_outip = fin->fin_saddr;
129*ab25eeb5Syz 		ipn->in_redir = NAT_MAP;
130*ab25eeb5Syz 	} else if (nat->nat_dir == NAT_INBOUND) {
131*ab25eeb5Syz 		ipn->in_nip = 0;
132*ab25eeb5Syz 		ipn->in_outip = nat->nat_outip.s_addr;
133*ab25eeb5Syz 		ipn->in_redir = NAT_REDIRECT;
134*ab25eeb5Syz 	}
135*ab25eeb5Syz 	ipn->in_inip = nat->nat_inip.s_addr;
136*ab25eeb5Syz 	ipn->in_inmsk = 0xffffffff;
137*ab25eeb5Syz 	ipn->in_outmsk = 0xffffffff;
138*ab25eeb5Syz 	ipn->in_srcip = fin->fin_saddr;
139*ab25eeb5Syz 	ipn->in_srcmsk = 0xffffffff;
140*ab25eeb5Syz 	bcopy(nat->nat_ptr->in_ifnames[0], ipn->in_ifnames[0],
141*ab25eeb5Syz 	      sizeof(ipn->in_ifnames[0]));
142*ab25eeb5Syz 	ipn->in_p = IPPROTO_GRE;
143*ab25eeb5Syz 
144*ab25eeb5Syz 	pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer;
145*ab25eeb5Syz 	pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer;
146*ab25eeb5Syz 	return 0;
147*ab25eeb5Syz }
148*ab25eeb5Syz 
149*ab25eeb5Syz 
150*ab25eeb5Syz void ippr_pptp_donatstate(fin, nat, pptp)
151*ab25eeb5Syz fr_info_t *fin;
152*ab25eeb5Syz nat_t *nat;
153*ab25eeb5Syz pptp_pxy_t *pptp;
154*ab25eeb5Syz {
155*ab25eeb5Syz 	fr_info_t fi;
156*ab25eeb5Syz 	grehdr_t gre;
157*ab25eeb5Syz 	nat_t *nat2;
158*ab25eeb5Syz 	u_char p;
159*ab25eeb5Syz 	ip_t *ip;
160*ab25eeb5Syz 
161*ab25eeb5Syz 	ip = fin->fin_ip;
162*ab25eeb5Syz 	p = ip->ip_p;
163*ab25eeb5Syz 
164*ab25eeb5Syz 	nat2 = pptp->pptp_nat;
165*ab25eeb5Syz 	if ((nat2 == NULL) || (pptp->pptp_state == NULL)) {
166*ab25eeb5Syz 		bcopy((char *)fin, (char *)&fi, sizeof(fi));
167*ab25eeb5Syz 		bzero((char *)&gre, sizeof(gre));
168*ab25eeb5Syz 		fi.fin_state = NULL;
169*ab25eeb5Syz 		fi.fin_nat = NULL;
170*ab25eeb5Syz 		fi.fin_fi.fi_p = IPPROTO_GRE;
171*ab25eeb5Syz 		fi.fin_fr = &pptpfr;
172*ab25eeb5Syz 		if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) ||
173*ab25eeb5Syz 		    (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) {
174*ab25eeb5Syz 			fi.fin_data[0] = pptp->pptp_call[0];
175*ab25eeb5Syz 			fi.fin_data[1] = pptp->pptp_call[1];
176*ab25eeb5Syz 		} else {
177*ab25eeb5Syz 			fi.fin_data[0] = pptp->pptp_call[1];
178*ab25eeb5Syz 			fi.fin_data[1] = pptp->pptp_call[0];
179*ab25eeb5Syz 		}
180*ab25eeb5Syz 		ip = fin->fin_ip;
181*ab25eeb5Syz 		ip->ip_p = IPPROTO_GRE;
182*ab25eeb5Syz 		fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG);
183*ab25eeb5Syz 		fi.fin_flx |= FI_IGNORE;
184*ab25eeb5Syz 		fi.fin_dp = &gre;
185*ab25eeb5Syz 		gre.gr_flags = htons(1 << 13);
186*ab25eeb5Syz 		if (fin->fin_out && nat->nat_dir == NAT_INBOUND) {
187*ab25eeb5Syz 			fi.fin_fi.fi_saddr = fin->fin_fi.fi_daddr;
188*ab25eeb5Syz 			fi.fin_fi.fi_daddr = nat->nat_outip.s_addr;
189*ab25eeb5Syz 		} else if (!fin->fin_out && nat->nat_dir == NAT_OUTBOUND) {
190*ab25eeb5Syz 			fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
191*ab25eeb5Syz 			fi.fin_fi.fi_daddr = fin->fin_fi.fi_saddr;
192*ab25eeb5Syz 		}
193*ab25eeb5Syz 	}
194*ab25eeb5Syz 
195*ab25eeb5Syz 	/*
196*ab25eeb5Syz 	 * Update NAT timeout/create NAT if missing.
197*ab25eeb5Syz 	 */
198*ab25eeb5Syz 	if (nat2 != NULL)
199*ab25eeb5Syz 		fr_queueback(&nat2->nat_tqe);
200*ab25eeb5Syz 	else {
201*ab25eeb5Syz 		nat2 = nat_new(&fi, &pptp->pptp_rule, &pptp->pptp_nat,
202*ab25eeb5Syz 			       NAT_SLAVE, nat->nat_dir);
203*ab25eeb5Syz 		pptp->pptp_nat = nat2;
204*ab25eeb5Syz 		if (nat2 != NULL) {
205*ab25eeb5Syz 			(void) nat_proto(&fi, nat2, 0);
206*ab25eeb5Syz 			nat_update(&fi, nat2, nat2->nat_ptr);
207*ab25eeb5Syz 		}
208*ab25eeb5Syz 	}
209*ab25eeb5Syz 
210*ab25eeb5Syz 	READ_ENTER(&ipf_state);
211*ab25eeb5Syz 	if (pptp->pptp_state != NULL) {
212*ab25eeb5Syz 		fr_queueback(&pptp->pptp_state->is_sti);
213*ab25eeb5Syz 		RWLOCK_EXIT(&ipf_state);
214*ab25eeb5Syz 	} else {
215*ab25eeb5Syz 		RWLOCK_EXIT(&ipf_state);
216*ab25eeb5Syz 		if (nat->nat_dir == NAT_INBOUND)
217*ab25eeb5Syz 			fi.fin_fi.fi_daddr = nat2->nat_inip.s_addr;
218*ab25eeb5Syz 		else
219*ab25eeb5Syz 			fi.fin_fi.fi_saddr = nat2->nat_inip.s_addr;
220*ab25eeb5Syz 		fi.fin_ifp = NULL;
221*ab25eeb5Syz 		pptp->pptp_state = fr_addstate(&fi, &pptp->pptp_state,
222*ab25eeb5Syz 					       0);
223*ab25eeb5Syz 		if (fi.fin_state != NULL)
224*ab25eeb5Syz 			fr_statederef(&fi, (ipstate_t **)&fi.fin_state);
225*ab25eeb5Syz 	}
226*ab25eeb5Syz 	ip->ip_p = p;
227*ab25eeb5Syz 	return;
228*ab25eeb5Syz }
229*ab25eeb5Syz 
230*ab25eeb5Syz 
231*ab25eeb5Syz /*
232*ab25eeb5Syz  * Try and build up the next PPTP message in the TCP stream and if we can
233*ab25eeb5Syz  * build it up completely (fits in our buffer) then pass it off to the message
234*ab25eeb5Syz  * parsing function.
235*ab25eeb5Syz  */
236*ab25eeb5Syz int ippr_pptp_nextmessage(fin, nat, pptp, rev)
237*ab25eeb5Syz fr_info_t *fin;
238*ab25eeb5Syz nat_t *nat;
239*ab25eeb5Syz pptp_pxy_t *pptp;
240*ab25eeb5Syz int rev;
241*ab25eeb5Syz {
242*ab25eeb5Syz 	static char *funcname = "ippr_pptp_nextmessage";
243*ab25eeb5Syz 	pptp_side_t *pptps;
244*ab25eeb5Syz 	u_32_t start, end;
245*ab25eeb5Syz 	pptp_hdr_t *hdr;
246*ab25eeb5Syz 	tcphdr_t *tcp;
247*ab25eeb5Syz 	int dlen, off;
248*ab25eeb5Syz 	u_short len;
249*ab25eeb5Syz 	char *msg;
250*ab25eeb5Syz 
251*ab25eeb5Syz 	tcp = fin->fin_dp;
252*ab25eeb5Syz 	dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
253*ab25eeb5Syz 	start = ntohl(tcp->th_seq);
254*ab25eeb5Syz 	pptps = &pptp->pptp_side[rev];
255*ab25eeb5Syz 	off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) +
256*ab25eeb5Syz 	      fin->fin_ipoff;
257*ab25eeb5Syz 
258*ab25eeb5Syz 	if (dlen <= 0)
259*ab25eeb5Syz 		return 0;
260*ab25eeb5Syz 	/*
261*ab25eeb5Syz 	 * If the complete data packet is before what we expect to see
262*ab25eeb5Syz 	 * "next", just ignore it as the chances are we've already seen it.
263*ab25eeb5Syz 	 * The next if statement following this one really just causes packets
264*ab25eeb5Syz 	 * ahead of what we've seen to be dropped, implying that something in
265*ab25eeb5Syz 	 * the middle went missing and we want to see that first.
266*ab25eeb5Syz 	 */
267*ab25eeb5Syz 	end = start + dlen;
268*ab25eeb5Syz 	if (pptps->pptps_next > end && pptps->pptps_next > start)
269*ab25eeb5Syz 		return 0;
270*ab25eeb5Syz 
271*ab25eeb5Syz 	if (pptps->pptps_next != start) {
272*ab25eeb5Syz 		if (ippr_pptp_debug > 5)
273*ab25eeb5Syz 			printf("%s: next (%x) != start (%x)\n", funcname,
274*ab25eeb5Syz 				pptps->pptps_next, start);
275*ab25eeb5Syz 		return -1;
276*ab25eeb5Syz 	}
277*ab25eeb5Syz 
278*ab25eeb5Syz 	msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2);
279*ab25eeb5Syz 
280*ab25eeb5Syz 	while (dlen > 0) {
281*ab25eeb5Syz 		off += pptps->pptps_bytes;
282*ab25eeb5Syz 		if (pptps->pptps_gothdr == 0) {
283*ab25eeb5Syz 			/*
284*ab25eeb5Syz 			 * PPTP has an 8 byte header that inclues the cookie.
285*ab25eeb5Syz 			 * The start of every message should include one and
286*ab25eeb5Syz 			 * it should match 1a2b3c4d.  Byte order is ignored,
287*ab25eeb5Syz 			 * deliberately, when printing out the error.
288*ab25eeb5Syz 			 */
289*ab25eeb5Syz 			len = MIN(8 - pptps->pptps_bytes, dlen);
290*ab25eeb5Syz 			COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
291*ab25eeb5Syz 			pptps->pptps_bytes += len;
292*ab25eeb5Syz 			pptps->pptps_wptr += len;
293*ab25eeb5Syz 			hdr = (pptp_hdr_t *)pptps->pptps_buffer;
294*ab25eeb5Syz 			if (pptps->pptps_bytes == 8) {
295*ab25eeb5Syz 				pptps->pptps_next += 8;
296*ab25eeb5Syz 				if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) {
297*ab25eeb5Syz 					if (ippr_pptp_debug > 1)
298*ab25eeb5Syz 						printf("%s: bad cookie (%x)\n",
299*ab25eeb5Syz 						       funcname,
300*ab25eeb5Syz 						       hdr->pptph_cookie);
301*ab25eeb5Syz 					return -1;
302*ab25eeb5Syz 				}
303*ab25eeb5Syz 			}
304*ab25eeb5Syz 			dlen -= len;
305*ab25eeb5Syz 			msg += len;
306*ab25eeb5Syz 			off += len;
307*ab25eeb5Syz 
308*ab25eeb5Syz 			pptps->pptps_gothdr = 1;
309*ab25eeb5Syz 			len = ntohs(hdr->pptph_len);
310*ab25eeb5Syz 			pptps->pptps_len = len;
311*ab25eeb5Syz 			pptps->pptps_nexthdr += len;
312*ab25eeb5Syz 
313*ab25eeb5Syz 			/*
314*ab25eeb5Syz 			 * If a message is too big for the buffer, just set
315*ab25eeb5Syz 			 * the fields for the next message to come along.
316*ab25eeb5Syz 			 * The messages defined in RFC 2637 will not exceed
317*ab25eeb5Syz 			 * 512 bytes (in total length) so this is likely a
318*ab25eeb5Syz 			 * bad data packet, anyway.
319*ab25eeb5Syz 			 */
320*ab25eeb5Syz 			if (len > sizeof(pptps->pptps_buffer)) {
321*ab25eeb5Syz 				if (ippr_pptp_debug > 3)
322*ab25eeb5Syz 					printf("%s: message too big (%d)\n",
323*ab25eeb5Syz 					       funcname, len);
324*ab25eeb5Syz 				pptps->pptps_next = pptps->pptps_nexthdr;
325*ab25eeb5Syz 				pptps->pptps_wptr = pptps->pptps_buffer;
326*ab25eeb5Syz 				pptps->pptps_gothdr = 0;
327*ab25eeb5Syz 				pptps->pptps_bytes = 0;
328*ab25eeb5Syz 				pptps->pptps_len = 0;
329*ab25eeb5Syz 				break;
330*ab25eeb5Syz 			}
331*ab25eeb5Syz 		}
332*ab25eeb5Syz 
333*ab25eeb5Syz 		len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen);
334*ab25eeb5Syz 		COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr);
335*ab25eeb5Syz 		pptps->pptps_bytes += len;
336*ab25eeb5Syz 		pptps->pptps_wptr += len;
337*ab25eeb5Syz 		pptps->pptps_next += len;
338*ab25eeb5Syz 
339*ab25eeb5Syz 		if (pptps->pptps_len > pptps->pptps_bytes)
340*ab25eeb5Syz 			break;
341*ab25eeb5Syz 
342*ab25eeb5Syz 		(void) ippr_pptp_message(fin, nat, pptp, pptps);
343*ab25eeb5Syz 		pptps->pptps_wptr = pptps->pptps_buffer;
344*ab25eeb5Syz 		pptps->pptps_gothdr = 0;
345*ab25eeb5Syz 		pptps->pptps_bytes = 0;
346*ab25eeb5Syz 		pptps->pptps_len = 0;
347*ab25eeb5Syz 
348*ab25eeb5Syz 		start += len;
349*ab25eeb5Syz 		msg += len;
350*ab25eeb5Syz 		dlen -= len;
351*ab25eeb5Syz 	}
352*ab25eeb5Syz 
353*ab25eeb5Syz 	return 0;
354*ab25eeb5Syz }
355*ab25eeb5Syz 
356*ab25eeb5Syz 
357*ab25eeb5Syz /*
358*ab25eeb5Syz  * handle a complete PPTP message
359*ab25eeb5Syz  */
360*ab25eeb5Syz int ippr_pptp_message(fin, nat, pptp, pptps)
361*ab25eeb5Syz fr_info_t *fin;
362*ab25eeb5Syz nat_t *nat;
363*ab25eeb5Syz pptp_pxy_t *pptp;
364*ab25eeb5Syz pptp_side_t *pptps;
365*ab25eeb5Syz {
366*ab25eeb5Syz 	pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer;
367*ab25eeb5Syz 
368*ab25eeb5Syz 	switch (ntohs(hdr->pptph_type))
369*ab25eeb5Syz 	{
370*ab25eeb5Syz 	case PPTP_MSGTYPE_CTL :
371*ab25eeb5Syz 		(void) ippr_pptp_mctl(fin, nat, pptp, pptps);
372*ab25eeb5Syz 		break;
373*ab25eeb5Syz 
374*ab25eeb5Syz 	default :
375*ab25eeb5Syz 		break;
376*ab25eeb5Syz 	}
377*ab25eeb5Syz 	return 0;
378*ab25eeb5Syz }
379*ab25eeb5Syz 
380*ab25eeb5Syz 
381*ab25eeb5Syz /*
382*ab25eeb5Syz  * handle a complete PPTP control message
383*ab25eeb5Syz  */
384*ab25eeb5Syz int ippr_pptp_mctl(fin, nat, pptp, pptps)
385*ab25eeb5Syz fr_info_t *fin;
386*ab25eeb5Syz nat_t *nat;
387*ab25eeb5Syz pptp_pxy_t *pptp;
388*ab25eeb5Syz pptp_side_t *pptps;
389*ab25eeb5Syz {
390*ab25eeb5Syz 	u_short *buffer = (u_short *)(pptps->pptps_buffer);
391*ab25eeb5Syz 	pptp_side_t *pptpo;
392*ab25eeb5Syz 
393*ab25eeb5Syz 	if (pptps == &pptp->pptp_side[0])
394*ab25eeb5Syz 		pptpo = &pptp->pptp_side[1];
395*ab25eeb5Syz 	else
396*ab25eeb5Syz 		pptpo = &pptp->pptp_side[0];
397*ab25eeb5Syz 
398*ab25eeb5Syz 	/*
399*ab25eeb5Syz 	 * Breakout to handle all the various messages.  Most are just state
400*ab25eeb5Syz 	 * transition.
401*ab25eeb5Syz 	 */
402*ab25eeb5Syz 	switch (ntohs(buffer[4]))
403*ab25eeb5Syz 	{
404*ab25eeb5Syz 	case PPTP_MTCTL_STARTREQ :
405*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_STARTREQ;
406*ab25eeb5Syz 		break;
407*ab25eeb5Syz 	case PPTP_MTCTL_STARTREP :
408*ab25eeb5Syz 		if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ)
409*ab25eeb5Syz 			pptps->pptps_state = PPTP_MTCTL_STARTREP;
410*ab25eeb5Syz 		break;
411*ab25eeb5Syz 	case PPTP_MTCTL_STOPREQ :
412*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_STOPREQ;
413*ab25eeb5Syz 		break;
414*ab25eeb5Syz 	case PPTP_MTCTL_STOPREP :
415*ab25eeb5Syz 		if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ)
416*ab25eeb5Syz 			pptps->pptps_state = PPTP_MTCTL_STOPREP;
417*ab25eeb5Syz 		break;
418*ab25eeb5Syz 	case PPTP_MTCTL_ECHOREQ :
419*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_ECHOREQ;
420*ab25eeb5Syz 		break;
421*ab25eeb5Syz 	case PPTP_MTCTL_ECHOREP :
422*ab25eeb5Syz 		if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ)
423*ab25eeb5Syz 			pptps->pptps_state = PPTP_MTCTL_ECHOREP;
424*ab25eeb5Syz 		break;
425*ab25eeb5Syz 	case PPTP_MTCTL_OUTREQ :
426*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_OUTREQ;
427*ab25eeb5Syz 		break;
428*ab25eeb5Syz 	case PPTP_MTCTL_OUTREP :
429*ab25eeb5Syz 		if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) {
430*ab25eeb5Syz 			pptps->pptps_state = PPTP_MTCTL_OUTREP;
431*ab25eeb5Syz 			pptp->pptp_call[0] = buffer[7];
432*ab25eeb5Syz 			pptp->pptp_call[1] = buffer[6];
433*ab25eeb5Syz 			ippr_pptp_donatstate(fin, nat, pptp);
434*ab25eeb5Syz 		}
435*ab25eeb5Syz 		break;
436*ab25eeb5Syz 	case PPTP_MTCTL_INREQ :
437*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_INREQ;
438*ab25eeb5Syz 		break;
439*ab25eeb5Syz 	case PPTP_MTCTL_INREP :
440*ab25eeb5Syz 		if (pptpo->pptps_state == PPTP_MTCTL_INREQ) {
441*ab25eeb5Syz 			pptps->pptps_state = PPTP_MTCTL_INREP;
442*ab25eeb5Syz 			pptp->pptp_call[0] = buffer[7];
443*ab25eeb5Syz 			pptp->pptp_call[1] = buffer[6];
444*ab25eeb5Syz 			ippr_pptp_donatstate(fin, nat, pptp);
445*ab25eeb5Syz 		}
446*ab25eeb5Syz 		break;
447*ab25eeb5Syz 	case PPTP_MTCTL_INCONNECT :
448*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_INCONNECT;
449*ab25eeb5Syz 		break;
450*ab25eeb5Syz 	case PPTP_MTCTL_CLEAR :
451*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_CLEAR;
452*ab25eeb5Syz 		break;
453*ab25eeb5Syz 	case PPTP_MTCTL_DISCONNECT :
454*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_DISCONNECT;
455*ab25eeb5Syz 		break;
456*ab25eeb5Syz 	case PPTP_MTCTL_WANERROR :
457*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_WANERROR;
458*ab25eeb5Syz 		break;
459*ab25eeb5Syz 	case PPTP_MTCTL_LINKINFO :
460*ab25eeb5Syz 		pptps->pptps_state = PPTP_MTCTL_LINKINFO;
461*ab25eeb5Syz 		break;
462*ab25eeb5Syz 	}
463*ab25eeb5Syz 
464*ab25eeb5Syz 	return 0;
465*ab25eeb5Syz }
466*ab25eeb5Syz 
467*ab25eeb5Syz 
468*ab25eeb5Syz /*
469*ab25eeb5Syz  * For outgoing PPTP packets.  refresh timeouts for NAT & state entries, if
470*ab25eeb5Syz  * we can.  If they have disappeared, recreate them.
471*ab25eeb5Syz  */
472*ab25eeb5Syz int ippr_pptp_inout(fin, aps, nat)
473*ab25eeb5Syz fr_info_t *fin;
474*ab25eeb5Syz ap_session_t *aps;
475*ab25eeb5Syz nat_t *nat;
476*ab25eeb5Syz {
477*ab25eeb5Syz 	pptp_pxy_t *pptp;
478*ab25eeb5Syz 	tcphdr_t *tcp;
479*ab25eeb5Syz 	int rev;
480*ab25eeb5Syz 
481*ab25eeb5Syz 	if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND))
482*ab25eeb5Syz 		rev = 1;
483*ab25eeb5Syz 	else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND))
484*ab25eeb5Syz 		rev = 1;
485*ab25eeb5Syz 	else
486*ab25eeb5Syz 		rev = 0;
487*ab25eeb5Syz 
488*ab25eeb5Syz 	tcp = (tcphdr_t *)fin->fin_dp;
489*ab25eeb5Syz 	if ((tcp->th_flags & TH_OPENING) == TH_OPENING) {
490*ab25eeb5Syz 		pptp = (pptp_pxy_t *)aps->aps_data;
491*ab25eeb5Syz 		pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack);
492*ab25eeb5Syz 		pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack);
493*ab25eeb5Syz 		pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1;
494*ab25eeb5Syz 		pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1;
495*ab25eeb5Syz 	}
496*ab25eeb5Syz 	return ippr_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data,
497*ab25eeb5Syz 				     rev);
498*ab25eeb5Syz }
499*ab25eeb5Syz 
500*ab25eeb5Syz 
501*ab25eeb5Syz /*
502*ab25eeb5Syz  * clean up after ourselves.
503*ab25eeb5Syz  */
504*ab25eeb5Syz void ippr_pptp_del(aps)
505*ab25eeb5Syz ap_session_t *aps;
506*ab25eeb5Syz {
507*ab25eeb5Syz 	pptp_pxy_t *pptp;
508*ab25eeb5Syz 
509*ab25eeb5Syz 	pptp = aps->aps_data;
510*ab25eeb5Syz 
511*ab25eeb5Syz 	if (pptp != NULL) {
512*ab25eeb5Syz 		/*
513*ab25eeb5Syz 		 * Don't bother changing any of the NAT structure details,
514*ab25eeb5Syz 		 * *_del() is on a callback from aps_free(), from nat_delete()
515*ab25eeb5Syz 		 */
516*ab25eeb5Syz 
517*ab25eeb5Syz 		READ_ENTER(&ipf_state);
518*ab25eeb5Syz 		if (pptp->pptp_state != NULL) {
519*ab25eeb5Syz 			pptp->pptp_state->is_die = fr_ticks + 1;
520*ab25eeb5Syz 			pptp->pptp_state->is_me = NULL;
521*ab25eeb5Syz 			fr_queuefront(&pptp->pptp_state->is_sti);
522*ab25eeb5Syz 		}
523*ab25eeb5Syz 		RWLOCK_EXIT(&ipf_state);
524*ab25eeb5Syz 
525*ab25eeb5Syz 		pptp->pptp_state = NULL;
526*ab25eeb5Syz 		pptp->pptp_nat = NULL;
527*ab25eeb5Syz 	}
528*ab25eeb5Syz }
529