1*ab25eeb5Syz /* 2*ab25eeb5Syz * Copyright (C) 2002-2003 by Darren Reed 3*ab25eeb5Syz * 4*ab25eeb5Syz * Simple PPTP transparent proxy for in-kernel use. For use with the NAT 5*ab25eeb5Syz * code. 6*ab25eeb5Syz * 7*ab25eeb5Syz * $Id: ip_pptp_pxy.c,v 2.10.2.10 2005/07/15 21:56:52 darrenr Exp $ 8*ab25eeb5Syz * 9*ab25eeb5Syz * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 10*ab25eeb5Syz * Use is subject to license terms. 11*ab25eeb5Syz */ 12*ab25eeb5Syz 13*ab25eeb5Syz #pragma ident "%Z%%M% %I% %E% SMI" 14*ab25eeb5Syz 15*ab25eeb5Syz #define IPF_PPTP_PROXY 16*ab25eeb5Syz 17*ab25eeb5Syz typedef struct pptp_hdr { 18*ab25eeb5Syz u_short pptph_len; 19*ab25eeb5Syz u_short pptph_type; 20*ab25eeb5Syz u_32_t pptph_cookie; 21*ab25eeb5Syz } pptp_hdr_t; 22*ab25eeb5Syz 23*ab25eeb5Syz #define PPTP_MSGTYPE_CTL 1 24*ab25eeb5Syz #define PPTP_MTCTL_STARTREQ 1 25*ab25eeb5Syz #define PPTP_MTCTL_STARTREP 2 26*ab25eeb5Syz #define PPTP_MTCTL_STOPREQ 3 27*ab25eeb5Syz #define PPTP_MTCTL_STOPREP 4 28*ab25eeb5Syz #define PPTP_MTCTL_ECHOREQ 5 29*ab25eeb5Syz #define PPTP_MTCTL_ECHOREP 6 30*ab25eeb5Syz #define PPTP_MTCTL_OUTREQ 7 31*ab25eeb5Syz #define PPTP_MTCTL_OUTREP 8 32*ab25eeb5Syz #define PPTP_MTCTL_INREQ 9 33*ab25eeb5Syz #define PPTP_MTCTL_INREP 10 34*ab25eeb5Syz #define PPTP_MTCTL_INCONNECT 11 35*ab25eeb5Syz #define PPTP_MTCTL_CLEAR 12 36*ab25eeb5Syz #define PPTP_MTCTL_DISCONNECT 13 37*ab25eeb5Syz #define PPTP_MTCTL_WANERROR 14 38*ab25eeb5Syz #define PPTP_MTCTL_LINKINFO 15 39*ab25eeb5Syz 40*ab25eeb5Syz 41*ab25eeb5Syz int ippr_pptp_init __P((void)); 42*ab25eeb5Syz void ippr_pptp_fini __P((void)); 43*ab25eeb5Syz int ippr_pptp_new __P((fr_info_t *, ap_session_t *, nat_t *)); 44*ab25eeb5Syz void ippr_pptp_del __P((ap_session_t *)); 45*ab25eeb5Syz int ippr_pptp_inout __P((fr_info_t *, ap_session_t *, nat_t *)); 46*ab25eeb5Syz void ippr_pptp_donatstate __P((fr_info_t *, nat_t *, pptp_pxy_t *)); 47*ab25eeb5Syz int ippr_pptp_message __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *)); 48*ab25eeb5Syz int ippr_pptp_nextmessage __P((fr_info_t *, nat_t *, pptp_pxy_t *, int)); 49*ab25eeb5Syz int ippr_pptp_mctl __P((fr_info_t *, nat_t *, pptp_pxy_t *, pptp_side_t *)); 50*ab25eeb5Syz 51*ab25eeb5Syz static frentry_t pptpfr; 52*ab25eeb5Syz 53*ab25eeb5Syz int pptp_proxy_init = 0; 54*ab25eeb5Syz int ippr_pptp_debug = 0; 55*ab25eeb5Syz int ippr_pptp_gretimeout = IPF_TTLVAL(120); /* 2 minutes */ 56*ab25eeb5Syz 57*ab25eeb5Syz 58*ab25eeb5Syz /* 59*ab25eeb5Syz * PPTP application proxy initialization. 60*ab25eeb5Syz */ 61*ab25eeb5Syz int ippr_pptp_init() 62*ab25eeb5Syz { 63*ab25eeb5Syz bzero((char *)&pptpfr, sizeof(pptpfr)); 64*ab25eeb5Syz pptpfr.fr_ref = 1; 65*ab25eeb5Syz pptpfr.fr_age[0] = ippr_pptp_gretimeout; 66*ab25eeb5Syz pptpfr.fr_age[1] = ippr_pptp_gretimeout; 67*ab25eeb5Syz pptpfr.fr_flags = FR_OUTQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 68*ab25eeb5Syz MUTEX_INIT(&pptpfr.fr_lock, "PPTP proxy rule lock"); 69*ab25eeb5Syz pptp_proxy_init = 1; 70*ab25eeb5Syz 71*ab25eeb5Syz return 0; 72*ab25eeb5Syz } 73*ab25eeb5Syz 74*ab25eeb5Syz 75*ab25eeb5Syz void ippr_pptp_fini() 76*ab25eeb5Syz { 77*ab25eeb5Syz if (pptp_proxy_init == 1) { 78*ab25eeb5Syz MUTEX_DESTROY(&pptpfr.fr_lock); 79*ab25eeb5Syz pptp_proxy_init = 0; 80*ab25eeb5Syz } 81*ab25eeb5Syz } 82*ab25eeb5Syz 83*ab25eeb5Syz 84*ab25eeb5Syz /* 85*ab25eeb5Syz * Setup for a new PPTP proxy. 86*ab25eeb5Syz */ 87*ab25eeb5Syz int ippr_pptp_new(fin, aps, nat) 88*ab25eeb5Syz fr_info_t *fin; 89*ab25eeb5Syz ap_session_t *aps; 90*ab25eeb5Syz nat_t *nat; 91*ab25eeb5Syz { 92*ab25eeb5Syz pptp_pxy_t *pptp; 93*ab25eeb5Syz ipnat_t *ipn; 94*ab25eeb5Syz ip_t *ip; 95*ab25eeb5Syz 96*ab25eeb5Syz ip = fin->fin_ip; 97*ab25eeb5Syz 98*ab25eeb5Syz if (nat_outlookup(fin, 0, IPPROTO_GRE, nat->nat_inip, 99*ab25eeb5Syz ip->ip_dst) != NULL) { 100*ab25eeb5Syz if (ippr_pptp_debug > 0) 101*ab25eeb5Syz printf("ippr_pptp_new: GRE session already exists\n"); 102*ab25eeb5Syz return -1; 103*ab25eeb5Syz } 104*ab25eeb5Syz 105*ab25eeb5Syz aps->aps_psiz = sizeof(*pptp); 106*ab25eeb5Syz KMALLOCS(aps->aps_data, pptp_pxy_t *, sizeof(*pptp)); 107*ab25eeb5Syz if (aps->aps_data == NULL) { 108*ab25eeb5Syz if (ippr_pptp_debug > 0) 109*ab25eeb5Syz printf("ippr_pptp_new: malloc for aps_data failed\n"); 110*ab25eeb5Syz return -1; 111*ab25eeb5Syz } 112*ab25eeb5Syz 113*ab25eeb5Syz /* 114*ab25eeb5Syz * Create NAT rule against which the tunnel/transport mapping is 115*ab25eeb5Syz * created. This is required because the current NAT rule does not 116*ab25eeb5Syz * describe GRE but TCP instead. 117*ab25eeb5Syz */ 118*ab25eeb5Syz pptp = aps->aps_data; 119*ab25eeb5Syz bzero((char *)pptp, sizeof(*pptp)); 120*ab25eeb5Syz ipn = &pptp->pptp_rule; 121*ab25eeb5Syz ipn->in_ifps[0] = fin->fin_ifp; 122*ab25eeb5Syz ipn->in_apr = NULL; 123*ab25eeb5Syz ipn->in_use = 1; 124*ab25eeb5Syz ipn->in_hits = 1; 125*ab25eeb5Syz ipn->in_ippip = 1; 126*ab25eeb5Syz if (nat->nat_dir == NAT_OUTBOUND) { 127*ab25eeb5Syz ipn->in_nip = ntohl(nat->nat_outip.s_addr); 128*ab25eeb5Syz ipn->in_outip = fin->fin_saddr; 129*ab25eeb5Syz ipn->in_redir = NAT_MAP; 130*ab25eeb5Syz } else if (nat->nat_dir == NAT_INBOUND) { 131*ab25eeb5Syz ipn->in_nip = 0; 132*ab25eeb5Syz ipn->in_outip = nat->nat_outip.s_addr; 133*ab25eeb5Syz ipn->in_redir = NAT_REDIRECT; 134*ab25eeb5Syz } 135*ab25eeb5Syz ipn->in_inip = nat->nat_inip.s_addr; 136*ab25eeb5Syz ipn->in_inmsk = 0xffffffff; 137*ab25eeb5Syz ipn->in_outmsk = 0xffffffff; 138*ab25eeb5Syz ipn->in_srcip = fin->fin_saddr; 139*ab25eeb5Syz ipn->in_srcmsk = 0xffffffff; 140*ab25eeb5Syz bcopy(nat->nat_ptr->in_ifnames[0], ipn->in_ifnames[0], 141*ab25eeb5Syz sizeof(ipn->in_ifnames[0])); 142*ab25eeb5Syz ipn->in_p = IPPROTO_GRE; 143*ab25eeb5Syz 144*ab25eeb5Syz pptp->pptp_side[0].pptps_wptr = pptp->pptp_side[0].pptps_buffer; 145*ab25eeb5Syz pptp->pptp_side[1].pptps_wptr = pptp->pptp_side[1].pptps_buffer; 146*ab25eeb5Syz return 0; 147*ab25eeb5Syz } 148*ab25eeb5Syz 149*ab25eeb5Syz 150*ab25eeb5Syz void ippr_pptp_donatstate(fin, nat, pptp) 151*ab25eeb5Syz fr_info_t *fin; 152*ab25eeb5Syz nat_t *nat; 153*ab25eeb5Syz pptp_pxy_t *pptp; 154*ab25eeb5Syz { 155*ab25eeb5Syz fr_info_t fi; 156*ab25eeb5Syz grehdr_t gre; 157*ab25eeb5Syz nat_t *nat2; 158*ab25eeb5Syz u_char p; 159*ab25eeb5Syz ip_t *ip; 160*ab25eeb5Syz 161*ab25eeb5Syz ip = fin->fin_ip; 162*ab25eeb5Syz p = ip->ip_p; 163*ab25eeb5Syz 164*ab25eeb5Syz nat2 = pptp->pptp_nat; 165*ab25eeb5Syz if ((nat2 == NULL) || (pptp->pptp_state == NULL)) { 166*ab25eeb5Syz bcopy((char *)fin, (char *)&fi, sizeof(fi)); 167*ab25eeb5Syz bzero((char *)&gre, sizeof(gre)); 168*ab25eeb5Syz fi.fin_state = NULL; 169*ab25eeb5Syz fi.fin_nat = NULL; 170*ab25eeb5Syz fi.fin_fi.fi_p = IPPROTO_GRE; 171*ab25eeb5Syz fi.fin_fr = &pptpfr; 172*ab25eeb5Syz if ((nat->nat_dir == NAT_OUTBOUND && fin->fin_out) || 173*ab25eeb5Syz (nat->nat_dir == NAT_INBOUND && !fin->fin_out)) { 174*ab25eeb5Syz fi.fin_data[0] = pptp->pptp_call[0]; 175*ab25eeb5Syz fi.fin_data[1] = pptp->pptp_call[1]; 176*ab25eeb5Syz } else { 177*ab25eeb5Syz fi.fin_data[0] = pptp->pptp_call[1]; 178*ab25eeb5Syz fi.fin_data[1] = pptp->pptp_call[0]; 179*ab25eeb5Syz } 180*ab25eeb5Syz ip = fin->fin_ip; 181*ab25eeb5Syz ip->ip_p = IPPROTO_GRE; 182*ab25eeb5Syz fi.fin_flx &= ~(FI_TCPUDP|FI_STATE|FI_FRAG); 183*ab25eeb5Syz fi.fin_flx |= FI_IGNORE; 184*ab25eeb5Syz fi.fin_dp = &gre; 185*ab25eeb5Syz gre.gr_flags = htons(1 << 13); 186*ab25eeb5Syz if (fin->fin_out && nat->nat_dir == NAT_INBOUND) { 187*ab25eeb5Syz fi.fin_fi.fi_saddr = fin->fin_fi.fi_daddr; 188*ab25eeb5Syz fi.fin_fi.fi_daddr = nat->nat_outip.s_addr; 189*ab25eeb5Syz } else if (!fin->fin_out && nat->nat_dir == NAT_OUTBOUND) { 190*ab25eeb5Syz fi.fin_fi.fi_saddr = nat->nat_inip.s_addr; 191*ab25eeb5Syz fi.fin_fi.fi_daddr = fin->fin_fi.fi_saddr; 192*ab25eeb5Syz } 193*ab25eeb5Syz } 194*ab25eeb5Syz 195*ab25eeb5Syz /* 196*ab25eeb5Syz * Update NAT timeout/create NAT if missing. 197*ab25eeb5Syz */ 198*ab25eeb5Syz if (nat2 != NULL) 199*ab25eeb5Syz fr_queueback(&nat2->nat_tqe); 200*ab25eeb5Syz else { 201*ab25eeb5Syz nat2 = nat_new(&fi, &pptp->pptp_rule, &pptp->pptp_nat, 202*ab25eeb5Syz NAT_SLAVE, nat->nat_dir); 203*ab25eeb5Syz pptp->pptp_nat = nat2; 204*ab25eeb5Syz if (nat2 != NULL) { 205*ab25eeb5Syz (void) nat_proto(&fi, nat2, 0); 206*ab25eeb5Syz nat_update(&fi, nat2, nat2->nat_ptr); 207*ab25eeb5Syz } 208*ab25eeb5Syz } 209*ab25eeb5Syz 210*ab25eeb5Syz READ_ENTER(&ipf_state); 211*ab25eeb5Syz if (pptp->pptp_state != NULL) { 212*ab25eeb5Syz fr_queueback(&pptp->pptp_state->is_sti); 213*ab25eeb5Syz RWLOCK_EXIT(&ipf_state); 214*ab25eeb5Syz } else { 215*ab25eeb5Syz RWLOCK_EXIT(&ipf_state); 216*ab25eeb5Syz if (nat->nat_dir == NAT_INBOUND) 217*ab25eeb5Syz fi.fin_fi.fi_daddr = nat2->nat_inip.s_addr; 218*ab25eeb5Syz else 219*ab25eeb5Syz fi.fin_fi.fi_saddr = nat2->nat_inip.s_addr; 220*ab25eeb5Syz fi.fin_ifp = NULL; 221*ab25eeb5Syz pptp->pptp_state = fr_addstate(&fi, &pptp->pptp_state, 222*ab25eeb5Syz 0); 223*ab25eeb5Syz if (fi.fin_state != NULL) 224*ab25eeb5Syz fr_statederef(&fi, (ipstate_t **)&fi.fin_state); 225*ab25eeb5Syz } 226*ab25eeb5Syz ip->ip_p = p; 227*ab25eeb5Syz return; 228*ab25eeb5Syz } 229*ab25eeb5Syz 230*ab25eeb5Syz 231*ab25eeb5Syz /* 232*ab25eeb5Syz * Try and build up the next PPTP message in the TCP stream and if we can 233*ab25eeb5Syz * build it up completely (fits in our buffer) then pass it off to the message 234*ab25eeb5Syz * parsing function. 235*ab25eeb5Syz */ 236*ab25eeb5Syz int ippr_pptp_nextmessage(fin, nat, pptp, rev) 237*ab25eeb5Syz fr_info_t *fin; 238*ab25eeb5Syz nat_t *nat; 239*ab25eeb5Syz pptp_pxy_t *pptp; 240*ab25eeb5Syz int rev; 241*ab25eeb5Syz { 242*ab25eeb5Syz static char *funcname = "ippr_pptp_nextmessage"; 243*ab25eeb5Syz pptp_side_t *pptps; 244*ab25eeb5Syz u_32_t start, end; 245*ab25eeb5Syz pptp_hdr_t *hdr; 246*ab25eeb5Syz tcphdr_t *tcp; 247*ab25eeb5Syz int dlen, off; 248*ab25eeb5Syz u_short len; 249*ab25eeb5Syz char *msg; 250*ab25eeb5Syz 251*ab25eeb5Syz tcp = fin->fin_dp; 252*ab25eeb5Syz dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 253*ab25eeb5Syz start = ntohl(tcp->th_seq); 254*ab25eeb5Syz pptps = &pptp->pptp_side[rev]; 255*ab25eeb5Syz off = (char *)tcp - (char *)fin->fin_ip + (TCP_OFF(tcp) << 2) + 256*ab25eeb5Syz fin->fin_ipoff; 257*ab25eeb5Syz 258*ab25eeb5Syz if (dlen <= 0) 259*ab25eeb5Syz return 0; 260*ab25eeb5Syz /* 261*ab25eeb5Syz * If the complete data packet is before what we expect to see 262*ab25eeb5Syz * "next", just ignore it as the chances are we've already seen it. 263*ab25eeb5Syz * The next if statement following this one really just causes packets 264*ab25eeb5Syz * ahead of what we've seen to be dropped, implying that something in 265*ab25eeb5Syz * the middle went missing and we want to see that first. 266*ab25eeb5Syz */ 267*ab25eeb5Syz end = start + dlen; 268*ab25eeb5Syz if (pptps->pptps_next > end && pptps->pptps_next > start) 269*ab25eeb5Syz return 0; 270*ab25eeb5Syz 271*ab25eeb5Syz if (pptps->pptps_next != start) { 272*ab25eeb5Syz if (ippr_pptp_debug > 5) 273*ab25eeb5Syz printf("%s: next (%x) != start (%x)\n", funcname, 274*ab25eeb5Syz pptps->pptps_next, start); 275*ab25eeb5Syz return -1; 276*ab25eeb5Syz } 277*ab25eeb5Syz 278*ab25eeb5Syz msg = (char *)fin->fin_dp + (TCP_OFF(tcp) << 2); 279*ab25eeb5Syz 280*ab25eeb5Syz while (dlen > 0) { 281*ab25eeb5Syz off += pptps->pptps_bytes; 282*ab25eeb5Syz if (pptps->pptps_gothdr == 0) { 283*ab25eeb5Syz /* 284*ab25eeb5Syz * PPTP has an 8 byte header that inclues the cookie. 285*ab25eeb5Syz * The start of every message should include one and 286*ab25eeb5Syz * it should match 1a2b3c4d. Byte order is ignored, 287*ab25eeb5Syz * deliberately, when printing out the error. 288*ab25eeb5Syz */ 289*ab25eeb5Syz len = MIN(8 - pptps->pptps_bytes, dlen); 290*ab25eeb5Syz COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr); 291*ab25eeb5Syz pptps->pptps_bytes += len; 292*ab25eeb5Syz pptps->pptps_wptr += len; 293*ab25eeb5Syz hdr = (pptp_hdr_t *)pptps->pptps_buffer; 294*ab25eeb5Syz if (pptps->pptps_bytes == 8) { 295*ab25eeb5Syz pptps->pptps_next += 8; 296*ab25eeb5Syz if (ntohl(hdr->pptph_cookie) != 0x1a2b3c4d) { 297*ab25eeb5Syz if (ippr_pptp_debug > 1) 298*ab25eeb5Syz printf("%s: bad cookie (%x)\n", 299*ab25eeb5Syz funcname, 300*ab25eeb5Syz hdr->pptph_cookie); 301*ab25eeb5Syz return -1; 302*ab25eeb5Syz } 303*ab25eeb5Syz } 304*ab25eeb5Syz dlen -= len; 305*ab25eeb5Syz msg += len; 306*ab25eeb5Syz off += len; 307*ab25eeb5Syz 308*ab25eeb5Syz pptps->pptps_gothdr = 1; 309*ab25eeb5Syz len = ntohs(hdr->pptph_len); 310*ab25eeb5Syz pptps->pptps_len = len; 311*ab25eeb5Syz pptps->pptps_nexthdr += len; 312*ab25eeb5Syz 313*ab25eeb5Syz /* 314*ab25eeb5Syz * If a message is too big for the buffer, just set 315*ab25eeb5Syz * the fields for the next message to come along. 316*ab25eeb5Syz * The messages defined in RFC 2637 will not exceed 317*ab25eeb5Syz * 512 bytes (in total length) so this is likely a 318*ab25eeb5Syz * bad data packet, anyway. 319*ab25eeb5Syz */ 320*ab25eeb5Syz if (len > sizeof(pptps->pptps_buffer)) { 321*ab25eeb5Syz if (ippr_pptp_debug > 3) 322*ab25eeb5Syz printf("%s: message too big (%d)\n", 323*ab25eeb5Syz funcname, len); 324*ab25eeb5Syz pptps->pptps_next = pptps->pptps_nexthdr; 325*ab25eeb5Syz pptps->pptps_wptr = pptps->pptps_buffer; 326*ab25eeb5Syz pptps->pptps_gothdr = 0; 327*ab25eeb5Syz pptps->pptps_bytes = 0; 328*ab25eeb5Syz pptps->pptps_len = 0; 329*ab25eeb5Syz break; 330*ab25eeb5Syz } 331*ab25eeb5Syz } 332*ab25eeb5Syz 333*ab25eeb5Syz len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen); 334*ab25eeb5Syz COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr); 335*ab25eeb5Syz pptps->pptps_bytes += len; 336*ab25eeb5Syz pptps->pptps_wptr += len; 337*ab25eeb5Syz pptps->pptps_next += len; 338*ab25eeb5Syz 339*ab25eeb5Syz if (pptps->pptps_len > pptps->pptps_bytes) 340*ab25eeb5Syz break; 341*ab25eeb5Syz 342*ab25eeb5Syz (void) ippr_pptp_message(fin, nat, pptp, pptps); 343*ab25eeb5Syz pptps->pptps_wptr = pptps->pptps_buffer; 344*ab25eeb5Syz pptps->pptps_gothdr = 0; 345*ab25eeb5Syz pptps->pptps_bytes = 0; 346*ab25eeb5Syz pptps->pptps_len = 0; 347*ab25eeb5Syz 348*ab25eeb5Syz start += len; 349*ab25eeb5Syz msg += len; 350*ab25eeb5Syz dlen -= len; 351*ab25eeb5Syz } 352*ab25eeb5Syz 353*ab25eeb5Syz return 0; 354*ab25eeb5Syz } 355*ab25eeb5Syz 356*ab25eeb5Syz 357*ab25eeb5Syz /* 358*ab25eeb5Syz * handle a complete PPTP message 359*ab25eeb5Syz */ 360*ab25eeb5Syz int ippr_pptp_message(fin, nat, pptp, pptps) 361*ab25eeb5Syz fr_info_t *fin; 362*ab25eeb5Syz nat_t *nat; 363*ab25eeb5Syz pptp_pxy_t *pptp; 364*ab25eeb5Syz pptp_side_t *pptps; 365*ab25eeb5Syz { 366*ab25eeb5Syz pptp_hdr_t *hdr = (pptp_hdr_t *)pptps->pptps_buffer; 367*ab25eeb5Syz 368*ab25eeb5Syz switch (ntohs(hdr->pptph_type)) 369*ab25eeb5Syz { 370*ab25eeb5Syz case PPTP_MSGTYPE_CTL : 371*ab25eeb5Syz (void) ippr_pptp_mctl(fin, nat, pptp, pptps); 372*ab25eeb5Syz break; 373*ab25eeb5Syz 374*ab25eeb5Syz default : 375*ab25eeb5Syz break; 376*ab25eeb5Syz } 377*ab25eeb5Syz return 0; 378*ab25eeb5Syz } 379*ab25eeb5Syz 380*ab25eeb5Syz 381*ab25eeb5Syz /* 382*ab25eeb5Syz * handle a complete PPTP control message 383*ab25eeb5Syz */ 384*ab25eeb5Syz int ippr_pptp_mctl(fin, nat, pptp, pptps) 385*ab25eeb5Syz fr_info_t *fin; 386*ab25eeb5Syz nat_t *nat; 387*ab25eeb5Syz pptp_pxy_t *pptp; 388*ab25eeb5Syz pptp_side_t *pptps; 389*ab25eeb5Syz { 390*ab25eeb5Syz u_short *buffer = (u_short *)(pptps->pptps_buffer); 391*ab25eeb5Syz pptp_side_t *pptpo; 392*ab25eeb5Syz 393*ab25eeb5Syz if (pptps == &pptp->pptp_side[0]) 394*ab25eeb5Syz pptpo = &pptp->pptp_side[1]; 395*ab25eeb5Syz else 396*ab25eeb5Syz pptpo = &pptp->pptp_side[0]; 397*ab25eeb5Syz 398*ab25eeb5Syz /* 399*ab25eeb5Syz * Breakout to handle all the various messages. Most are just state 400*ab25eeb5Syz * transition. 401*ab25eeb5Syz */ 402*ab25eeb5Syz switch (ntohs(buffer[4])) 403*ab25eeb5Syz { 404*ab25eeb5Syz case PPTP_MTCTL_STARTREQ : 405*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_STARTREQ; 406*ab25eeb5Syz break; 407*ab25eeb5Syz case PPTP_MTCTL_STARTREP : 408*ab25eeb5Syz if (pptpo->pptps_state == PPTP_MTCTL_STARTREQ) 409*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_STARTREP; 410*ab25eeb5Syz break; 411*ab25eeb5Syz case PPTP_MTCTL_STOPREQ : 412*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_STOPREQ; 413*ab25eeb5Syz break; 414*ab25eeb5Syz case PPTP_MTCTL_STOPREP : 415*ab25eeb5Syz if (pptpo->pptps_state == PPTP_MTCTL_STOPREQ) 416*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_STOPREP; 417*ab25eeb5Syz break; 418*ab25eeb5Syz case PPTP_MTCTL_ECHOREQ : 419*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_ECHOREQ; 420*ab25eeb5Syz break; 421*ab25eeb5Syz case PPTP_MTCTL_ECHOREP : 422*ab25eeb5Syz if (pptpo->pptps_state == PPTP_MTCTL_ECHOREQ) 423*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_ECHOREP; 424*ab25eeb5Syz break; 425*ab25eeb5Syz case PPTP_MTCTL_OUTREQ : 426*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_OUTREQ; 427*ab25eeb5Syz break; 428*ab25eeb5Syz case PPTP_MTCTL_OUTREP : 429*ab25eeb5Syz if (pptpo->pptps_state == PPTP_MTCTL_OUTREQ) { 430*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_OUTREP; 431*ab25eeb5Syz pptp->pptp_call[0] = buffer[7]; 432*ab25eeb5Syz pptp->pptp_call[1] = buffer[6]; 433*ab25eeb5Syz ippr_pptp_donatstate(fin, nat, pptp); 434*ab25eeb5Syz } 435*ab25eeb5Syz break; 436*ab25eeb5Syz case PPTP_MTCTL_INREQ : 437*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_INREQ; 438*ab25eeb5Syz break; 439*ab25eeb5Syz case PPTP_MTCTL_INREP : 440*ab25eeb5Syz if (pptpo->pptps_state == PPTP_MTCTL_INREQ) { 441*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_INREP; 442*ab25eeb5Syz pptp->pptp_call[0] = buffer[7]; 443*ab25eeb5Syz pptp->pptp_call[1] = buffer[6]; 444*ab25eeb5Syz ippr_pptp_donatstate(fin, nat, pptp); 445*ab25eeb5Syz } 446*ab25eeb5Syz break; 447*ab25eeb5Syz case PPTP_MTCTL_INCONNECT : 448*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_INCONNECT; 449*ab25eeb5Syz break; 450*ab25eeb5Syz case PPTP_MTCTL_CLEAR : 451*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_CLEAR; 452*ab25eeb5Syz break; 453*ab25eeb5Syz case PPTP_MTCTL_DISCONNECT : 454*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_DISCONNECT; 455*ab25eeb5Syz break; 456*ab25eeb5Syz case PPTP_MTCTL_WANERROR : 457*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_WANERROR; 458*ab25eeb5Syz break; 459*ab25eeb5Syz case PPTP_MTCTL_LINKINFO : 460*ab25eeb5Syz pptps->pptps_state = PPTP_MTCTL_LINKINFO; 461*ab25eeb5Syz break; 462*ab25eeb5Syz } 463*ab25eeb5Syz 464*ab25eeb5Syz return 0; 465*ab25eeb5Syz } 466*ab25eeb5Syz 467*ab25eeb5Syz 468*ab25eeb5Syz /* 469*ab25eeb5Syz * For outgoing PPTP packets. refresh timeouts for NAT & state entries, if 470*ab25eeb5Syz * we can. If they have disappeared, recreate them. 471*ab25eeb5Syz */ 472*ab25eeb5Syz int ippr_pptp_inout(fin, aps, nat) 473*ab25eeb5Syz fr_info_t *fin; 474*ab25eeb5Syz ap_session_t *aps; 475*ab25eeb5Syz nat_t *nat; 476*ab25eeb5Syz { 477*ab25eeb5Syz pptp_pxy_t *pptp; 478*ab25eeb5Syz tcphdr_t *tcp; 479*ab25eeb5Syz int rev; 480*ab25eeb5Syz 481*ab25eeb5Syz if ((fin->fin_out == 1) && (nat->nat_dir == NAT_INBOUND)) 482*ab25eeb5Syz rev = 1; 483*ab25eeb5Syz else if ((fin->fin_out == 0) && (nat->nat_dir == NAT_OUTBOUND)) 484*ab25eeb5Syz rev = 1; 485*ab25eeb5Syz else 486*ab25eeb5Syz rev = 0; 487*ab25eeb5Syz 488*ab25eeb5Syz tcp = (tcphdr_t *)fin->fin_dp; 489*ab25eeb5Syz if ((tcp->th_flags & TH_OPENING) == TH_OPENING) { 490*ab25eeb5Syz pptp = (pptp_pxy_t *)aps->aps_data; 491*ab25eeb5Syz pptp->pptp_side[1 - rev].pptps_next = ntohl(tcp->th_ack); 492*ab25eeb5Syz pptp->pptp_side[1 - rev].pptps_nexthdr = ntohl(tcp->th_ack); 493*ab25eeb5Syz pptp->pptp_side[rev].pptps_next = ntohl(tcp->th_seq) + 1; 494*ab25eeb5Syz pptp->pptp_side[rev].pptps_nexthdr = ntohl(tcp->th_seq) + 1; 495*ab25eeb5Syz } 496*ab25eeb5Syz return ippr_pptp_nextmessage(fin, nat, (pptp_pxy_t *)aps->aps_data, 497*ab25eeb5Syz rev); 498*ab25eeb5Syz } 499*ab25eeb5Syz 500*ab25eeb5Syz 501*ab25eeb5Syz /* 502*ab25eeb5Syz * clean up after ourselves. 503*ab25eeb5Syz */ 504*ab25eeb5Syz void ippr_pptp_del(aps) 505*ab25eeb5Syz ap_session_t *aps; 506*ab25eeb5Syz { 507*ab25eeb5Syz pptp_pxy_t *pptp; 508*ab25eeb5Syz 509*ab25eeb5Syz pptp = aps->aps_data; 510*ab25eeb5Syz 511*ab25eeb5Syz if (pptp != NULL) { 512*ab25eeb5Syz /* 513*ab25eeb5Syz * Don't bother changing any of the NAT structure details, 514*ab25eeb5Syz * *_del() is on a callback from aps_free(), from nat_delete() 515*ab25eeb5Syz */ 516*ab25eeb5Syz 517*ab25eeb5Syz READ_ENTER(&ipf_state); 518*ab25eeb5Syz if (pptp->pptp_state != NULL) { 519*ab25eeb5Syz pptp->pptp_state->is_die = fr_ticks + 1; 520*ab25eeb5Syz pptp->pptp_state->is_me = NULL; 521*ab25eeb5Syz fr_queuefront(&pptp->pptp_state->is_sti); 522*ab25eeb5Syz } 523*ab25eeb5Syz RWLOCK_EXIT(&ipf_state); 524*ab25eeb5Syz 525*ab25eeb5Syz pptp->pptp_state = NULL; 526*ab25eeb5Syz pptp->pptp_nat = NULL; 527*ab25eeb5Syz } 528*ab25eeb5Syz } 529