115bcb5d5a7c72721d4c57f0b6687b06ccebfba2
[linux-2.6.git] / net / netfilter / nf_conntrack_pptp.c
1 /*
2  * Connection tracking support for PPTP (Point to Point Tunneling Protocol).
3  * PPTP is a a protocol for creating virtual private networks.
4  * It is a specification defined by Microsoft and some vendors
5  * working with Microsoft.  PPTP is built on top of a modified
6  * version of the Internet Generic Routing Encapsulation Protocol.
7  * GRE is defined in RFC 1701 and RFC 1702.  Documentation of
8  * PPTP can be found in RFC 2637
9  *
10  * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
11  *
12  * Development of this code funded by Astaro AG (http://www.astaro.com/)
13  *
14  * Limitations:
15  *       - We blindly assume that control connections are always
16  *         established in PNS->PAC direction.  This is a violation
17  *         of RFFC2673
18  *       - We can only support one single call within each session
19  * TODO:
20  *       - testing of incoming PPTP calls
21  */
22
23 #include <linux/module.h>
24 #include <linux/skbuff.h>
25 #include <linux/in.h>
26 #include <linux/tcp.h>
27
28 #include <net/netfilter/nf_conntrack.h>
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack_helper.h>
31 #include <linux/netfilter/nf_conntrack_proto_gre.h>
32 #include <linux/netfilter/nf_conntrack_pptp.h>
33
34 #define NF_CT_PPTP_VERSION "3.1"
35
36 MODULE_LICENSE("GPL");
37 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
38 MODULE_DESCRIPTION("Netfilter connection tracking helper module for PPTP");
39 MODULE_ALIAS("ip_conntrack_pptp");
40
41 static DEFINE_SPINLOCK(nf_pptp_lock);
42
43 int
44 (*nf_nat_pptp_hook_outbound)(struct sk_buff **pskb,
45                              struct nf_conn *ct, enum ip_conntrack_info ctinfo,
46                              struct PptpControlHeader *ctlh,
47                              union pptp_ctrl_union *pptpReq) __read_mostly;
48 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_outbound);
49
50 int
51 (*nf_nat_pptp_hook_inbound)(struct sk_buff **pskb,
52                             struct nf_conn *ct, enum ip_conntrack_info ctinfo,
53                             struct PptpControlHeader *ctlh,
54                             union pptp_ctrl_union *pptpReq) __read_mostly;
55 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_inbound);
56
57 void
58 (*nf_nat_pptp_hook_exp_gre)(struct nf_conntrack_expect *expect_orig,
59                             struct nf_conntrack_expect *expect_reply)
60                             __read_mostly;
61 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_exp_gre);
62
63 void
64 (*nf_nat_pptp_hook_expectfn)(struct nf_conn *ct,
65                              struct nf_conntrack_expect *exp) __read_mostly;
66 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);
67
68 #if 0
69 /* PptpControlMessageType names */
70 const char *pptp_msg_name[] = {
71         "UNKNOWN_MESSAGE",
72         "START_SESSION_REQUEST",
73         "START_SESSION_REPLY",
74         "STOP_SESSION_REQUEST",
75         "STOP_SESSION_REPLY",
76         "ECHO_REQUEST",
77         "ECHO_REPLY",
78         "OUT_CALL_REQUEST",
79         "OUT_CALL_REPLY",
80         "IN_CALL_REQUEST",
81         "IN_CALL_REPLY",
82         "IN_CALL_CONNECT",
83         "CALL_CLEAR_REQUEST",
84         "CALL_DISCONNECT_NOTIFY",
85         "WAN_ERROR_NOTIFY",
86         "SET_LINK_INFO"
87 };
88 EXPORT_SYMBOL(pptp_msg_name);
89 #define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, __FUNCTION__, ## args)
90 #else
91 #define DEBUGP(format, args...)
92 #endif
93
94 #define SECS *HZ
95 #define MINS * 60 SECS
96 #define HOURS * 60 MINS
97
98 #define PPTP_GRE_TIMEOUT                (10 MINS)
99 #define PPTP_GRE_STREAM_TIMEOUT         (5 HOURS)
100
101 static void pptp_expectfn(struct nf_conn *ct,
102                          struct nf_conntrack_expect *exp)
103 {
104         typeof(nf_nat_pptp_hook_expectfn) nf_nat_pptp_expectfn;
105         DEBUGP("increasing timeouts\n");
106
107         /* increase timeout of GRE data channel conntrack entry */
108         ct->proto.gre.timeout        = PPTP_GRE_TIMEOUT;
109         ct->proto.gre.stream_timeout = PPTP_GRE_STREAM_TIMEOUT;
110
111         /* Can you see how rusty this code is, compared with the pre-2.6.11
112          * one? That's what happened to my shiny newnat of 2002 ;( -HW */
113
114         rcu_read_lock();
115         nf_nat_pptp_expectfn = rcu_dereference(nf_nat_pptp_hook_expectfn);
116         if (nf_nat_pptp_expectfn && ct->master->status & IPS_NAT_MASK)
117                 nf_nat_pptp_expectfn(ct, exp);
118         else {
119                 struct nf_conntrack_tuple inv_t;
120                 struct nf_conntrack_expect *exp_other;
121
122                 /* obviously this tuple inversion only works until you do NAT */
123                 nf_ct_invert_tuplepr(&inv_t, &exp->tuple);
124                 DEBUGP("trying to unexpect other dir: ");
125                 NF_CT_DUMP_TUPLE(&inv_t);
126
127                 exp_other = nf_conntrack_expect_find_get(&inv_t);
128                 if (exp_other) {
129                         /* delete other expectation.  */
130                         DEBUGP("found\n");
131                         nf_conntrack_unexpect_related(exp_other);
132                         nf_conntrack_expect_put(exp_other);
133                 } else {
134                         DEBUGP("not found\n");
135                 }
136         }
137         rcu_read_unlock();
138 }
139
140 static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
141 {
142         struct nf_conntrack_tuple_hash *h;
143         struct nf_conntrack_expect *exp;
144         struct nf_conn *sibling;
145
146         DEBUGP("trying to timeout ct or exp for tuple ");
147         NF_CT_DUMP_TUPLE(t);
148
149         h = nf_conntrack_find_get(t, NULL);
150         if (h)  {
151                 sibling = nf_ct_tuplehash_to_ctrack(h);
152                 DEBUGP("setting timeout of conntrack %p to 0\n", sibling);
153                 sibling->proto.gre.timeout        = 0;
154                 sibling->proto.gre.stream_timeout = 0;
155                 if (del_timer(&sibling->timeout))
156                         sibling->timeout.function((unsigned long)sibling);
157                 nf_ct_put(sibling);
158                 return 1;
159         } else {
160                 exp = nf_conntrack_expect_find_get(t);
161                 if (exp) {
162                         DEBUGP("unexpect_related of expect %p\n", exp);
163                         nf_conntrack_unexpect_related(exp);
164                         nf_conntrack_expect_put(exp);
165                         return 1;
166                 }
167         }
168         return 0;
169 }
170
171 /* timeout GRE data connections */
172 static void pptp_destroy_siblings(struct nf_conn *ct)
173 {
174         struct nf_conn_help *help = nfct_help(ct);
175         struct nf_conntrack_tuple t;
176
177         nf_ct_gre_keymap_destroy(ct);
178
179         /* try original (pns->pac) tuple */
180         memcpy(&t, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, sizeof(t));
181         t.dst.protonum = IPPROTO_GRE;
182         t.src.u.gre.key = help->help.ct_pptp_info.pns_call_id;
183         t.dst.u.gre.key = help->help.ct_pptp_info.pac_call_id;
184         if (!destroy_sibling_or_exp(&t))
185                 DEBUGP("failed to timeout original pns->pac ct/exp\n");
186
187         /* try reply (pac->pns) tuple */
188         memcpy(&t, &ct->tuplehash[IP_CT_DIR_REPLY].tuple, sizeof(t));
189         t.dst.protonum = IPPROTO_GRE;
190         t.src.u.gre.key = help->help.ct_pptp_info.pac_call_id;
191         t.dst.u.gre.key = help->help.ct_pptp_info.pns_call_id;
192         if (!destroy_sibling_or_exp(&t))
193                 DEBUGP("failed to timeout reply pac->pns ct/exp\n");
194 }
195
196 /* expect GRE connections (PNS->PAC and PAC->PNS direction) */
197 static int exp_gre(struct nf_conn *ct, __be16 callid, __be16 peer_callid)
198 {
199         struct nf_conntrack_expect *exp_orig, *exp_reply;
200         enum ip_conntrack_dir dir;
201         int ret = 1;
202         typeof(nf_nat_pptp_hook_exp_gre) nf_nat_pptp_exp_gre;
203
204         exp_orig = nf_conntrack_expect_alloc(ct);
205         if (exp_orig == NULL)
206                 goto out;
207
208         exp_reply = nf_conntrack_expect_alloc(ct);
209         if (exp_reply == NULL)
210                 goto out_put_orig;
211
212         /* original direction, PNS->PAC */
213         dir = IP_CT_DIR_ORIGINAL;
214         nf_conntrack_expect_init(exp_orig, ct->tuplehash[dir].tuple.src.l3num,
215                                  &ct->tuplehash[dir].tuple.src.u3,
216                                  &ct->tuplehash[dir].tuple.dst.u3,
217                                  IPPROTO_GRE, &peer_callid, &callid);
218         exp_orig->expectfn = pptp_expectfn;
219
220         /* reply direction, PAC->PNS */
221         dir = IP_CT_DIR_REPLY;
222         nf_conntrack_expect_init(exp_reply, ct->tuplehash[dir].tuple.src.l3num,
223                                  &ct->tuplehash[dir].tuple.src.u3,
224                                  &ct->tuplehash[dir].tuple.dst.u3,
225                                  IPPROTO_GRE, &callid, &peer_callid);
226         exp_reply->expectfn = pptp_expectfn;
227
228         nf_nat_pptp_exp_gre = rcu_dereference(nf_nat_pptp_hook_exp_gre);
229         if (nf_nat_pptp_exp_gre && ct->status & IPS_NAT_MASK)
230                 nf_nat_pptp_exp_gre(exp_orig, exp_reply);
231         if (nf_conntrack_expect_related(exp_orig) != 0)
232                 goto out_put_both;
233         if (nf_conntrack_expect_related(exp_reply) != 0)
234                 goto out_unexpect_orig;
235
236         /* Add GRE keymap entries */
237         if (nf_ct_gre_keymap_add(ct, IP_CT_DIR_ORIGINAL, &exp_orig->tuple) != 0)
238                 goto out_unexpect_both;
239         if (nf_ct_gre_keymap_add(ct, IP_CT_DIR_REPLY, &exp_reply->tuple) != 0) {
240                 nf_ct_gre_keymap_destroy(ct);
241                 goto out_unexpect_both;
242         }
243         ret = 0;
244
245 out_put_both:
246         nf_conntrack_expect_put(exp_reply);
247 out_put_orig:
248         nf_conntrack_expect_put(exp_orig);
249 out:
250         return ret;
251
252 out_unexpect_both:
253         nf_conntrack_unexpect_related(exp_reply);
254 out_unexpect_orig:
255         nf_conntrack_unexpect_related(exp_orig);
256         goto out_put_both;
257 }
258
259 static inline int
260 pptp_inbound_pkt(struct sk_buff **pskb,
261                  struct PptpControlHeader *ctlh,
262                  union pptp_ctrl_union *pptpReq,
263                  unsigned int reqlen,
264                  struct nf_conn *ct,
265                  enum ip_conntrack_info ctinfo)
266 {
267         struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
268         u_int16_t msg;
269         __be16 cid = 0, pcid = 0;
270         typeof(nf_nat_pptp_hook_inbound) nf_nat_pptp_inbound;
271
272         msg = ntohs(ctlh->messageType);
273         DEBUGP("inbound control message %s\n", pptp_msg_name[msg]);
274
275         switch (msg) {
276         case PPTP_START_SESSION_REPLY:
277                 /* server confirms new control session */
278                 if (info->sstate < PPTP_SESSION_REQUESTED)
279                         goto invalid;
280                 if (pptpReq->srep.resultCode == PPTP_START_OK)
281                         info->sstate = PPTP_SESSION_CONFIRMED;
282                 else
283                         info->sstate = PPTP_SESSION_ERROR;
284                 break;
285
286         case PPTP_STOP_SESSION_REPLY:
287                 /* server confirms end of control session */
288                 if (info->sstate > PPTP_SESSION_STOPREQ)
289                         goto invalid;
290                 if (pptpReq->strep.resultCode == PPTP_STOP_OK)
291                         info->sstate = PPTP_SESSION_NONE;
292                 else
293                         info->sstate = PPTP_SESSION_ERROR;
294                 break;
295
296         case PPTP_OUT_CALL_REPLY:
297                 /* server accepted call, we now expect GRE frames */
298                 if (info->sstate != PPTP_SESSION_CONFIRMED)
299                         goto invalid;
300                 if (info->cstate != PPTP_CALL_OUT_REQ &&
301                     info->cstate != PPTP_CALL_OUT_CONF)
302                         goto invalid;
303
304                 cid = pptpReq->ocack.callID;
305                 pcid = pptpReq->ocack.peersCallID;
306                 if (info->pns_call_id != pcid)
307                         goto invalid;
308                 DEBUGP("%s, CID=%X, PCID=%X\n", pptp_msg_name[msg],
309                         ntohs(cid), ntohs(pcid));
310
311                 if (pptpReq->ocack.resultCode == PPTP_OUTCALL_CONNECT) {
312                         info->cstate = PPTP_CALL_OUT_CONF;
313                         info->pac_call_id = cid;
314                         exp_gre(ct, cid, pcid);
315                 } else
316                         info->cstate = PPTP_CALL_NONE;
317                 break;
318
319         case PPTP_IN_CALL_REQUEST:
320                 /* server tells us about incoming call request */
321                 if (info->sstate != PPTP_SESSION_CONFIRMED)
322                         goto invalid;
323
324                 cid = pptpReq->icreq.callID;
325                 DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
326                 info->cstate = PPTP_CALL_IN_REQ;
327                 info->pac_call_id = cid;
328                 break;
329
330         case PPTP_IN_CALL_CONNECT:
331                 /* server tells us about incoming call established */
332                 if (info->sstate != PPTP_SESSION_CONFIRMED)
333                         goto invalid;
334                 if (info->cstate != PPTP_CALL_IN_REP &&
335                     info->cstate != PPTP_CALL_IN_CONF)
336                         goto invalid;
337
338                 pcid = pptpReq->iccon.peersCallID;
339                 cid = info->pac_call_id;
340
341                 if (info->pns_call_id != pcid)
342                         goto invalid;
343
344                 DEBUGP("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(pcid));
345                 info->cstate = PPTP_CALL_IN_CONF;
346
347                 /* we expect a GRE connection from PAC to PNS */
348                 exp_gre(ct, cid, pcid);
349                 break;
350
351         case PPTP_CALL_DISCONNECT_NOTIFY:
352                 /* server confirms disconnect */
353                 cid = pptpReq->disc.callID;
354                 DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
355                 info->cstate = PPTP_CALL_NONE;
356
357                 /* untrack this call id, unexpect GRE packets */
358                 pptp_destroy_siblings(ct);
359                 break;
360
361         case PPTP_WAN_ERROR_NOTIFY:
362         case PPTP_ECHO_REQUEST:
363         case PPTP_ECHO_REPLY:
364                 /* I don't have to explain these ;) */
365                 break;
366
367         default:
368                 goto invalid;
369         }
370
371         nf_nat_pptp_inbound = rcu_dereference(nf_nat_pptp_hook_inbound);
372         if (nf_nat_pptp_inbound && ct->status & IPS_NAT_MASK)
373                 return nf_nat_pptp_inbound(pskb, ct, ctinfo, ctlh, pptpReq);
374         return NF_ACCEPT;
375
376 invalid:
377         DEBUGP("invalid %s: type=%d cid=%u pcid=%u "
378                "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
379                msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
380                msg, ntohs(cid), ntohs(pcid),  info->cstate, info->sstate,
381                ntohs(info->pns_call_id), ntohs(info->pac_call_id));
382         return NF_ACCEPT;
383 }
384
385 static inline int
386 pptp_outbound_pkt(struct sk_buff **pskb,
387                   struct PptpControlHeader *ctlh,
388                   union pptp_ctrl_union *pptpReq,
389                   unsigned int reqlen,
390                   struct nf_conn *ct,
391                   enum ip_conntrack_info ctinfo)
392 {
393         struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
394         u_int16_t msg;
395         __be16 cid = 0, pcid = 0;
396         typeof(nf_nat_pptp_hook_outbound) nf_nat_pptp_outbound;
397
398         msg = ntohs(ctlh->messageType);
399         DEBUGP("outbound control message %s\n", pptp_msg_name[msg]);
400
401         switch (msg) {
402         case PPTP_START_SESSION_REQUEST:
403                 /* client requests for new control session */
404                 if (info->sstate != PPTP_SESSION_NONE)
405                         goto invalid;
406                 info->sstate = PPTP_SESSION_REQUESTED;
407                 break;
408
409         case PPTP_STOP_SESSION_REQUEST:
410                 /* client requests end of control session */
411                 info->sstate = PPTP_SESSION_STOPREQ;
412                 break;
413
414         case PPTP_OUT_CALL_REQUEST:
415                 /* client initiating connection to server */
416                 if (info->sstate != PPTP_SESSION_CONFIRMED)
417                         goto invalid;
418                 info->cstate = PPTP_CALL_OUT_REQ;
419                 /* track PNS call id */
420                 cid = pptpReq->ocreq.callID;
421                 DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
422                 info->pns_call_id = cid;
423                 break;
424
425         case PPTP_IN_CALL_REPLY:
426                 /* client answers incoming call */
427                 if (info->cstate != PPTP_CALL_IN_REQ &&
428                     info->cstate != PPTP_CALL_IN_REP)
429                         goto invalid;
430
431                 cid = pptpReq->icack.callID;
432                 pcid = pptpReq->icack.peersCallID;
433                 if (info->pac_call_id != pcid)
434                         goto invalid;
435                 DEBUGP("%s, CID=%X PCID=%X\n", pptp_msg_name[msg],
436                        ntohs(cid), ntohs(pcid));
437
438                 if (pptpReq->icack.resultCode == PPTP_INCALL_ACCEPT) {
439                         /* part two of the three-way handshake */
440                         info->cstate = PPTP_CALL_IN_REP;
441                         info->pns_call_id = cid;
442                 } else
443                         info->cstate = PPTP_CALL_NONE;
444                 break;
445
446         case PPTP_CALL_CLEAR_REQUEST:
447                 /* client requests hangup of call */
448                 if (info->sstate != PPTP_SESSION_CONFIRMED)
449                         goto invalid;
450                 /* FUTURE: iterate over all calls and check if
451                  * call ID is valid.  We don't do this without newnat,
452                  * because we only know about last call */
453                 info->cstate = PPTP_CALL_CLEAR_REQ;
454                 break;
455
456         case PPTP_SET_LINK_INFO:
457         case PPTP_ECHO_REQUEST:
458         case PPTP_ECHO_REPLY:
459                 /* I don't have to explain these ;) */
460                 break;
461
462         default:
463                 goto invalid;
464         }
465
466         nf_nat_pptp_outbound = rcu_dereference(nf_nat_pptp_hook_outbound);
467         if (nf_nat_pptp_outbound && ct->status & IPS_NAT_MASK)
468                 return nf_nat_pptp_outbound(pskb, ct, ctinfo, ctlh, pptpReq);
469         return NF_ACCEPT;
470
471 invalid:
472         DEBUGP("invalid %s: type=%d cid=%u pcid=%u "
473                "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
474                msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
475                msg, ntohs(cid), ntohs(pcid),  info->cstate, info->sstate,
476                ntohs(info->pns_call_id), ntohs(info->pac_call_id));
477         return NF_ACCEPT;
478 }
479
480 static const unsigned int pptp_msg_size[] = {
481         [PPTP_START_SESSION_REQUEST]  = sizeof(struct PptpStartSessionRequest),
482         [PPTP_START_SESSION_REPLY]    = sizeof(struct PptpStartSessionReply),
483         [PPTP_STOP_SESSION_REQUEST]   = sizeof(struct PptpStopSessionRequest),
484         [PPTP_STOP_SESSION_REPLY]     = sizeof(struct PptpStopSessionReply),
485         [PPTP_OUT_CALL_REQUEST]       = sizeof(struct PptpOutCallRequest),
486         [PPTP_OUT_CALL_REPLY]         = sizeof(struct PptpOutCallReply),
487         [PPTP_IN_CALL_REQUEST]        = sizeof(struct PptpInCallRequest),
488         [PPTP_IN_CALL_REPLY]          = sizeof(struct PptpInCallReply),
489         [PPTP_IN_CALL_CONNECT]        = sizeof(struct PptpInCallConnected),
490         [PPTP_CALL_CLEAR_REQUEST]     = sizeof(struct PptpClearCallRequest),
491         [PPTP_CALL_DISCONNECT_NOTIFY] = sizeof(struct PptpCallDisconnectNotify),
492         [PPTP_WAN_ERROR_NOTIFY]       = sizeof(struct PptpWanErrorNotify),
493         [PPTP_SET_LINK_INFO]          = sizeof(struct PptpSetLinkInfo),
494 };
495
496 /* track caller id inside control connection, call expect_related */
497 static int
498 conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
499                     struct nf_conn *ct, enum ip_conntrack_info ctinfo)
500
501 {
502         int dir = CTINFO2DIR(ctinfo);
503         struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
504         struct tcphdr _tcph, *tcph;
505         struct pptp_pkt_hdr _pptph, *pptph;
506         struct PptpControlHeader _ctlh, *ctlh;
507         union pptp_ctrl_union _pptpReq, *pptpReq;
508         unsigned int tcplen = (*pskb)->len - protoff;
509         unsigned int datalen, reqlen, nexthdr_off;
510         int oldsstate, oldcstate;
511         int ret;
512         u_int16_t msg;
513
514         /* don't do any tracking before tcp handshake complete */
515         if (ctinfo != IP_CT_ESTABLISHED &&
516             ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
517                 return NF_ACCEPT;
518
519         nexthdr_off = protoff;
520         tcph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_tcph), &_tcph);
521         BUG_ON(!tcph);
522         nexthdr_off += tcph->doff * 4;
523         datalen = tcplen - tcph->doff * 4;
524
525         pptph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_pptph), &_pptph);
526         if (!pptph) {
527                 DEBUGP("no full PPTP header, can't track\n");
528                 return NF_ACCEPT;
529         }
530         nexthdr_off += sizeof(_pptph);
531         datalen -= sizeof(_pptph);
532
533         /* if it's not a control message we can't do anything with it */
534         if (ntohs(pptph->packetType) != PPTP_PACKET_CONTROL ||
535             ntohl(pptph->magicCookie) != PPTP_MAGIC_COOKIE) {
536                 DEBUGP("not a control packet\n");
537                 return NF_ACCEPT;
538         }
539
540         ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
541         if (!ctlh)
542                 return NF_ACCEPT;
543         nexthdr_off += sizeof(_ctlh);
544         datalen -= sizeof(_ctlh);
545
546         reqlen = datalen;
547         msg = ntohs(ctlh->messageType);
548         if (msg > 0 && msg <= PPTP_MSG_MAX && reqlen < pptp_msg_size[msg])
549                 return NF_ACCEPT;
550         if (reqlen > sizeof(*pptpReq))
551                 reqlen = sizeof(*pptpReq);
552
553         pptpReq = skb_header_pointer(*pskb, nexthdr_off, reqlen, &_pptpReq);
554         if (!pptpReq)
555                 return NF_ACCEPT;
556
557         oldsstate = info->sstate;
558         oldcstate = info->cstate;
559
560         spin_lock_bh(&nf_pptp_lock);
561
562         /* FIXME: We just blindly assume that the control connection is always
563          * established from PNS->PAC.  However, RFC makes no guarantee */
564         if (dir == IP_CT_DIR_ORIGINAL)
565                 /* client -> server (PNS -> PAC) */
566                 ret = pptp_outbound_pkt(pskb, ctlh, pptpReq, reqlen, ct,
567                                         ctinfo);
568         else
569                 /* server -> client (PAC -> PNS) */
570                 ret = pptp_inbound_pkt(pskb, ctlh, pptpReq, reqlen, ct,
571                                        ctinfo);
572         DEBUGP("sstate: %d->%d, cstate: %d->%d\n",
573                 oldsstate, info->sstate, oldcstate, info->cstate);
574         spin_unlock_bh(&nf_pptp_lock);
575
576         return ret;
577 }
578
579 /* control protocol helper */
580 static struct nf_conntrack_helper pptp __read_mostly = {
581         .name                   = "pptp",
582         .me                     = THIS_MODULE,
583         .max_expected           = 2,
584         .timeout                = 5 * 60,
585         .tuple.src.l3num        = AF_INET,
586         .tuple.src.u.tcp.port   = __constant_htons(PPTP_CONTROL_PORT),
587         .tuple.dst.protonum     = IPPROTO_TCP,
588         .mask.src.l3num         = 0xffff,
589         .mask.src.u.tcp.port    = __constant_htons(0xffff),
590         .mask.dst.protonum      = 0xff,
591         .help                   = conntrack_pptp_help,
592         .destroy                = pptp_destroy_siblings,
593 };
594
595 static int __init nf_conntrack_pptp_init(void)
596 {
597         return nf_conntrack_helper_register(&pptp);
598 }
599
600 static void __exit nf_conntrack_pptp_fini(void)
601 {
602         nf_conntrack_helper_unregister(&pptp);
603         nf_ct_gre_keymap_flush();
604 }
605
606 module_init(nf_conntrack_pptp_init);
607 module_exit(nf_conntrack_pptp_fini);