pptp.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 *  Point-to-Point Tunneling Protocol for Linux
  4 *
  5 *	Authors: Dmitry Kozlov <xeb@mail.ru>
  6 */
  7
  8#include <linux/string.h>
  9#include <linux/module.h>
 10#include <linux/kernel.h>
 11#include <linux/slab.h>
 12#include <linux/errno.h>
 13#include <linux/netdevice.h>
 14#include <linux/net.h>
 15#include <linux/skbuff.h>
 16#include <linux/vmalloc.h>
 17#include <linux/init.h>
 18#include <linux/ppp_channel.h>
 19#include <linux/ppp_defs.h>
 20#include <linux/if_pppox.h>
 21#include <linux/ppp-ioctl.h>
 22#include <linux/notifier.h>
 23#include <linux/file.h>
 24#include <linux/in.h>
 25#include <linux/ip.h>
 26#include <linux/rcupdate.h>
 27#include <linux/security.h>
 28#include <linux/spinlock.h>
 29
 30#include <net/sock.h>
 31#include <net/protocol.h>
 32#include <net/ip.h>
 33#include <net/icmp.h>
 34#include <net/route.h>
 35#include <net/gre.h>
 36#include <net/pptp.h>
 37
 38#include <linux/uaccess.h>
 39
 40#define PPTP_DRIVER_VERSION "0.8.5"
 41
 42#define MAX_CALLID 65535
 43
 44static DECLARE_BITMAP(callid_bitmap, MAX_CALLID + 1);
 45static struct pppox_sock __rcu **callid_sock;
 46
 47static DEFINE_SPINLOCK(chan_lock);
 48
 49static struct proto pptp_sk_proto __read_mostly;
 50static const struct ppp_channel_ops pptp_chan_ops;
 51static const struct proto_ops pptp_ops;
 52
 53static struct pppox_sock *lookup_chan(u16 call_id, __be32 s_addr)
 54{
 55	struct pppox_sock *sock;
 56	struct pptp_opt *opt;
 57
 58	rcu_read_lock();
 59	sock = rcu_dereference(callid_sock[call_id]);
 60	if (sock) {
 61		opt = &sock->proto.pptp;
 62		if (opt->dst_addr.sin_addr.s_addr != s_addr)
 63			sock = NULL;
 64		else
 65			sock_hold(sk_pppox(sock));
 66	}
 67	rcu_read_unlock();
 68
 69	return sock;
 70}
 71
 72static int lookup_chan_dst(u16 call_id, __be32 d_addr)
 73{
 74	struct pppox_sock *sock;
 75	struct pptp_opt *opt;
 76	int i;
 77
 78	rcu_read_lock();
 79	i = 1;
 80	for_each_set_bit_from(i, callid_bitmap, MAX_CALLID) {
 81		sock = rcu_dereference(callid_sock[i]);
 82		if (!sock)
 83			continue;
 84		opt = &sock->proto.pptp;
 85		if (opt->dst_addr.call_id == call_id &&
 86			  opt->dst_addr.sin_addr.s_addr == d_addr)
 87			break;
 88	}
 89	rcu_read_unlock();
 90
 91	return i < MAX_CALLID;
 92}
 93
 94static int add_chan(struct pppox_sock *sock,
 95		    struct pptp_addr *sa)
 96{
 97	static int call_id;
 98
 99	spin_lock(&chan_lock);
100	if (!sa->call_id)	{
101		call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, call_id + 1);
102		if (call_id == MAX_CALLID) {
103			call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, 1);
104			if (call_id == MAX_CALLID)
105				goto out_err;
106		}
107		sa->call_id = call_id;
108	} else if (test_bit(sa->call_id, callid_bitmap)) {
109		goto out_err;
110	}
111
112	sock->proto.pptp.src_addr = *sa;
113	set_bit(sa->call_id, callid_bitmap);
114	rcu_assign_pointer(callid_sock[sa->call_id], sock);
115	spin_unlock(&chan_lock);
116
117	return 0;
118
119out_err:
120	spin_unlock(&chan_lock);
121	return -1;
122}
123
124static void del_chan(struct pppox_sock *sock)
125{
126	spin_lock(&chan_lock);
127	clear_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
128	RCU_INIT_POINTER(callid_sock[sock->proto.pptp.src_addr.call_id], NULL);
129	spin_unlock(&chan_lock);
130}
131
132static struct rtable *pptp_route_output(const struct pppox_sock *po,
133					struct flowi4 *fl4)
134{
135	const struct sock *sk = &po->sk;
136	struct net *net;
137
138	net = sock_net(sk);
139	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
140			   RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
141			   po->proto.pptp.dst_addr.sin_addr.s_addr,
142			   po->proto.pptp.src_addr.sin_addr.s_addr,
143			   0, 0, sock_net_uid(net, sk));
144	security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4));
145
146	return ip_route_output_flow(net, fl4, sk);
147}
148
149static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
150{
151	struct sock *sk = chan->private;
152	struct pppox_sock *po = pppox_sk(sk);
153	struct net *net = sock_net(sk);
154	struct pptp_opt *opt = &po->proto.pptp;
155	struct pptp_gre_header *hdr;
156	unsigned int header_len = sizeof(*hdr);
157	struct flowi4 fl4;
158	int islcp;
159	int len;
160	unsigned char *data;
161	__u32 seq_recv;
162	struct rtable *rt;
163	struct net_device *tdev;
164	struct iphdr  *iph;
165	int    max_headroom;
166
167	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
168		goto tx_drop;
169
170	rt = pptp_route_output(po, &fl4);
171	if (IS_ERR(rt))
172		goto tx_drop;
173
174	tdev = rt->dst.dev;
175
176	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(*iph) + sizeof(*hdr) + 2;
177
178	if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
179		struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
180
181		if (!new_skb)
182			goto tx_error;
183
184		if (skb->sk)
185			skb_set_owner_w(new_skb, skb->sk);
186		consume_skb(skb);
187		skb = new_skb;
188	}
189
190	/* Ensure we can safely access protocol field and LCP code */
191	if (!pskb_may_pull(skb, 3))
192		goto tx_error;
193
194	data = skb->data;
195	islcp = ((data[0] << 8) + data[1]) == PPP_LCP && 1 <= data[2] && data[2] <= 7;
196
197	/* compress protocol field */
198	if ((opt->ppp_flags & SC_COMP_PROT) && data[0] == 0 && !islcp)
199		skb_pull(skb, 1);
200
201	/* Put in the address/control bytes if necessary */
202	if ((opt->ppp_flags & SC_COMP_AC) == 0 || islcp) {
203		data = skb_push(skb, 2);
204		data[0] = PPP_ALLSTATIONS;
205		data[1] = PPP_UI;
206	}
207
208	len = skb->len;
209
210	seq_recv = opt->seq_recv;
211
212	if (opt->ack_sent == seq_recv)
213		header_len -= sizeof(hdr->ack);
214
215	/* Push down and install GRE header */
216	skb_push(skb, header_len);
217	hdr = (struct pptp_gre_header *)(skb->data);
218
219	hdr->gre_hd.flags = GRE_KEY | GRE_VERSION_1 | GRE_SEQ;
220	hdr->gre_hd.protocol = GRE_PROTO_PPP;
221	hdr->call_id = htons(opt->dst_addr.call_id);
222
223	hdr->seq = htonl(++opt->seq_sent);
224	if (opt->ack_sent != seq_recv)	{
225		/* send ack with this message */
226		hdr->gre_hd.flags |= GRE_ACK;
227		hdr->ack  = htonl(seq_recv);
228		opt->ack_sent = seq_recv;
229	}
230	hdr->payload_len = htons(len);
231
232	/*	Push down and install the IP header. */
233
234	skb_reset_transport_header(skb);
235	skb_push(skb, sizeof(*iph));
236	skb_reset_network_header(skb);
237	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
238	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED);
239
240	iph =	ip_hdr(skb);
241	iph->version =	4;
242	iph->ihl =	sizeof(struct iphdr) >> 2;
243	if (ip_dont_fragment(sk, &rt->dst))
244		iph->frag_off	=	htons(IP_DF);
245	else
246		iph->frag_off	=	0;
247	iph->protocol = IPPROTO_GRE;
248	iph->tos      = 0;
249	iph->daddr    = fl4.daddr;
250	iph->saddr    = fl4.saddr;
251	iph->ttl      = ip4_dst_hoplimit(&rt->dst);
252	iph->tot_len  = htons(skb->len);
253
254	skb_dst_drop(skb);
255	skb_dst_set(skb, &rt->dst);
256
257	nf_reset_ct(skb);
258
259	skb->ip_summed = CHECKSUM_NONE;
260	ip_select_ident(net, skb, NULL);
261	ip_send_check(iph);
262
263	ip_local_out(net, skb->sk, skb);
264	return 1;
265
266tx_error:
267	ip_rt_put(rt);
268tx_drop:
269	kfree_skb(skb);
270	return 1;
271}
272
273static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
274{
275	struct pppox_sock *po = pppox_sk(sk);
276	struct pptp_opt *opt = &po->proto.pptp;
277	int headersize, payload_len, seq;
278	__u8 *payload;
279	struct pptp_gre_header *header;
280
281	if (!(sk->sk_state & PPPOX_CONNECTED)) {
282		if (sock_queue_rcv_skb(sk, skb))
283			goto drop;
284		return NET_RX_SUCCESS;
285	}
286
287	header = (struct pptp_gre_header *)(skb->data);
288	headersize  = sizeof(*header);
289
290	/* test if acknowledgement present */
291	if (GRE_IS_ACK(header->gre_hd.flags)) {
292		__u32 ack;
293
294		if (!pskb_may_pull(skb, headersize))
295			goto drop;
296		header = (struct pptp_gre_header *)(skb->data);
297
298		/* ack in different place if S = 0 */
299		ack = GRE_IS_SEQ(header->gre_hd.flags) ? ntohl(header->ack) :
300							 ntohl(header->seq);
301		if (ack > opt->ack_recv)
302			opt->ack_recv = ack;
303		/* also handle sequence number wrap-around  */
304		if (WRAPPED(ack, opt->ack_recv))
305			opt->ack_recv = ack;
306	} else {
307		headersize -= sizeof(header->ack);
308	}
309	/* test if payload present */
310	if (!GRE_IS_SEQ(header->gre_hd.flags))
311		goto drop;
312
313	payload_len = ntohs(header->payload_len);
314	seq         = ntohl(header->seq);
315
316	/* check for incomplete packet (length smaller than expected) */
317	if (!pskb_may_pull(skb, headersize + payload_len))
318		goto drop;
319
320	payload = skb->data + headersize;
321	/* check for expected sequence number */
322	if (seq < opt->seq_recv + 1 || WRAPPED(opt->seq_recv, seq)) {
323		if ((payload[0] == PPP_ALLSTATIONS) && (payload[1] == PPP_UI) &&
324				(PPP_PROTOCOL(payload) == PPP_LCP) &&
325				((payload[4] == PPP_LCP_ECHOREQ) || (payload[4] == PPP_LCP_ECHOREP)))
326			goto allow_packet;
327	} else {
328		opt->seq_recv = seq;
329allow_packet:
330		skb_pull(skb, headersize);
331
332		if (payload[0] == PPP_ALLSTATIONS && payload[1] == PPP_UI) {
333			/* chop off address/control */
334			if (skb->len < 3)
335				goto drop;
336			skb_pull(skb, 2);
337		}
338
339		skb->ip_summed = CHECKSUM_NONE;
340		skb_set_network_header(skb, skb->head-skb->data);
341		ppp_input(&po->chan, skb);
342
343		return NET_RX_SUCCESS;
344	}
345drop:
346	kfree_skb(skb);
347	return NET_RX_DROP;
348}
349
350static int pptp_rcv(struct sk_buff *skb)
351{
352	struct pppox_sock *po;
353	struct pptp_gre_header *header;
354	struct iphdr *iph;
355
356	if (skb->pkt_type != PACKET_HOST)
357		goto drop;
358
359	if (!pskb_may_pull(skb, 12))
360		goto drop;
361
362	iph = ip_hdr(skb);
363
364	header = (struct pptp_gre_header *)skb->data;
365
366	if (header->gre_hd.protocol != GRE_PROTO_PPP || /* PPTP-GRE protocol for PPTP */
367		GRE_IS_CSUM(header->gre_hd.flags) ||    /* flag CSUM should be clear */
368		GRE_IS_ROUTING(header->gre_hd.flags) || /* flag ROUTING should be clear */
369		!GRE_IS_KEY(header->gre_hd.flags) ||    /* flag KEY should be set */
370		(header->gre_hd.flags & GRE_FLAGS))     /* flag Recursion Ctrl should be clear */
371		/* if invalid, discard this packet */
372		goto drop;
373
374	po = lookup_chan(ntohs(header->call_id), iph->saddr);
375	if (po) {
376		skb_dst_drop(skb);
377		nf_reset_ct(skb);
378		return sk_receive_skb(sk_pppox(po), skb, 0);
379	}
380drop:
381	kfree_skb(skb);
382	return NET_RX_DROP;
383}
384
385static int pptp_bind(struct socket *sock, struct sockaddr_unsized *uservaddr,
386		     int sockaddr_len)
387{
388	struct sock *sk = sock->sk;
389	struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
390	struct pppox_sock *po = pppox_sk(sk);
391	int error = 0;
392
393	if (sockaddr_len < sizeof(struct sockaddr_pppox))
394		return -EINVAL;
395
396	lock_sock(sk);
397
398	if (sk->sk_state & PPPOX_DEAD) {
399		error = -EALREADY;
400		goto out;
401	}
402
403	if (sk->sk_state & PPPOX_BOUND) {
404		error = -EBUSY;
405		goto out;
406	}
407
408	if (add_chan(po, &sp->sa_addr.pptp))
409		error = -EBUSY;
410	else
411		sk->sk_state |= PPPOX_BOUND;
412
413out:
414	release_sock(sk);
415	return error;
416}
417
418static int pptp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
419			int sockaddr_len, int flags)
420{
421	struct sock *sk = sock->sk;
422	struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
423	struct pppox_sock *po = pppox_sk(sk);
424	struct pptp_opt *opt = &po->proto.pptp;
425	struct rtable *rt;
426	struct flowi4 fl4;
427	int error = 0;
428
429	if (sockaddr_len < sizeof(struct sockaddr_pppox))
430		return -EINVAL;
431
432	if (sp->sa_protocol != PX_PROTO_PPTP)
433		return -EINVAL;
434
435	if (lookup_chan_dst(sp->sa_addr.pptp.call_id, sp->sa_addr.pptp.sin_addr.s_addr))
436		return -EALREADY;
437
438	lock_sock(sk);
439	/* Check for already bound sockets */
440	if (sk->sk_state & PPPOX_CONNECTED) {
441		error = -EBUSY;
442		goto end;
443	}
444
445	/* Check for already disconnected sockets, on attempts to disconnect */
446	if (sk->sk_state & PPPOX_DEAD) {
447		error = -EALREADY;
448		goto end;
449	}
450
451	if (!opt->src_addr.sin_addr.s_addr || !sp->sa_addr.pptp.sin_addr.s_addr) {
452		error = -EINVAL;
453		goto end;
454	}
455
456	po->chan.private = sk;
457	po->chan.ops = &pptp_chan_ops;
458
459	rt = pptp_route_output(po, &fl4);
460	if (IS_ERR(rt)) {
461		error = -EHOSTUNREACH;
462		goto end;
463	}
464	sk_setup_caps(sk, &rt->dst);
465
466	po->chan.mtu = dst_mtu(&rt->dst);
467	if (!po->chan.mtu)
468		po->chan.mtu = PPP_MRU;
469	po->chan.mtu -= PPTP_HEADER_OVERHEAD;
470
471	po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
472	po->chan.direct_xmit = true;
473	error = ppp_register_channel(&po->chan);
474	if (error) {
475		pr_err("PPTP: failed to register PPP channel (%d)\n", error);
476		goto end;
477	}
478
479	opt->dst_addr = sp->sa_addr.pptp;
480	sk->sk_state |= PPPOX_CONNECTED;
481
482 end:
483	release_sock(sk);
484	return error;
485}
486
487static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
488	int peer)
489{
490	int len = sizeof(struct sockaddr_pppox);
491	struct sockaddr_pppox sp;
492
493	memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
494
495	sp.sa_family    = AF_PPPOX;
496	sp.sa_protocol  = PX_PROTO_PPTP;
497	sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
498
499	memcpy(uaddr, &sp, len);
500
501	return len;
502}
503
504static int pptp_release(struct socket *sock)
505{
506	struct sock *sk = sock->sk;
507	struct pppox_sock *po;
508	int error = 0;
509
510	if (!sk)
511		return 0;
512
513	lock_sock(sk);
514
515	if (sock_flag(sk, SOCK_DEAD)) {
516		release_sock(sk);
517		return -EBADF;
518	}
519
520	po = pppox_sk(sk);
521	del_chan(po);
522	synchronize_rcu();
523
524	pppox_unbind_sock(sk);
525	sk->sk_state = PPPOX_DEAD;
526
527	sock_orphan(sk);
528	sock->sk = NULL;
529
530	release_sock(sk);
531	sock_put(sk);
532
533	return error;
534}
535
536static void pptp_sock_destruct(struct sock *sk)
537{
538	if (!(sk->sk_state & PPPOX_DEAD)) {
539		del_chan(pppox_sk(sk));
540		pppox_unbind_sock(sk);
541	}
542	skb_queue_purge(&sk->sk_receive_queue);
543	dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
544}
545
546static int pptp_create(struct net *net, struct socket *sock, int kern)
547{
548	int error = -ENOMEM;
549	struct sock *sk;
550	struct pppox_sock *po;
551	struct pptp_opt *opt;
552
553	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pptp_sk_proto, kern);
554	if (!sk)
555		goto out;
556
557	sock_init_data(sock, sk);
558
559	sock->state = SS_UNCONNECTED;
560	sock->ops   = &pptp_ops;
561
562	sk->sk_backlog_rcv = pptp_rcv_core;
563	sk->sk_state       = PPPOX_NONE;
564	sk->sk_type        = SOCK_STREAM;
565	sk->sk_family      = PF_PPPOX;
566	sk->sk_protocol    = PX_PROTO_PPTP;
567	sk->sk_destruct    = pptp_sock_destruct;
568
569	po = pppox_sk(sk);
570	opt = &po->proto.pptp;
571
572	opt->seq_sent = 0; opt->seq_recv = 0xffffffff;
573	opt->ack_recv = 0; opt->ack_sent = 0xffffffff;
574
575	error = 0;
576out:
577	return error;
578}
579
580static int pptp_ppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
581	unsigned long arg)
582{
583	struct sock *sk = chan->private;
584	struct pppox_sock *po = pppox_sk(sk);
585	struct pptp_opt *opt = &po->proto.pptp;
586	void __user *argp = (void __user *)arg;
587	int __user *p = argp;
588	int err, val;
589
590	err = -EFAULT;
591	switch (cmd) {
592	case PPPIOCGFLAGS:
593		val = opt->ppp_flags;
594		if (put_user(val, p))
595			break;
596		err = 0;
597		break;
598	case PPPIOCSFLAGS:
599		if (get_user(val, p))
600			break;
601		opt->ppp_flags = val & ~SC_RCV_BITS;
602		err = 0;
603		break;
604	default:
605		err = -ENOTTY;
606	}
607
608	return err;
609}
610
611static const struct ppp_channel_ops pptp_chan_ops = {
612	.start_xmit = pptp_xmit,
613	.ioctl      = pptp_ppp_ioctl,
614};
615
616static struct proto pptp_sk_proto __read_mostly = {
617	.name     = "PPTP",
618	.owner    = THIS_MODULE,
619	.obj_size = sizeof(struct pppox_sock),
620};
621
622static const struct proto_ops pptp_ops = {
623	.family     = AF_PPPOX,
624	.owner      = THIS_MODULE,
625	.release    = pptp_release,
626	.bind       = pptp_bind,
627	.connect    = pptp_connect,
628	.socketpair = sock_no_socketpair,
629	.accept     = sock_no_accept,
630	.getname    = pptp_getname,
631	.listen     = sock_no_listen,
632	.shutdown   = sock_no_shutdown,
633	.sendmsg    = sock_no_sendmsg,
634	.recvmsg    = sock_no_recvmsg,
635	.mmap       = sock_no_mmap,
636	.ioctl      = pppox_ioctl,
637#ifdef CONFIG_COMPAT
638	.compat_ioctl = pppox_compat_ioctl,
639#endif
640};
641
642static const struct pppox_proto pppox_pptp_proto = {
643	.create = pptp_create,
644	.owner  = THIS_MODULE,
645};
646
647static const struct gre_protocol gre_pptp_protocol = {
648	.handler = pptp_rcv,
649};
650
651static int __init pptp_init_module(void)
652{
653	int err = 0;
654	pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
655
656	callid_sock = vzalloc(array_size(sizeof(void *), (MAX_CALLID + 1)));
657	if (!callid_sock)
658		return -ENOMEM;
659
660	err = gre_add_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
661	if (err) {
662		pr_err("PPTP: can't add gre protocol\n");
663		goto out_mem_free;
664	}
665
666	err = proto_register(&pptp_sk_proto, 0);
667	if (err) {
668		pr_err("PPTP: can't register sk_proto\n");
669		goto out_gre_del_protocol;
670	}
671
672	err = register_pppox_proto(PX_PROTO_PPTP, &pppox_pptp_proto);
673	if (err) {
674		pr_err("PPTP: can't register pppox_proto\n");
675		goto out_unregister_sk_proto;
676	}
677
678	return 0;
679
680out_unregister_sk_proto:
681	proto_unregister(&pptp_sk_proto);
682out_gre_del_protocol:
683	gre_del_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
684out_mem_free:
685	vfree(callid_sock);
686
687	return err;
688}
689
690static void __exit pptp_exit_module(void)
691{
692	unregister_pppox_proto(PX_PROTO_PPTP);
693	proto_unregister(&pptp_sk_proto);
694	gre_del_protocol(&gre_pptp_protocol, GREPROTO_PPTP);
695	vfree(callid_sock);
696}
697
698module_init(pptp_init_module);
699module_exit(pptp_exit_module);
700
701MODULE_DESCRIPTION("Point-to-Point Tunneling Protocol");
702MODULE_AUTHOR("D. Kozlov <xeb@mail.ru>");
703MODULE_LICENSE("GPL");
704MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_PPTP);