[PATCH 9/15] [NETFILTER] PPTP helper: fix PNS-PAC expectation call id

[Harald Welte]

[NETFILTER] PPTP helper: fix PNS-PAC expectation call id

The reply tuple of the PNS->PAC expectation was using the wrong call id.

So we had the following situation:
- PNS behind NAT firewall
- PNS call id requires NATing
- PNS->PAC gre packet arrives first

then the PNS->PAC expectation is matched, and the other expectation
is deleted, but the PAC->PNS gre packets do not match the gre conntrack
because the call id is wrong.

We also cannot use ip_nat_follow_master().

Signed-off-by: Philip Craig <[EMAIL PROTECTED]>
Signed-off-by: Harald Welte <[EMAIL PROTECTED]>

---
commit 5bd49cc95f4f8ef5e6782242709927cd3ee6337d
tree f65149100cd216f50190c23032a39530512c9b82
parent 7b13da49573e77b6e122d9f9253728dac04d6658
author Philip Craig <[EMAIL PROTECTED]> Sat, 05 Nov 2005 12:30:02 +0100
committer Harald Welte <[EMAIL PROTECTED]> Sat, 05 Nov 2005 12:30:02 +0100

 net/ipv4/netfilter/ip_nat_helper_pptp.c |   28 ++++++++++++++++++++++++++--
 1 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ip_nat_helper_pptp.c 
b/net/ipv4/netfilter/ip_nat_helper_pptp.c
--- a/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -73,6 +73,7 @@ static void pptp_nat_expected(struct ip_
        struct ip_conntrack_tuple t;
        struct ip_ct_pptp_master *ct_pptp_info;
        struct ip_nat_pptp *nat_pptp_info;
+       struct ip_nat_range range;
 
        ct_pptp_info = &master->help.ct_pptp_info;
        nat_pptp_info = &master->nat.help.nat_pptp_info;
@@ -110,7 +111,30 @@ static void pptp_nat_expected(struct ip_
                DEBUGP("not found!\n");
        }
 
-       ip_nat_follow_master(ct, exp);
+       /* This must be a fresh one. */
+       BUG_ON(ct->status & IPS_NAT_DONE_MASK);
+
+       /* Change src to where master sends to */
+       range.flags = IP_NAT_RANGE_MAP_IPS;
+       range.min_ip = range.max_ip
+               = ct->master->tuplehash[!exp->dir].tuple.dst.ip;
+       if (exp->dir == IP_CT_DIR_ORIGINAL) {
+               range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+               range.min = range.max = exp->saved_proto;
+       }
+       /* hook doesn't matter, but it has to do source manip */
+       ip_nat_setup_info(ct, &range, NF_IP_POST_ROUTING);
+
+       /* For DST manip, map port here to where it's expected. */
+       range.flags = IP_NAT_RANGE_MAP_IPS;
+       range.min_ip = range.max_ip
+               = ct->master->tuplehash[!exp->dir].tuple.src.ip;
+       if (exp->dir == IP_CT_DIR_REPLY) {
+               range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+               range.min = range.max = exp->saved_proto;
+       }
+       /* hook doesn't matter, but it has to do destination manip */
+       ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
 }
 
 /* outbound packets == from PNS to PAC */
@@ -213,7 +237,7 @@ pptp_exp_gre(struct ip_conntrack_expect 
 
        /* alter expectation for PNS->PAC direction */
        invert_tuplepr(&inv_t, &expect_orig->tuple);
-       expect_orig->saved_proto.gre.key = htons(nat_pptp_info->pac_call_id);
+       expect_orig->saved_proto.gre.key = htons(ct_pptp_info->pns_call_id);
        expect_orig->tuple.src.u.gre.key = htons(nat_pptp_info->pns_call_id);
        expect_orig->tuple.dst.u.gre.key = htons(ct_pptp_info->pac_call_id);
        expect_orig->dir = IP_CT_DIR_ORIGINAL;
-- 
- Harald Welte <[EMAIL PROTECTED]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

pgp9nScbej2FI.pgp
Description: PGP signature