pptp_msg_name[msg], ntohs(*cid)); 
pptp_msg_name[msg], ntohs(*pcid)); 
pptp_inbound_pkt(struct sk_buff **pskb,		 struct tcphdr *tcph,		 unsigned int nexthdr_off,		 unsigned int datalen,		 struct ip_conntrack *ct,		 enum ip_conntrack_info ctinfo){	struct PptpControlHeader _ctlh, *ctlh;	unsigned int reqlen;	union pptp_ctrl_union _pptpReq, *pptpReq;	struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;	u_int16_t msg, *cid, *pcid;	u_int32_t seq;		ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);	if (!ctlh) {		DEBUGP("error during skb_header_pointer\n");		return NF_ACCEPT;	}	nexthdr_off += sizeof(_ctlh);	datalen -= sizeof(_ctlh);	reqlen = datalen;	if (reqlen > sizeof(*pptpReq))		reqlen = sizeof(*pptpReq);	pptpReq = skb_header_pointer(*pskb, nexthdr_off, reqlen, &_pptpReq);	if (!pptpReq) {		DEBUGP("error during skb_header_pointer\n");		return NF_ACCEPT;	}	msg = ntohs(ctlh->messageType);	DEBUGP("inbound control message %s\n", pptp_msg_name[msg]);	switch (msg) {	case PPTP_START_SESSION_REPLY:		if (reqlen < sizeof(_pptpReq.srep)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server confirms new control session */		if (info->sstate < PPTP_SESSION_REQUESTED) {			DEBUGP("%s without START_SESS_REQUEST\n",				pptp_msg_name[msg]);			break;		}		if (pptpReq->srep.resultCode == PPTP_START_OK)			info->sstate = PPTP_SESSION_CONFIRMED;		else 			info->sstate = PPTP_SESSION_ERROR;		break;	case PPTP_STOP_SESSION_REPLY:		if (reqlen < sizeof(_pptpReq.strep)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server confirms end of control session */		if (info->sstate > PPTP_SESSION_STOPREQ) {			DEBUGP("%s without STOP_SESS_REQUEST\n",				pptp_msg_name[msg]);			break;		}		if (pptpReq->strep.resultCode == PPTP_STOP_OK)			info->sstate = PPTP_SESSION_NONE;		else			info->sstate = PPTP_SESSION_ERROR;		break;	case PPTP_OUT_CALL_REPLY:		if (reqlen < sizeof(_pptpReq.ocack)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server accepted call, we now expect GRE frames */		if (info->sstate != PPTP_SESSION_CONFIRMED) {			DEBUGP("%s but no session\n", pptp_msg_name[msg]);			break;		}		if (info->cstate != PPTP_CALL_OUT_REQ &&		    info->cstate != PPTP_CALL_OUT_CONF) {			DEBUGP("%s without OUTCALL_REQ\n", pptp_msg_name[msg]);			break;		}		if (pptpReq->ocack.resultCode != PPTP_OUTCALL_CONNECT) {			info->cstate = PPTP_CALL_NONE;			break;		}		cid = &pptpReq->ocack.callID;		pcid = &pptpReq->ocack.peersCallID;		info->pac_call_id = ntohs(*cid);				if (htons(info->pns_call_id) != *pcid) {			DEBUGP("%s for unknown callid %u\n",				pptp_msg_name[msg], ntohs(*pcid));			break;		}		DEBUGP("%s, CID=%X, PCID=%X\n", pptp_msg_name[msg], 			ntohs(*cid), ntohs(*pcid));				info->cstate = PPTP_CALL_OUT_CONF;		seq = ntohl(tcph->seq) + sizeof(struct pptp_pkt_hdr)				       + sizeof(struct PptpControlHeader)				       + ((void *)pcid - (void *)pptpReq);					if (exp_gre(ct, seq, *cid, *pcid) != 0)			printk("ip_conntrack_pptp: error during exp_gre\n");		break;	case PPTP_IN_CALL_REQUEST:		if (reqlen < sizeof(_pptpReq.icack)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server tells us about incoming call request */		if (info->sstate != PPTP_SESSION_CONFIRMED) {			DEBUGP("%s but no session\n", pptp_msg_name[msg]);			break;		}		pcid = &pptpReq->icack.peersCallID;		DEBUGP("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(*pcid));		info->cstate = PPTP_CALL_IN_REQ;		info->pac_call_id = ntohs(*pcid);		break;	case PPTP_IN_CALL_CONNECT:		if (reqlen < sizeof(_pptpReq.iccon)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server tells us about incoming call established */		if (info->sstate != PPTP_SESSION_CONFIRMED) {			DEBUGP("%s but no session\n", pptp_msg_name[msg]);			break;		}		if (info->sstate != PPTP_CALL_IN_REP		    && info->sstate != PPTP_CALL_IN_CONF) {			DEBUGP("%s but never sent IN_CALL_REPLY\n",				pptp_msg_name[msg]);			break;		}		pcid = &pptpReq->iccon.peersCallID;		cid = &info->pac_call_id;		if (info->pns_call_id != ntohs(*pcid)) {			DEBUGP("%s for unknown CallID %u\n", 				pptp_msg_name[msg], ntohs(*cid));			break;		}		DEBUGP("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(*pcid));		info->cstate = PPTP_CALL_IN_CONF;		/* we expect a GRE connection from PAC to PNS */		seq = ntohl(tcph->seq) + sizeof(struct pptp_pkt_hdr)				       + sizeof(struct PptpControlHeader)				       + ((void *)pcid - (void *)pptpReq);					if (exp_gre(ct, seq, *cid, *pcid) != 0)			printk("ip_conntrack_pptp: error during exp_gre\n");		break;	case PPTP_CALL_DISCONNECT_NOTIFY:		if (reqlen < sizeof(_pptpReq.disc)) {			DEBUGP("%s: short packet\n", pptp_msg_name[msg]);			break;		}		/* server confirms disconnect */		cid = &pptpReq->disc.callID;		DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(*cid));		info->cstate = PPTP_CALL_NONE;		/* untrack this call id, unexpect GRE packets */		pptp_destroy_siblings(ct);		break;	case PPTP_WAN_ERROR_NOTIFY:		break;	case PPTP_ECHO_REQUEST:	case PPTP_ECHO_REPLY:		/* I don't have to explain these ;) */		break;	default:		DEBUGP("invalid %s (TY=%d)\n", (msg <= PPTP_MSG_MAX)			? pptp_msg_name[msg]:pptp_msg_name[0], msg);		break;	}	if (ip_nat_pptp_hook_inbound)		return ip_nat_pptp_hook_inbound(pskb, ct, ctinfo, ctlh,						pptpReq);	return NF_ACCEPT;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/0ae5d253adcc467b1c52b512bbca9419eb438409/ip_conntrack_helper_pptp.c/buggy/net/ipv4/netfilter/ip_conntrack_helper_pptp.c