1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * $Id$
8 *
9 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT
10 * code.
11 */
12
13 #define IPF_RCMD_PROXY
14
15 typedef struct rcmdinfo {
16 u_32_t rcmd_port; /* Port number seen */
17 u_32_t rcmd_portseq; /* Sequence number where port is first seen */
18 ipnat_t *rcmd_rule; /* Template rule for back connection */
19 } rcmdinfo_t;
20
21 void ipf_p_rcmd_main_load(void);
22 void ipf_p_rcmd_main_unload(void);
23
24 int ipf_p_rcmd_init(void);
25 void ipf_p_rcmd_fini(void);
26 void ipf_p_rcmd_del(ipf_main_softc_t *, ap_session_t *);
27 int ipf_p_rcmd_new(void *, fr_info_t *, ap_session_t *, nat_t *);
28 int ipf_p_rcmd_out(void *, fr_info_t *, ap_session_t *, nat_t *);
29 int ipf_p_rcmd_in(void *, fr_info_t *, ap_session_t *, nat_t *);
30 u_short ipf_rcmd_atoi(char *);
31 int ipf_p_rcmd_portmsg(fr_info_t *, ap_session_t *, nat_t *);
32
33 static frentry_t rcmdfr;
34
35 static int rcmd_proxy_init = 0;
36
37
38 /*
39 * RCMD application proxy initialization.
40 */
41 void
ipf_p_rcmd_main_load(void)42 ipf_p_rcmd_main_load(void)
43 {
44 bzero((char *)&rcmdfr, sizeof(rcmdfr));
45 rcmdfr.fr_ref = 1;
46 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
47 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock");
48 rcmd_proxy_init = 1;
49 }
50
51
52 void
ipf_p_rcmd_main_unload(void)53 ipf_p_rcmd_main_unload(void)
54 {
55 if (rcmd_proxy_init == 1) {
56 MUTEX_DESTROY(&rcmdfr.fr_lock);
57 rcmd_proxy_init = 0;
58 }
59 }
60
61
62 /*
63 * Setup for a new RCMD proxy.
64 */
65 int
ipf_p_rcmd_new(void * arg,fr_info_t * fin __unused,ap_session_t * aps,nat_t * nat)66 ipf_p_rcmd_new(void *arg, fr_info_t *fin __unused, ap_session_t *aps, nat_t *nat)
67 {
68 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
69 rcmdinfo_t *rc;
70 ipnat_t *ipn;
71
72 KMALLOC(rc, rcmdinfo_t *);
73 if (rc == NULL) {
74 #ifdef IP_RCMD_PROXY_DEBUG
75 printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc));
76 #endif
77 return (-1);
78 }
79 aps->aps_sport = tcp->th_sport;
80 aps->aps_dport = tcp->th_dport;
81
82 ipn = ipf_proxy_rule_rev(nat);
83 if (ipn == NULL) {
84 KFREE(rc);
85 return (-1);
86 }
87
88 aps->aps_data = rc;
89 aps->aps_psiz = sizeof(*rc);
90 bzero((char *)rc, sizeof(*rc));
91
92 rc->rcmd_rule = ipn;
93
94 return (0);
95 }
96
97
98 void
ipf_p_rcmd_del(ipf_main_softc_t * softc,ap_session_t * aps)99 ipf_p_rcmd_del(ipf_main_softc_t *softc, ap_session_t *aps)
100 {
101 rcmdinfo_t *rci;
102
103 rci = aps->aps_data;
104 if (rci != NULL) {
105 rci->rcmd_rule->in_flags |= IPN_DELETE;
106 ipf_nat_rule_deref(softc, &rci->rcmd_rule);
107 }
108 }
109
110
111 /*
112 * ipf_rcmd_atoi - implement a simple version of atoi
113 */
114 u_short
ipf_rcmd_atoi(char * ptr)115 ipf_rcmd_atoi(char *ptr)
116 {
117 register char *s = ptr, c;
118 register u_short i = 0;
119
120 while (((c = *s++) != '\0') && ISDIGIT(c)) {
121 i *= 10;
122 i += c - '0';
123 }
124 return (i);
125 }
126
127
128 int
ipf_p_rcmd_portmsg(fr_info_t * fin,ap_session_t * aps,nat_t * nat)129 ipf_p_rcmd_portmsg(fr_info_t *fin, ap_session_t *aps, nat_t *nat)
130 {
131 tcphdr_t *tcp, tcph, *tcp2 = &tcph;
132 int off, dlen, nflags, direction;
133 ipf_main_softc_t *softc;
134 ipf_nat_softc_t *softn;
135 char portbuf[8], *s;
136 rcmdinfo_t *rc;
137 fr_info_t fi;
138 u_short sp;
139 nat_t *nat2;
140 #ifdef USE_INET6
141 ip6_t *ip6;
142 #endif
143 int tcpsz;
144 int slen = 0; /* silence gcc */
145 ip_t *ip;
146 mb_t *m;
147
148 tcp = (tcphdr_t *)fin->fin_dp;
149
150 m = fin->fin_m;
151 ip = fin->fin_ip;
152 tcpsz = TCP_OFF(tcp) << 2;
153 #ifdef USE_INET6
154 ip6 = (ip6_t *)fin->fin_ip;
155 #endif
156 softc = fin->fin_main_soft;
157 softn = softc->ipf_nat_soft;
158 off = (char *)tcp - (char *)ip + tcpsz + fin->fin_ipoff;
159
160 dlen = fin->fin_dlen - tcpsz;
161 if (dlen <= 0)
162 return (0);
163
164 rc = (rcmdinfo_t *)aps->aps_data;
165 if ((rc->rcmd_portseq != 0) &&
166 (tcp->th_seq != rc->rcmd_portseq))
167 return (0);
168
169 bzero(portbuf, sizeof(portbuf));
170 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf);
171
172 portbuf[sizeof(portbuf) - 1] = '\0';
173 s = portbuf;
174 sp = ipf_rcmd_atoi(s);
175 if (sp == 0) {
176 #ifdef IP_RCMD_PROXY_DEBUG
177 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n",
178 dlen, portbuf);
179 #endif
180 return (0);
181 }
182
183 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) {
184 #ifdef IP_RCMD_PROXY_DEBUG
185 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n",
186 sp, rc->rcmd_port);
187 #endif
188 return (0);
189 }
190
191 rc->rcmd_port = sp;
192 rc->rcmd_portseq = tcp->th_seq;
193
194 /*
195 * Initialise the packet info structure so we can search the NAT
196 * table to see if there already is soemthing present that matches
197 * up with what we want to add.
198 */
199 bcopy((char *)fin, (char *)&fi, sizeof(fi));
200 fi.fin_flx |= FI_IGNORE;
201 fi.fin_data[0] = 0;
202 fi.fin_data[1] = sp;
203 fi.fin_src6 = nat->nat_ndst6;
204 fi.fin_dst6 = nat->nat_nsrc6;
205
206 if (nat->nat_v[0] == 6) {
207 #ifdef USE_INET6
208 if (nat->nat_dir == NAT_OUTBOUND) {
209 nat2 = ipf_nat6_outlookup(&fi, NAT_SEARCH|IPN_TCP,
210 nat->nat_pr[1],
211 &nat->nat_osrc6.in6,
212 &nat->nat_odst6.in6);
213 } else {
214 nat2 = ipf_nat6_inlookup(&fi, NAT_SEARCH|IPN_TCP,
215 nat->nat_pr[0],
216 &nat->nat_osrc6.in6,
217 &nat->nat_odst6.in6);
218 }
219 #else
220 nat2 = (void *)-1;
221 #endif
222 } else {
223 if (nat->nat_dir == NAT_OUTBOUND) {
224 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP,
225 nat->nat_pr[1],
226 nat->nat_osrcip,
227 nat->nat_odstip);
228 } else {
229 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP,
230 nat->nat_pr[0],
231 nat->nat_osrcip,
232 nat->nat_odstip);
233 }
234 }
235 if (nat2 != NULL)
236 return (APR_ERR(1));
237
238 /*
239 * Add skeleton NAT entry for connection which will come
240 * back the other way.
241 */
242
243 if (nat->nat_v[0] == 6) {
244 #ifdef USE_INET6
245 slen = ip6->ip6_plen;
246 ip6->ip6_plen = htons(sizeof(*tcp));
247 #endif
248 } else {
249 slen = ip->ip_len;
250 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp));
251 }
252
253 /*
254 * Fill out the fake TCP header with a few fields that ipfilter
255 * considers to be important.
256 */
257 bzero((char *)tcp2, sizeof(*tcp2));
258 tcp2->th_win = htons(8192);
259 TCP_OFF_A(tcp2, 5);
260 tcp_set_flags(tcp2, TH_SYN);
261
262 fi.fin_dp = (char *)tcp2;
263 fi.fin_fr = &rcmdfr;
264 fi.fin_dlen = sizeof(*tcp2);
265 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
266 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
267
268 if (nat->nat_dir == NAT_OUTBOUND) {
269 fi.fin_out = 0;
270 direction = NAT_INBOUND;
271 } else {
272 fi.fin_out = 1;
273 direction = NAT_OUTBOUND;
274 }
275 nflags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
276
277 MUTEX_ENTER(&softn->ipf_nat_new);
278 if (fin->fin_v == 4)
279 nat2 = ipf_nat_add(&fi, rc->rcmd_rule, NULL, nflags,
280 direction);
281 #ifdef USE_INET6
282 else
283 nat2 = ipf_nat6_add(&fi, rc->rcmd_rule, NULL, nflags,
284 direction);
285 #endif
286 MUTEX_EXIT(&softn->ipf_nat_new);
287
288 if (nat2 != NULL) {
289 (void) ipf_nat_proto(&fi, nat2, IPN_TCP);
290 MUTEX_ENTER(&nat2->nat_lock);
291 ipf_nat_update(&fi, nat2);
292 MUTEX_EXIT(&nat2->nat_lock);
293 fi.fin_ifp = NULL;
294 if (nat2->nat_dir == NAT_INBOUND)
295 fi.fin_dst6 = nat->nat_osrc6;
296 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT);
297 }
298 if (nat->nat_v[0] == 6) {
299 #ifdef USE_INET6
300 ip6->ip6_plen = slen;
301 #endif
302 } else {
303 ip->ip_len = slen;
304 }
305 if (nat2 == NULL)
306 return (APR_ERR(1));
307 return (0);
308 }
309
310
311 int
ipf_p_rcmd_out(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)312 ipf_p_rcmd_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
313 {
314 if (nat->nat_dir == NAT_OUTBOUND)
315 return (ipf_p_rcmd_portmsg(fin, aps, nat));
316 return (0);
317 }
318
319
320 int
ipf_p_rcmd_in(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)321 ipf_p_rcmd_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
322 {
323 if (nat->nat_dir == NAT_INBOUND)
324 return (ipf_p_rcmd_portmsg(fin, aps, nat));
325 return (0);
326 }
327