1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * $Id$
8 *
9 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT
10 * code.
11 */
12
13 #define IPF_RCMD_PROXY
14
15 typedef struct rcmdinfo {
16 u_32_t rcmd_port; /* Port number seen */
17 u_32_t rcmd_portseq; /* Sequence number where port is first seen */
18 ipnat_t *rcmd_rule; /* Template rule for back connection */
19 } rcmdinfo_t;
20
21 void ipf_p_rcmd_main_load(void);
22 void ipf_p_rcmd_main_unload(void);
23
24 int ipf_p_rcmd_init(void);
25 void ipf_p_rcmd_fini(void);
26 void ipf_p_rcmd_del(ipf_main_softc_t *, ap_session_t *);
27 int ipf_p_rcmd_new(void *, fr_info_t *, ap_session_t *, nat_t *);
28 int ipf_p_rcmd_out(void *, fr_info_t *, ap_session_t *, nat_t *);
29 int ipf_p_rcmd_in(void *, fr_info_t *, ap_session_t *, nat_t *);
30 u_short ipf_rcmd_atoi(char *);
31 int ipf_p_rcmd_portmsg(fr_info_t *, ap_session_t *, nat_t *);
32
33 static frentry_t rcmdfr;
34
35 static int rcmd_proxy_init = 0;
36
37
38 /*
39 * RCMD application proxy initialization.
40 */
41 void
ipf_p_rcmd_main_load(void)42 ipf_p_rcmd_main_load(void)
43 {
44 bzero((char *)&rcmdfr, sizeof(rcmdfr));
45 rcmdfr.fr_ref = 1;
46 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
47 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock");
48 rcmd_proxy_init = 1;
49 }
50
51
52 void
ipf_p_rcmd_main_unload(void)53 ipf_p_rcmd_main_unload(void)
54 {
55 if (rcmd_proxy_init == 1) {
56 MUTEX_DESTROY(&rcmdfr.fr_lock);
57 rcmd_proxy_init = 0;
58 }
59 }
60
61
62 /*
63 * Setup for a new RCMD proxy.
64 */
65 int
ipf_p_rcmd_new(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)66 ipf_p_rcmd_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
67 {
68 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
69 rcmdinfo_t *rc;
70 ipnat_t *ipn;
71 ipnat_t *np;
72 int size;
73
74 fin = fin; /* LINT */
75
76 np = nat->nat_ptr;
77 size = np->in_size;
78 KMALLOC(rc, rcmdinfo_t *);
79 if (rc == NULL) {
80 #ifdef IP_RCMD_PROXY_DEBUG
81 printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc));
82 #endif
83 return (-1);
84 }
85 aps->aps_sport = tcp->th_sport;
86 aps->aps_dport = tcp->th_dport;
87
88 ipn = ipf_proxy_rule_rev(nat);
89 if (ipn == NULL) {
90 KFREE(rc);
91 return (-1);
92 }
93
94 aps->aps_data = rc;
95 aps->aps_psiz = sizeof(*rc);
96 bzero((char *)rc, sizeof(*rc));
97
98 rc->rcmd_rule = ipn;
99
100 return (0);
101 }
102
103
104 void
ipf_p_rcmd_del(ipf_main_softc_t * softc,ap_session_t * aps)105 ipf_p_rcmd_del(ipf_main_softc_t *softc, ap_session_t *aps)
106 {
107 rcmdinfo_t *rci;
108
109 rci = aps->aps_data;
110 if (rci != NULL) {
111 rci->rcmd_rule->in_flags |= IPN_DELETE;
112 ipf_nat_rule_deref(softc, &rci->rcmd_rule);
113 }
114 }
115
116
117 /*
118 * ipf_rcmd_atoi - implement a simple version of atoi
119 */
120 u_short
ipf_rcmd_atoi(char * ptr)121 ipf_rcmd_atoi(char *ptr)
122 {
123 register char *s = ptr, c;
124 register u_short i = 0;
125
126 while (((c = *s++) != '\0') && ISDIGIT(c)) {
127 i *= 10;
128 i += c - '0';
129 }
130 return (i);
131 }
132
133
134 int
ipf_p_rcmd_portmsg(fr_info_t * fin,ap_session_t * aps,nat_t * nat)135 ipf_p_rcmd_portmsg(fr_info_t *fin, ap_session_t *aps, nat_t *nat)
136 {
137 tcphdr_t *tcp, tcph, *tcp2 = &tcph;
138 int off, dlen, nflags, direction;
139 ipf_main_softc_t *softc;
140 ipf_nat_softc_t *softn;
141 char portbuf[8], *s;
142 rcmdinfo_t *rc;
143 fr_info_t fi;
144 u_short sp;
145 nat_t *nat2;
146 #ifdef USE_INET6
147 ip6_t *ip6;
148 #endif
149 int tcpsz;
150 int slen = 0; /* silence gcc */
151 ip_t *ip;
152 mb_t *m;
153
154 tcp = (tcphdr_t *)fin->fin_dp;
155
156 m = fin->fin_m;
157 ip = fin->fin_ip;
158 tcpsz = TCP_OFF(tcp) << 2;
159 #ifdef USE_INET6
160 ip6 = (ip6_t *)fin->fin_ip;
161 #endif
162 softc = fin->fin_main_soft;
163 softn = softc->ipf_nat_soft;
164 off = (char *)tcp - (char *)ip + tcpsz + fin->fin_ipoff;
165
166 dlen = fin->fin_dlen - tcpsz;
167 if (dlen <= 0)
168 return (0);
169
170 rc = (rcmdinfo_t *)aps->aps_data;
171 if ((rc->rcmd_portseq != 0) &&
172 (tcp->th_seq != rc->rcmd_portseq))
173 return (0);
174
175 bzero(portbuf, sizeof(portbuf));
176 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf);
177
178 portbuf[sizeof(portbuf) - 1] = '\0';
179 s = portbuf;
180 sp = ipf_rcmd_atoi(s);
181 if (sp == 0) {
182 #ifdef IP_RCMD_PROXY_DEBUG
183 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n",
184 dlen, portbuf);
185 #endif
186 return (0);
187 }
188
189 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) {
190 #ifdef IP_RCMD_PROXY_DEBUG
191 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n",
192 sp, rc->rcmd_port);
193 #endif
194 return (0);
195 }
196
197 rc->rcmd_port = sp;
198 rc->rcmd_portseq = tcp->th_seq;
199
200 /*
201 * Initialise the packet info structure so we can search the NAT
202 * table to see if there already is soemthing present that matches
203 * up with what we want to add.
204 */
205 bcopy((char *)fin, (char *)&fi, sizeof(fi));
206 fi.fin_flx |= FI_IGNORE;
207 fi.fin_data[0] = 0;
208 fi.fin_data[1] = sp;
209 fi.fin_src6 = nat->nat_ndst6;
210 fi.fin_dst6 = nat->nat_nsrc6;
211
212 if (nat->nat_v[0] == 6) {
213 #ifdef USE_INET6
214 if (nat->nat_dir == NAT_OUTBOUND) {
215 nat2 = ipf_nat6_outlookup(&fi, NAT_SEARCH|IPN_TCP,
216 nat->nat_pr[1],
217 &nat->nat_osrc6.in6,
218 &nat->nat_odst6.in6);
219 } else {
220 nat2 = ipf_nat6_inlookup(&fi, NAT_SEARCH|IPN_TCP,
221 nat->nat_pr[0],
222 &nat->nat_osrc6.in6,
223 &nat->nat_odst6.in6);
224 }
225 #else
226 nat2 = (void *)-1;
227 #endif
228 } else {
229 if (nat->nat_dir == NAT_OUTBOUND) {
230 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP,
231 nat->nat_pr[1],
232 nat->nat_osrcip,
233 nat->nat_odstip);
234 } else {
235 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP,
236 nat->nat_pr[0],
237 nat->nat_osrcip,
238 nat->nat_odstip);
239 }
240 }
241 if (nat2 != NULL)
242 return (APR_ERR(1));
243
244 /*
245 * Add skeleton NAT entry for connection which will come
246 * back the other way.
247 */
248
249 if (nat->nat_v[0] == 6) {
250 #ifdef USE_INET6
251 slen = ip6->ip6_plen;
252 ip6->ip6_plen = htons(sizeof(*tcp));
253 #endif
254 } else {
255 slen = ip->ip_len;
256 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp));
257 }
258
259 /*
260 * Fill out the fake TCP header with a few fields that ipfilter
261 * considers to be important.
262 */
263 bzero((char *)tcp2, sizeof(*tcp2));
264 tcp2->th_win = htons(8192);
265 TCP_OFF_A(tcp2, 5);
266 tcp_set_flags(tcp2, TH_SYN);
267
268 fi.fin_dp = (char *)tcp2;
269 fi.fin_fr = &rcmdfr;
270 fi.fin_dlen = sizeof(*tcp2);
271 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
272 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
273
274 if (nat->nat_dir == NAT_OUTBOUND) {
275 fi.fin_out = 0;
276 direction = NAT_INBOUND;
277 } else {
278 fi.fin_out = 1;
279 direction = NAT_OUTBOUND;
280 }
281 nflags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
282
283 MUTEX_ENTER(&softn->ipf_nat_new);
284 if (fin->fin_v == 4)
285 nat2 = ipf_nat_add(&fi, rc->rcmd_rule, NULL, nflags,
286 direction);
287 #ifdef USE_INET6
288 else
289 nat2 = ipf_nat6_add(&fi, rc->rcmd_rule, NULL, nflags,
290 direction);
291 #endif
292 MUTEX_EXIT(&softn->ipf_nat_new);
293
294 if (nat2 != NULL) {
295 (void) ipf_nat_proto(&fi, nat2, IPN_TCP);
296 MUTEX_ENTER(&nat2->nat_lock);
297 ipf_nat_update(&fi, nat2);
298 MUTEX_EXIT(&nat2->nat_lock);
299 fi.fin_ifp = NULL;
300 if (nat2->nat_dir == NAT_INBOUND)
301 fi.fin_dst6 = nat->nat_osrc6;
302 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT);
303 }
304 if (nat->nat_v[0] == 6) {
305 #ifdef USE_INET6
306 ip6->ip6_plen = slen;
307 #endif
308 } else {
309 ip->ip_len = slen;
310 }
311 if (nat2 == NULL)
312 return (APR_ERR(1));
313 return (0);
314 }
315
316
317 int
ipf_p_rcmd_out(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)318 ipf_p_rcmd_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
319 {
320 if (nat->nat_dir == NAT_OUTBOUND)
321 return (ipf_p_rcmd_portmsg(fin, aps, nat));
322 return (0);
323 }
324
325
326 int
ipf_p_rcmd_in(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)327 ipf_p_rcmd_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
328 {
329 if (nat->nat_dir == NAT_INBOUND)
330 return (ipf_p_rcmd_portmsg(fin, aps, nat));
331 return (0);
332 }
333