1 /* Alias_irc.c intercepts packages contain IRC CTCP commands, and 2 changes DCC commands to export a port on the aliasing host instead 3 of an aliased host. 4 5 For this routine to work, the DCC command must fit entirely into a 6 single TCP packet. This will usually happen, but is not 7 guaranteed. 8 9 The interception is likely to change the length of the packet. 10 The handling of this is copied more-or-less verbatim from 11 ftp_alias.c 12 13 This software is placed into the public domain with no restrictions 14 on its distribution. 15 16 Initial version: Eivind Eklund <perhaps@yes.no> (ee) 97-01-29 17 18 Version 2.1: May, 1997 (cjm) 19 Very minor changes to conform with 20 local/global/function naming conventions 21 withing the packet alising module. 22 23 $FreeBSD$ 24 */ 25 26 /* Includes */ 27 #include <ctype.h> 28 #include <stdio.h> 29 #include <string.h> 30 #include <sys/types.h> 31 #include <netinet/in_systm.h> 32 #include <netinet/in.h> 33 #include <netinet/ip.h> 34 #include <netinet/tcp.h> 35 #include <limits.h> 36 37 #include "alias_local.h" 38 39 /* Local defines */ 40 #define DBprintf(a) 41 42 43 void 44 AliasHandleIrcOut(struct ip *pip, /* IP packet to examine */ 45 struct alias_link *link, /* Which link are we on? */ 46 int maxsize /* Maximum size of IP packet including headers */ 47 ) 48 { 49 int hlen, tlen, dlen; 50 struct in_addr true_addr; 51 u_short true_port; 52 char *sptr; 53 struct tcphdr *tc; 54 int i; /* Iterator through the source */ 55 56 /* Calculate data length of TCP packet */ 57 tc = (struct tcphdr *) ((char *) pip + (pip->ip_hl << 2)); 58 hlen = (pip->ip_hl + tc->th_off) << 2; 59 tlen = ntohs(pip->ip_len); 60 dlen = tlen - hlen; 61 62 /* Return if data length is too short - assume an entire PRIVMSG in each packet. */ 63 if (dlen<sizeof(":A!a@n.n PRIVMSG A :aDCC 1 1a")-1) 64 return; 65 66 /* Place string pointer at beginning of data */ 67 sptr = (char *) pip; 68 sptr += hlen; 69 maxsize -= hlen; /* We're interested in maximum size of data, not packet */ 70 71 /* Search for a CTCP command [Note 1] */ 72 for( i=0; i<dlen; i++ ) { 73 if(sptr[i]=='\001') 74 goto lFOUND_CTCP; 75 } 76 return; /* No CTCP commands in */ 77 /* Handle CTCP commands - the buffer may have to be copied */ 78 lFOUND_CTCP: 79 { 80 char newpacket[65536]; /* Estimate of maximum packet size :) */ 81 int copyat = i; /* Same */ 82 int iCopy = 0; /* How much data have we written to copy-back string? */ 83 unsigned long org_addr; /* Original IP address */ 84 unsigned short org_port; /* Original source port address */ 85 lCTCP_START: 86 if( i >= dlen || iCopy >= sizeof(newpacket) ) 87 goto lPACKET_DONE; 88 newpacket[iCopy++] = sptr[i++]; /* Copy the CTCP start character */ 89 /* Start of a CTCP */ 90 if( i+4 >= dlen ) /* Too short for DCC */ 91 goto lBAD_CTCP; 92 if( sptr[i+0] != 'D' ) 93 goto lBAD_CTCP; 94 if( sptr[i+1] != 'C' ) 95 goto lBAD_CTCP; 96 if( sptr[i+2] != 'C' ) 97 goto lBAD_CTCP; 98 if( sptr[i+3] != ' ' ) 99 goto lBAD_CTCP; 100 /* We have a DCC command - handle it! */ 101 i+= 4; /* Skip "DCC " */ 102 if( iCopy+4 > sizeof(newpacket) ) 103 goto lPACKET_DONE; 104 newpacket[iCopy++] = 'D'; 105 newpacket[iCopy++] = 'C'; 106 newpacket[iCopy++] = 'C'; 107 newpacket[iCopy++] = ' '; 108 109 DBprintf(("Found DCC\n")); 110 /* Skip any extra spaces (should not occur according to 111 protocol, but DCC breaks CTCP protocol anyway */ 112 while(sptr[i] == ' ') { 113 if( ++i >= dlen) { 114 DBprintf(("DCC packet terminated in just spaces\n")); 115 goto lPACKET_DONE; 116 } 117 } 118 119 DBprintf(("Transferring command...\n")); 120 while(sptr[i] != ' ') { 121 newpacket[iCopy++] = sptr[i]; 122 if( ++i >= dlen || iCopy >= sizeof(newpacket) ) { 123 DBprintf(("DCC packet terminated during command\n")); 124 goto lPACKET_DONE; 125 } 126 } 127 /* Copy _one_ space */ 128 if( i+1 < dlen && iCopy < sizeof(newpacket) ) 129 newpacket[iCopy++] = sptr[i++]; 130 131 DBprintf(("Done command - removing spaces\n")); 132 /* Skip any extra spaces (should not occur according to 133 protocol, but DCC breaks CTCP protocol anyway */ 134 while(sptr[i] == ' ') { 135 if( ++i >= dlen ) { 136 DBprintf(("DCC packet terminated in just spaces (post-command)\n")); 137 goto lPACKET_DONE; 138 } 139 } 140 141 DBprintf(("Transferring filename...\n")); 142 while(sptr[i] != ' ') { 143 newpacket[iCopy++] = sptr[i]; 144 if( ++i >= dlen || iCopy >= sizeof(newpacket) ) { 145 DBprintf(("DCC packet terminated during filename\n")); 146 goto lPACKET_DONE; 147 } 148 } 149 /* Copy _one_ space */ 150 if( i+1 < dlen && iCopy < sizeof(newpacket) ) 151 newpacket[iCopy++] = sptr[i++]; 152 153 DBprintf(("Done filename - removing spaces\n")); 154 /* Skip any extra spaces (should not occur according to 155 protocol, but DCC breaks CTCP protocol anyway */ 156 while(sptr[i] == ' ') { 157 if( ++i >= dlen ) { 158 DBprintf(("DCC packet terminated in just spaces (post-filename)\n")); 159 goto lPACKET_DONE; 160 } 161 } 162 163 DBprintf(("Fetching IP address\n")); 164 /* Fetch IP address */ 165 org_addr = 0; 166 while(i<dlen && isdigit(sptr[i])) { 167 if( org_addr > ULONG_MAX/10UL ) { /* Terminate on overflow */ 168 DBprintf(("DCC Address overflow (org_addr == 0x%08lx, next char %c\n", org_addr, sptr[i])); 169 goto lBAD_CTCP; 170 } 171 org_addr *= 10; 172 org_addr += sptr[i++]-'0'; 173 } 174 DBprintf(("Skipping space\n")); 175 if( i+1 >= dlen || sptr[i] != ' ' ) { 176 DBprintf(("Overflow (%d >= %d) or bad character (%02x) terminating IP address\n", i+1, dlen, sptr[i])); 177 goto lBAD_CTCP; 178 } 179 /* Skip any extra spaces (should not occur according to 180 protocol, but DCC breaks CTCP protocol anyway, so we might 181 as well play it safe */ 182 while(sptr[i] == ' ') { 183 if( ++i >= dlen ) { 184 DBprintf(("Packet failure - space overflow.\n")); 185 goto lPACKET_DONE; 186 } 187 } 188 DBprintf(("Fetching port number\n")); 189 /* Fetch source port */ 190 org_port = 0; 191 while(i<dlen && isdigit(sptr[i])) { 192 if( org_port > 6554 ) { /* Terminate on overflow (65536/10 rounded up*/ 193 DBprintf(("DCC: port number overflow\n")); 194 goto lBAD_CTCP; 195 } 196 org_port *= 10; 197 org_port += sptr[i++]-'0'; 198 } 199 /* Skip illegal addresses (or early termination) */ 200 if( i >= dlen || (sptr[i] != '\001' && sptr[i] != ' ') ) { 201 DBprintf(("Bad port termination\n")); 202 goto lBAD_CTCP; 203 } 204 DBprintf(("Got IP %lu and port %u\n", org_addr, (unsigned)org_port)); 205 206 /* We've got the address and port - now alias it */ 207 { 208 struct alias_link *dcc_link; 209 struct in_addr destaddr; 210 211 212 true_port = htons(org_port); 213 true_addr.s_addr = htonl(org_addr); 214 destaddr.s_addr = 0; 215 216 /* Steal the FTP_DATA_PORT - it doesn't really matter, and this 217 would probably allow it through at least _some_ 218 firewalls. */ 219 dcc_link = FindUdpTcpOut(true_addr, destaddr, 220 true_port, 0, 221 IPPROTO_TCP, 1); 222 DBprintf(("Got a DCC link\n")); 223 if ( dcc_link ) { 224 struct in_addr alias_address; /* Address from aliasing */ 225 u_short alias_port; /* Port given by aliasing */ 226 227 #ifndef NO_FW_PUNCH 228 /* Generate firewall hole as appropriate */ 229 PunchFWHole(dcc_link); 230 #endif 231 232 alias_address = GetAliasAddress(link); 233 iCopy += snprintf(&newpacket[iCopy], 234 sizeof(newpacket)-iCopy, 235 "%lu ", (u_long)htonl(alias_address.s_addr)); 236 if( iCopy >= sizeof(newpacket) ) { /* Truncated/fit exactly - bad news */ 237 DBprintf(("DCC constructed packet overflow.\n")); 238 goto lBAD_CTCP; 239 } 240 alias_port = GetAliasPort(dcc_link); 241 iCopy += snprintf(&newpacket[iCopy], 242 sizeof(newpacket)-iCopy, 243 "%u", htons(alias_port) ); 244 /* Done - truncated cases will be taken care of by lBAD_CTCP */ 245 DBprintf(("Aliased IP %lu and port %u\n", alias_address.s_addr, (unsigned)alias_port)); 246 } 247 } 248 /* An uninteresting CTCP - state entered right after '\001' has 249 been pushed. Also used to copy the rest of a DCC, after IP 250 address and port has been handled */ 251 lBAD_CTCP: 252 for(; i<dlen && iCopy<sizeof(newpacket); i++,iCopy++) { 253 newpacket[iCopy] = sptr[i]; /* Copy CTCP unchanged */ 254 if(sptr[i] == '\001') { 255 goto lNORMAL_TEXT; 256 } 257 } 258 goto lPACKET_DONE; 259 /* Normal text */ 260 lNORMAL_TEXT: 261 for(; i<dlen && iCopy<sizeof(newpacket); i++,iCopy++) { 262 newpacket[iCopy] = sptr[i]; /* Copy CTCP unchanged */ 263 if(sptr[i] == '\001') { 264 goto lCTCP_START; 265 } 266 } 267 /* Handle the end of a packet */ 268 lPACKET_DONE: 269 iCopy = iCopy > maxsize-copyat ? maxsize-copyat : iCopy; 270 memcpy(sptr+copyat, newpacket, iCopy); 271 272 /* Save information regarding modified seq and ack numbers */ 273 { 274 int delta; 275 276 SetAckModified(link); 277 delta = GetDeltaSeqOut(pip, link); 278 AddSeq(pip, link, delta+copyat+iCopy-dlen); 279 } 280 281 /* Revise IP header */ 282 { 283 u_short new_len; 284 285 new_len = htons(hlen + iCopy + copyat); 286 DifferentialChecksum(&pip->ip_sum, 287 &new_len, 288 &pip->ip_len, 289 1); 290 pip->ip_len = new_len; 291 } 292 293 /* Compute TCP checksum for revised packet */ 294 tc->th_sum = 0; 295 tc->th_sum = TcpChecksum(pip); 296 return; 297 } 298 } 299 300 /* Notes: 301 [Note 1] 302 The initial search will most often fail; it could be replaced with a 32-bit specific search. 303 Such a search would be done for 32-bit unsigned value V: 304 V ^= 0x01010101; (Search is for null bytes) 305 if( ((V-0x01010101)^V) & 0x80808080 ) { 306 (found a null bytes which was a 01 byte) 307 } 308 To assert that the processor is 32-bits, do 309 extern int ircdccar[32]; (32 bits) 310 extern int ircdccar[CHAR_BIT*sizeof(unsigned int)]; 311 which will generate a type-error on all but 32-bit machines. 312 313 [Note 2] This routine really ought to be replaced with one that 314 creates a transparent proxy on the aliasing host, to allow arbitary 315 changes in the TCP stream. This should not be too difficult given 316 this base; I (ee) will try to do this some time later. 317 */ 318