1 /* 2 * Copyright (C) 1997-2001 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * $Id: ip_proxy.h,v 2.31.2.3 2005/06/18 02:41:33 darrenr Exp $ 7 * 8 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 9 * Use is subject to license terms. 10 */ 11 12 #ifndef __IP_PROXY_H__ 13 #define __IP_PROXY_H__ 14 15 #ifdef SOLARIS 16 #undef SOLARIS 17 #endif 18 #if (defined(sun) && (defined(__svr4__) || defined(__SVR4))) 19 #define SOLARIS (1) 20 #else 21 #define SOLARIS (0) 22 #endif 23 24 #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51) 25 #define SIOCPROXY _IOWR('r', 64, struct ap_control) 26 #else 27 #define SIOCPROXY _IOWR(r, 64, struct ap_control) 28 #endif 29 30 #ifndef APR_LABELLEN 31 #define APR_LABELLEN 16 32 #endif 33 #define AP_SESS_SIZE 53 34 35 struct nat; 36 struct ipnat; 37 struct ipstate; 38 39 typedef struct ap_tcp { 40 u_short apt_sport; /* source port */ 41 u_short apt_dport; /* destination port */ 42 short apt_sel[2]; /* {seq,ack}{off,min} set selector */ 43 short apt_seqoff[2]; /* sequence # difference */ 44 u_32_t apt_seqmin[2]; /* don't change seq-off until after this */ 45 short apt_ackoff[2]; /* sequence # difference */ 46 u_32_t apt_ackmin[2]; /* don't change seq-off until after this */ 47 u_char apt_state[2]; /* connection state */ 48 } ap_tcp_t; 49 50 typedef struct ap_udp { 51 u_short apu_sport; /* source port */ 52 u_short apu_dport; /* destination port */ 53 } ap_udp_t; 54 55 typedef struct ap_session { 56 struct aproxy *aps_apr; 57 union { 58 struct ap_tcp apu_tcp; 59 struct ap_udp apu_udp; 60 } aps_un; 61 u_int aps_flags; 62 U_QUAD_T aps_bytes; /* bytes sent */ 63 U_QUAD_T aps_pkts; /* packets sent */ 64 void *aps_nat; /* pointer back to nat struct */ 65 void *aps_data; /* private data */ 66 int aps_p; /* protocol */ 67 int aps_psiz; /* size of private data */ 68 struct ap_session *aps_hnext; 69 struct ap_session *aps_next; 70 } ap_session_t; 71 72 #define aps_sport aps_un.apu_tcp.apt_sport 73 #define aps_dport aps_un.apu_tcp.apt_dport 74 #define aps_sel aps_un.apu_tcp.apt_sel 75 #define aps_seqoff aps_un.apu_tcp.apt_seqoff 76 #define aps_seqmin aps_un.apu_tcp.apt_seqmin 77 #define aps_state aps_un.apu_tcp.apt_state 78 #define aps_ackoff aps_un.apu_tcp.apt_ackoff 79 #define aps_ackmin aps_un.apu_tcp.apt_ackmin 80 81 82 typedef struct ap_control { 83 char apc_label[APR_LABELLEN]; 84 u_char apc_p; 85 /* 86 * The following fields are upto the proxy's apr_ctl routine to deal 87 * with. When the proxy gets this in kernel space, apc_data will 88 * point to a malloc'd region of memory of apc_dsize bytes. If the 89 * proxy wants to keep that memory, it must set apc_data to NULL 90 * before it returns. It is expected if this happens that it will 91 * take care to free it in apr_fini or otherwise as appropriate. 92 * apc_cmd is provided as a standard place to put simple commands, 93 * with apc_arg being available to put a simple arg. 94 */ 95 u_long apc_cmd; 96 u_long apc_arg; 97 void *apc_data; 98 size_t apc_dsize; 99 } ap_ctl_t; 100 101 102 typedef struct aproxy { 103 struct aproxy *apr_next; 104 char apr_label[APR_LABELLEN]; /* Proxy label # */ 105 u_char apr_p; /* protocol */ 106 int apr_ref; /* +1 per rule referencing it */ 107 int apr_flags; 108 void *apr_private; /* proxy private data */ 109 int (* apr_init) __P((void **, ipf_stack_t *)); 110 void (* apr_fini) __P((void **, ipf_stack_t *)); 111 int (* apr_new) __P((fr_info_t *, ap_session_t *, struct nat *, void *)); 112 void (* apr_del) __P((ap_session_t *, void *, ipf_stack_t *)); 113 int (* apr_inpkt) __P((fr_info_t *, ap_session_t *, struct nat *, void *)); 114 int (* apr_outpkt) __P((fr_info_t *, ap_session_t *, struct nat *, void *)); 115 int (* apr_match) __P((fr_info_t *, ap_session_t *, struct nat *, void *)); 116 int (* apr_ctl) __P((struct aproxy *, struct ap_control *, void *)); 117 } aproxy_t; 118 119 #define APR_DELETE 1 120 121 #define APR_ERR(x) ((x) << 16) 122 #define APR_EXIT(x) (((x) >> 16) & 0xffff) 123 #define APR_INC(x) ((x) & 0xffff) 124 125 /* 126 * Generic #define's to cover missing things in the kernel 127 */ 128 #ifndef isdigit 129 #define isdigit(x) ((x) >= '0' && (x) <= '9') 130 #endif 131 #ifndef isupper 132 #define isupper(x) (((unsigned)(x) >= 'A') && ((unsigned)(x) <= 'Z')) 133 #endif 134 #ifndef islower 135 #define islower(x) (((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z')) 136 #endif 137 #ifndef isalpha 138 #define isalpha(x) (isupper(x) || islower(x)) 139 #endif 140 #ifndef toupper 141 #define toupper(x) (isupper(x) ? (x) : (x) - 'a' + 'A') 142 #endif 143 #ifndef isspace 144 #define isspace(x) (((x) == ' ') || ((x) == '\r') || ((x) == '\n') || \ 145 ((x) == '\t') || ((x) == '\b')) 146 #endif 147 148 /* 149 * This is the scratch buffer size used to hold strings from the TCP stream 150 * that we may want to parse. It's an arbitrary size, really, but it must 151 * be at least as large as IPF_FTPBUFSZ. 152 */ 153 #define FTP_BUFSZ 120 154 155 /* 156 * This buffer, however, doesn't need to be nearly so big. It just needs to 157 * be able to squeeze in the largest command it needs to rewrite, Which ones 158 * does it rewrite? EPRT, PORT, 227 replies. 159 */ 160 #define IPF_FTPBUFSZ 80 /* This *MUST* be >= 53! */ 161 162 typedef struct ftpside { 163 char *ftps_rptr; 164 char *ftps_wptr; 165 void *ftps_ifp; 166 u_32_t ftps_seq[2]; 167 u_32_t ftps_len; 168 int ftps_junk; /* 2 = no cr/lf yet, 1 = cannot parse */ 169 int ftps_cmds; 170 char ftps_buf[FTP_BUFSZ]; 171 } ftpside_t; 172 173 typedef struct ftpinfo { 174 int ftp_passok; 175 int ftp_incok; 176 ftpside_t ftp_side[2]; 177 } ftpinfo_t; 178 179 180 /* 181 * For the irc proxy. 182 */ 183 typedef struct ircinfo { 184 size_t irc_len; 185 char *irc_snick; 186 char *irc_dnick; 187 char *irc_type; 188 char *irc_arg; 189 char *irc_addr; 190 u_32_t irc_ipnum; 191 u_short irc_port; 192 } ircinfo_t; 193 194 195 /* 196 * Real audio proxy structure and #defines 197 */ 198 typedef struct raudio_s { 199 int rap_seenpna; 200 int rap_seenver; 201 int rap_version; 202 int rap_eos; /* End Of Startup */ 203 int rap_gotid; 204 int rap_gotlen; 205 int rap_mode; 206 int rap_sdone; 207 u_short rap_plport; 208 u_short rap_prport; 209 u_short rap_srport; 210 char rap_svr[19]; 211 u_32_t rap_sbf; /* flag to indicate which of the 19 bytes have 212 * been filled 213 */ 214 u_32_t rap_sseq; 215 } raudio_t; 216 217 #define RA_ID_END 0 218 #define RA_ID_UDP 1 219 #define RA_ID_ROBUST 7 220 221 #define RAP_M_UDP 1 222 #define RAP_M_ROBUST 2 223 #define RAP_M_TCP 4 224 #define RAP_M_UDP_ROBUST (RAP_M_UDP|RAP_M_ROBUST) 225 226 227 /* 228 * MSN RPC proxy 229 */ 230 typedef struct msnrpcinfo { 231 u_int mri_flags; 232 int mri_cmd[2]; 233 u_int mri_valid; 234 struct in_addr mri_raddr; 235 u_short mri_rport; 236 } msnrpcinfo_t; 237 238 239 /* 240 * IPSec proxy 241 */ 242 typedef u_32_t ipsec_cookie_t[2]; 243 244 typedef struct ipsec_pxy { 245 ipsec_cookie_t ipsc_icookie; 246 ipsec_cookie_t ipsc_rcookie; 247 int ipsc_rckset; 248 ipnat_t ipsc_rule; 249 nat_t *ipsc_nat; 250 struct ipstate *ipsc_state; 251 } ipsec_pxy_t; 252 253 /* 254 * PPTP proxy 255 */ 256 typedef struct pptp_side { 257 u_32_t pptps_nexthdr; 258 u_32_t pptps_next; 259 int pptps_state; 260 int pptps_gothdr; 261 int pptps_len; 262 int pptps_bytes; 263 char *pptps_wptr; 264 char pptps_buffer[512]; 265 } pptp_side_t; 266 267 typedef struct pptp_pxy { 268 ipnat_t pptp_rule; 269 nat_t *pptp_nat; 270 struct ipstate *pptp_state; 271 u_short pptp_call[2]; 272 pptp_side_t pptp_side[2]; 273 } pptp_pxy_t; 274 275 276 /* 277 * Sun RPCBIND proxy 278 */ 279 #define RPCB_MAXMSG 888 280 #define RPCB_RES_PMAP 0 /* Response contains a v2 port. */ 281 #define RPCB_RES_STRING 1 /* " " " v3 (GETADDR) string. */ 282 #define RPCB_RES_LIST 2 /* " " " v4 (GETADDRLIST) list. */ 283 #define RPCB_MAXREQS 32 /* Arbitrary limit on tracked transactions */ 284 285 #define RPCB_REQMIN 40 286 #define RPCB_REQMAX 888 287 #define RPCB_REPMIN 20 288 #define RPCB_REPMAX 604 /* XXX double check this! */ 289 290 /* 291 * These macros determine the number of bytes between p and the end of 292 * r->rs_buf relative to l. 293 */ 294 #define RPCB_BUF_END(r) (char *)((r)->rm_msgbuf + (r)->rm_buflen) 295 #define RPCB_BUF_GEQ(r, p, l) \ 296 ((RPCB_BUF_END((r)) > (char *)(p)) && \ 297 ((RPCB_BUF_END((r)) - (char *)(p)) >= (l))) 298 #define RPCB_BUF_EQ(r, p, l) \ 299 (RPCB_BUF_END((r)) == ((char *)(p) + (l))) 300 301 /* 302 * The following correspond to RPC(B) detailed in RFC183[13]. 303 */ 304 #define RPCB_CALL 0 305 #define RPCB_REPLY 1 306 #define RPCB_MSG_VERSION 2 307 #define RPCB_PROG 100000 308 #define RPCB_GETPORT 3 309 #define RPCB_GETADDR 3 310 #define RPCB_GETADDRLIST 11 311 #define RPCB_MSG_ACCEPTED 0 312 #define RPCB_MSG_DENIED 1 313 314 /* BEGIN (Generic XDR structures) */ 315 typedef struct xdr_string { 316 u_32_t *xs_len; 317 char *xs_str; 318 } xdr_string_t; 319 320 typedef struct xdr_auth { 321 /* u_32_t xa_flavor; */ 322 xdr_string_t xa_string; 323 } xdr_auth_t; 324 325 typedef struct xdr_uaddr { 326 u_32_t xu_ip; 327 u_short xu_port; 328 xdr_string_t xu_str; 329 } xdr_uaddr_t; 330 331 typedef struct xdr_proto { 332 u_int xp_proto; 333 xdr_string_t xp_str; 334 } xdr_proto_t; 335 336 #define xu_xslen xu_str.xs_len 337 #define xu_xsstr xu_str.xs_str 338 #define xp_xslen xp_str.xs_len 339 #define xp_xsstr xp_str.xs_str 340 /* END (Generic XDR structures) */ 341 342 /* BEGIN (RPC call structures) */ 343 typedef struct pmap_args { 344 /* u_32_t pa_prog; */ 345 /* u_32_t pa_vers; */ 346 u_32_t *pa_prot; 347 /* u_32_t pa_port; */ 348 } pmap_args_t; 349 350 typedef struct rpcb_args { 351 /* u_32_t *ra_prog; */ 352 /* u_32_t *ra_vers; */ 353 xdr_proto_t ra_netid; 354 xdr_uaddr_t ra_maddr; 355 /* xdr_string_t ra_owner; */ 356 } rpcb_args_t; 357 358 typedef struct rpc_call { 359 /* u_32_t rc_rpcvers; */ 360 /* u_32_t rc_prog; */ 361 u_32_t *rc_vers; 362 u_32_t *rc_proc; 363 xdr_auth_t rc_authcred; 364 xdr_auth_t rc_authverf; 365 union { 366 pmap_args_t ra_pmapargs; 367 rpcb_args_t ra_rpcbargs; 368 } rpcb_args; 369 } rpc_call_t; 370 371 #define rc_pmapargs rpcb_args.ra_pmapargs 372 #define rc_rpcbargs rpcb_args.ra_rpcbargs 373 /* END (RPC call structures) */ 374 375 /* BEGIN (RPC reply structures) */ 376 typedef struct rpcb_entry { 377 xdr_uaddr_t re_maddr; 378 xdr_proto_t re_netid; 379 /* u_32_t re_semantics; */ 380 xdr_string_t re_family; 381 xdr_proto_t re_proto; 382 u_32_t *re_more; /* 1 == another entry follows */ 383 } rpcb_entry_t; 384 385 typedef struct rpcb_listp { 386 u_32_t *rl_list; /* 1 == list follows */ 387 int rl_cnt; 388 rpcb_entry_t rl_entries[2]; /* TCP / UDP only */ 389 } rpcb_listp_t; 390 391 typedef struct rpc_resp { 392 /* u_32_t rr_acceptdeny; */ 393 /* Omitted 'message denied' fork; we don't care about rejects. */ 394 xdr_auth_t rr_authverf; 395 /* u_32_t *rr_astat; */ 396 union { 397 u_32_t *resp_pmap; 398 xdr_uaddr_t resp_getaddr; 399 rpcb_listp_t resp_getaddrlist; 400 } rpcb_reply; 401 } rpc_resp_t; 402 403 #define rr_v2 rpcb_reply.resp_pmap 404 #define rr_v3 rpcb_reply.resp_getaddr 405 #define rr_v4 rpcb_reply.resp_getaddrlist 406 /* END (RPC reply structures) */ 407 408 /* BEGIN (RPC message structure & macros) */ 409 typedef struct rpc_msg { 410 char rm_msgbuf[RPCB_MAXMSG]; /* RPCB data buffer */ 411 u_int rm_buflen; 412 u_32_t *rm_xid; 413 /* u_32_t Call vs Reply */ 414 union { 415 rpc_call_t rb_call; 416 rpc_resp_t rb_resp; 417 } rm_body; 418 } rpc_msg_t; 419 420 #define rm_call rm_body.rb_call 421 #define rm_resp rm_body.rb_resp 422 /* END (RPC message structure & macros) */ 423 424 /* 425 * These code paths aren't hot enough to warrant per transaction 426 * mutexes. 427 */ 428 typedef struct rpcb_xact { 429 struct rpcb_xact *rx_next; 430 struct rpcb_xact **rx_pnext; 431 u_32_t rx_xid; /* RPC transmission ID */ 432 u_int rx_type; /* RPCB response type */ 433 u_int rx_ref; /* reference count */ 434 u_int rx_proto; /* transport protocol (v2 only) */ 435 } rpcb_xact_t; 436 437 typedef struct rpcb_session { 438 ipfmutex_t rs_rxlock; 439 rpcb_xact_t *rs_rxlist; 440 } rpcb_session_t; 441 442 /* 443 * For an explanation, please see the following: 444 * RFC1832 - Sections 3.11, 4.4, and 4.5. 445 */ 446 #define XDRALIGN(x) ((((x) % 4) != 0) ? ((((x) + 3) / 4) * 4) : (x)) 447 448 extern int appr_add __P((aproxy_t *, ipf_stack_t *)); 449 extern int appr_ctl __P((ap_ctl_t *, ipf_stack_t *)); 450 extern int appr_del __P((aproxy_t *, ipf_stack_t *)); 451 extern int appr_init __P((ipf_stack_t *)); 452 extern void appr_unload __P((ipf_stack_t *)); 453 extern int appr_ok __P((fr_info_t *, tcphdr_t *, struct ipnat *)); 454 extern int appr_match __P((fr_info_t *, struct nat *)); 455 extern void appr_free __P((aproxy_t *)); 456 extern void aps_free __P((ap_session_t *, ipf_stack_t *)); 457 extern int appr_check __P((fr_info_t *, struct nat *)); 458 extern aproxy_t *appr_lookup __P((u_int, char *, ipf_stack_t *)); 459 extern int appr_new __P((fr_info_t *, struct nat *)); 460 extern int appr_ioctl __P((caddr_t, ioctlcmd_t, int, ipf_stack_t *)); 461 462 #endif /* __IP_PROXY_H__ */ 463