1 2 /* 3 * Copyright (C) 2012 by Darren Reed. 4 * 5 * See the IPFILTER.LICENCE file for details on licencing. 6 * 7 * $Id$ 8 * 9 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT 10 * code. 11 */ 12 13 #define IPF_RCMD_PROXY 14 15 typedef struct rcmdinfo { 16 u_32_t rcmd_port; /* Port number seen */ 17 u_32_t rcmd_portseq; /* Sequence number where port is first seen */ 18 ipnat_t *rcmd_rule; /* Template rule for back connection */ 19 } rcmdinfo_t; 20 21 void ipf_p_rcmd_main_load(void); 22 void ipf_p_rcmd_main_unload(void); 23 24 int ipf_p_rcmd_init(void); 25 void ipf_p_rcmd_fini(void); 26 void ipf_p_rcmd_del(ipf_main_softc_t *, ap_session_t *); 27 int ipf_p_rcmd_new(void *, fr_info_t *, ap_session_t *, nat_t *); 28 int ipf_p_rcmd_out(void *, fr_info_t *, ap_session_t *, nat_t *); 29 int ipf_p_rcmd_in(void *, fr_info_t *, ap_session_t *, nat_t *); 30 u_short ipf_rcmd_atoi(char *); 31 int ipf_p_rcmd_portmsg(fr_info_t *, ap_session_t *, nat_t *); 32 33 static frentry_t rcmdfr; 34 35 static int rcmd_proxy_init = 0; 36 37 38 /* 39 * RCMD application proxy initialization. 40 */ 41 void 42 ipf_p_rcmd_main_load(void) 43 { 44 bzero((char *)&rcmdfr, sizeof(rcmdfr)); 45 rcmdfr.fr_ref = 1; 46 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 47 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock"); 48 rcmd_proxy_init = 1; 49 } 50 51 52 void 53 ipf_p_rcmd_main_unload(void) 54 { 55 if (rcmd_proxy_init == 1) { 56 MUTEX_DESTROY(&rcmdfr.fr_lock); 57 rcmd_proxy_init = 0; 58 } 59 } 60 61 62 /* 63 * Setup for a new RCMD proxy. 64 */ 65 int 66 ipf_p_rcmd_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 67 { 68 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp; 69 rcmdinfo_t *rc; 70 ipnat_t *ipn; 71 ipnat_t *np; 72 int size; 73 74 fin = fin; /* LINT */ 75 76 np = nat->nat_ptr; 77 size = np->in_size; 78 KMALLOC(rc, rcmdinfo_t *); 79 if (rc == NULL) { 80 #ifdef IP_RCMD_PROXY_DEBUG 81 printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc)); 82 #endif 83 return (-1); 84 } 85 aps->aps_sport = tcp->th_sport; 86 aps->aps_dport = tcp->th_dport; 87 88 ipn = ipf_proxy_rule_rev(nat); 89 if (ipn == NULL) { 90 KFREE(rc); 91 return (-1); 92 } 93 94 aps->aps_data = rc; 95 aps->aps_psiz = sizeof(*rc); 96 bzero((char *)rc, sizeof(*rc)); 97 98 rc->rcmd_rule = ipn; 99 100 return (0); 101 } 102 103 104 void 105 ipf_p_rcmd_del(ipf_main_softc_t *softc, ap_session_t *aps) 106 { 107 rcmdinfo_t *rci; 108 109 rci = aps->aps_data; 110 if (rci != NULL) { 111 rci->rcmd_rule->in_flags |= IPN_DELETE; 112 ipf_nat_rule_deref(softc, &rci->rcmd_rule); 113 } 114 } 115 116 117 /* 118 * ipf_rcmd_atoi - implement a simple version of atoi 119 */ 120 u_short 121 ipf_rcmd_atoi(char *ptr) 122 { 123 register char *s = ptr, c; 124 register u_short i = 0; 125 126 while (((c = *s++) != '\0') && ISDIGIT(c)) { 127 i *= 10; 128 i += c - '0'; 129 } 130 return (i); 131 } 132 133 134 int 135 ipf_p_rcmd_portmsg(fr_info_t *fin, ap_session_t *aps, nat_t *nat) 136 { 137 tcphdr_t *tcp, tcph, *tcp2 = &tcph; 138 int off, dlen, nflags, direction; 139 ipf_main_softc_t *softc; 140 ipf_nat_softc_t *softn; 141 char portbuf[8], *s; 142 rcmdinfo_t *rc; 143 fr_info_t fi; 144 u_short sp; 145 nat_t *nat2; 146 #ifdef USE_INET6 147 ip6_t *ip6; 148 #endif 149 int tcpsz; 150 int slen = 0; /* silence gcc */ 151 ip_t *ip; 152 mb_t *m; 153 154 tcp = (tcphdr_t *)fin->fin_dp; 155 156 m = fin->fin_m; 157 ip = fin->fin_ip; 158 tcpsz = TCP_OFF(tcp) << 2; 159 #ifdef USE_INET6 160 ip6 = (ip6_t *)fin->fin_ip; 161 #endif 162 softc = fin->fin_main_soft; 163 softn = softc->ipf_nat_soft; 164 off = (char *)tcp - (char *)ip + tcpsz + fin->fin_ipoff; 165 166 dlen = fin->fin_dlen - tcpsz; 167 if (dlen <= 0) 168 return (0); 169 170 rc = (rcmdinfo_t *)aps->aps_data; 171 if ((rc->rcmd_portseq != 0) && 172 (tcp->th_seq != rc->rcmd_portseq)) 173 return (0); 174 175 bzero(portbuf, sizeof(portbuf)); 176 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf); 177 178 portbuf[sizeof(portbuf) - 1] = '\0'; 179 s = portbuf; 180 sp = ipf_rcmd_atoi(s); 181 if (sp == 0) { 182 #ifdef IP_RCMD_PROXY_DEBUG 183 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n", 184 dlen, portbuf); 185 #endif 186 return (0); 187 } 188 189 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) { 190 #ifdef IP_RCMD_PROXY_DEBUG 191 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n", 192 sp, rc->rcmd_port); 193 #endif 194 return (0); 195 } 196 197 rc->rcmd_port = sp; 198 rc->rcmd_portseq = tcp->th_seq; 199 200 /* 201 * Initialise the packet info structure so we can search the NAT 202 * table to see if there already is soemthing present that matches 203 * up with what we want to add. 204 */ 205 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 206 fi.fin_flx |= FI_IGNORE; 207 fi.fin_data[0] = 0; 208 fi.fin_data[1] = sp; 209 fi.fin_src6 = nat->nat_ndst6; 210 fi.fin_dst6 = nat->nat_nsrc6; 211 212 if (nat->nat_v[0] == 6) { 213 #ifdef USE_INET6 214 if (nat->nat_dir == NAT_OUTBOUND) { 215 nat2 = ipf_nat6_outlookup(&fi, NAT_SEARCH|IPN_TCP, 216 nat->nat_pr[1], 217 &nat->nat_osrc6.in6, 218 &nat->nat_odst6.in6); 219 } else { 220 nat2 = ipf_nat6_inlookup(&fi, NAT_SEARCH|IPN_TCP, 221 nat->nat_pr[0], 222 &nat->nat_osrc6.in6, 223 &nat->nat_odst6.in6); 224 } 225 #else 226 nat2 = (void *)-1; 227 #endif 228 } else { 229 if (nat->nat_dir == NAT_OUTBOUND) { 230 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, 231 nat->nat_pr[1], 232 nat->nat_osrcip, 233 nat->nat_odstip); 234 } else { 235 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, 236 nat->nat_pr[0], 237 nat->nat_osrcip, 238 nat->nat_odstip); 239 } 240 } 241 if (nat2 != NULL) 242 return (APR_ERR(1)); 243 244 /* 245 * Add skeleton NAT entry for connection which will come 246 * back the other way. 247 */ 248 249 if (nat->nat_v[0] == 6) { 250 #ifdef USE_INET6 251 slen = ip6->ip6_plen; 252 ip6->ip6_plen = htons(sizeof(*tcp)); 253 #endif 254 } else { 255 slen = ip->ip_len; 256 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp)); 257 } 258 259 /* 260 * Fill out the fake TCP header with a few fields that ipfilter 261 * considers to be important. 262 */ 263 bzero((char *)tcp2, sizeof(*tcp2)); 264 tcp2->th_win = htons(8192); 265 TCP_OFF_A(tcp2, 5); 266 tcp2->th_flags = TH_SYN; 267 268 fi.fin_dp = (char *)tcp2; 269 fi.fin_fr = &rcmdfr; 270 fi.fin_dlen = sizeof(*tcp2); 271 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 272 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 273 274 if (nat->nat_dir == NAT_OUTBOUND) { 275 fi.fin_out = 0; 276 direction = NAT_INBOUND; 277 } else { 278 fi.fin_out = 1; 279 direction = NAT_OUTBOUND; 280 } 281 nflags = SI_W_SPORT|NAT_SLAVE|IPN_TCP; 282 283 MUTEX_ENTER(&softn->ipf_nat_new); 284 if (fin->fin_v == 4) 285 nat2 = ipf_nat_add(&fi, rc->rcmd_rule, NULL, nflags, 286 direction); 287 #ifdef USE_INET6 288 else 289 nat2 = ipf_nat6_add(&fi, rc->rcmd_rule, NULL, nflags, 290 direction); 291 #endif 292 MUTEX_EXIT(&softn->ipf_nat_new); 293 294 if (nat2 != NULL) { 295 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 296 MUTEX_ENTER(&nat2->nat_lock); 297 ipf_nat_update(&fi, nat2); 298 MUTEX_EXIT(&nat2->nat_lock); 299 fi.fin_ifp = NULL; 300 if (nat2->nat_dir == NAT_INBOUND) 301 fi.fin_dst6 = nat->nat_osrc6; 302 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT); 303 } 304 if (nat->nat_v[0] == 6) { 305 #ifdef USE_INET6 306 ip6->ip6_plen = slen; 307 #endif 308 } else { 309 ip->ip_len = slen; 310 } 311 if (nat2 == NULL) 312 return (APR_ERR(1)); 313 return (0); 314 } 315 316 317 int 318 ipf_p_rcmd_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 319 { 320 if (nat->nat_dir == NAT_OUTBOUND) 321 return (ipf_p_rcmd_portmsg(fin, aps, nat)); 322 return (0); 323 } 324 325 326 int 327 ipf_p_rcmd_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 328 { 329 if (nat->nat_dir == NAT_INBOUND) 330 return (ipf_p_rcmd_portmsg(fin, aps, nat)); 331 return (0); 332 } 333