xref: /src/dist/pf/usr.sbin/ftp-proxy/npf.c

/*	$NetBSD: npf.c,v 1.2.32.1 2020/04/13 07:45:23 martin Exp $	*/

/*
 * Copyright (c) 2011, 2019 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/queue.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>

#include <arpa/inet.h>
#include <net/if.h>
#include <net/pfvar.h>
#include <net/bpf.h>

#define NPF_BPFCOP
#include <npf.h>

#include <stdlib.h>
#include <string.h>
#include <stddef.h>
#include <fcntl.h>
#include <errno.h>
#include <err.h>
#include <assert.h>

#include "filter.h"

static void	npf_init_filter(char *, char *, int);
static int	npf_add_filter(uint32_t, uint8_t, struct sockaddr *,
		    struct sockaddr *, uint16_t);
static int	npf_add_nat(uint32_t, struct sockaddr *, struct sockaddr *,
		    uint16_t, struct sockaddr *, uint16_t, uint16_t);
static int	npf_add_rdr(uint32_t, struct sockaddr *, struct sockaddr *,
		    uint16_t, struct sockaddr *, uint16_t);
static int	npf_server_lookup(struct sockaddr *, struct sockaddr *,
		    struct sockaddr *);
static int	npf_prepare_commit(uint32_t);
static int	npf_do_commit(void);
static int	npf_do_rollback(void);

const ftp_proxy_ops_t npf_fprx_ops = {
	.init_filter	= npf_init_filter,
	.add_filter	= npf_add_filter,
	.add_nat	= npf_add_nat,
	.add_rdr	= npf_add_rdr,
	.server_lookup	= npf_server_lookup,
	.prepare_commit	= npf_prepare_commit,
	.do_commit	= npf_do_commit,
	.do_rollback	= npf_do_rollback
};

#define	sa_to_32(sa)		(((struct sockaddr_in *)sa)->sin_addr.s_addr)

#define	NPF_DEV_PATH		"/dev/npf"

typedef struct fp_ent {
	LIST_ENTRY(fp_ent)	fpe_list;
	uint32_t		fpe_id;
	nl_rule_t *		fpe_rl;
	nl_rule_t *		fpe_nat;
	nl_rule_t *		fpe_rdr;
} fp_ent_t;

char *				npfopts;

static LIST_HEAD(, fp_ent)	fp_ent_list;
static struct sockaddr_in	fp_server_sa;
static char *			fp_ifname;
static int			npf_fd;

#define	NPF_BPF_SUCCESS		((u_int)-1)
#define	NPF_BPF_FAILURE		0

#define INSN_IPSRC	5
#define INSN_IPDST	7
#define INSN_DPORT	10

static struct bpf_insn insns[13] = {
	/* Want IPv4. */
	BPF_STMT(BPF_LD+BPF_MEM, BPF_MW_IPVER),
	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 4, 0, 10),
	/* Want TCP. */
	BPF_STMT(BPF_LD+BPF_MEM, BPF_MW_L4PROTO),
	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8),
	/* Check source IP. */
	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct ip, ip_src)),
	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0xDEADBEEF, 0, 6),
	/* Check destination IP. */
	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct ip, ip_dst)),
	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0xDEADBEEF, 0, 4),
	/* Check port. */
	BPF_STMT(BPF_LDX+BPF_MEM, BPF_MW_L4OFF),
	BPF_STMT(BPF_LD+BPF_H+BPF_IND, offsetof(struct tcphdr, th_dport)),
	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0xDEADBEEF, 0, 1),
	/* Success. */
	BPF_STMT(BPF_RET+BPF_K, NPF_BPF_SUCCESS),
	/* Failure. */
	BPF_STMT(BPF_RET+BPF_K, NPF_BPF_FAILURE),
};

static void
modify_bytecode(in_addr_t shost, in_addr_t dhost, in_port_t dport)
{
	/*
	 * Replace the 0xDEADBEEF by actual values. Note that BPF is in
	 * host order.
	 */

	/* Source address to match. */
	insns[INSN_IPSRC].k = shost;
	/* Destination address to match. */
	insns[INSN_IPDST].k = dhost;
	/* Destination port to match. */
	insns[INSN_DPORT].k = dport;
}

static fp_ent_t *
proxy_lookup(uint32_t id)
{
	fp_ent_t *fpe;

	LIST_FOREACH(fpe, &fp_ent_list, fpe_list) {
		if (fpe->fpe_id == id)
			break;
	}

	return fpe;
}

static void
npf_init_filter(char *opt_qname, char *opt_tagname, int opt_verbose)
{
	char *netif = npfopts, *saddr, *port;
	int kernver, idx;

	/* XXX get rid of this */
	if ((saddr = strchr(netif, ':')) == NULL) {
		errx(EXIT_FAILURE, "invalid -N option string: %s", npfopts);
	}
	*saddr++ = '\0';
	if ((port = strchr(saddr, ':')) == NULL) {
		errx(EXIT_FAILURE, "invalid -N option string: %s", npfopts);
	}
	*port++ = '\0';

	fp_ifname = netif;
	idx = if_nametoindex(fp_ifname);
	if (idx == 0) {
		errx(EXIT_FAILURE, "invalid network interface '%s'", fp_ifname);
	}

	memset(&fp_server_sa, 0, sizeof(struct sockaddr_in));
	fp_server_sa.sin_len = sizeof(struct sockaddr_in);
	fp_server_sa.sin_family = AF_INET;
	fp_server_sa.sin_addr.s_addr = inet_addr(saddr);
	fp_server_sa.sin_port = htons(atoi(port));

	npf_fd = open(NPF_DEV_PATH, O_RDONLY);
	if (npf_fd == -1) {
		err(EXIT_FAILURE, "cannot open '%s'", NPF_DEV_PATH);
	}
	if (ioctl(npf_fd, IOC_NPF_VERSION, &kernver) == -1) {
		err(EXIT_FAILURE, "ioctl failed on IOC_NPF_VERSION");
	}
	if (kernver != NPF_VERSION) {
		errx(EXIT_FAILURE,
		    "incompatible NPF interface version (%d, kernel %d)\n"
		    "Hint: update %s?", NPF_VERSION, kernver,
		    kernver > NPF_VERSION ? "userland" : "kernel");
	}

	LIST_INIT(&fp_ent_list);
}

static int
npf_prepare_commit(uint32_t id)
{
	fp_ent_t *fpe;

	/* Check if already exists. */
	fpe = proxy_lookup(id);
	if (fpe) {
		/* Destroy existing rules and reset the values. */
		npf_rule_destroy(fpe->fpe_rl);
		npf_rule_destroy(fpe->fpe_nat);
		npf_rule_destroy(fpe->fpe_rdr);
		goto reset;
	}

	/* Create a new one, if not found. */
	fpe = malloc(sizeof(fp_ent_t));
	if (fpe == NULL)
		return -1;
	LIST_INSERT_HEAD(&fp_ent_list, fpe, fpe_list);
	fpe->fpe_id = id;

reset:
	fpe->fpe_rl = NULL;
	fpe->fpe_nat = NULL;
	fpe->fpe_rdr = NULL;
	return 0;
}

static int
npf_add_filter(uint32_t id, uint8_t pf_dir, struct sockaddr *src,
    struct sockaddr *dst, uint16_t dport)
{
	fp_ent_t *fpe;
	nl_rule_t *rl;
	int di;

	if (!src || !dst || !dport) {
		errno = EINVAL;
		return -1;
	}
	fpe = proxy_lookup(id);
	assert(fpe != NULL);

	di = (pf_dir == PF_OUT) ? NPF_RULE_OUT : NPF_RULE_IN;
	rl = npf_rule_create(NULL, di | NPF_RULE_PASS | NPF_RULE_FINAL, NULL);
	if (rl == NULL) {
		errno = ENOMEM;
		return -1;
	}

	modify_bytecode(sa_to_32(src), sa_to_32(dst), dport);
	errno = npf_rule_setcode(rl, NPF_CODE_BPF, insns, sizeof(insns));
	if (errno) {
		npf_rule_destroy(rl);
		return -1;
	}

	assert(fpe->fpe_rl == NULL);
	fpe->fpe_rl = rl;
	return 0;
}

/*
 * Note: we don't use plow and phigh. In NPF they are not per-rule, but global,
 * under the "portmap.min_port" and "portmap.max_port" params.
 */
static int
npf_add_nat(uint32_t id, struct sockaddr *src, struct sockaddr *dst,
    uint16_t dport, struct sockaddr *snat, uint16_t plow, uint16_t phigh)
{
	npf_addr_t addr;
	fp_ent_t *fpe;
	nl_nat_t *nt;

	if (!src || !dst || !dport || !snat || !plow ||
	    (src->sa_family != snat->sa_family)) {
		errno = EINVAL;
		return -1;
	}
	fpe = proxy_lookup(id);
	assert(fpe != NULL);

	memset(&addr, 0, sizeof(npf_addr_t));
	memcpy(&addr, &sa_to_32(snat), sizeof(struct in_addr));

	nt = npf_nat_create(NPF_NATOUT, NPF_NAT_PORTS | NPF_NAT_PORTMAP, NULL);
	if (nt == NULL) {
		errno = ENOMEM;
		return -1;
	}
	errno = npf_nat_setaddr(nt, AF_INET, &addr, 0);
	if (errno) {
		goto err;
	}

	modify_bytecode(sa_to_32(src), sa_to_32(dst), dport);
	errno = npf_rule_setcode(nt, NPF_CODE_BPF, insns, sizeof(insns));
	if (errno) {
		goto err;
	}

	assert(fpe->fpe_nat == NULL);
	fpe->fpe_nat = nt;
	return 0;

err:
	npf_rule_destroy(nt);
	return -1;
}

static int
npf_add_rdr(uint32_t id, struct sockaddr *src, struct sockaddr *dst,
    uint16_t dport, struct sockaddr *rdr, uint16_t rdr_port)
{
	npf_addr_t addr;
	fp_ent_t *fpe;
	nl_nat_t *nt;

	if (!src || !dst || !dport || !rdr || !rdr_port ||
	    (src->sa_family != rdr->sa_family)) {
		errno = EINVAL;
		return -1;
	}
	fpe = proxy_lookup(id);
	assert(fpe != NULL);

	memset(&addr, 0, sizeof(npf_addr_t));
	memcpy(&addr, &sa_to_32(rdr), sizeof(struct in_addr));

	nt = npf_nat_create(NPF_NATIN, NPF_NAT_PORTS, NULL);
	if (nt == NULL) {
		errno = ENOMEM;
		return -1;
	}
	errno = npf_nat_setaddr(nt, AF_INET, &addr, 0);
	if (errno) {
		goto err;
	}
	errno = npf_nat_setport(nt, htons(rdr_port));
	if (errno) {
		goto err;
	}

	modify_bytecode(sa_to_32(src), sa_to_32(dst), dport);
	errno = npf_rule_setcode(nt, NPF_CODE_BPF, insns, sizeof(insns));
	if (errno) {
		goto err;
	}

	assert(fpe->fpe_rdr == NULL);
	fpe->fpe_rdr = nt;
	return 0;

err:
	npf_rule_destroy(nt);
	return -1;
}

static int
npf_server_lookup(struct sockaddr *client, struct sockaddr *proxy,
    struct sockaddr *server)
{

	memcpy(server, &fp_server_sa, sizeof(struct sockaddr_in));
	return 0;
}

static int
npf_do_commit(void)
{
	nl_config_t *ncf;
	nl_rule_t *group;
	fp_ent_t *fpe;
	pri_t pri;

	ncf = npf_config_create();
	if (ncf == NULL) {
		errno = ENOMEM;
		return -1;
	}

	group = npf_rule_create(NULL, NPF_RULE_GROUP | NPF_RULE_PASS |
	    NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_FINAL, fp_ifname);
	if (group == NULL) {
		errno = ENOMEM;
		goto err;
	}

	pri = 1;
	LIST_FOREACH(fpe, &fp_ent_list, fpe_list) {
		if (fpe->fpe_rl == NULL) {
			/* Empty. */
			continue;
		}
		npf_rule_setprio(fpe->fpe_rl, pri++);
		npf_rule_insert(NULL, group, fpe->fpe_rl);
		/*
		 * XXX: Mmh, aren't we supposed to insert fpe_nat and fpe_rdr
		 * too here?
		 */
	}
	npf_rule_insert(ncf, NULL, group);

	errno = npf_config_submit(ncf, npf_fd, NULL);
	if (errno != 0)
		goto err;

	npf_config_destroy(ncf);
	return 0;

err:
	if (ncf != NULL)
		npf_config_destroy(ncf);
	return -1;
}

static int
npf_do_rollback(void)
{
	/* None. */
	return 0;
}