ip_dns_pxy.c revision 1.2.4.3
1 1.2.4.3 yamt /* $NetBSD: ip_dns_pxy.c,v 1.2.4.3 2012/10/30 17:22:19 yamt Exp $ */ 2 1.2.4.2 yamt 3 1.2.4.2 yamt /* 4 1.2.4.3 yamt * Copyright (C) 2012 by Darren Reed. 5 1.2.4.2 yamt * 6 1.2.4.2 yamt * See the IPFILTER.LICENCE file for details on licencing. 7 1.2.4.2 yamt * 8 1.2.4.3 yamt * Id: ip_dns_pxy.c,v 1.1.1.2 2012/07/22 13:45:10 darrenr Exp 9 1.2.4.2 yamt */ 10 1.2.4.2 yamt 11 1.2.4.2 yamt #define IPF_DNS_PROXY 12 1.2.4.2 yamt 13 1.2.4.2 yamt /* 14 1.2.4.2 yamt * map ... proxy port dns/udp 53 { block .cnn.com; } 15 1.2.4.2 yamt */ 16 1.2.4.2 yamt typedef struct ipf_dns_filter { 17 1.2.4.2 yamt struct ipf_dns_filter *idns_next; 18 1.2.4.2 yamt char *idns_name; 19 1.2.4.2 yamt int idns_namelen; 20 1.2.4.2 yamt int idns_pass; 21 1.2.4.2 yamt } ipf_dns_filter_t; 22 1.2.4.2 yamt 23 1.2.4.2 yamt 24 1.2.4.2 yamt typedef struct ipf_dns_softc_s { 25 1.2.4.2 yamt ipf_dns_filter_t *ipf_p_dns_list; 26 1.2.4.2 yamt ipfrwlock_t ipf_p_dns_rwlock; 27 1.2.4.2 yamt u_long ipf_p_dns_compress; 28 1.2.4.2 yamt u_long ipf_p_dns_toolong; 29 1.2.4.2 yamt u_long ipf_p_dns_nospace; 30 1.2.4.2 yamt } ipf_dns_softc_t; 31 1.2.4.2 yamt 32 1.2.4.2 yamt int ipf_p_dns_allow_query(ipf_dns_softc_t *, dnsinfo_t *); 33 1.2.4.2 yamt int ipf_p_dns_ctl(ipf_main_softc_t *, void *, ap_ctl_t *); 34 1.2.4.2 yamt int ipf_p_dns_del(ipf_main_softc_t *, ap_session_t *); 35 1.2.4.2 yamt int ipf_p_dns_get_name(ipf_dns_softc_t *, char *, int, char *, int); 36 1.2.4.2 yamt int ipf_p_dns_inout(void *, fr_info_t *, ap_session_t *, nat_t *); 37 1.2.4.2 yamt int ipf_p_dns_match(fr_info_t *, ap_session_t *, nat_t *); 38 1.2.4.2 yamt int ipf_p_dns_match_names(ipf_dns_filter_t *, char *, int); 39 1.2.4.2 yamt int ipf_p_dns_new(void *, fr_info_t *, ap_session_t *, nat_t *); 40 1.2.4.2 yamt void *ipf_p_dns_soft_create(ipf_main_softc_t *); 41 1.2.4.2 yamt void ipf_p_dns_soft_destroy(ipf_main_softc_t *, void *); 42 1.2.4.2 yamt 43 1.2.4.2 yamt typedef struct { 44 1.2.4.2 yamt u_char dns_id[2]; 45 1.2.4.2 yamt u_short dns_ctlword; 46 1.2.4.2 yamt u_short dns_qdcount; 47 1.2.4.2 yamt u_short dns_ancount; 48 1.2.4.2 yamt u_short dns_nscount; 49 1.2.4.2 yamt u_short dns_arcount; 50 1.2.4.2 yamt } ipf_dns_hdr_t; 51 1.2.4.2 yamt 52 1.2.4.2 yamt #define DNS_QR(x) ((ntohs(x) & 0x8000) >> 15) 53 1.2.4.2 yamt #define DNS_OPCODE(x) ((ntohs(x) & 0x7800) >> 11) 54 1.2.4.2 yamt #define DNS_AA(x) ((ntohs(x) & 0x0400) >> 10) 55 1.2.4.2 yamt #define DNS_TC(x) ((ntohs(x) & 0x0200) >> 9) 56 1.2.4.2 yamt #define DNS_RD(x) ((ntohs(x) & 0x0100) >> 8) 57 1.2.4.2 yamt #define DNS_RA(x) ((ntohs(x) & 0x0080) >> 7) 58 1.2.4.2 yamt #define DNS_Z(x) ((ntohs(x) & 0x0070) >> 4) 59 1.2.4.2 yamt #define DNS_RCODE(x) ((ntohs(x) & 0x000f) >> 0) 60 1.2.4.2 yamt 61 1.2.4.2 yamt 62 1.2.4.2 yamt void * 63 1.2.4.2 yamt ipf_p_dns_soft_create(ipf_main_softc_t *softc) 64 1.2.4.2 yamt { 65 1.2.4.2 yamt ipf_dns_softc_t *softd; 66 1.2.4.2 yamt 67 1.2.4.2 yamt KMALLOC(softd, ipf_dns_softc_t *); 68 1.2.4.2 yamt if (softd == NULL) 69 1.2.4.2 yamt return NULL; 70 1.2.4.2 yamt 71 1.2.4.2 yamt bzero((char *)softd, sizeof(*softd)); 72 1.2.4.2 yamt RWLOCK_INIT(&softd->ipf_p_dns_rwlock, "ipf dns rwlock"); 73 1.2.4.2 yamt 74 1.2.4.2 yamt return softd; 75 1.2.4.2 yamt } 76 1.2.4.2 yamt 77 1.2.4.2 yamt 78 1.2.4.2 yamt void 79 1.2.4.2 yamt ipf_p_dns_soft_destroy(ipf_main_softc_t *softc, void *arg) 80 1.2.4.2 yamt { 81 1.2.4.2 yamt ipf_dns_softc_t *softd = arg; 82 1.2.4.2 yamt ipf_dns_filter_t *idns; 83 1.2.4.2 yamt 84 1.2.4.2 yamt while ((idns = softd->ipf_p_dns_list) != NULL) { 85 1.2.4.2 yamt KFREES(idns->idns_name, idns->idns_namelen); 86 1.2.4.2 yamt idns->idns_name = NULL; 87 1.2.4.2 yamt idns->idns_namelen = 0; 88 1.2.4.2 yamt softd->ipf_p_dns_list = idns->idns_next; 89 1.2.4.2 yamt KFREE(idns); 90 1.2.4.2 yamt } 91 1.2.4.2 yamt RW_DESTROY(&softd->ipf_p_dns_rwlock); 92 1.2.4.2 yamt 93 1.2.4.2 yamt KFREE(softd); 94 1.2.4.2 yamt } 95 1.2.4.2 yamt 96 1.2.4.2 yamt 97 1.2.4.2 yamt int 98 1.2.4.2 yamt ipf_p_dns_ctl(ipf_main_softc_t *softc, void *arg, ap_ctl_t *ctl) 99 1.2.4.2 yamt { 100 1.2.4.2 yamt ipf_dns_softc_t *softd = arg; 101 1.2.4.2 yamt ipf_dns_filter_t *tmp, *idns, **idnsp; 102 1.2.4.2 yamt int error = 0; 103 1.2.4.2 yamt 104 1.2.4.2 yamt /* 105 1.2.4.2 yamt * To make locking easier. 106 1.2.4.2 yamt */ 107 1.2.4.2 yamt KMALLOC(tmp, ipf_dns_filter_t *); 108 1.2.4.2 yamt 109 1.2.4.2 yamt WRITE_ENTER(&softd->ipf_p_dns_rwlock); 110 1.2.4.2 yamt for (idnsp = &softd->ipf_p_dns_list; (idns = *idnsp) != NULL; 111 1.2.4.2 yamt idnsp = &idns->idns_next) { 112 1.2.4.2 yamt if (idns->idns_namelen != ctl->apc_dsize) 113 1.2.4.2 yamt continue; 114 1.2.4.2 yamt if (!strncmp(ctl->apc_data, idns->idns_name, 115 1.2.4.2 yamt idns->idns_namelen)) 116 1.2.4.2 yamt break; 117 1.2.4.2 yamt } 118 1.2.4.2 yamt 119 1.2.4.2 yamt switch (ctl->apc_cmd) 120 1.2.4.2 yamt { 121 1.2.4.2 yamt case APC_CMD_DEL : 122 1.2.4.2 yamt if (idns == NULL) { 123 1.2.4.2 yamt IPFERROR(80006); 124 1.2.4.2 yamt error = ESRCH; 125 1.2.4.2 yamt break; 126 1.2.4.2 yamt } 127 1.2.4.2 yamt *idnsp = idns->idns_next; 128 1.2.4.2 yamt idns->idns_next = NULL; 129 1.2.4.2 yamt KFREES(idns->idns_name, idns->idns_namelen); 130 1.2.4.2 yamt idns->idns_name = NULL; 131 1.2.4.2 yamt idns->idns_namelen = 0; 132 1.2.4.2 yamt KFREE(idns); 133 1.2.4.2 yamt break; 134 1.2.4.2 yamt case APC_CMD_ADD : 135 1.2.4.2 yamt if (idns != NULL) { 136 1.2.4.2 yamt IPFERROR(80007); 137 1.2.4.2 yamt error = EEXIST; 138 1.2.4.2 yamt break; 139 1.2.4.2 yamt } 140 1.2.4.2 yamt if (tmp == NULL) { 141 1.2.4.2 yamt IPFERROR(80008); 142 1.2.4.2 yamt error = ENOMEM; 143 1.2.4.2 yamt break; 144 1.2.4.2 yamt } 145 1.2.4.2 yamt idns = tmp; 146 1.2.4.2 yamt tmp = NULL; 147 1.2.4.2 yamt idns->idns_namelen = ctl->apc_dsize; 148 1.2.4.2 yamt idns->idns_name = ctl->apc_data; 149 1.2.4.2 yamt idns->idns_pass = ctl->apc_arg; 150 1.2.4.2 yamt idns->idns_next = NULL; 151 1.2.4.2 yamt *idnsp = idns; 152 1.2.4.2 yamt ctl->apc_data = NULL; 153 1.2.4.2 yamt ctl->apc_dsize = 0; 154 1.2.4.2 yamt break; 155 1.2.4.2 yamt default : 156 1.2.4.2 yamt IPFERROR(80009); 157 1.2.4.2 yamt error = EINVAL; 158 1.2.4.2 yamt break; 159 1.2.4.2 yamt } 160 1.2.4.2 yamt RWLOCK_EXIT(&softd->ipf_p_dns_rwlock); 161 1.2.4.2 yamt 162 1.2.4.2 yamt if (tmp != NULL) { 163 1.2.4.2 yamt KFREE(tmp); 164 1.2.4.2 yamt tmp = NULL; 165 1.2.4.2 yamt } 166 1.2.4.2 yamt 167 1.2.4.2 yamt return error; 168 1.2.4.2 yamt } 169 1.2.4.2 yamt 170 1.2.4.2 yamt 171 1.2.4.2 yamt /* ARGSUSED */ 172 1.2.4.2 yamt int 173 1.2.4.2 yamt ipf_p_dns_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 174 1.2.4.2 yamt { 175 1.2.4.2 yamt dnsinfo_t *di; 176 1.2.4.2 yamt int dlen; 177 1.2.4.2 yamt 178 1.2.4.3 yamt if (fin->fin_v != 4) 179 1.2.4.3 yamt return -1; 180 1.2.4.3 yamt 181 1.2.4.2 yamt dlen = fin->fin_dlen - sizeof(udphdr_t); 182 1.2.4.2 yamt if (dlen < sizeof(ipf_dns_hdr_t)) { 183 1.2.4.2 yamt /* 184 1.2.4.2 yamt * No real DNS packet is smaller than that. 185 1.2.4.2 yamt */ 186 1.2.4.2 yamt return -1; 187 1.2.4.2 yamt } 188 1.2.4.2 yamt 189 1.2.4.2 yamt aps->aps_psiz = sizeof(dnsinfo_t); 190 1.2.4.2 yamt KMALLOCS(di, dnsinfo_t *, sizeof(dnsinfo_t)); 191 1.2.4.2 yamt if (di == NULL) { 192 1.2.4.2 yamt printf("ipf_dns_new:KMALLOCS(%zu) failed\n", sizeof(*di)); 193 1.2.4.2 yamt return -1; 194 1.2.4.2 yamt } 195 1.2.4.2 yamt 196 1.2.4.2 yamt MUTEX_INIT(&di->dnsi_lock, "dns lock"); 197 1.2.4.2 yamt 198 1.2.4.2 yamt aps->aps_data = di; 199 1.2.4.2 yamt 200 1.2.4.2 yamt dlen = fin->fin_dlen - sizeof(udphdr_t); 201 1.2.4.2 yamt COPYDATA(fin->fin_m, fin->fin_hlen + sizeof(udphdr_t), 202 1.2.4.2 yamt MIN(dlen, sizeof(di->dnsi_buffer)), di->dnsi_buffer); 203 1.2.4.2 yamt di->dnsi_id = (di->dnsi_buffer[0] << 8) | di->dnsi_buffer[1]; 204 1.2.4.2 yamt return 0; 205 1.2.4.2 yamt } 206 1.2.4.2 yamt 207 1.2.4.2 yamt 208 1.2.4.2 yamt /* ARGSUSED */ 209 1.2.4.2 yamt int 210 1.2.4.2 yamt ipf_p_dns_del(ipf_main_softc_t *softc, ap_session_t *aps) 211 1.2.4.2 yamt { 212 1.2.4.2 yamt #ifdef USE_MUTEXES 213 1.2.4.2 yamt dnsinfo_t *di = aps->aps_data; 214 1.2.4.2 yamt 215 1.2.4.2 yamt MUTEX_DESTROY(&di->dnsi_lock); 216 1.2.4.2 yamt #endif 217 1.2.4.2 yamt KFREES(aps->aps_data, aps->aps_psiz); 218 1.2.4.2 yamt aps->aps_data = NULL; 219 1.2.4.2 yamt aps->aps_psiz = 0; 220 1.2.4.2 yamt return 0; 221 1.2.4.2 yamt } 222 1.2.4.2 yamt 223 1.2.4.2 yamt 224 1.2.4.2 yamt /* 225 1.2.4.2 yamt * Tries to match the base string (in our ACL) with the query from a packet. 226 1.2.4.2 yamt */ 227 1.2.4.2 yamt int 228 1.2.4.2 yamt ipf_p_dns_match_names(ipf_dns_filter_t *idns, char *query, int qlen) 229 1.2.4.2 yamt { 230 1.2.4.2 yamt int blen; 231 1.2.4.2 yamt char *base; 232 1.2.4.2 yamt 233 1.2.4.2 yamt blen = idns->idns_namelen; 234 1.2.4.2 yamt base = idns->idns_name; 235 1.2.4.2 yamt 236 1.2.4.2 yamt if (blen > qlen) 237 1.2.4.2 yamt return 1; 238 1.2.4.2 yamt 239 1.2.4.2 yamt if (blen == qlen) 240 1.2.4.2 yamt return strncasecmp(base, query, qlen); 241 1.2.4.2 yamt 242 1.2.4.2 yamt /* 243 1.2.4.2 yamt * If the base string string is shorter than the query, allow the 244 1.2.4.2 yamt * tail of the base to match the same length tail of the query *if*: 245 1.2.4.2 yamt * - the base string starts with a '*' (*cnn.com) 246 1.2.4.2 yamt * - the base string represents a domain (.cnn.com) 247 1.2.4.2 yamt * as otherwise it would not be possible to block just "cnn.com" 248 1.2.4.2 yamt * without also impacting "foocnn.com", etc. 249 1.2.4.2 yamt */ 250 1.2.4.2 yamt if (*base == '*') { 251 1.2.4.2 yamt base++; 252 1.2.4.2 yamt blen--; 253 1.2.4.2 yamt } else if (*base != '.') 254 1.2.4.2 yamt return 1; 255 1.2.4.2 yamt 256 1.2.4.2 yamt return strncasecmp(base, query + qlen - blen, blen); 257 1.2.4.2 yamt } 258 1.2.4.2 yamt 259 1.2.4.2 yamt 260 1.2.4.2 yamt int 261 1.2.4.2 yamt ipf_p_dns_get_name(ipf_dns_softc_t *softd, char *start, int len, char *buffer, 262 1.2.4.2 yamt int buflen) 263 1.2.4.2 yamt { 264 1.2.4.2 yamt char *s, *t, clen; 265 1.2.4.2 yamt int slen, blen; 266 1.2.4.2 yamt 267 1.2.4.2 yamt s = start; 268 1.2.4.2 yamt t = buffer; 269 1.2.4.2 yamt slen = len; 270 1.2.4.2 yamt blen = buflen - 1; /* Always make room for trailing \0 */ 271 1.2.4.2 yamt 272 1.2.4.2 yamt while (*s != '\0') { 273 1.2.4.2 yamt clen = *s; 274 1.2.4.2 yamt if ((clen & 0xc0) == 0xc0) { /* Doesn't do compression */ 275 1.2.4.2 yamt softd->ipf_p_dns_compress++; 276 1.2.4.2 yamt return 0; 277 1.2.4.2 yamt } 278 1.2.4.2 yamt if (clen > slen) { 279 1.2.4.2 yamt softd->ipf_p_dns_toolong++; 280 1.2.4.2 yamt return 0; /* Does the name run off the end? */ 281 1.2.4.2 yamt } 282 1.2.4.2 yamt if ((clen + 1) > blen) { 283 1.2.4.2 yamt softd->ipf_p_dns_nospace++; 284 1.2.4.2 yamt return 0; /* Enough room for name+.? */ 285 1.2.4.2 yamt } 286 1.2.4.2 yamt s++; 287 1.2.4.2 yamt bcopy(s, t, clen); 288 1.2.4.2 yamt t += clen; 289 1.2.4.2 yamt s += clen; 290 1.2.4.2 yamt *t++ = '.'; 291 1.2.4.2 yamt slen -= clen; 292 1.2.4.2 yamt blen -= (clen + 1); 293 1.2.4.2 yamt } 294 1.2.4.2 yamt 295 1.2.4.2 yamt *(t - 1) = '\0'; 296 1.2.4.2 yamt return s - start; 297 1.2.4.2 yamt } 298 1.2.4.2 yamt 299 1.2.4.2 yamt 300 1.2.4.2 yamt int 301 1.2.4.2 yamt ipf_p_dns_allow_query(ipf_dns_softc_t *softd, dnsinfo_t *dnsi) 302 1.2.4.2 yamt { 303 1.2.4.2 yamt ipf_dns_filter_t *idns; 304 1.2.4.2 yamt int len; 305 1.2.4.2 yamt 306 1.2.4.2 yamt len = strlen(dnsi->dnsi_buffer); 307 1.2.4.2 yamt 308 1.2.4.2 yamt for (idns = softd->ipf_p_dns_list; idns != NULL; idns = idns->idns_next) 309 1.2.4.2 yamt if (ipf_p_dns_match_names(idns, dnsi->dnsi_buffer, len) == 0) 310 1.2.4.2 yamt return idns->idns_pass; 311 1.2.4.2 yamt return 0; 312 1.2.4.2 yamt } 313 1.2.4.2 yamt 314 1.2.4.2 yamt 315 1.2.4.2 yamt /* ARGSUSED */ 316 1.2.4.2 yamt int 317 1.2.4.2 yamt ipf_p_dns_inout(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 318 1.2.4.2 yamt { 319 1.2.4.2 yamt ipf_dns_softc_t *softd = arg; 320 1.2.4.2 yamt ipf_dns_hdr_t *dns; 321 1.2.4.2 yamt dnsinfo_t *di; 322 1.2.4.2 yamt char *data; 323 1.2.4.2 yamt int dlen, q, rc = 0; 324 1.2.4.2 yamt 325 1.2.4.2 yamt if (fin->fin_dlen < sizeof(*dns)) 326 1.2.4.2 yamt return APR_ERR(1); 327 1.2.4.2 yamt 328 1.2.4.2 yamt dns = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t)); 329 1.2.4.2 yamt 330 1.2.4.2 yamt q = dns->dns_qdcount; 331 1.2.4.2 yamt 332 1.2.4.2 yamt data = (char *)(dns + 1); 333 1.2.4.2 yamt dlen = fin->fin_dlen - sizeof(*dns) - sizeof(udphdr_t); 334 1.2.4.2 yamt 335 1.2.4.2 yamt di = aps->aps_data; 336 1.2.4.2 yamt 337 1.2.4.2 yamt READ_ENTER(&softd->ipf_p_dns_rwlock); 338 1.2.4.2 yamt MUTEX_ENTER(&di->dnsi_lock); 339 1.2.4.2 yamt 340 1.2.4.2 yamt for (; (dlen > 0) && (q > 0); q--) { 341 1.2.4.2 yamt int len; 342 1.2.4.2 yamt 343 1.2.4.2 yamt len = ipf_p_dns_get_name(softd, data, dlen, di->dnsi_buffer, 344 1.2.4.2 yamt sizeof(di->dnsi_buffer)); 345 1.2.4.2 yamt if (len == 0) { 346 1.2.4.2 yamt rc = 1; 347 1.2.4.2 yamt break; 348 1.2.4.2 yamt } 349 1.2.4.2 yamt rc = ipf_p_dns_allow_query(softd, di); 350 1.2.4.2 yamt if (rc != 0) 351 1.2.4.2 yamt break; 352 1.2.4.2 yamt data += len; 353 1.2.4.2 yamt dlen -= len; 354 1.2.4.2 yamt } 355 1.2.4.2 yamt MUTEX_EXIT(&di->dnsi_lock); 356 1.2.4.2 yamt RWLOCK_EXIT(&softd->ipf_p_dns_rwlock); 357 1.2.4.2 yamt 358 1.2.4.2 yamt return APR_ERR(rc); 359 1.2.4.2 yamt } 360 1.2.4.2 yamt 361 1.2.4.2 yamt 362 1.2.4.2 yamt /* ARGSUSED */ 363 1.2.4.2 yamt int 364 1.2.4.2 yamt ipf_p_dns_match(fr_info_t *fin, ap_session_t *aps, nat_t *nat) 365 1.2.4.2 yamt { 366 1.2.4.2 yamt dnsinfo_t *di = aps->aps_data; 367 1.2.4.2 yamt ipf_dns_hdr_t *dnh; 368 1.2.4.2 yamt 369 1.2.4.2 yamt if ((fin->fin_dlen < sizeof(u_short)) || (fin->fin_flx & FI_FRAG)) 370 1.2.4.2 yamt return -1; 371 1.2.4.2 yamt 372 1.2.4.2 yamt dnh = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t)); 373 1.2.4.2 yamt if (((dnh->dns_id[0] << 8) | dnh->dns_id[1]) != di->dnsi_id) 374 1.2.4.2 yamt return -1; 375 1.2.4.2 yamt return 0; 376 1.2.4.2 yamt } 377
Indexes created Sun Oct 26 20:09:54 GMT 2025