ip_proxy.c revision 1.3
1 /* $NetBSD: ip_proxy.c,v 1.3 2012/07/22 14:27:51 darrenr Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if defined(KERNEL) || defined(_KERNEL) 9 # undef KERNEL 10 # undef _KERNEL 11 # define KERNEL 1 12 # define _KERNEL 1 13 #endif 14 #include <sys/errno.h> 15 #include <sys/types.h> 16 #include <sys/param.h> 17 #include <sys/time.h> 18 #include <sys/file.h> 19 #if !defined(AIX) 20 # include <sys/fcntl.h> 21 #endif 22 #if !defined(_KERNEL) && !defined(__KERNEL__) 23 # include <stdio.h> 24 # include <string.h> 25 # include <stdlib.h> 26 # include <ctype.h> 27 # define _KERNEL 28 # ifdef __OpenBSD__ 29 struct file; 30 # endif 31 # include <sys/uio.h> 32 # undef _KERNEL 33 #endif 34 #if !defined(linux) 35 # include <sys/protosw.h> 36 #endif 37 #include <sys/socket.h> 38 #if defined(_KERNEL) 39 # if !defined(__NetBSD__) && !defined(sun) && !defined(__osf__) && \ 40 !defined(__OpenBSD__) && !defined(__hpux) && !defined(__sgi) && \ 41 !defined(AIX) 42 # include <sys/ctype.h> 43 # endif 44 # include <sys/systm.h> 45 # if !defined(__SVR4) && !defined(__svr4__) 46 # include <sys/mbuf.h> 47 # endif 48 #endif 49 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 50 # include <sys/filio.h> 51 # include <sys/fcntl.h> 52 #else 53 # include <sys/ioctl.h> 54 #endif 55 #if defined(__SVR4) || defined(__svr4__) 56 # include <sys/byteorder.h> 57 # ifdef _KERNEL 58 # include <sys/dditypes.h> 59 # endif 60 # include <sys/stream.h> 61 # include <sys/kmem.h> 62 #endif 63 #if __FreeBSD__ > 2 64 # include <sys/queue.h> 65 #endif 66 #include <net/if.h> 67 #ifdef sun 68 # include <net/af.h> 69 #endif 70 #include <netinet/in.h> 71 #include <netinet/in_systm.h> 72 #include <netinet/ip.h> 73 #ifndef linux 74 # include <netinet/ip_var.h> 75 #endif 76 #include <netinet/tcp.h> 77 #include <netinet/udp.h> 78 #include <netinet/ip_icmp.h> 79 #include "netinet/ip_compat.h" 80 #include <netinet/tcpip.h> 81 #include "netinet/ip_fil.h" 82 #include "netinet/ip_nat.h" 83 #include "netinet/ip_state.h" 84 #include "netinet/ip_proxy.h" 85 #if (__FreeBSD_version >= 300000) 86 # include <sys/malloc.h> 87 #endif 88 89 /* END OF INCLUDES */ 90 91 #include "netinet/ip_dns_pxy.c" 92 #include "netinet/ip_ftp_pxy.c" 93 #include "netinet/ip_tftp_pxy.c" 94 #include "netinet/ip_rcmd_pxy.c" 95 #include "netinet/ip_pptp_pxy.c" 96 #if defined(_KERNEL) 97 # include "netinet/ip_irc_pxy.c" 98 # include "netinet/ip_raudio_pxy.c" 99 # include "netinet/ip_h323_pxy.c" 100 # include "netinet/ip_netbios_pxy.c" 101 #endif 102 #include "netinet/ip_ipsec_pxy.c" 103 #include "netinet/ip_rpcb_pxy.c" 104 105 #if !defined(lint) 106 #if defined(__NetBSD__) 107 #include <sys/cdefs.h> 108 __KERNEL_RCSID(0, "$NetBSD: ip_proxy.c,v 1.3 2012/07/22 14:27:51 darrenr Exp $"); 109 #else 110 static const char rcsid[] = "@(#)Id: ip_proxy.c,v 1.1.1.2 2012/07/22 13:45:33 darrenr Exp"; 111 #endif 112 #endif 113 114 #define AP_SESS_SIZE 53 115 116 static int ipf_proxy_fixseqack(fr_info_t *, ip_t *, ap_session_t *, int ); 117 static aproxy_t *ipf_proxy_create_clone(ipf_main_softc_t *, aproxy_t *); 118 119 typedef struct ipf_proxy_softc_s { 120 int ips_proxy_debug; 121 int ips_proxy_session_size; 122 ap_session_t **ips_sess_tab; 123 ap_session_t *ips_sess_list; 124 aproxy_t *ips_proxies; 125 int ips_init_run; 126 ipftuneable_t *ipf_proxy_tune; 127 } ipf_proxy_softc_t; 128 129 static ipftuneable_t ipf_proxy_tuneables[] = { 130 { { (void *)offsetof(ipf_proxy_softc_t, ips_proxy_debug) }, 131 "proxy_debug", 0, 0x1f, 132 stsizeof(ipf_proxy_softc_t, ips_proxy_debug), 133 0, NULL, NULL }, 134 { { NULL }, NULL, 0, 0, 135 0, 136 0, NULL, NULL} 137 }; 138 139 static aproxy_t *ap_proxylist = NULL; 140 static aproxy_t ips_proxies[] = { 141 #ifdef IPF_FTP_PROXY 142 { NULL, NULL, "ftp", (char)IPPROTO_TCP, 0, 0, 0, 143 ipf_p_ftp_main_load, ipf_p_ftp_main_unload, 144 ipf_p_ftp_soft_create, ipf_p_ftp_soft_destroy, 145 NULL, NULL, 146 ipf_p_ftp_new, ipf_p_ftp_del, ipf_p_ftp_in, ipf_p_ftp_out, NULL, 147 NULL, NULL, NULL, NULL }, 148 #endif 149 #ifdef IPF_TFTP_PROXY 150 { NULL, NULL, "tftp", (char)IPPROTO_UDP, 0, 0, 0, 151 ipf_p_tftp_main_load, ipf_p_tftp_main_unload, 152 ipf_p_tftp_soft_create, ipf_p_tftp_soft_destroy, 153 NULL, NULL, 154 ipf_p_tftp_new, ipf_p_tftp_del, 155 ipf_p_tftp_in, ipf_p_tftp_out, NULL, 156 NULL, NULL, NULL, NULL }, 157 #endif 158 #ifdef IPF_IRC_PROXY 159 { NULL, NULL, "irc", (char)IPPROTO_TCP, 0, 0, 0, 160 ipf_p_irc_main_load, ipf_p_irc_main_unload, 161 NULL, NULL, 162 NULL, NULL, 163 ipf_p_irc_new, NULL, NULL, ipf_p_irc_out, NULL, 164 NULL, NULL, NULL, NULL }, 165 #endif 166 #ifdef IPF_RCMD_PROXY 167 { NULL, NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, 0, 168 ipf_p_rcmd_main_load, ipf_p_rcmd_main_unload, 169 NULL, NULL, 170 NULL, NULL, 171 ipf_p_rcmd_new, ipf_p_rcmd_del, 172 ipf_p_rcmd_in, ipf_p_rcmd_out, NULL, 173 NULL, NULL, NULL, NULL }, 174 #endif 175 #ifdef IPF_RAUDIO_PROXY 176 { NULL, NULL, "raudio", (char)IPPROTO_TCP, 0, 0, 0, 177 ipf_p_raudio_main_load, ipf_p_raudio_main_unload, 178 NULL, NULL, 179 NULL, NULL, 180 ipf_p_raudio_new, NULL, ipf_p_raudio_in, ipf_p_raudio_out, NULL, 181 NULL, NULL, NULL, NULL }, 182 #endif 183 #ifdef IPF_MSNRPC_PROXY 184 { NULL, NULL, "msnrpc", (char)IPPROTO_TCP, 0, 0, 0, 185 ipf_p_msnrpc_init, ipf_p_msnrpc_fini, 186 NULL, NULL, 187 NULL, NULL, 188 ipf_p_msnrpc_new, NULL, ipf_p_msnrpc_in, ipf_p_msnrpc_out, NULL, 189 NULL, NULL, NULL, NULL }, 190 #endif 191 #ifdef IPF_NETBIOS_PROXY 192 { NULL, NULL, "netbios", (char)IPPROTO_UDP, 0, 0, 0, 193 ipf_p_netbios_main_load, ipf_p_netbios_main_unload, 194 NULL, NULL, 195 NULL, NULL, 196 NULL, NULL, NULL, ipf_p_netbios_out, NULL, 197 NULL, NULL, NULL, NULL }, 198 #endif 199 #ifdef IPF_IPSEC_PROXY 200 { NULL, NULL, "ipsec", (char)IPPROTO_UDP, 0, 0, 0, 201 NULL, NULL, 202 ipf_p_ipsec_soft_create, ipf_p_ipsec_soft_destroy, 203 ipf_p_ipsec_soft_init, ipf_p_ipsec_soft_fini, 204 ipf_p_ipsec_new, ipf_p_ipsec_del, 205 ipf_p_ipsec_inout, ipf_p_ipsec_inout, ipf_p_ipsec_match, 206 NULL, NULL, NULL, NULL }, 207 #endif 208 #ifdef IPF_DNS_PROXY 209 { NULL, NULL, "dns", (char)IPPROTO_UDP, 0, 0, 0, 210 NULL, NULL, 211 ipf_p_dns_soft_create, ipf_p_dns_soft_destroy, 212 NULL, NULL, 213 ipf_p_dns_new, ipf_p_ipsec_del, 214 ipf_p_dns_inout, ipf_p_dns_inout, ipf_p_dns_match, 215 ipf_p_dns_ctl, NULL, NULL, NULL }, 216 #endif 217 #ifdef IPF_PPTP_PROXY 218 { NULL, NULL, "pptp", (char)IPPROTO_TCP, 0, 0, 0, 219 ipf_p_pptp_main_load, ipf_p_pptp_main_unload, 220 NULL, NULL, 221 NULL, NULL, 222 ipf_p_pptp_new, ipf_p_pptp_del, 223 ipf_p_pptp_inout, ipf_p_pptp_inout, NULL, 224 NULL, NULL, NULL, NULL }, 225 #endif 226 #ifdef IPF_H323_PROXY 227 { NULL, NULL, "h323", (char)IPPROTO_TCP, 0, 0, 0, 228 ipf_p_h323_main_load, ipf_p_h323_main_unload, 229 NULL, NULL, 230 NULL, NULL, 231 ipf_p_h323_new, ipf_p_h323_del, 232 ipf_p_h323_in, NULL, NULL, 233 NULL, NULL, NULL, NULL }, 234 { NULL, NULL, "h245", (char)IPPROTO_TCP, 0, 0, 0, NULL, NULL, 235 NULL, NULL, 236 NULL, NULL, 237 ipf_p_h245_new, NULL, 238 NULL, ipf_p_h245_out, NULL, 239 NULL, NULL, NULL, NULL }, 240 #endif 241 #ifdef IPF_RPCB_PROXY 242 # ifndef _KERNEL 243 { NULL, NULL, "rpcbt", (char)IPPROTO_TCP, 0, 0, 0, 244 NULL, NULL, 245 NULL, NULL, 246 NULL, NULL, 247 ipf_p_rpcb_new, ipf_p_rpcb_del, 248 ipf_p_rpcb_in, ipf_p_rpcb_out, NULL, 249 NULL, NULL, NULL, NULL }, 250 # endif 251 { NULL, NULL, "rpcbu", (char)IPPROTO_UDP, 0, 0, 0, 252 ipf_p_rpcb_main_load, ipf_p_rpcb_main_unload, 253 NULL, NULL, 254 NULL, NULL, 255 ipf_p_rpcb_new, ipf_p_rpcb_del, 256 ipf_p_rpcb_in, ipf_p_rpcb_out, NULL, 257 NULL, NULL, NULL, NULL }, 258 #endif 259 { NULL, NULL, "", '\0', 0, 0, 0, 260 NULL, NULL, 261 NULL, NULL, 262 NULL, NULL, 263 NULL, NULL, 264 NULL, NULL, NULL, 265 NULL, NULL, NULL, NULL } 266 }; 267 268 269 /* ------------------------------------------------------------------------ */ 270 /* Function: ipf_proxy_main_load */ 271 /* Returns: int - 0 == success, else failure. */ 272 /* Parameters: Nil */ 273 /* */ 274 /* Initialise hook for kernel application proxies. */ 275 /* Call the initialise routine for all the compiled in kernel proxies. */ 276 /* ------------------------------------------------------------------------ */ 277 int 278 ipf_proxy_main_load(void) 279 { 280 aproxy_t *ap; 281 282 for (ap = ips_proxies; ap->apr_p; ap++) { 283 if (ap->apr_load != NULL) 284 (*ap->apr_load)(); 285 } 286 return 0; 287 } 288 289 290 /* ------------------------------------------------------------------------ */ 291 /* Function: ipf_proxy_main_unload */ 292 /* Returns: int - 0 == success, else failure. */ 293 /* Parameters: Nil */ 294 /* */ 295 /* Unload hook for kernel application proxies. */ 296 /* Call the finialise routine for all the compiled in kernel proxies. */ 297 /* ------------------------------------------------------------------------ */ 298 int 299 ipf_proxy_main_unload(void) 300 { 301 aproxy_t *ap; 302 303 for (ap = ips_proxies; ap->apr_p; ap++) 304 if (ap->apr_unload != NULL) 305 (*ap->apr_unload)(); 306 for (ap = ap_proxylist; ap; ap = ap->apr_next) 307 if (ap->apr_unload != NULL) 308 (*ap->apr_unload)(); 309 310 return 0; 311 } 312 313 314 /* ------------------------------------------------------------------------ */ 315 /* Function: ipf_proxy_soft_create */ 316 /* Returns: void * - */ 317 /* Parameters: softc(I) - pointer to soft context main structure */ 318 /* */ 319 /* Build the structure to hold all of the run time data to support proxies. */ 320 /* ------------------------------------------------------------------------ */ 321 void * 322 ipf_proxy_soft_create(ipf_main_softc_t *softc) 323 { 324 ipf_proxy_softc_t *softp; 325 aproxy_t *last; 326 aproxy_t *apn; 327 aproxy_t *ap; 328 329 KMALLOC(softp, ipf_proxy_softc_t *); 330 if (softp == NULL) 331 return softp; 332 333 bzero((char *)softp, sizeof(*softp)); 334 335 #if defined(_KERNEL) 336 softp->ips_proxy_debug = 0; 337 #else 338 softp->ips_proxy_debug = 2; 339 #endif 340 softp->ips_proxy_session_size = AP_SESS_SIZE; 341 342 softp->ipf_proxy_tune = ipf_tune_array_copy(softp, 343 sizeof(ipf_proxy_tuneables), 344 ipf_proxy_tuneables); 345 if (softp->ipf_proxy_tune == NULL) { 346 ipf_proxy_soft_destroy(softc, softp); 347 return NULL; 348 } 349 if (ipf_tune_array_link(softc, softp->ipf_proxy_tune) == -1) { 350 ipf_proxy_soft_destroy(softc, softp); 351 return NULL; 352 } 353 354 last = NULL; 355 for (ap = ips_proxies; ap->apr_p; ap++) { 356 apn = ipf_proxy_create_clone(softc, ap); 357 if (apn == NULL) 358 goto failed; 359 if (last != NULL) 360 last->apr_next = apn; 361 else 362 softp->ips_proxies = apn; 363 last = apn; 364 } 365 for (ap = ips_proxies; ap != NULL; ap = ap->apr_next) { 366 apn = ipf_proxy_create_clone(softc, ap); 367 if (apn == NULL) 368 goto failed; 369 if (last != NULL) 370 last->apr_next = apn; 371 else 372 softp->ips_proxies = apn; 373 last = apn; 374 } 375 376 return softp; 377 failed: 378 ipf_proxy_soft_destroy(softc, softp); 379 return NULL; 380 } 381 382 383 /* ------------------------------------------------------------------------ */ 384 /* Function: ipf_proxy_soft_create */ 385 /* Returns: void * - */ 386 /* Parameters: softc(I) - pointer to soft context main structure */ 387 /* orig(I) - pointer to proxy definition to copy */ 388 /* */ 389 /* This function clones a proxy definition given by orig and returns a */ 390 /* a pointer to that copy. */ 391 /* ------------------------------------------------------------------------ */ 392 static aproxy_t * 393 ipf_proxy_create_clone(ipf_main_softc_t *softc, aproxy_t *orig) 394 { 395 aproxy_t *apn; 396 397 KMALLOC(apn, aproxy_t *); 398 if (apn == NULL) 399 return NULL; 400 401 bcopy((char *)orig, (char *)apn, sizeof(*apn)); 402 apn->apr_next = NULL; 403 apn->apr_soft = NULL; 404 405 if (apn->apr_create != NULL) { 406 apn->apr_soft = (*apn->apr_create)(softc); 407 if (apn->apr_soft == NULL) { 408 KFREE(apn); 409 return NULL; 410 } 411 } 412 413 apn->apr_parent = orig; 414 orig->apr_clones++; 415 416 return apn; 417 } 418 419 420 /* ------------------------------------------------------------------------ */ 421 /* Function: ipf_proxy_soft_create */ 422 /* Returns: int - 0 == success, else failure. */ 423 /* Parameters: softc(I) - pointer to soft context main structure */ 424 /* arg(I) - pointer to proxy contect data */ 425 /* */ 426 /* Initialise the proxy context and walk through each of the proxies and */ 427 /* call its initialisation function. This allows for proxies to do any */ 428 /* local setup prior to actual use. */ 429 /* ------------------------------------------------------------------------ */ 430 int 431 ipf_proxy_soft_init(ipf_main_softc_t *softc, void *arg) 432 { 433 ipf_proxy_softc_t *softp; 434 aproxy_t *ap; 435 u_int size; 436 int err; 437 438 softp = arg; 439 size = softp->ips_proxy_session_size * sizeof(ap_session_t *); 440 441 KMALLOCS(softp->ips_sess_tab, ap_session_t **, size); 442 443 if (softp->ips_sess_tab == NULL) 444 return -1; 445 446 bzero(softp->ips_sess_tab, size); 447 448 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) { 449 if (ap->apr_init != NULL) { 450 err = (*ap->apr_init)(softc, ap->apr_soft); 451 if (err != 0) 452 return -2; 453 } 454 } 455 softp->ips_init_run = 1; 456 457 return 0; 458 } 459 460 461 /* ------------------------------------------------------------------------ */ 462 /* Function: ipf_proxy_soft_create */ 463 /* Returns: int - 0 == success, else failure. */ 464 /* Parameters: softc(I) - pointer to soft context main structure */ 465 /* arg(I) - pointer to proxy contect data */ 466 /* */ 467 /* This function should always succeed. It is responsible for ensuring that */ 468 /* the proxy context can be safely called when ipf_proxy_soft_destroy is */ 469 /* called and suring all of the proxies have similarly been instructed. */ 470 /* ------------------------------------------------------------------------ */ 471 int 472 ipf_proxy_soft_fini(ipf_main_softc_t *softc, void *arg) 473 { 474 ipf_proxy_softc_t *softp = arg; 475 aproxy_t *ap; 476 477 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) { 478 if (ap->apr_fini != NULL) { 479 (*ap->apr_fini)(softc, ap->apr_soft); 480 } 481 } 482 483 if (softp->ips_sess_tab != NULL) { 484 KFREES(softp->ips_sess_tab, 485 softp->ips_proxy_session_size * sizeof(ap_session_t *)); 486 softp->ips_sess_tab = NULL; 487 } 488 softp->ips_init_run = 0; 489 490 return 0; 491 } 492 493 494 /* ------------------------------------------------------------------------ */ 495 /* Function: ipf_proxy_soft_destroy */ 496 /* Returns: Nil */ 497 /* Parameters: softc(I) - pointer to soft context main structure */ 498 /* arg(I) - pointer to proxy contect data */ 499 /* */ 500 /* Free up all of the local data structures allocated during creation. */ 501 /* ------------------------------------------------------------------------ */ 502 void 503 ipf_proxy_soft_destroy(ipf_main_softc_t *softc, void *arg) 504 { 505 ipf_proxy_softc_t *softp = arg; 506 aproxy_t *ap; 507 508 while ((ap = softp->ips_proxies) != NULL) { 509 softp->ips_proxies = ap->apr_next; 510 if (ap->apr_destroy != NULL) 511 (*ap->apr_destroy)(softc, ap->apr_soft); 512 ap->apr_parent->apr_clones--; 513 KFREE(ap); 514 } 515 516 if (softp->ipf_proxy_tune != NULL) { 517 ipf_tune_array_unlink(softc, softp->ipf_proxy_tune); 518 KFREES(softp->ipf_proxy_tune, sizeof(ipf_proxy_tuneables)); 519 softp->ipf_proxy_tune = NULL; 520 } 521 522 KFREE(softp); 523 } 524 525 526 /* ------------------------------------------------------------------------ */ 527 /* Function: ipf_proxy_flush */ 528 /* Returns: Nil */ 529 /* Parameters: arg(I) - pointer to proxy contect data */ 530 /* how(I) - indicates the type of flush operation */ 531 /* */ 532 /* Walk through all of the proxies and pass on the flush command as either */ 533 /* a flush or a clear. */ 534 /* ------------------------------------------------------------------------ */ 535 void 536 ipf_proxy_flush(void *arg, int how) 537 { 538 ipf_proxy_softc_t *softp = arg; 539 aproxy_t *ap; 540 541 switch (how) 542 { 543 case 0 : 544 for (ap = softp->ips_proxies; ap; ap = ap->apr_next) 545 if (ap->apr_flush != NULL) 546 (*ap->apr_flush)(ap, how); 547 break; 548 case 1 : 549 for (ap = softp->ips_proxies; ap; ap = ap->apr_next) 550 if (ap->apr_clear != NULL) 551 (*ap->apr_clear)(ap); 552 break; 553 default : 554 break; 555 } 556 } 557 558 559 /* ------------------------------------------------------------------------ */ 560 /* Function: ipf_proxy_add */ 561 /* Returns: int - 0 == success, else failure. */ 562 /* Parameters: ap(I) - pointer to proxy structure */ 563 /* */ 564 /* Dynamically add a new kernel proxy. Ensure that it is unique in the */ 565 /* collection compiled in and dynamically added. */ 566 /* ------------------------------------------------------------------------ */ 567 int 568 ipf_proxy_add(void *arg, aproxy_t *ap) 569 { 570 ipf_proxy_softc_t *softp = arg; 571 572 aproxy_t *a; 573 574 for (a = ips_proxies; a->apr_p; a++) 575 if ((a->apr_p == ap->apr_p) && 576 !strncmp(a->apr_label, ap->apr_label, 577 sizeof(ap->apr_label))) { 578 if (softp->ips_proxy_debug & 0x01) 579 printf("ipf_proxy_add: %s/%d present (B)\n", 580 a->apr_label, a->apr_p); 581 return -1; 582 } 583 584 for (a = ap_proxylist; (a != NULL); a = a->apr_next) 585 if ((a->apr_p == ap->apr_p) && 586 !strncmp(a->apr_label, ap->apr_label, 587 sizeof(ap->apr_label))) { 588 if (softp->ips_proxy_debug & 0x01) 589 printf("ipf_proxy_add: %s/%d present (D)\n", 590 a->apr_label, a->apr_p); 591 return -1; 592 } 593 ap->apr_next = ap_proxylist; 594 ap_proxylist = ap; 595 if (ap->apr_load != NULL) 596 (*ap->apr_load)(); 597 return 0; 598 } 599 600 601 /* ------------------------------------------------------------------------ */ 602 /* Function: ipf_proxy_ctl */ 603 /* Returns: int - 0 == success, else error */ 604 /* Parameters: softc(I) - pointer to soft context main structure */ 605 /* arg(I) - pointer to proxy context */ 606 /* ctl(I) - pointer to proxy control structure */ 607 /* */ 608 /* Check to see if the proxy this control request has come through for */ 609 /* exists, and if it does and it has a control function then invoke that */ 610 /* control function. */ 611 /* ------------------------------------------------------------------------ */ 612 int 613 ipf_proxy_ctl(ipf_main_softc_t *softc, void *arg, ap_ctl_t *ctl) 614 { 615 ipf_proxy_softc_t *softp = arg; 616 aproxy_t *a; 617 int error; 618 619 a = ipf_proxy_lookup(arg, ctl->apc_p, ctl->apc_label); 620 if (a == NULL) { 621 if (softp->ips_proxy_debug & 0x01) 622 printf("ipf_proxy_ctl: can't find %s/%d\n", 623 ctl->apc_label, ctl->apc_p); 624 IPFERROR(80001); 625 error = ESRCH; 626 } else if (a->apr_ctl == NULL) { 627 if (softp->ips_proxy_debug & 0x01) 628 printf("ipf_proxy_ctl: no ctl function for %s/%d\n", 629 ctl->apc_label, ctl->apc_p); 630 IPFERROR(80002); 631 error = ENXIO; 632 } else { 633 error = (*a->apr_ctl)(softc, a->apr_soft, ctl); 634 if ((error != 0) && (softp->ips_proxy_debug & 0x02)) 635 printf("ipf_proxy_ctl: %s/%d ctl error %d\n", 636 a->apr_label, a->apr_p, error); 637 } 638 return error; 639 } 640 641 642 /* ------------------------------------------------------------------------ */ 643 /* Function: ipf_proxy_del */ 644 /* Returns: int - 0 == success, else failure. */ 645 /* Parameters: ap(I) - pointer to proxy structure */ 646 /* */ 647 /* Delete a proxy that has been added dynamically from those available. */ 648 /* If it is in use, return 1 (do not destroy NOW), not in use 0 or -1 */ 649 /* if it cannot be matched. */ 650 /* ------------------------------------------------------------------------ */ 651 int 652 ipf_proxy_del(aproxy_t *ap) 653 { 654 aproxy_t *a, **app; 655 656 for (app = &ap_proxylist; ((a = *app) != NULL); app = &a->apr_next) { 657 if (a == ap) { 658 a->apr_flags |= APR_DELETE; 659 if (ap->apr_ref == 0 && ap->apr_clones == 0) { 660 *app = a->apr_next; 661 return 0; 662 } 663 return 1; 664 } 665 } 666 667 return -1; 668 } 669 670 671 /* ------------------------------------------------------------------------ */ 672 /* Function: ipf_proxy_ok */ 673 /* Returns: int - 1 == good match else not. */ 674 /* Parameters: fin(I) - pointer to packet information */ 675 /* tcp(I) - pointer to TCP/UDP header */ 676 /* nat(I) - pointer to current NAT session */ 677 /* */ 678 /* This function extends the NAT matching to ensure that a packet that has */ 679 /* arrived matches the proxy information attached to the NAT rule. Notably, */ 680 /* if the proxy is scheduled to be deleted then packets will not match the */ 681 /* rule even if the rule is still active. */ 682 /* ------------------------------------------------------------------------ */ 683 int 684 ipf_proxy_ok(fr_info_t *fin, tcphdr_t *tcp, ipnat_t *np) 685 { 686 aproxy_t *apr = np->in_apr; 687 u_short dport = np->in_odport; 688 689 if ((apr == NULL) || (apr->apr_flags & APR_DELETE) || 690 (fin->fin_p != apr->apr_p)) 691 return 0; 692 if ((tcp == NULL) && dport) 693 return 0; 694 return 1; 695 } 696 697 698 /* ------------------------------------------------------------------------ */ 699 /* Function: ipf_proxy_ioctl */ 700 /* Returns: int - 0 == success, else error */ 701 /* Parameters: softc(I) - pointer to soft context main structure */ 702 /* data(I) - pointer to ioctl data */ 703 /* cmd(I) - ioctl command */ 704 /* mode(I) - mode bits for device */ 705 /* ctx(I) - pointer to context information */ 706 /* */ 707 /* ------------------------------------------------------------------------ */ 708 int 709 ipf_proxy_ioctl(ipf_main_softc_t *softc, void *data, ioctlcmd_t cmd, int mode, 710 void *ctx) 711 { 712 ap_ctl_t ctl; 713 void *ptr; 714 int error; 715 716 mode = mode; /* LINT */ 717 718 switch (cmd) 719 { 720 case SIOCPROXY : 721 error = ipf_inobj(softc, data, NULL, &ctl, IPFOBJ_PROXYCTL); 722 if (error != 0) { 723 return error; 724 } 725 ptr = NULL; 726 727 if (ctl.apc_dsize > 0) { 728 KMALLOCS(ptr, void *, ctl.apc_dsize); 729 if (ptr == NULL) { 730 IPFERROR(80003); 731 error = ENOMEM; 732 } else { 733 error = copyinptr(softc, ctl.apc_data, ptr, 734 ctl.apc_dsize); 735 if (error == 0) 736 ctl.apc_data = ptr; 737 } 738 } else { 739 ctl.apc_data = NULL; 740 error = 0; 741 } 742 743 if (error == 0) 744 error = ipf_proxy_ctl(softc, softc->ipf_proxy_soft, 745 &ctl); 746 747 if ((error != 0) && (ptr != NULL)) { 748 KFREES(ptr, ctl.apc_dsize); 749 } 750 break; 751 752 default : 753 IPFERROR(80004); 754 error = EINVAL; 755 } 756 return error; 757 } 758 759 760 /* ------------------------------------------------------------------------ */ 761 /* Function: ipf_proxy_match */ 762 /* Returns: int - 0 == success, else error */ 763 /* Parameters: fin(I) - pointer to packet information */ 764 /* nat(I) - pointer to current NAT session */ 765 /* */ 766 /* If a proxy has a match function, call that to do extended packet */ 767 /* matching. Whilst other parts of the NAT code are rather lenient when it */ 768 /* comes to the quality of the packet that it will transform, the proxy */ 769 /* matching is not because they need to work with data, not just headers. */ 770 /* ------------------------------------------------------------------------ */ 771 int 772 ipf_proxy_match(fr_info_t *fin, nat_t *nat) 773 { 774 ipf_main_softc_t *softc = fin->fin_main_soft; 775 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 776 aproxy_t *apr; 777 ipnat_t *ipn; 778 int result; 779 780 ipn = nat->nat_ptr; 781 if (softp->ips_proxy_debug & 0x04) 782 printf("ipf_proxy_match(%lx,%lx) aps %lx ptr %lx\n", 783 (u_long)fin, (u_long)nat, (u_long)nat->nat_aps, 784 (u_long)ipn); 785 786 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) != 0) { 787 if (softp->ips_proxy_debug & 0x08) 788 printf("ipf_proxy_match: flx 0x%x (BAD|SHORT)\n", 789 fin->fin_flx); 790 return -1; 791 } 792 793 apr = ipn->in_apr; 794 if ((apr == NULL) || (apr->apr_flags & APR_DELETE)) { 795 if (softp->ips_proxy_debug & 0x08) 796 printf("ipf_proxy_match:apr %lx apr_flags 0x%x\n", 797 (u_long)apr, apr ? apr->apr_flags : 0); 798 return -1; 799 } 800 801 if (apr->apr_match != NULL) { 802 result = (*apr->apr_match)(fin, nat->nat_aps, nat); 803 if (result != 0) { 804 if (softp->ips_proxy_debug & 0x08) 805 printf("ipf_proxy_match: result %d\n", result); 806 return -1; 807 } 808 } 809 return 0; 810 } 811 812 813 /* ------------------------------------------------------------------------ */ 814 /* Function: ipf_proxy_new */ 815 /* Returns: int - 0 == success, else error */ 816 /* Parameters: fin(I) - pointer to packet information */ 817 /* nat(I) - pointer to current NAT session */ 818 /* */ 819 /* Allocate a new application proxy structure and fill it in with the */ 820 /* relevant details. call the init function once complete, prior to */ 821 /* returning. */ 822 /* ------------------------------------------------------------------------ */ 823 int 824 ipf_proxy_new(fr_info_t *fin, nat_t *nat) 825 { 826 ipf_main_softc_t *softc = fin->fin_main_soft; 827 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 828 register ap_session_t *aps; 829 aproxy_t *apr; 830 831 if (softp->ips_proxy_debug & 0x04) 832 printf("ipf_proxy_new(%lx,%lx) \n", (u_long)fin, (u_long)nat); 833 834 if ((nat->nat_ptr == NULL) || (nat->nat_aps != NULL)) { 835 if (softp->ips_proxy_debug & 0x08) 836 printf("ipf_proxy_new: nat_ptr %lx nat_aps %lx\n", 837 (u_long)nat->nat_ptr, (u_long)nat->nat_aps); 838 return -1; 839 } 840 841 apr = nat->nat_ptr->in_apr; 842 843 if ((apr->apr_flags & APR_DELETE) || 844 (fin->fin_p != apr->apr_p)) { 845 if (softp->ips_proxy_debug & 0x08) 846 printf("ipf_proxy_new: apr_flags 0x%x p %d/%d\n", 847 apr->apr_flags, fin->fin_p, apr->apr_p); 848 return -1; 849 } 850 851 KMALLOC(aps, ap_session_t *); 852 if (!aps) { 853 if (softp->ips_proxy_debug & 0x08) 854 printf("ipf_proxy_new: malloc failed (%lu)\n", 855 (u_long)sizeof(ap_session_t)); 856 return -1; 857 } 858 859 bzero((char *)aps, sizeof(*aps)); 860 aps->aps_data = NULL; 861 aps->aps_apr = apr; 862 aps->aps_psiz = 0; 863 if (apr->apr_new != NULL) 864 if ((*apr->apr_new)(apr->apr_soft, fin, aps, nat) == -1) { 865 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) { 866 KFREES(aps->aps_data, aps->aps_psiz); 867 } 868 KFREE(aps); 869 if (softp->ips_proxy_debug & 0x08) 870 printf("ipf_proxy_new: new(%lx) failed\n", 871 (u_long)apr->apr_new); 872 return -1; 873 } 874 aps->aps_nat = nat; 875 aps->aps_next = softp->ips_sess_list; 876 softp->ips_sess_list = aps; 877 nat->nat_aps = aps; 878 879 return 0; 880 } 881 882 883 /* ------------------------------------------------------------------------ */ 884 /* Function: ipf_proxy_check */ 885 /* Returns: int - -1 == error, 0 == success */ 886 /* Parameters: fin(I) - pointer to packet information */ 887 /* nat(I) - pointer to current NAT session */ 888 /* */ 889 /* Check to see if a packet should be passed through an active proxy */ 890 /* routine if one has been setup for it. We don't need to check the */ 891 /* checksum here if IPFILTER_CKSUM is defined because if it is, a failed */ 892 /* check causes FI_BAD to be set. */ 893 /* ------------------------------------------------------------------------ */ 894 int 895 ipf_proxy_check(fr_info_t *fin, nat_t *nat) 896 { 897 ipf_main_softc_t *softc = fin->fin_main_soft; 898 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 899 #if SOLARIS && defined(_KERNEL) && defined(ICK_VALID) 900 mb_t *m; 901 #endif 902 tcphdr_t *tcp = NULL; 903 udphdr_t *udp = NULL; 904 ap_session_t *aps; 905 aproxy_t *apr; 906 short adjlen; 907 int dosum; 908 ip_t *ip; 909 short rv; 910 int err; 911 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) 912 u_32_t s1, s2, sd; 913 #endif 914 915 if (fin->fin_flx & FI_BAD) { 916 if (softp->ips_proxy_debug & 0x08) 917 printf("ipf_proxy_check: flx 0x%x (BAD)\n", 918 fin->fin_flx); 919 return -1; 920 } 921 922 #ifndef IPFILTER_CKSUM 923 if ((fin->fin_out == 0) && (ipf_checkl4sum(fin) == -1)) { 924 if (softp->ips_proxy_debug & 0x08) 925 printf("ipf_proxy_check: l4 checksum failure %d\n", 926 fin->fin_p); 927 if (fin->fin_p == IPPROTO_TCP) 928 softc->ipf_stats[fin->fin_out].fr_tcpbad++; 929 return -1; 930 } 931 #endif 932 933 aps = nat->nat_aps; 934 if (aps != NULL) { 935 /* 936 * If there is data in this packet to be proxied then try and 937 * get it all into the one buffer, else drop it. 938 */ 939 #if defined(MENTAT) || defined(HAVE_M_PULLDOWN) 940 if ((fin->fin_dlen > 0) && !(fin->fin_flx & FI_COALESCE)) 941 if (ipf_coalesce(fin) == -1) { 942 if (softp->ips_proxy_debug & 0x08) 943 printf("ipf_proxy_check: %s %x\n", 944 "coalesce failed", fin->fin_flx); 945 return -1; 946 } 947 #endif 948 ip = fin->fin_ip; 949 if (fin->fin_cksum > FI_CK_SUMOK) 950 dosum = 0; 951 else 952 dosum = 1; 953 954 switch (fin->fin_p) 955 { 956 case IPPROTO_TCP : 957 tcp = (tcphdr_t *)fin->fin_dp; 958 #if SOLARIS && defined(_KERNEL) && defined(ICK_VALID) 959 m = fin->fin_qfm; 960 if (dohwcksum && (m->b_ick_flag == ICK_VALID)) 961 dosum = 0; 962 #endif 963 break; 964 case IPPROTO_UDP : 965 udp = (udphdr_t *)fin->fin_dp; 966 break; 967 default : 968 break; 969 } 970 971 apr = aps->aps_apr; 972 err = 0; 973 if (fin->fin_out != 0) { 974 if (apr->apr_outpkt != NULL) 975 err = (*apr->apr_outpkt)(apr->apr_soft, fin, 976 aps, nat); 977 } else { 978 if (apr->apr_inpkt != NULL) 979 err = (*apr->apr_inpkt)(apr->apr_soft, fin, 980 aps, nat); 981 } 982 983 rv = APR_EXIT(err); 984 if (((softp->ips_proxy_debug & 0x08) && (rv != 0)) || 985 (softp->ips_proxy_debug & 0x04)) 986 printf("ipf_proxy_check: out %d err %x rv %d\n", 987 fin->fin_out, err, rv); 988 if (rv == 1) 989 return -1; 990 991 if (rv == 2) { 992 ipf_proxy_deref(apr); 993 nat->nat_aps = NULL; 994 return -1; 995 } 996 997 /* 998 * If err != 0 then the data size of the packet has changed 999 * so we need to recalculate the header checksums for the 1000 * packet. 1001 */ 1002 adjlen = APR_INC(err); 1003 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) 1004 s1 = LONG_SUM(fin->fin_plen - adjlen); 1005 s2 = LONG_SUM(fin->fin_plen); 1006 CALC_SUMD(s1, s2, sd); 1007 if ((err != 0) && (fin->fin_cksum < FI_CK_L4PART) && 1008 fin->fin_v == 4) 1009 ipf_fix_outcksum(0, &ip->ip_sum, sd, 0); 1010 #endif 1011 if (fin->fin_flx & FI_DOCKSUM) 1012 dosum = 1; 1013 1014 #ifdef INET 1015 /* 1016 * For TCP packets, we may need to adjust the sequence and 1017 * acknowledgement numbers to reflect changes in size of the 1018 * data stream. 1019 * 1020 * For both TCP and UDP, recalculate the layer 4 checksum, 1021 * regardless, as we can't tell (here) if data has been 1022 * changed or not. 1023 */ 1024 if (tcp != NULL) { 1025 err = ipf_proxy_fixseqack(fin, ip, aps, adjlen); 1026 if (fin->fin_cksum == FI_CK_L4PART) { 1027 u_short sum = ntohs(tcp->th_sum); 1028 sum += adjlen; 1029 tcp->th_sum = htons(sum); 1030 } else if (fin->fin_cksum < FI_CK_L4PART) { 1031 tcp->th_sum = fr_cksum(fin, ip, 1032 IPPROTO_TCP, tcp); 1033 } 1034 } else if ((udp != NULL) && (udp->uh_sum != 0)) { 1035 if (fin->fin_cksum == FI_CK_L4PART) { 1036 u_short sum = ntohs(udp->uh_sum); 1037 sum += adjlen; 1038 udp->uh_sum = htons(sum); 1039 } else if (dosum) { 1040 udp->uh_sum = fr_cksum(fin, ip, 1041 IPPROTO_UDP, udp); 1042 } 1043 } 1044 #endif 1045 aps->aps_bytes += fin->fin_plen; 1046 aps->aps_pkts++; 1047 return 1; 1048 } 1049 return 0; 1050 } 1051 1052 1053 /* ------------------------------------------------------------------------ */ 1054 /* Function: ipf_proxy_lookup */ 1055 /* Returns: int - -1 == error, 0 == success */ 1056 /* Parameters: arg(I) - pointer to proxy context information */ 1057 /* pr(I) - protocol number for proxy */ 1058 /* name(I) - proxy name */ 1059 /* */ 1060 /* Search for an proxy by the protocol it is being used with and its name. */ 1061 /* ------------------------------------------------------------------------ */ 1062 aproxy_t * 1063 ipf_proxy_lookup(void *arg, u_int pr, char *name) 1064 { 1065 ipf_proxy_softc_t *softp = arg; 1066 aproxy_t *ap; 1067 1068 if (softp->ips_proxy_debug & 0x04) 1069 printf("ipf_proxy_lookup(%d,%s)\n", pr, name); 1070 1071 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) 1072 if ((ap->apr_p == pr) && 1073 !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) { 1074 ap->apr_ref++; 1075 return ap; 1076 } 1077 1078 if (softp->ips_proxy_debug & 0x08) 1079 printf("ipf_proxy_lookup: failed for %d/%s\n", pr, name); 1080 return NULL; 1081 } 1082 1083 1084 /* ------------------------------------------------------------------------ */ 1085 /* Function: ipf_proxy_deref */ 1086 /* Returns: Nil */ 1087 /* Parameters: ap(I) - pointer to proxy structure */ 1088 /* */ 1089 /* Drop the reference counter associated with the proxy. */ 1090 /* ------------------------------------------------------------------------ */ 1091 void 1092 ipf_proxy_deref(aproxy_t *ap) 1093 { 1094 ap->apr_ref--; 1095 } 1096 1097 1098 /* ------------------------------------------------------------------------ */ 1099 /* Function: ipf_proxy_free */ 1100 /* Returns: Nil */ 1101 /* Parameters: softc(I) - pointer to soft context main structure */ 1102 /* aps(I) - pointer to current proxy session */ 1103 /* Locks Held: ipf_nat_new, ipf_nat(W) */ 1104 /* */ 1105 /* Free up proxy session information allocated to be used with a NAT */ 1106 /* session. */ 1107 /* ------------------------------------------------------------------------ */ 1108 void 1109 ipf_proxy_free(ipf_main_softc_t *softc, ap_session_t *aps) 1110 { 1111 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 1112 ap_session_t *a, **ap; 1113 aproxy_t *apr; 1114 1115 if (!aps) 1116 return; 1117 1118 for (ap = &softp->ips_sess_list; ((a = *ap) != NULL); ap = &a->aps_next) 1119 if (a == aps) { 1120 *ap = a->aps_next; 1121 break; 1122 } 1123 1124 apr = aps->aps_apr; 1125 if ((apr != NULL) && (apr->apr_del != NULL)) 1126 (*apr->apr_del)(softc, aps); 1127 1128 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) 1129 KFREES(aps->aps_data, aps->aps_psiz); 1130 KFREE(aps); 1131 } 1132 1133 1134 /* ------------------------------------------------------------------------ */ 1135 /* Function: ipf_proxy_fixseqack */ 1136 /* Returns: int - 2 if TCP ack/seq is changed, else 0 */ 1137 /* Parameters: fin(I) - pointer to packet information */ 1138 /* ip(I) - pointer to IP header */ 1139 /* nat(I) - pointer to current NAT session */ 1140 /* inc(I) - delta to apply to TCP sequence numbering */ 1141 /* */ 1142 /* Adjust the TCP sequence/acknowledge numbers in the TCP header based on */ 1143 /* whether or not the new header is past the point at which an adjustment */ 1144 /* occurred. This might happen because of (say) an FTP string being changed */ 1145 /* and the new string being a different length to the old. */ 1146 /* ------------------------------------------------------------------------ */ 1147 static int 1148 ipf_proxy_fixseqack(fr_info_t *fin, ip_t *ip, ap_session_t *aps, int inc) 1149 { 1150 ipf_main_softc_t *softc = fin->fin_main_soft; 1151 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 1152 int sel, ch = 0, out, nlen; 1153 u_32_t seq1, seq2; 1154 tcphdr_t *tcp; 1155 short inc2; 1156 1157 tcp = (tcphdr_t *)fin->fin_dp; 1158 out = fin->fin_out; 1159 /* 1160 * ip_len has already been adjusted by 'inc'. 1161 */ 1162 nlen = fin->fin_dlen; 1163 nlen -= (TCP_OFF(tcp) << 2); 1164 1165 inc2 = inc; 1166 inc = (int)inc2; 1167 1168 if (out != 0) { 1169 seq1 = (u_32_t)ntohl(tcp->th_seq); 1170 sel = aps->aps_sel[out]; 1171 1172 /* switch to other set ? */ 1173 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) && 1174 (seq1 > aps->aps_seqmin[!sel])) { 1175 if (softp->ips_proxy_debug & 0x10) 1176 printf("proxy out switch set seq %d -> %d %x > %x\n", 1177 sel, !sel, seq1, 1178 aps->aps_seqmin[!sel]); 1179 sel = aps->aps_sel[out] = !sel; 1180 } 1181 1182 if (aps->aps_seqoff[sel]) { 1183 seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel]; 1184 if (seq1 > seq2) { 1185 seq2 = aps->aps_seqoff[sel]; 1186 seq1 += seq2; 1187 tcp->th_seq = htonl(seq1); 1188 ch = 1; 1189 } 1190 } 1191 1192 if (inc && (seq1 > aps->aps_seqmin[!sel])) { 1193 aps->aps_seqmin[sel] = seq1 + nlen - 1; 1194 aps->aps_seqoff[sel] = aps->aps_seqoff[sel] + inc; 1195 if (softp->ips_proxy_debug & 0x10) 1196 printf("proxy seq set %d at %x to %d + %d\n", 1197 sel, aps->aps_seqmin[sel], 1198 aps->aps_seqoff[sel], inc); 1199 } 1200 1201 /***/ 1202 1203 seq1 = ntohl(tcp->th_ack); 1204 sel = aps->aps_sel[1 - out]; 1205 1206 /* switch to other set ? */ 1207 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) && 1208 (seq1 > aps->aps_ackmin[!sel])) { 1209 if (softp->ips_proxy_debug & 0x10) 1210 printf("proxy out switch set ack %d -> %d %x > %x\n", 1211 sel, !sel, seq1, 1212 aps->aps_ackmin[!sel]); 1213 sel = aps->aps_sel[1 - out] = !sel; 1214 } 1215 1216 if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) { 1217 seq2 = aps->aps_ackoff[sel]; 1218 tcp->th_ack = htonl(seq1 - seq2); 1219 ch = 1; 1220 } 1221 } else { 1222 seq1 = ntohl(tcp->th_seq); 1223 sel = aps->aps_sel[out]; 1224 1225 /* switch to other set ? */ 1226 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) && 1227 (seq1 > aps->aps_ackmin[!sel])) { 1228 if (softp->ips_proxy_debug & 0x10) 1229 printf("proxy in switch set ack %d -> %d %x > %x\n", 1230 sel, !sel, seq1, aps->aps_ackmin[!sel]); 1231 sel = aps->aps_sel[out] = !sel; 1232 } 1233 1234 if (aps->aps_ackoff[sel]) { 1235 seq2 = aps->aps_ackmin[sel] - aps->aps_ackoff[sel]; 1236 if (seq1 > seq2) { 1237 seq2 = aps->aps_ackoff[sel]; 1238 seq1 += seq2; 1239 tcp->th_seq = htonl(seq1); 1240 ch = 1; 1241 } 1242 } 1243 1244 if (inc && (seq1 > aps->aps_ackmin[!sel])) { 1245 aps->aps_ackmin[!sel] = seq1 + nlen - 1; 1246 aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc; 1247 1248 if (softp->ips_proxy_debug & 0x10) 1249 printf("proxy ack set %d at %x to %d + %d\n", 1250 !sel, aps->aps_seqmin[!sel], 1251 aps->aps_seqoff[sel], inc); 1252 } 1253 1254 /***/ 1255 1256 seq1 = ntohl(tcp->th_ack); 1257 sel = aps->aps_sel[1 - out]; 1258 1259 /* switch to other set ? */ 1260 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) && 1261 (seq1 > aps->aps_seqmin[!sel])) { 1262 if (softp->ips_proxy_debug & 0x10) 1263 printf("proxy in switch set seq %d -> %d %x > %x\n", 1264 sel, !sel, seq1, aps->aps_seqmin[!sel]); 1265 sel = aps->aps_sel[1 - out] = !sel; 1266 } 1267 1268 if (aps->aps_seqoff[sel] != 0) { 1269 if (softp->ips_proxy_debug & 0x10) 1270 printf("sel %d seqoff %d seq1 %x seqmin %x\n", 1271 sel, aps->aps_seqoff[sel], seq1, 1272 aps->aps_seqmin[sel]); 1273 if (seq1 > aps->aps_seqmin[sel]) { 1274 seq2 = aps->aps_seqoff[sel]; 1275 tcp->th_ack = htonl(seq1 - seq2); 1276 ch = 1; 1277 } 1278 } 1279 } 1280 1281 if (softp->ips_proxy_debug & 0x10) 1282 printf("ipf_proxy_fixseqack: seq %u ack %u\n", 1283 (u_32_t)ntohl(tcp->th_seq), (u_32_t)ntohl(tcp->th_ack)); 1284 return ch ? 2 : 0; 1285 } 1286 1287 1288 /* ------------------------------------------------------------------------ */ 1289 /* Function: ipf_proxy_rule_rev */ 1290 /* Returns: ipnat_t * - NULL = failure, else pointer to new rule */ 1291 /* Parameters: nat(I) - pointer to NAT session to create rule from */ 1292 /* */ 1293 /* This function creates a NAT rule that is based upon the reverse packet */ 1294 /* flow associated with this NAT session. Thus if this NAT session was */ 1295 /* created with a map rule then this function will create a rdr rule. */ 1296 /* Only address fields and network interfaces are assigned in this function */ 1297 /* and the address fields are formed such that an exact is required. If the */ 1298 /* original rule had a netmask, that is not replicated here not is it */ 1299 /* desired. The ultimate goal here is to create a NAT rule to support a NAT */ 1300 /* session being created that does not have a user configured rule. The */ 1301 /* classic example is supporting the FTP proxy, where a data channel needs */ 1302 /* to be setup, based on the addresses used for the control connection. In */ 1303 /* that case, this function is used to handle creating NAT rules to support */ 1304 /* data connections with the PORT and EPRT commands. */ 1305 /* ------------------------------------------------------------------------ */ 1306 ipnat_t * 1307 ipf_proxy_rule_rev(nat) 1308 nat_t *nat; 1309 { 1310 ipnat_t *old; 1311 ipnat_t *ipn; 1312 int size; 1313 1314 old = nat->nat_ptr; 1315 size = old->in_size; 1316 1317 KMALLOCS(ipn, ipnat_t *, size); 1318 if (ipn == NULL) 1319 return NULL; 1320 1321 bzero((char *)ipn, size); 1322 1323 ipn->in_use = 1; 1324 ipn->in_hits = 1; 1325 ipn->in_ippip = 1; 1326 ipn->in_apr = NULL; 1327 ipn->in_size = size; 1328 ipn->in_pr[0] = old->in_pr[1]; 1329 ipn->in_pr[1] = old->in_pr[0]; 1330 ipn->in_v[0] = old->in_v[1]; 1331 ipn->in_v[1] = old->in_v[0]; 1332 ipn->in_ifps[0] = old->in_ifps[1]; 1333 ipn->in_ifps[1] = old->in_ifps[0]; 1334 ipn->in_flags = (old->in_flags | IPN_PROXYRULE); 1335 1336 ipn->in_nsrcip6 = nat->nat_odst6; 1337 ipn->in_osrcip6 = nat->nat_ndst6; 1338 1339 if ((old->in_redir & NAT_REDIRECT) != 0) { 1340 ipn->in_redir = NAT_MAP; 1341 if (ipn->in_v[0] == 4) { 1342 ipn->in_snip = ntohl(nat->nat_odstaddr); 1343 ipn->in_dnip = ntohl(nat->nat_nsrcaddr); 1344 } else { 1345 #ifdef USE_INET6 1346 ipn->in_snip6 = nat->nat_odst6; 1347 ipn->in_dnip6 = nat->nat_nsrc6; 1348 #endif 1349 } 1350 ipn->in_ndstip6 = nat->nat_nsrc6; 1351 ipn->in_odstip6 = nat->nat_osrc6; 1352 } else { 1353 ipn->in_redir = NAT_REDIRECT; 1354 if (ipn->in_v[0] == 4) { 1355 ipn->in_snip = ntohl(nat->nat_odstaddr); 1356 ipn->in_dnip = ntohl(nat->nat_osrcaddr); 1357 } else { 1358 #ifdef USE_INET6 1359 ipn->in_snip6 = nat->nat_odst6; 1360 ipn->in_dnip6 = nat->nat_osrc6; 1361 #endif 1362 } 1363 ipn->in_ndstip6 = nat->nat_osrc6; 1364 ipn->in_odstip6 = nat->nat_nsrc6; 1365 } 1366 1367 IP6_SETONES(&ipn->in_osrcmsk6); 1368 IP6_SETONES(&ipn->in_nsrcmsk6); 1369 IP6_SETONES(&ipn->in_odstmsk6); 1370 IP6_SETONES(&ipn->in_ndstmsk6); 1371 1372 ipn->in_namelen = old->in_namelen; 1373 ipn->in_ifnames[0] = old->in_ifnames[1]; 1374 ipn->in_ifnames[1] = old->in_ifnames[0]; 1375 bcopy(old->in_names, ipn->in_names, ipn->in_namelen); 1376 MUTEX_INIT(&ipn->in_lock, "ipnat rev rule lock"); 1377 1378 return ipn; 1379 } 1380 1381 1382 /* ------------------------------------------------------------------------ */ 1383 /* Function: ipf_proxy_rule_fwd */ 1384 /* Returns: ipnat_t * - NULL = failure, else pointer to new rule */ 1385 /* Parameters: nat(I) - pointer to NAT session to create rule from */ 1386 /* */ 1387 /* The purpose and rationale of this function is much the same as the above */ 1388 /* function, ipf_proxy_rule_rev, except that a rule is created that matches */ 1389 /* the same direction as that of the existing NAT session. Thus if this NAT */ 1390 /* session was created with a map rule then this function will also create */ 1391 /* a data structure to represent a map rule. Whereas ipf_proxy_rule_rev is */ 1392 /* used to support PORT/EPRT, this function supports PASV/EPSV. */ 1393 /* ------------------------------------------------------------------------ */ 1394 ipnat_t * 1395 ipf_proxy_rule_fwd(nat) 1396 nat_t *nat; 1397 { 1398 ipnat_t *old; 1399 ipnat_t *ipn; 1400 int size; 1401 1402 old = nat->nat_ptr; 1403 size = old->in_size; 1404 1405 KMALLOCS(ipn, ipnat_t *, size); 1406 if (ipn == NULL) 1407 return NULL; 1408 1409 bzero((char *)ipn, size); 1410 1411 ipn->in_use = 1; 1412 ipn->in_hits = 1; 1413 ipn->in_ippip = 1; 1414 ipn->in_apr = NULL; 1415 ipn->in_size = size; 1416 ipn->in_pr[0] = old->in_pr[0]; 1417 ipn->in_pr[1] = old->in_pr[1]; 1418 ipn->in_v[0] = old->in_v[0]; 1419 ipn->in_v[1] = old->in_v[1]; 1420 ipn->in_ifps[0] = nat->nat_ifps[0]; 1421 ipn->in_ifps[1] = nat->nat_ifps[1]; 1422 ipn->in_flags = (old->in_flags | IPN_PROXYRULE); 1423 1424 ipn->in_nsrcip6 = nat->nat_nsrc6; 1425 ipn->in_osrcip6 = nat->nat_osrc6; 1426 ipn->in_ndstip6 = nat->nat_ndst6; 1427 ipn->in_odstip6 = nat->nat_odst6; 1428 ipn->in_redir = old->in_redir; 1429 1430 if (ipn->in_v[0] == 4) { 1431 ipn->in_snip = ntohl(nat->nat_nsrcaddr); 1432 ipn->in_dnip = ntohl(nat->nat_ndstaddr); 1433 } else { 1434 #ifdef USE_INET6 1435 ipn->in_snip6 = nat->nat_nsrc6; 1436 ipn->in_dnip6 = nat->nat_ndst6; 1437 #endif 1438 } 1439 1440 IP6_SETONES(&ipn->in_osrcmsk6); 1441 IP6_SETONES(&ipn->in_nsrcmsk6); 1442 IP6_SETONES(&ipn->in_odstmsk6); 1443 IP6_SETONES(&ipn->in_ndstmsk6); 1444 1445 ipn->in_namelen = old->in_namelen; 1446 ipn->in_ifnames[0] = old->in_ifnames[0]; 1447 ipn->in_ifnames[1] = old->in_ifnames[1]; 1448 bcopy(old->in_names, ipn->in_names, ipn->in_namelen); 1449 MUTEX_INIT(&ipn->in_lock, "ipnat fwd rule lock"); 1450 1451 return ipn; 1452 } 1453
Indexes created Thu Sep 25 16:09:42 GMT 2025