ip_rcmd_pxy.c revision 1.1
1 /* $NetBSD: ip_rcmd_pxy.c,v 1.1 2012/03/23 20:37:02 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2011 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id 9 * 10 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT 11 * code. 12 */ 13 14 #define IPF_RCMD_PROXY 15 16 void ipf_p_rcmd_main_load __P((void)); 17 void ipf_p_rcmd_main_unload __P((void)); 18 19 int ipf_p_rcmd_init __P((void)); 20 void ipf_p_rcmd_fini __P((void)); 21 void ipf_p_rcmd_del __P((ipf_main_softc_t *, ap_session_t *)); 22 int ipf_p_rcmd_new __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 23 int ipf_p_rcmd_out __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 24 int ipf_p_rcmd_in __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 25 u_short ipf_rcmd_atoi __P((char *)); 26 int ipf_p_rcmd_portmsg __P((fr_info_t *, ap_session_t *, nat_t *)); 27 28 static frentry_t rcmdfr; 29 30 static int rcmd_proxy_init = 0; 31 32 33 /* 34 * RCMD application proxy initialization. 35 */ 36 void 37 ipf_p_rcmd_main_load() 38 { 39 bzero((char *)&rcmdfr, sizeof(rcmdfr)); 40 rcmdfr.fr_ref = 1; 41 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 42 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock"); 43 rcmd_proxy_init = 1; 44 } 45 46 47 void 48 ipf_p_rcmd_main_unload() 49 { 50 if (rcmd_proxy_init == 1) { 51 MUTEX_DESTROY(&rcmdfr.fr_lock); 52 rcmd_proxy_init = 0; 53 } 54 } 55 56 57 /* 58 * Setup for a new RCMD proxy. 59 */ 60 int 61 ipf_p_rcmd_new(arg, fin, aps, nat) 62 void *arg; 63 fr_info_t *fin; 64 ap_session_t *aps; 65 nat_t *nat; 66 { 67 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp; 68 rcmdinfo_t *rc; 69 ipnat_t *ipn; 70 71 fin = fin; /* LINT */ 72 nat = nat; /* LINT */ 73 74 aps->aps_psiz = sizeof(rcmdinfo_t) + nat->nat_ptr->in_namelen + 1; 75 KMALLOCS(rc, rcmdinfo_t *, aps->aps_psiz); 76 if (rc == NULL) { 77 #ifdef IP_RCMD_PROXY_DEBUG 78 printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc)); 79 #endif 80 return -1; 81 } 82 83 aps->aps_data = rc; 84 bzero((char *)rc, sizeof(*rc)); 85 aps->aps_sport = tcp->th_sport; 86 aps->aps_dport = tcp->th_dport; 87 88 ipn = &rc->rcmd_rule; 89 ipn->in_ifps[0] = nat->nat_ifps[0]; 90 ipn->in_ifps[1] = nat->nat_ifps[1]; 91 ipn->in_apr = NULL; 92 ipn->in_use = 1; 93 ipn->in_hits = 1; 94 ipn->in_ippip = 1; 95 96 if ((nat->nat_ptr->in_redir & NAT_REDIRECT) != 0) { 97 ipn->in_redir = NAT_MAP; 98 ipn->in_snip = ntohl(nat->nat_odstaddr); 99 ipn->in_nsrcaddr = nat->nat_odstaddr; 100 ipn->in_dnip = ntohl(nat->nat_nsrcaddr); 101 ipn->in_ndstaddr = nat->nat_nsrcaddr; 102 ipn->in_osrcaddr = nat->nat_ndstaddr; 103 ipn->in_odstaddr = nat->nat_osrcaddr; 104 } else { 105 ipn->in_redir = NAT_REDIRECT; 106 ipn->in_snip = ntohl(nat->nat_odstaddr); 107 ipn->in_nsrcaddr = nat->nat_odstaddr; 108 ipn->in_dnip = ntohl(nat->nat_osrcaddr); 109 ipn->in_ndstaddr = nat->nat_osrcaddr; 110 ipn->in_osrcaddr = nat->nat_ndstaddr; 111 ipn->in_odstaddr = nat->nat_nsrcaddr; 112 } 113 114 ipn->in_osrcmsk = 0xffffffff; 115 ipn->in_nsrcmsk = 0xffffffff; 116 ipn->in_odstmsk = 0xffffffff; 117 ipn->in_ndstmsk = 0xffffffff; 118 ipn->in_pr[0] = IPPROTO_TCP; 119 ipn->in_pr[1] = IPPROTO_TCP; 120 MUTEX_INIT(&ipn->in_lock, "rcmd proxy NAT rule"); 121 122 ipn->in_namelen = nat->nat_ptr->in_namelen; 123 bcopy(nat->nat_ptr->in_names, ipn->in_ifnames, ipn->in_namelen); 124 ipn->in_ifnames[0] = nat->nat_ptr->in_ifnames[0]; 125 ipn->in_ifnames[1] = nat->nat_ptr->in_ifnames[1]; 126 127 return 0; 128 } 129 130 131 void 132 ipf_p_rcmd_del(softc, aps) 133 ipf_main_softc_t *softc; 134 ap_session_t *aps; 135 { 136 rcmdinfo_t *rci; 137 138 rci = aps->aps_data; 139 if (rci != NULL) { 140 MUTEX_DESTROY(&rci->rcmd_rule.in_lock); 141 } 142 } 143 144 145 /* 146 * ipf_rcmd_atoi - implement a simple version of atoi 147 */ 148 u_short 149 ipf_rcmd_atoi(ptr) 150 char *ptr; 151 { 152 register char *s = ptr, c; 153 register u_short i = 0; 154 155 while (((c = *s++) != '\0') && ISDIGIT(c)) { 156 i *= 10; 157 i += c - '0'; 158 } 159 return i; 160 } 161 162 163 int 164 ipf_p_rcmd_portmsg(fin, aps, nat) 165 fr_info_t *fin; 166 ap_session_t *aps; 167 nat_t *nat; 168 { 169 tcphdr_t *tcp, tcph, *tcp2 = &tcph; 170 int off, dlen, nflags, direction; 171 ipf_main_softc_t *softc; 172 char portbuf[8], *s; 173 rcmdinfo_t *rc; 174 fr_info_t fi; 175 u_short sp; 176 nat_t *nat2; 177 ip_t *ip; 178 mb_t *m; 179 180 tcp = (tcphdr_t *)fin->fin_dp; 181 182 m = fin->fin_m; 183 ip = fin->fin_ip; 184 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 185 186 #ifdef __sgi 187 dlen = fin->fin_plen - off; 188 #else 189 dlen = MSGDSIZE(m) - off; 190 #endif 191 if (dlen <= 0) 192 return 0; 193 194 rc = (rcmdinfo_t *)aps->aps_data; 195 if ((rc->rcmd_portseq != 0) && 196 (tcp->th_seq != rc->rcmd_portseq)) 197 return 0; 198 199 bzero(portbuf, sizeof(portbuf)); 200 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf); 201 202 portbuf[sizeof(portbuf) - 1] = '\0'; 203 s = portbuf; 204 sp = ipf_rcmd_atoi(s); 205 if (sp == 0) { 206 #ifdef IP_RCMD_PROXY_DEBUG 207 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n", 208 dlen, portbuf); 209 #endif 210 return 0; 211 } 212 213 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) { 214 #ifdef IP_RCMD_PROXY_DEBUG 215 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n", 216 sp, rc->rcmd_port); 217 #endif 218 return 0; 219 } 220 221 rc->rcmd_port = sp; 222 rc->rcmd_portseq = tcp->th_seq; 223 224 /* 225 * Initialise the packet info structure so we can search the NAT 226 * table to see if there already is soemthing present that matches 227 * up with what we want to add. 228 */ 229 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 230 fi.fin_flx |= FI_IGNORE; 231 fi.fin_data[0] = 0; 232 fi.fin_data[1] = sp; 233 fi.fin_fi.fi_saddr = nat->nat_ndstaddr; 234 fi.fin_fi.fi_daddr = nat->nat_nsrcaddr; 235 236 if (nat->nat_dir == NAT_OUTBOUND) { 237 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, 238 nat->nat_pr[1], 239 nat->nat_osrcip, nat->nat_odstip); 240 } else { 241 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, 242 nat->nat_pr[0], 243 nat->nat_osrcip, nat->nat_odstip); 244 } 245 246 softc = fin->fin_main_soft; 247 if (nat2 == NULL) { 248 #ifdef USE_MUTEXES 249 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 250 #endif 251 252 /* 253 * Add skeleton NAT entry for connection which will come 254 * back the other way. 255 */ 256 int slen; 257 258 slen = ip->ip_len; 259 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp)); 260 261 /* 262 * Fill out the fake TCP header with a few fields that ipfilter 263 * considers to be important. 264 */ 265 bzero((char *)tcp2, sizeof(*tcp2)); 266 tcp2->th_win = htons(8192); 267 TCP_OFF_A(tcp2, 5); 268 tcp2->th_flags = TH_SYN; 269 270 fi.fin_dp = (char *)tcp2; 271 fi.fin_fr = &rcmdfr; 272 fi.fin_dlen = sizeof(*tcp2); 273 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 274 275 if (nat->nat_dir == NAT_OUTBOUND) { 276 fi.fin_out = 0; 277 direction = NAT_INBOUND; 278 } else { 279 fi.fin_out = 1; 280 direction = NAT_OUTBOUND; 281 } 282 nflags = SI_W_SPORT; 283 284 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 285 286 nflags |= NAT_SLAVE|IPN_TCP; 287 MUTEX_ENTER(&softn->ipf_nat_new); 288 nat2 = ipf_nat_add(&fi, &rc->rcmd_rule, NULL, nflags, 289 direction); 290 MUTEX_EXIT(&softn->ipf_nat_new); 291 292 if (nat2 != NULL) { 293 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 294 MUTEX_ENTER(&nat2->nat_lock); 295 ipf_nat_update(&fi, nat2); 296 MUTEX_EXIT(&nat2->nat_lock); 297 fi.fin_ifp = NULL; 298 if (nat2->nat_dir == NAT_INBOUND) 299 fi.fin_fi.fi_daddr = nat->nat_osrcaddr; 300 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT); 301 } 302 ip->ip_len = slen; 303 } 304 return 0; 305 } 306 307 308 int 309 ipf_p_rcmd_out(arg, fin, aps, nat) 310 void *arg; 311 fr_info_t *fin; 312 ap_session_t *aps; 313 nat_t *nat; 314 { 315 if (nat->nat_dir == NAT_OUTBOUND) 316 return ipf_p_rcmd_portmsg(fin, aps, nat); 317 return 0; 318 } 319 320 321 int 322 ipf_p_rcmd_in(arg, fin, aps, nat) 323 void *arg; 324 fr_info_t *fin; 325 ap_session_t *aps; 326 nat_t *nat; 327 { 328 if (nat->nat_dir == NAT_INBOUND) 329 return ipf_p_rcmd_portmsg(fin, aps, nat); 330 return 0; 331 } 332
Indexes created Tue Sep 30 11:09:46 GMT 2025