ip_rcmd_pxy.c revision 1.2
1 /* $NetBSD: ip_rcmd_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2011 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id: ip_rcmd_pxy.c,v 1.65.2.2 2012/01/26 05:29:13 darrenr Exp 9 * 10 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT 11 * code. 12 */ 13 14 #include <sys/cdefs.h> 15 __KERNEL_RCSID(1, "$NetBSD: ip_rcmd_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $"); 16 17 #define IPF_RCMD_PROXY 18 19 void ipf_p_rcmd_main_load(void); 20 void ipf_p_rcmd_main_unload(void); 21 22 int ipf_p_rcmd_init(void); 23 void ipf_p_rcmd_fini(void); 24 void ipf_p_rcmd_del(ipf_main_softc_t *, ap_session_t *); 25 int ipf_p_rcmd_new(void *, fr_info_t *, ap_session_t *, nat_t *); 26 int ipf_p_rcmd_out(void *, fr_info_t *, ap_session_t *, nat_t *); 27 int ipf_p_rcmd_in(void *, fr_info_t *, ap_session_t *, nat_t *); 28 u_short ipf_rcmd_atoi(char *); 29 int ipf_p_rcmd_portmsg(fr_info_t *, ap_session_t *, nat_t *); 30 31 static frentry_t rcmdfr; 32 33 static int rcmd_proxy_init = 0; 34 35 36 /* 37 * RCMD application proxy initialization. 38 */ 39 void 40 ipf_p_rcmd_main_load(void) 41 { 42 bzero((char *)&rcmdfr, sizeof(rcmdfr)); 43 rcmdfr.fr_ref = 1; 44 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 45 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock"); 46 rcmd_proxy_init = 1; 47 } 48 49 50 void 51 ipf_p_rcmd_main_unload(void) 52 { 53 if (rcmd_proxy_init == 1) { 54 MUTEX_DESTROY(&rcmdfr.fr_lock); 55 rcmd_proxy_init = 0; 56 } 57 } 58 59 60 /* 61 * Setup for a new RCMD proxy. 62 */ 63 int 64 ipf_p_rcmd_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 65 { 66 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp; 67 rcmdinfo_t *rc; 68 ipnat_t *ipn; 69 70 fin = fin; /* LINT */ 71 nat = nat; /* LINT */ 72 73 aps->aps_psiz = sizeof(rcmdinfo_t) + nat->nat_ptr->in_namelen + 1; 74 KMALLOCS(rc, rcmdinfo_t *, aps->aps_psiz); 75 if (rc == NULL) { 76 printf("ipf_p_rcmd_new:KMALLOCS(%zu) failed\n", sizeof(*rc)); 77 return -1; 78 } 79 80 aps->aps_data = rc; 81 bzero((char *)rc, sizeof(*rc)); 82 aps->aps_sport = tcp->th_sport; 83 aps->aps_dport = tcp->th_dport; 84 85 ipn = &rc->rcmd_rule; 86 ipn->in_ifps[0] = nat->nat_ifps[0]; 87 ipn->in_ifps[1] = nat->nat_ifps[1]; 88 ipn->in_apr = NULL; 89 ipn->in_use = 1; 90 ipn->in_hits = 1; 91 ipn->in_ippip = 1; 92 93 if ((nat->nat_ptr->in_redir & NAT_REDIRECT) != 0) { 94 ipn->in_redir = NAT_MAP; 95 ipn->in_snip = ntohl(nat->nat_odstaddr); 96 ipn->in_nsrcaddr = nat->nat_odstaddr; 97 ipn->in_dnip = ntohl(nat->nat_nsrcaddr); 98 ipn->in_ndstaddr = nat->nat_nsrcaddr; 99 ipn->in_osrcaddr = nat->nat_ndstaddr; 100 ipn->in_odstaddr = nat->nat_osrcaddr; 101 } else { 102 ipn->in_redir = NAT_REDIRECT; 103 ipn->in_snip = ntohl(nat->nat_odstaddr); 104 ipn->in_nsrcaddr = nat->nat_odstaddr; 105 ipn->in_dnip = ntohl(nat->nat_osrcaddr); 106 ipn->in_ndstaddr = nat->nat_osrcaddr; 107 ipn->in_osrcaddr = nat->nat_ndstaddr; 108 ipn->in_odstaddr = nat->nat_nsrcaddr; 109 } 110 111 ipn->in_osrcmsk = 0xffffffff; 112 ipn->in_nsrcmsk = 0xffffffff; 113 ipn->in_odstmsk = 0xffffffff; 114 ipn->in_ndstmsk = 0xffffffff; 115 ipn->in_pr[0] = IPPROTO_TCP; 116 ipn->in_pr[1] = IPPROTO_TCP; 117 MUTEX_INIT(&ipn->in_lock, "rcmd proxy NAT rule"); 118 119 ipn->in_namelen = nat->nat_ptr->in_namelen; 120 bcopy(nat->nat_ptr->in_names, ipn->in_ifnames, ipn->in_namelen); 121 ipn->in_ifnames[0] = nat->nat_ptr->in_ifnames[0]; 122 ipn->in_ifnames[1] = nat->nat_ptr->in_ifnames[1]; 123 124 return 0; 125 } 126 127 128 void 129 ipf_p_rcmd_del(ipf_main_softc_t *softc, ap_session_t *aps) 130 { 131 rcmdinfo_t *rci; 132 133 rci = aps->aps_data; 134 if (rci != NULL) { 135 MUTEX_DESTROY(&rci->rcmd_rule.in_lock); 136 } 137 } 138 139 140 /* 141 * ipf_rcmd_atoi - implement a simple version of atoi 142 */ 143 u_short 144 ipf_rcmd_atoi(char *ptr) 145 { 146 char *s = ptr, c; 147 u_short i = 0; 148 149 while (((c = *s++) != '\0') && ISDIGIT(c)) { 150 i *= 10; 151 i += c - '0'; 152 } 153 return i; 154 } 155 156 157 int 158 ipf_p_rcmd_portmsg(fr_info_t *fin, ap_session_t *aps, nat_t *nat) 159 { 160 tcphdr_t *tcp, tcph, *tcp2 = &tcph; 161 int off, dlen, nflags, direction; 162 ipf_main_softc_t *softc; 163 char portbuf[8], *s; 164 rcmdinfo_t *rc; 165 fr_info_t fi; 166 u_short sp; 167 nat_t *nat2; 168 ip_t *ip; 169 mb_t *m; 170 171 tcp = (tcphdr_t *)fin->fin_dp; 172 173 m = fin->fin_m; 174 ip = fin->fin_ip; 175 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 176 177 #ifdef __sgi 178 dlen = fin->fin_plen - off; 179 #else 180 dlen = MSGDSIZE(m) - off; 181 #endif 182 if (dlen <= 0) 183 return 0; 184 185 rc = (rcmdinfo_t *)aps->aps_data; 186 if ((rc->rcmd_portseq != 0) && 187 (tcp->th_seq != rc->rcmd_portseq)) 188 return 0; 189 190 bzero(portbuf, sizeof(portbuf)); 191 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf); 192 193 portbuf[sizeof(portbuf) - 1] = '\0'; 194 s = portbuf; 195 sp = ipf_rcmd_atoi(s); 196 if (sp == 0) { 197 #ifdef IP_RCMD_PROXY_DEBUG 198 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n", 199 dlen, portbuf); 200 #endif 201 return 0; 202 } 203 204 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) { 205 #ifdef IP_RCMD_PROXY_DEBUG 206 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n", 207 sp, rc->rcmd_port); 208 #endif 209 return 0; 210 } 211 212 rc->rcmd_port = sp; 213 rc->rcmd_portseq = tcp->th_seq; 214 215 /* 216 * Initialise the packet info structure so we can search the NAT 217 * table to see if there already is soemthing present that matches 218 * up with what we want to add. 219 */ 220 bcopy((char *)fin, (char *)&fi, sizeof(fi)); 221 fi.fin_flx |= FI_IGNORE; 222 fi.fin_data[0] = 0; 223 fi.fin_data[1] = sp; 224 fi.fin_fi.fi_saddr = nat->nat_ndstaddr; 225 fi.fin_fi.fi_daddr = nat->nat_nsrcaddr; 226 227 if (nat->nat_dir == NAT_OUTBOUND) { 228 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, 229 nat->nat_pr[1], 230 nat->nat_osrcip, nat->nat_odstip); 231 } else { 232 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, 233 nat->nat_pr[0], 234 nat->nat_osrcip, nat->nat_odstip); 235 } 236 237 softc = fin->fin_main_soft; 238 if (nat2 == NULL) { 239 #ifdef USE_MUTEXES 240 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 241 #endif 242 243 /* 244 * Add skeleton NAT entry for connection which will come 245 * back the other way. 246 */ 247 int slen; 248 249 slen = ip->ip_len; 250 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp)); 251 252 /* 253 * Fill out the fake TCP header with a few fields that ipfilter 254 * considers to be important. 255 */ 256 bzero((char *)tcp2, sizeof(*tcp2)); 257 tcp2->th_win = htons(8192); 258 TCP_OFF_A(tcp2, 5); 259 tcp2->th_flags = TH_SYN; 260 261 fi.fin_dp = (char *)tcp2; 262 fi.fin_fr = &rcmdfr; 263 fi.fin_dlen = sizeof(*tcp2); 264 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 265 266 if (nat->nat_dir == NAT_OUTBOUND) { 267 fi.fin_out = 0; 268 direction = NAT_INBOUND; 269 } else { 270 fi.fin_out = 1; 271 direction = NAT_OUTBOUND; 272 } 273 nflags = SI_W_SPORT; 274 275 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE; 276 277 nflags |= NAT_SLAVE|IPN_TCP; 278 MUTEX_ENTER(&softn->ipf_nat_new); 279 nat2 = ipf_nat_add(&fi, &rc->rcmd_rule, NULL, nflags, 280 direction); 281 MUTEX_EXIT(&softn->ipf_nat_new); 282 283 if (nat2 != NULL) { 284 (void) ipf_nat_proto(&fi, nat2, IPN_TCP); 285 MUTEX_ENTER(&nat2->nat_lock); 286 ipf_nat_update(&fi, nat2); 287 MUTEX_EXIT(&nat2->nat_lock); 288 fi.fin_ifp = NULL; 289 if (nat2->nat_dir == NAT_INBOUND) 290 fi.fin_fi.fi_daddr = nat->nat_osrcaddr; 291 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT); 292 } 293 ip->ip_len = slen; 294 } 295 return 0; 296 } 297 298 299 int 300 ipf_p_rcmd_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 301 { 302 if (nat->nat_dir == NAT_OUTBOUND) 303 return ipf_p_rcmd_portmsg(fin, aps, nat); 304 return 0; 305 } 306 307 308 int 309 ipf_p_rcmd_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 310 { 311 if (nat->nat_dir == NAT_INBOUND) 312 return ipf_p_rcmd_portmsg(fin, aps, nat); 313 return 0; 314 } 315
Indexes created Tue Sep 30 11:09:46 GMT 2025