1
2/*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * $Id$
8 *
9 * Simple RCMD transparent proxy for in-kernel use.  For use with the NAT
10 * code.
11 */
12
13#define	IPF_RCMD_PROXY
14
15typedef struct rcmdinfo {
16	u_32_t	rcmd_port;	/* Port number seen */
17	u_32_t	rcmd_portseq;	/* Sequence number where port is first seen */
18	ipnat_t	*rcmd_rule;	/* Template rule for back connection */
19} rcmdinfo_t;
20
21void ipf_p_rcmd_main_load(void);
22void ipf_p_rcmd_main_unload(void);
23
24int ipf_p_rcmd_init(void);
25void ipf_p_rcmd_fini(void);
26void ipf_p_rcmd_del(ipf_main_softc_t *, ap_session_t *);
27int ipf_p_rcmd_new(void *, fr_info_t *, ap_session_t *, nat_t *);
28int ipf_p_rcmd_out(void *, fr_info_t *, ap_session_t *, nat_t *);
29int ipf_p_rcmd_in(void *, fr_info_t *, ap_session_t *, nat_t *);
30u_short ipf_rcmd_atoi(char *);
31int ipf_p_rcmd_portmsg(fr_info_t *, ap_session_t *, nat_t *);
32
33static	frentry_t	rcmdfr;
34
35static	int		rcmd_proxy_init = 0;
36
37
38/*
39 * RCMD application proxy initialization.
40 */
41void
42ipf_p_rcmd_main_load(void)
43{
44	bzero((char *)&rcmdfr, sizeof(rcmdfr));
45	rcmdfr.fr_ref = 1;
46	rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
47	MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock");
48	rcmd_proxy_init = 1;
49}
50
51
52void
53ipf_p_rcmd_main_unload(void)
54{
55	if (rcmd_proxy_init == 1) {
56		MUTEX_DESTROY(&rcmdfr.fr_lock);
57		rcmd_proxy_init = 0;
58	}
59}
60
61
62/*
63 * Setup for a new RCMD proxy.
64 */
65int
66ipf_p_rcmd_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
67{
68	tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
69	rcmdinfo_t *rc;
70	ipnat_t *ipn;
71	ipnat_t *np;
72	int size;
73
74	fin = fin;	/* LINT */
75
76	np = nat->nat_ptr;
77	size = np->in_size;
78	KMALLOC(rc, rcmdinfo_t *);
79	if (rc == NULL) {
80#ifdef IP_RCMD_PROXY_DEBUG
81		printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc));
82#endif
83		return (-1);
84	}
85	aps->aps_sport = tcp->th_sport;
86	aps->aps_dport = tcp->th_dport;
87
88	ipn = ipf_proxy_rule_rev(nat);
89	if (ipn == NULL) {
90		KFREE(rc);
91		return (-1);
92	}
93
94	aps->aps_data = rc;
95	aps->aps_psiz = sizeof(*rc);
96	bzero((char *)rc, sizeof(*rc));
97
98	rc->rcmd_rule = ipn;
99
100	return (0);
101}
102
103
104void
105ipf_p_rcmd_del(ipf_main_softc_t *softc, ap_session_t *aps)
106{
107	rcmdinfo_t *rci;
108
109	rci = aps->aps_data;
110	if (rci != NULL) {
111		rci->rcmd_rule->in_flags |= IPN_DELETE;
112		ipf_nat_rule_deref(softc, &rci->rcmd_rule);
113	}
114}
115
116
117/*
118 * ipf_rcmd_atoi - implement a simple version of atoi
119 */
120u_short
121ipf_rcmd_atoi(char *ptr)
122{
123	register char *s = ptr, c;
124	register u_short i = 0;
125
126	while (((c = *s++) != '\0') && ISDIGIT(c)) {
127		i *= 10;
128		i += c - '0';
129	}
130	return (i);
131}
132
133
134int
135ipf_p_rcmd_portmsg(fr_info_t *fin, ap_session_t *aps, nat_t *nat)
136{
137	tcphdr_t *tcp, tcph, *tcp2 = &tcph;
138	int off, dlen, nflags, direction;
139	ipf_main_softc_t *softc;
140	ipf_nat_softc_t *softn;
141	char portbuf[8], *s;
142	rcmdinfo_t *rc;
143	fr_info_t fi;
144	u_short sp;
145	nat_t *nat2;
146#ifdef USE_INET6
147	ip6_t *ip6;
148#endif
149	int tcpsz;
150	int slen = 0; /* silence gcc */
151	ip_t *ip;
152	mb_t *m;
153
154	tcp = (tcphdr_t *)fin->fin_dp;
155
156	m = fin->fin_m;
157	ip = fin->fin_ip;
158	tcpsz = TCP_OFF(tcp) << 2;
159#ifdef USE_INET6
160	ip6 = (ip6_t *)fin->fin_ip;
161#endif
162	softc = fin->fin_main_soft;
163	softn = softc->ipf_nat_soft;
164	off = (char *)tcp - (char *)ip + tcpsz + fin->fin_ipoff;
165
166	dlen = fin->fin_dlen - tcpsz;
167	if (dlen <= 0)
168		return (0);
169
170	rc = (rcmdinfo_t *)aps->aps_data;
171	if ((rc->rcmd_portseq != 0) &&
172	    (tcp->th_seq != rc->rcmd_portseq))
173		return (0);
174
175	bzero(portbuf, sizeof(portbuf));
176	COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf);
177
178	portbuf[sizeof(portbuf) - 1] = '\0';
179	s = portbuf;
180	sp = ipf_rcmd_atoi(s);
181	if (sp == 0) {
182#ifdef IP_RCMD_PROXY_DEBUG
183		printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n",
184		       dlen, portbuf);
185#endif
186		return (0);
187	}
188
189	if (rc->rcmd_port != 0 && sp != rc->rcmd_port) {
190#ifdef IP_RCMD_PROXY_DEBUG
191		printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n",
192		       sp, rc->rcmd_port);
193#endif
194		return (0);
195	}
196
197	rc->rcmd_port = sp;
198	rc->rcmd_portseq = tcp->th_seq;
199
200	/*
201	 * Initialise the packet info structure so we can search the NAT
202	 * table to see if there already is soemthing present that matches
203	 * up with what we want to add.
204	 */
205	bcopy((char *)fin, (char *)&fi, sizeof(fi));
206	fi.fin_flx |= FI_IGNORE;
207	fi.fin_data[0] = 0;
208	fi.fin_data[1] = sp;
209	fi.fin_src6 = nat->nat_ndst6;
210	fi.fin_dst6 = nat->nat_nsrc6;
211
212	if (nat->nat_v[0] == 6) {
213#ifdef USE_INET6
214		if (nat->nat_dir == NAT_OUTBOUND) {
215			nat2 = ipf_nat6_outlookup(&fi, NAT_SEARCH|IPN_TCP,
216						  nat->nat_pr[1],
217						  &nat->nat_osrc6.in6,
218						  &nat->nat_odst6.in6);
219		} else {
220			nat2 = ipf_nat6_inlookup(&fi, NAT_SEARCH|IPN_TCP,
221						 nat->nat_pr[0],
222						 &nat->nat_osrc6.in6,
223						 &nat->nat_odst6.in6);
224		}
225#else
226		nat2 = (void *)-1;
227#endif
228	} else {
229		if (nat->nat_dir == NAT_OUTBOUND) {
230			nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP,
231						 nat->nat_pr[1],
232						 nat->nat_osrcip,
233						 nat->nat_odstip);
234		} else {
235			nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP,
236						nat->nat_pr[0],
237						nat->nat_osrcip,
238						nat->nat_odstip);
239		}
240	}
241	if (nat2 != NULL)
242		return (APR_ERR(1));
243
244	/*
245	 * Add skeleton NAT entry for connection which will come
246	 * back the other way.
247	 */
248
249	if (nat->nat_v[0] == 6) {
250#ifdef USE_INET6
251		slen = ip6->ip6_plen;
252		ip6->ip6_plen = htons(sizeof(*tcp));
253#endif
254	} else {
255		slen = ip->ip_len;
256		ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp));
257	}
258
259	/*
260	 * Fill out the fake TCP header with a few fields that ipfilter
261	 * considers to be important.
262	 */
263	bzero((char *)tcp2, sizeof(*tcp2));
264	tcp2->th_win = htons(8192);
265	TCP_OFF_A(tcp2, 5);
266	tcp2->th_flags = TH_SYN;
267
268	fi.fin_dp = (char *)tcp2;
269	fi.fin_fr = &rcmdfr;
270	fi.fin_dlen = sizeof(*tcp2);
271	fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
272	fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
273
274	if (nat->nat_dir == NAT_OUTBOUND) {
275		fi.fin_out = 0;
276		direction = NAT_INBOUND;
277	} else {
278		fi.fin_out = 1;
279		direction = NAT_OUTBOUND;
280	}
281	nflags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
282
283	MUTEX_ENTER(&softn->ipf_nat_new);
284	if (fin->fin_v == 4)
285		nat2 = ipf_nat_add(&fi, rc->rcmd_rule, NULL, nflags,
286				   direction);
287#ifdef USE_INET6
288	else
289		nat2 = ipf_nat6_add(&fi, rc->rcmd_rule, NULL, nflags,
290				    direction);
291#endif
292	MUTEX_EXIT(&softn->ipf_nat_new);
293
294	if (nat2 != NULL) {
295		(void) ipf_nat_proto(&fi, nat2, IPN_TCP);
296		MUTEX_ENTER(&nat2->nat_lock);
297		ipf_nat_update(&fi, nat2);
298		MUTEX_EXIT(&nat2->nat_lock);
299		fi.fin_ifp = NULL;
300		if (nat2->nat_dir == NAT_INBOUND)
301			fi.fin_dst6 = nat->nat_osrc6;
302		(void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT);
303	}
304	if (nat->nat_v[0] == 6) {
305#ifdef USE_INET6
306		ip6->ip6_plen = slen;
307#endif
308	} else {
309		ip->ip_len = slen;
310	}
311	if (nat2 == NULL)
312		return (APR_ERR(1));
313	return (0);
314}
315
316
317int
318ipf_p_rcmd_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
319{
320	if (nat->nat_dir == NAT_OUTBOUND)
321		return (ipf_p_rcmd_portmsg(fin, aps, nat));
322	return (0);
323}
324
325
326int
327ipf_p_rcmd_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
328{
329	if (nat->nat_dir == NAT_INBOUND)
330		return (ipf_p_rcmd_portmsg(fin, aps, nat));
331	return (0);
332}
333