contrib/ipfilter/ip_proxy.c

   1 /*
   2  * Copyright (C) 1997-2002 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  */
   6 #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
   7 # define        _KERNEL
   8 #endif
   9
  10 #if defined(__sgi) && (IRIX > 602)
  11 # include <sys/ptimers.h>
  12 #endif
  13 #include <sys/errno.h>
  14 #include <sys/types.h>
  15 #include <sys/param.h>
  16 #include <sys/time.h>
  17 #include <sys/file.h>
  18 #if !defined(__FreeBSD_version)
  19 # include <sys/ioctl.h>
  20 #endif
  21 #include <sys/fcntl.h>
  22 #if !defined(_KERNEL) && !defined(KERNEL)
  23 # include <stdio.h>
  24 # include <string.h>
  25 # include <stdlib.h>
  26 #endif
  27 #ifndef linux
  28 # include <sys/protosw.h>
  29 #endif
  30 #include <sys/socket.h>
  31 #if defined(_KERNEL)
  32 # if !defined(linux)
  33 #  include <sys/systm.h>
  34 # else
  35 #  include <linux/string.h>
  36 # endif
  37 #endif
  38 #if !defined(__SVR4) && !defined(__svr4__)
  39 # ifndef linux
  40 #  include <sys/mbuf.h>
  41 # endif
  42 #else
  43 # include <sys/byteorder.h>
  44 # ifdef _KERNEL
  45 #  include <sys/dditypes.h>
  46 # endif
  47 # include <sys/stream.h>
  48 # include <sys/kmem.h>
  49 #endif
  50 #if __FreeBSD__ > 2
  51 # include <sys/queue.h>
  52 #endif
  53 #include <net/if.h>
  54 #ifdef sun
  55 # include <net/af.h>
  56 #endif
  57 #include <net/route.h>
  58 #include <netinet/in.h>
  59 #include <netinet/in_systm.h>
  60 #include <netinet/ip.h>
  61 #ifndef linux
  62 # include <netinet/ip_var.h>
  63 #endif
  64 #include <netinet/tcp.h>
  65 #include <netinet/udp.h>
  66 #include <netinet/ip_icmp.h>
  67 #include "netinet/ip_compat.h"
  68 #include <netinet/tcpip.h>
  69 #include "netinet/ip_fil.h"
  70 #include "netinet/ip_nat.h"
  71 #include "netinet/ip_state.h"
  72 #include "netinet/ip_proxy.h"
  73 #if (__FreeBSD_version >= 300000)
  74 # include <sys/malloc.h>
  75 #endif
  76
  77 #if !defined(lint)
  78 static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.26 2002/12/06 11:40:23 darrenr Exp $";
  79 #endif
  80
  81 #if defined(_KERNEL) && (SOLARIS || defined(__sgi))
  82 extern  KRWLOCK_T       ipf_nat, ipf_state;
  83 #endif
  84
  85 #ifndef MIN
  86 #define MIN(a,b)        (((a)<(b))?(a):(b))
  87 #endif
  88
  89 static int appr_fixseqack __P((fr_info_t *, ip_t *, ap_session_t *, int ));
  90
  91
  92 #define PROXY_DEBUG 0
  93
  94 #define AP_SESS_SIZE    53
  95
  96 #include "netinet/ip_ftp_pxy.c"
  97 #if defined(_KERNEL)
  98 #include "netinet/ip_rcmd_pxy.c"
  99 #include "netinet/ip_raudio_pxy.c"
 100 #include "netinet/ip_netbios_pxy.c"
 101 #include "netinet/ip_h323_pxy.c"
 102 #endif
 103 #include "netinet/ip_ipsec_pxy.c"
 104
 105 ap_session_t    *ap_sess_tab[AP_SESS_SIZE];
 106 ap_session_t    *ap_sess_list = NULL;
 107 aproxy_t        *ap_proxylist = NULL;
 108 aproxy_t        ap_proxies[] = {
 109 #ifdef  IPF_FTP_PROXY
 110         { NULL, "ftp", (char)IPPROTO_TCP, 0, 0, ippr_ftp_init, NULL,
 111           ippr_ftp_new, NULL, ippr_ftp_in, ippr_ftp_out, NULL },
 112 #endif
 113 #ifdef  IPF_RCMD_PROXY
 114         { NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, ippr_rcmd_init, NULL,
 115           ippr_rcmd_new, NULL, NULL, ippr_rcmd_out, NULL },
 116 #endif
 117 #ifdef  IPF_RAUDIO_PROXY
 118         { NULL, "raudio", (char)IPPROTO_TCP, 0, 0, ippr_raudio_init, NULL,
 119           ippr_raudio_new, NULL, ippr_raudio_in, ippr_raudio_out, NULL },
 120 #endif
 121 #ifdef IPF_IPSEC_PROXY
 122         { NULL, "ipsec", (char)IPPROTO_UDP, 0, 0, ippr_ipsec_init, NULL,
 123           ippr_ipsec_new, ippr_ipsec_del, NULL, ippr_ipsec_out,
 124           ippr_ipsec_match },
 125 #endif
 126 #ifdef  IPF_NETBIOS_PROXY
 127         { NULL, "netbios", (char)IPPROTO_UDP, 0, 0, ippr_netbios_init, NULL,
 128           NULL, NULL, NULL, ippr_netbios_out, NULL },
 129 #endif
 130 #ifdef  IPF_H323_PROXY
 131     { NULL, "h323", (char)IPPROTO_TCP, 0, 0, ippr_h323_init, NULL,
 132           ippr_h323_new, ippr_h323_del, ippr_h323_in, ippr_h323_out, NULL },
 133     { NULL, "h245", (char)IPPROTO_TCP, 0, 0, ippr_h245_init, NULL,
 134           ippr_h245_new, NULL, NULL, ippr_h245_out, NULL },
 135 #endif
 136         { NULL, "", '\0', 0, 0, NULL, NULL, NULL }
 137 };
 138
 139
 140 /*
 141  * Dynamically add a new kernel proxy.  Ensure that it is unique in the
 142  * collection compiled in and dynamically added.
 143  */
 144 int appr_add(ap)
 145 aproxy_t *ap;
 146 {
 147         aproxy_t *a;
 148
 149         for (a = ap_proxies; a->apr_p; a++)
 150                 if ((a->apr_p == ap->apr_p) &&
 151                     !strncmp(a->apr_label, ap->apr_label,
 152                              sizeof(ap->apr_label)))
 153                         return -1;
 154
 155         for (a = ap_proxylist; a && a->apr_p; a = a->apr_next)
 156                 if ((a->apr_p == ap->apr_p) &&
 157                     !strncmp(a->apr_label, ap->apr_label,
 158                              sizeof(ap->apr_label)))
 159                         return -1;
 160         ap->apr_next = ap_proxylist;
 161         ap_proxylist = ap;
 162         return (*ap->apr_init)();
 163 }
 164
 165
 166 /*
 167  * Delete a proxy that has been added dynamically from those available.
 168  * If it is in use, return 1 (do not destroy NOW), not in use 0 or -1
 169  * if it cannot be matched.
 170  */
 171 int appr_del(ap)
 172 aproxy_t *ap;
 173 {
 174         aproxy_t *a, **app;
 175
 176         for (app = &ap_proxylist; (a = *app); app = &a->apr_next)
 177                 if (a == ap) {
 178                         a->apr_flags |= APR_DELETE;
 179                         *app = a->apr_next;
 180                         if (ap->apr_ref != 0)
 181                                 return 1;
 182                         return 0;
 183                 }
 184         return -1;
 185 }
 186
 187
 188 /*
 189  * Return 1 if the packet is a good match against a proxy, else 0.
 190  */
 191 int appr_ok(ip, tcp, nat)
 192 ip_t *ip;
 193 tcphdr_t *tcp;
 194 ipnat_t *nat;
 195 {
 196         aproxy_t *apr = nat->in_apr;
 197         u_short dport = nat->in_dport;
 198
 199         if ((apr == NULL) || (apr->apr_flags & APR_DELETE) ||
 200             (ip->ip_p != apr->apr_p))
 201                 return 0;
 202         if (((tcp != NULL) && (tcp->th_dport != dport)) || (!tcp && dport))
 203                 return 0;
 204         return 1;
 205 }
 206
 207
 208 /*
 209  * If a proxy has a match function, call that to do extended packet
 210  * matching.
 211  */
 212 int appr_match(fin, nat)
 213 fr_info_t *fin;
 214 nat_t *nat;
 215 {
 216         aproxy_t *apr;
 217         ipnat_t *ipn;
 218
 219         ipn = nat->nat_ptr;
 220         if (ipn == NULL)
 221                 return -1;
 222         apr = ipn->in_apr;
 223         if ((apr == NULL) || (apr->apr_flags & APR_DELETE) ||
 224             (nat->nat_aps == NULL))
 225                 return -1;
 226         if (apr->apr_match != NULL)
 227                 if ((*apr->apr_match)(fin, nat->nat_aps, nat) != 0)
 228                         return -1;
 229         return 0;
 230 }
 231
 232
 233 /*
 234  * Allocate a new application proxy structure and fill it in with the
 235  * relevant details.  call the init function once complete, prior to
 236  * returning.
 237  */
 238 int appr_new(fin, ip, nat)
 239 fr_info_t *fin;
 240 ip_t *ip;
 241 nat_t *nat;
 242 {
 243         register ap_session_t *aps;
 244         aproxy_t *apr;
 245
 246         if ((nat->nat_ptr == NULL) || (nat->nat_aps != NULL))
 247                 return -1;
 248
 249         apr = nat->nat_ptr->in_apr;
 250
 251         if (!apr || (apr->apr_flags & APR_DELETE) || (ip->ip_p != apr->apr_p))
 252                 return -1;
 253
 254         KMALLOC(aps, ap_session_t *);
 255         if (!aps)
 256                 return -1;
 257         bzero((char *)aps, sizeof(*aps));
 258         aps->aps_p = ip->ip_p;
 259         aps->aps_data = NULL;
 260         aps->aps_apr = apr;
 261         aps->aps_psiz = 0;
 262         if (apr->apr_new != NULL)
 263                 if ((*apr->apr_new)(fin, ip, aps, nat) == -1) {
 264                         if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) {
 265                                 KFREES(aps->aps_data, aps->aps_psiz);
 266                         }
 267                         KFREE(aps);
 268                         return -1;
 269                 }
 270         aps->aps_nat = nat;
 271         aps->aps_next = ap_sess_list;
 272         ap_sess_list = aps;
 273         nat->nat_aps = aps;
 274
 275         return 0;
 276 }
 277
 278
 279 /*
 280  * check to see if a packet should be passed through an active proxy routine
 281  * if one has been setup for it.
 282  */
 283 int appr_check(ip, fin, nat)
 284 ip_t *ip;
 285 fr_info_t *fin;
 286 nat_t *nat;
 287 {
 288 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 289         mb_t *m = fin->fin_qfm;
 290         int dosum = 1;
 291 #endif
 292         tcphdr_t *tcp = NULL;
 293         ap_session_t *aps;
 294         aproxy_t *apr;
 295         u_32_t sum;
 296         short rv;
 297         int err;
 298
 299         aps = nat->nat_aps;
 300         if ((aps != NULL) && (aps->aps_p == ip->ip_p)) {
 301                 if (ip->ip_p == IPPROTO_TCP) {
 302                         tcp = (tcphdr_t *)fin->fin_dp;
 303                         /*
 304                          * verify that the checksum is correct.  If not, then
 305                          * don't do anything with this packet.
 306                          */
 307 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 308                         if (dohwcksum && (m->b_ick_flag == ICK_VALID)) {
 309                                 sum = tcp->th_sum;
 310                                 dosum = 0;
 311                         }
 312                         if (dosum)
 313                                 sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
 314 #else
 315                         sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
 316 #endif
 317                         if (sum != tcp->th_sum) {
 318 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 319                                 printf("proxy tcp checksum failure\n");
 320 #endif
 321                                 frstats[fin->fin_out].fr_tcpbad++;
 322                                 return -1;
 323                         }
 324
 325                         /*
 326                          * Don't bother the proxy with these...or in fact,
 327                          * should we free up proxy stuff when seen?
 328                          */
 329                         if ((tcp->th_flags & TH_RST) != 0)
 330                                 return 0;
 331                 }
 332
 333                 apr = aps->aps_apr;
 334                 err = 0;
 335                 if (fin->fin_out != 0) {
 336                         if (apr->apr_outpkt != NULL)
 337                                 err = (*apr->apr_outpkt)(fin, ip, aps, nat);
 338                 } else {
 339                         if (apr->apr_inpkt != NULL)
 340                                 err = (*apr->apr_inpkt)(fin, ip, aps, nat);
 341                 }
 342
 343                 rv = APR_EXIT(err);
 344                 if (rv == 1) {
 345 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 346                         printf("proxy says bad packet received\n");
 347 #endif
 348                         return -1;
 349                 }
 350                 if (rv == 2) {
 351 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 352                         printf("proxy says free app proxy data\n");
 353 #endif
 354                         appr_free(apr);
 355                         nat->nat_aps = NULL;
 356                         return -1;
 357                 }
 358
 359                 if (tcp != NULL) {
 360                         err = appr_fixseqack(fin, ip, aps, APR_INC(err));
 361 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 362                         if (dosum)
 363                                 tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
 364 #else
 365                         tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
 366 #endif
 367                 }
 368                 aps->aps_bytes += ip->ip_len;
 369                 aps->aps_pkts++;
 370                 return 1;
 371         }
 372         return 0;
 373 }
 374
 375
 376 /*
 377  * Search for an proxy by the protocol it is being used with and its name.
 378  */
 379 aproxy_t *appr_lookup(pr, name)
 380 u_int pr;
 381 char *name;
 382 {
 383         aproxy_t *ap;
 384
 385         for (ap = ap_proxies; ap->apr_p; ap++)
 386                 if ((ap->apr_p == pr) &&
 387                     !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
 388                         ap->apr_ref++;
 389                         return ap;
 390                 }
 391
 392         for (ap = ap_proxylist; ap; ap = ap->apr_next)
 393                 if ((ap->apr_p == pr) &&
 394                     !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
 395                         ap->apr_ref++;
 396                         return ap;
 397                 }
 398         return NULL;
 399 }
 400
 401
 402 void appr_free(ap)
 403 aproxy_t *ap;
 404 {
 405         ap->apr_ref--;
 406 }
 407
 408
 409 void aps_free(aps)
 410 ap_session_t *aps;
 411 {
 412         ap_session_t *a, **ap;
 413         aproxy_t *apr;
 414
 415         if (!aps)
 416                 return;
 417
 418         for (ap = &ap_sess_list; (a = *ap); ap = &a->aps_next)
 419                 if (a == aps) {
 420                         *ap = a->aps_next;
 421                         break;
 422                 }
 423
 424         apr = aps->aps_apr;
 425         if ((apr != NULL) && (apr->apr_del != NULL))
 426                 (*apr->apr_del)(aps);
 427
 428         if ((aps->aps_data != NULL) && (aps->aps_psiz != 0))
 429                 KFREES(aps->aps_data, aps->aps_psiz);
 430         KFREE(aps);
 431 }
 432
 433
 434 /*
 435  * returns 2 if ack or seq number in TCP header is changed, returns 0 otherwise
 436  */
 437 static int appr_fixseqack(fin, ip, aps, inc)
 438 fr_info_t *fin;
 439 ip_t *ip;
 440 ap_session_t *aps;
 441 int inc;
 442 {
 443         int sel, ch = 0, out, nlen;
 444         u_32_t seq1, seq2;
 445         tcphdr_t *tcp;
 446         short inc2;
 447
 448         tcp = (tcphdr_t *)fin->fin_dp;
 449         out = fin->fin_out;
 450         /*
 451          * ip_len has already been adjusted by 'inc'.
 452          */
 453         nlen = ip->ip_len;
 454         nlen -= (ip->ip_hl << 2) + (tcp->th_off << 2);
 455
 456         inc2 = inc;
 457         inc = (int)inc2;
 458
 459         if (out != 0) {
 460                 seq1 = (u_32_t)ntohl(tcp->th_seq);
 461                 sel = aps->aps_sel[out];
 462
 463                 /* switch to other set ? */
 464                 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
 465                     (seq1 > aps->aps_seqmin[!sel])) {
 466 #if PROXY_DEBUG
 467                         printf("proxy out switch set seq %d -> %d %x > %x\n",
 468                                 sel, !sel, seq1, aps->aps_seqmin[!sel]);
 469 #endif
 470                         sel = aps->aps_sel[out] = !sel;
 471                 }
 472
 473                 if (aps->aps_seqoff[sel]) {
 474                         seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel];
 475                         if (seq1 > seq2) {
 476                                 seq2 = aps->aps_seqoff[sel];
 477                                 seq1 += seq2;
 478                                 tcp->th_seq = htonl(seq1);
 479                                 ch = 1;
 480                         }
 481                 }
 482
 483                 if (inc && (seq1 > aps->aps_seqmin[!sel])) {
 484                         aps->aps_seqmin[sel] = seq1 + nlen - 1;
 485                         aps->aps_seqoff[sel] = aps->aps_seqoff[sel] + inc;
 486 #if PROXY_DEBUG
 487                         printf("proxy seq set %d at %x to %d + %d\n", sel,
 488                                 aps->aps_seqmin[sel], aps->aps_seqoff[sel],
 489                                 inc);
 490 #endif
 491                 }
 492
 493                 /***/
 494
 495                 seq1 = ntohl(tcp->th_ack);
 496                 sel = aps->aps_sel[1 - out];
 497
 498                 /* switch to other set ? */
 499                 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
 500                     (seq1 > aps->aps_ackmin[!sel])) {
 501 #if PROXY_DEBUG
 502                         printf("proxy out switch set ack %d -> %d %x > %x\n",
 503                                 sel, !sel, seq1, aps->aps_ackmin[!sel]);
 504 #endif
 505                         sel = aps->aps_sel[1 - out] = !sel;
 506                 }
 507
 508                 if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) {
 509                         seq2 = aps->aps_ackoff[sel];
 510                         tcp->th_ack = htonl(seq1 - seq2);
 511                         ch = 1;
 512                 }
 513         } else {
 514                 seq1 = ntohl(tcp->th_seq);
 515                 sel = aps->aps_sel[out];
 516
 517                 /* switch to other set ? */
 518                 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
 519                     (seq1 > aps->aps_ackmin[!sel])) {
 520 #if PROXY_DEBUG
 521                         printf("proxy in switch set ack %d -> %d %x > %x\n",
 522                                 sel, !sel, seq1, aps->aps_ackmin[!sel]);
 523 #endif
 524                         sel = aps->aps_sel[out] = !sel;
 525                 }
 526
 527                 if (aps->aps_ackoff[sel]) {
 528                         seq2 = aps->aps_ackmin[sel] - aps->aps_ackoff[sel];
 529                         if (seq1 > seq2) {
 530                                 seq2 = aps->aps_ackoff[sel];
 531                                 seq1 += seq2;
 532                                 tcp->th_seq = htonl(seq1);
 533                                 ch = 1;
 534                         }
 535                 }
 536
 537                 if (inc && (seq1 > aps->aps_ackmin[!sel])) {
 538                         aps->aps_ackmin[!sel] = seq1 + nlen - 1;
 539                         aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc;
 540 #if PROXY_DEBUG
 541                         printf("proxy ack set %d at %x to %d + %d\n", !sel,
 542                                 aps->aps_seqmin[!sel], aps->aps_seqoff[sel],
 543                                 inc);
 544 #endif
 545                 }
 546
 547                 /***/
 548
 549                 seq1 = ntohl(tcp->th_ack);
 550                 sel = aps->aps_sel[1 - out];
 551
 552                 /* switch to other set ? */
 553                 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
 554                     (seq1 > aps->aps_seqmin[!sel])) {
 555 #if PROXY_DEBUG
 556                         printf("proxy in switch set seq %d -> %d %x > %x\n",
 557                                 sel, !sel, seq1, aps->aps_seqmin[!sel]);
 558 #endif
 559                         sel = aps->aps_sel[1 - out] = !sel;
 560                 }
 561
 562                 if (aps->aps_seqoff[sel] != 0) {
 563 #if PROXY_DEBUG
 564                         printf("sel %d seqoff %d seq1 %x seqmin %x\n", sel,
 565                                 aps->aps_seqoff[sel], seq1,
 566                                 aps->aps_seqmin[sel]);
 567 #endif
 568                         if (seq1 > aps->aps_seqmin[sel]) {
 569                                 seq2 = aps->aps_seqoff[sel];
 570                                 tcp->th_ack = htonl(seq1 - seq2);
 571                                 ch = 1;
 572                         }
 573                 }
 574         }
 575 #if PROXY_DEBUG
 576         printf("appr_fixseqack: seq %x ack %x\n", ntohl(tcp->th_seq),
 577                 ntohl(tcp->th_ack));
 578 #endif
 579         return ch ? 2 : 0;
 580 }
 581
 582
 583 /*
 584  * Initialise hook for kernel application proxies.
 585  * Call the initialise routine for all the compiled in kernel proxies.
 586  */
 587 int appr_init()
 588 {
 589         aproxy_t *ap;
 590         int err = 0;
 591
 592         for (ap = ap_proxies; ap->apr_p; ap++) {
 593                 err = (*ap->apr_init)();
 594                 if (err != 0)
 595                         break;
 596         }
 597         return err;
 598 }
 599
 600
 601 /*
 602  * Unload hook for kernel application proxies.
 603  * Call the finialise routine for all the compiled in kernel proxies.
 604  */
 605 void appr_unload()
 606 {
 607         aproxy_t *ap;
 608
 609         for (ap = ap_proxies; ap->apr_p; ap++)
 610                 if (ap->apr_fini)
 611                         (*ap->apr_fini)();
 612         for (ap = ap_proxylist; ap; ap = ap->apr_next)
 613                 if (ap->apr_fini)
 614                         (*ap->apr_fini)();
 615 }