sys/contrib/ipfilter/netinet/ip_proxy.c

   1 /*
   2  * Copyright (C) 1997-2002 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  */
   6 #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
   7 # define        _KERNEL
   8 #endif
   9
  10 #if defined(__sgi) && (IRIX > 602)
  11 # include <sys/ptimers.h>
  12 #endif
  13 #include <sys/errno.h>
  14 #include <sys/types.h>
  15 #include <sys/param.h>
  16 #include <sys/time.h>
  17 #include <sys/file.h>
  18 #if !defined(__FreeBSD_version)
  19 # include <sys/ioctl.h>
  20 #endif
  21 #include <sys/fcntl.h>
  22 #if !defined(_KERNEL) && !defined(KERNEL)
  23 # include <stdio.h>
  24 # include <string.h>
  25 # include <stdlib.h>
  26 #endif
  27 #ifndef linux
  28 # include <sys/protosw.h>
  29 #endif
  30 #include <sys/socket.h>
  31 #if defined(_KERNEL)
  32 # if !defined(linux)
  33 #  include <sys/systm.h>
  34 # else
  35 #  include <linux/string.h>
  36 # endif
  37 #endif
  38 #if !defined(__SVR4) && !defined(__svr4__)
  39 # ifndef linux
  40 #  include <sys/mbuf.h>
  41 # endif
  42 #else
  43 # include <sys/byteorder.h>
  44 # ifdef _KERNEL
  45 #  include <sys/dditypes.h>
  46 # endif
  47 # include <sys/stream.h>
  48 # include <sys/kmem.h>
  49 #endif
  50 #if __FreeBSD__ > 2
  51 # include <sys/queue.h>
  52 #endif
  53 #include <net/if.h>
  54 #ifdef sun
  55 # include <net/af.h>
  56 #endif
  57 #include <net/route.h>
  58 #include <netinet/in.h>
  59 #include <netinet/in_systm.h>
  60 #include <netinet/ip.h>
  61 #ifndef linux
  62 # include <netinet/ip_var.h>
  63 #endif
  64 #include <netinet/tcp.h>
  65 #include <netinet/udp.h>
  66 #include <netinet/ip_icmp.h>
  67 #include "netinet/ip_compat.h"
  68 #include <netinet/tcpip.h>
  69 #include "netinet/ip_fil.h"
  70 #include "netinet/ip_nat.h"
  71 #include "netinet/ip_state.h"
  72 #include "netinet/ip_proxy.h"
  73 #if (__FreeBSD_version >= 300000)
  74 # include <sys/malloc.h>
  75 #endif
  76
  77 #if !defined(lint)
  78 /*static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.24 2002/08/28 12:45:51 darrenr Exp $";*/
  79 static const char rcsid[] = "@(#)$FreeBSD: src/sys/contrib/ipfilter/netinet/ip_proxy.c,v 1.11.2.5 2003/03/01 03:55:54 darrenr Exp $";
  80 #endif
  81
  82 #if defined(_KERNEL) && (SOLARIS || defined(__sgi))
  83 extern  KRWLOCK_T       ipf_nat, ipf_state;
  84 #endif
  85
  86 #ifndef MIN
  87 #define MIN(a,b)        (((a)<(b))?(a):(b))
  88 #endif
  89
  90 static int appr_fixseqack __P((fr_info_t *, ip_t *, ap_session_t *, int ));
  91
  92
  93 #define PROXY_DEBUG 0
  94
  95 #define AP_SESS_SIZE    53
  96
  97 #include "netinet/ip_ftp_pxy.c"
  98 #if defined(_KERNEL)
  99 #include "netinet/ip_rcmd_pxy.c"
 100 #include "netinet/ip_raudio_pxy.c"
 101 #include "netinet/ip_netbios_pxy.c"
 102 #include "netinet/ip_h323_pxy.c"
 103 #endif
 104 #include "netinet/ip_ipsec_pxy.c"
 105
 106 ap_session_t    *ap_sess_tab[AP_SESS_SIZE];
 107 ap_session_t    *ap_sess_list = NULL;
 108 aproxy_t        *ap_proxylist = NULL;
 109 aproxy_t        ap_proxies[] = {
 110 #ifdef  IPF_FTP_PROXY
 111         { NULL, "ftp", (char)IPPROTO_TCP, 0, 0, ippr_ftp_init, NULL,
 112           ippr_ftp_new, NULL, ippr_ftp_in, ippr_ftp_out, NULL },
 113 #endif
 114 #ifdef  IPF_RCMD_PROXY
 115         { NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, ippr_rcmd_init, NULL,
 116           ippr_rcmd_new, NULL, NULL, ippr_rcmd_out, NULL },
 117 #endif
 118 #ifdef  IPF_RAUDIO_PROXY
 119         { NULL, "raudio", (char)IPPROTO_TCP, 0, 0, ippr_raudio_init, NULL,
 120           ippr_raudio_new, NULL, ippr_raudio_in, ippr_raudio_out, NULL },
 121 #endif
 122 #ifdef IPF_IPSEC_PROXY
 123         { NULL, "ipsec", (char)IPPROTO_UDP, 0, 0, ippr_ipsec_init, NULL,
 124           ippr_ipsec_new, ippr_ipsec_del, NULL, ippr_ipsec_out,
 125           ippr_ipsec_match },
 126 #endif
 127 #ifdef  IPF_NETBIOS_PROXY
 128         { NULL, "netbios", (char)IPPROTO_UDP, 0, 0, ippr_netbios_init, NULL,
 129           NULL, NULL, NULL, ippr_netbios_out, NULL },
 130 #endif
 131 #ifdef  IPF_H323_PROXY
 132     { NULL, "h323", (char)IPPROTO_TCP, 0, 0, ippr_h323_init, NULL,
 133           ippr_h323_new, ippr_h323_del, ippr_h323_in, ippr_h323_out, NULL },
 134     { NULL, "h245", (char)IPPROTO_TCP, 0, 0, ippr_h245_init, NULL,
 135           ippr_h245_new, NULL, NULL, ippr_h245_out, NULL },
 136 #endif
 137         { NULL, "", '\0', 0, 0, NULL, NULL, NULL }
 138 };
 139
 140
 141 /*
 142  * Dynamically add a new kernel proxy.  Ensure that it is unique in the
 143  * collection compiled in and dynamically added.
 144  */
 145 int appr_add(ap)
 146 aproxy_t *ap;
 147 {
 148         aproxy_t *a;
 149
 150         for (a = ap_proxies; a->apr_p; a++)
 151                 if ((a->apr_p == ap->apr_p) &&
 152                     !strncmp(a->apr_label, ap->apr_label,
 153                              sizeof(ap->apr_label)))
 154                         return -1;
 155
 156         for (a = ap_proxylist; a && a->apr_p; a = a->apr_next)
 157                 if ((a->apr_p == ap->apr_p) &&
 158                     !strncmp(a->apr_label, ap->apr_label,
 159                              sizeof(ap->apr_label)))
 160                         return -1;
 161         ap->apr_next = ap_proxylist;
 162         ap_proxylist = ap;
 163         return (*ap->apr_init)();
 164 }
 165
 166
 167 /*
 168  * Delete a proxy that has been added dynamically from those available.
 169  * If it is in use, return 1 (do not destroy NOW), not in use 0 or -1
 170  * if it cannot be matched.
 171  */
 172 int appr_del(ap)
 173 aproxy_t *ap;
 174 {
 175         aproxy_t *a, **app;
 176
 177         for (app = &ap_proxylist; (a = *app); app = &a->apr_next)
 178                 if (a == ap) {
 179                         a->apr_flags |= APR_DELETE;
 180                         *app = a->apr_next;
 181                         if (ap->apr_ref != 0)
 182                                 return 1;
 183                         return 0;
 184                 }
 185         return -1;
 186 }
 187
 188
 189 /*
 190  * Return 1 if the packet is a good match against a proxy, else 0.
 191  */
 192 int appr_ok(ip, tcp, nat)
 193 ip_t *ip;
 194 tcphdr_t *tcp;
 195 ipnat_t *nat;
 196 {
 197         aproxy_t *apr = nat->in_apr;
 198         u_short dport = nat->in_dport;
 199
 200         if ((apr == NULL) || (apr->apr_flags & APR_DELETE) ||
 201             (ip->ip_p != apr->apr_p))
 202                 return 0;
 203         if (((tcp != NULL) && (tcp->th_dport != dport)) || (!tcp && dport))
 204                 return 0;
 205         return 1;
 206 }
 207
 208
 209 /*
 210  * If a proxy has a match function, call that to do extended packet
 211  * matching.
 212  */
 213 int appr_match(fin, nat)
 214 fr_info_t *fin;
 215 nat_t *nat;
 216 {
 217         aproxy_t *apr;
 218         ipnat_t *ipn;
 219
 220         ipn = nat->nat_ptr;
 221         if (ipn == NULL)
 222                 return -1;
 223         apr = ipn->in_apr;
 224         if ((apr == NULL) || (apr->apr_flags & APR_DELETE) ||
 225             (nat->nat_aps == NULL))
 226                 return -1;
 227         if (apr->apr_match != NULL)
 228                 if ((*apr->apr_match)(fin, nat->nat_aps, nat) != 0)
 229                         return -1;
 230         return 0;
 231 }
 232
 233
 234 /*
 235  * Allocate a new application proxy structure and fill it in with the
 236  * relevant details.  call the init function once complete, prior to
 237  * returning.
 238  */
 239 int appr_new(fin, ip, nat)
 240 fr_info_t *fin;
 241 ip_t *ip;
 242 nat_t *nat;
 243 {
 244         register ap_session_t *aps;
 245         aproxy_t *apr;
 246
 247         if ((nat->nat_ptr == NULL) || (nat->nat_aps != NULL))
 248                 return -1;
 249
 250         apr = nat->nat_ptr->in_apr;
 251
 252         if (!apr || (apr->apr_flags & APR_DELETE) || (ip->ip_p != apr->apr_p))
 253                 return -1;
 254
 255         KMALLOC(aps, ap_session_t *);
 256         if (!aps)
 257                 return -1;
 258         bzero((char *)aps, sizeof(*aps));
 259         aps->aps_p = ip->ip_p;
 260         aps->aps_data = NULL;
 261         aps->aps_apr = apr;
 262         aps->aps_psiz = 0;
 263         if (apr->apr_new != NULL)
 264                 if ((*apr->apr_new)(fin, ip, aps, nat) == -1) {
 265                         if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) {
 266                                 KFREES(aps->aps_data, aps->aps_psiz);
 267                         }
 268                         KFREE(aps);
 269                         return -1;
 270                 }
 271         aps->aps_nat = nat;
 272         aps->aps_next = ap_sess_list;
 273         ap_sess_list = aps;
 274         nat->nat_aps = aps;
 275
 276         return 0;
 277 }
 278
 279
 280 /*
 281  * check to see if a packet should be passed through an active proxy routine
 282  * if one has been setup for it.
 283  */
 284 int appr_check(ip, fin, nat)
 285 ip_t *ip;
 286 fr_info_t *fin;
 287 nat_t *nat;
 288 {
 289 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 290         mb_t *m = fin->fin_qfm;
 291         int dosum = 1;
 292 #endif
 293         tcphdr_t *tcp = NULL;
 294         ap_session_t *aps;
 295         aproxy_t *apr;
 296         u_32_t sum;
 297         short rv;
 298         int err;
 299
 300         aps = nat->nat_aps;
 301         if ((aps != NULL) && (aps->aps_p == ip->ip_p)) {
 302                 if (ip->ip_p == IPPROTO_TCP) {
 303                         tcp = (tcphdr_t *)fin->fin_dp;
 304                         /*
 305                          * verify that the checksum is correct.  If not, then
 306                          * don't do anything with this packet.
 307                          */
 308 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 309                         if (dohwcksum && (m->b_ick_flag == ICK_VALID)) {
 310                                 sum = tcp->th_sum;
 311                                 dosum = 0;
 312                         }
 313                         if (dosum)
 314                                 sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
 315 #else
 316                         sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
 317 #endif
 318                         if (sum != tcp->th_sum) {
 319 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 320                                 printf("proxy tcp checksum failure\n");
 321 #endif
 322                                 frstats[fin->fin_out].fr_tcpbad++;
 323                                 return -1;
 324                         }
 325
 326                         /*
 327                          * Don't bother the proxy with these...or in fact,
 328                          * should we free up proxy stuff when seen?
 329                          */
 330                         if ((tcp->th_flags & TH_RST) != 0)
 331                                 return 0;
 332                 }
 333
 334                 apr = aps->aps_apr;
 335                 err = 0;
 336                 if (fin->fin_out != 0) {
 337                         if (apr->apr_outpkt != NULL)
 338                                 err = (*apr->apr_outpkt)(fin, ip, aps, nat);
 339                 } else {
 340                         if (apr->apr_inpkt != NULL)
 341                                 err = (*apr->apr_inpkt)(fin, ip, aps, nat);
 342                 }
 343
 344                 rv = APR_EXIT(err);
 345                 if (rv == 1) {
 346 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 347                         printf("proxy says bad packet received\n");
 348 #endif
 349                         return -1;
 350                 }
 351                 if (rv == 2) {
 352 #if PROXY_DEBUG || (!defined(_KERNEL) && !defined(KERNEL))
 353                         printf("proxy says free app proxy data\n");
 354 #endif
 355                         appr_free(apr);
 356                         nat->nat_aps = NULL;
 357                         return -1;
 358                 }
 359
 360                 if (tcp != NULL) {
 361                         err = appr_fixseqack(fin, ip, aps, APR_INC(err));
 362 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
 363                         if (dosum)
 364                                 tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
 365 #else
 366                         tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
 367 #endif
 368                 }
 369                 aps->aps_bytes += ip->ip_len;
 370                 aps->aps_pkts++;
 371                 return 1;
 372         }
 373         return 0;
 374 }
 375
 376
 377 /*
 378  * Search for an proxy by the protocol it is being used with and its name.
 379  */
 380 aproxy_t *appr_lookup(pr, name)
 381 u_int pr;
 382 char *name;
 383 {
 384         aproxy_t *ap;
 385
 386         for (ap = ap_proxies; ap->apr_p; ap++)
 387                 if ((ap->apr_p == pr) &&
 388                     !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
 389                         ap->apr_ref++;
 390                         return ap;
 391                 }
 392
 393         for (ap = ap_proxylist; ap; ap = ap->apr_next)
 394                 if ((ap->apr_p == pr) &&
 395                     !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
 396                         ap->apr_ref++;
 397                         return ap;
 398                 }
 399         return NULL;
 400 }
 401
 402
 403 void appr_free(ap)
 404 aproxy_t *ap;
 405 {
 406         ap->apr_ref--;
 407 }
 408
 409
 410 void aps_free(aps)
 411 ap_session_t *aps;
 412 {
 413         ap_session_t *a, **ap;
 414         aproxy_t *apr;
 415
 416         if (!aps)
 417                 return;
 418
 419         for (ap = &ap_sess_list; (a = *ap); ap = &a->aps_next)
 420                 if (a == aps) {
 421                         *ap = a->aps_next;
 422                         break;
 423                 }
 424
 425         apr = aps->aps_apr;
 426         if ((apr != NULL) && (apr->apr_del != NULL))
 427                 (*apr->apr_del)(aps);
 428
 429         if ((aps->aps_data != NULL) && (aps->aps_psiz != 0))
 430                 KFREES(aps->aps_data, aps->aps_psiz);
 431         KFREE(aps);
 432 }
 433
 434
 435 /*
 436  * returns 2 if ack or seq number in TCP header is changed, returns 0 otherwise
 437  */
 438 static int appr_fixseqack(fin, ip, aps, inc)
 439 fr_info_t *fin;
 440 ip_t *ip;
 441 ap_session_t *aps;
 442 int inc;
 443 {
 444         int sel, ch = 0, out, nlen;
 445         u_32_t seq1, seq2;
 446         tcphdr_t *tcp;
 447         short inc2;
 448
 449         tcp = (tcphdr_t *)fin->fin_dp;
 450         out = fin->fin_out;
 451         /*
 452          * ip_len has already been adjusted by 'inc'.
 453          */
 454         nlen = ip->ip_len;
 455         nlen -= (ip->ip_hl << 2) + (tcp->th_off << 2);
 456
 457         inc2 = inc;
 458         inc = (int)inc2;
 459
 460         if (out != 0) {
 461                 seq1 = (u_32_t)ntohl(tcp->th_seq);
 462                 sel = aps->aps_sel[out];
 463
 464                 /* switch to other set ? */
 465                 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
 466                     (seq1 > aps->aps_seqmin[!sel])) {
 467 #if PROXY_DEBUG
 468                         printf("proxy out switch set seq %d -> %d %x > %x\n",
 469                                 sel, !sel, seq1, aps->aps_seqmin[!sel]);
 470 #endif
 471                         sel = aps->aps_sel[out] = !sel;
 472                 }
 473
 474                 if (aps->aps_seqoff[sel]) {
 475                         seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel];
 476                         if (seq1 > seq2) {
 477                                 seq2 = aps->aps_seqoff[sel];
 478                                 seq1 += seq2;
 479                                 tcp->th_seq = htonl(seq1);
 480                                 ch = 1;
 481                         }
 482                 }
 483
 484                 if (inc && (seq1 > aps->aps_seqmin[!sel])) {
 485                         aps->aps_seqmin[sel] = seq1 + nlen - 1;
 486                         aps->aps_seqoff[sel] = aps->aps_seqoff[sel] + inc;
 487 #if PROXY_DEBUG
 488                         printf("proxy seq set %d at %x to %d + %d\n", sel,
 489                                 aps->aps_seqmin[sel], aps->aps_seqoff[sel],
 490                                 inc);
 491 #endif
 492                 }
 493
 494                 /***/
 495
 496                 seq1 = ntohl(tcp->th_ack);
 497                 sel = aps->aps_sel[1 - out];
 498
 499                 /* switch to other set ? */
 500                 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
 501                     (seq1 > aps->aps_ackmin[!sel])) {
 502 #if PROXY_DEBUG
 503                         printf("proxy out switch set ack %d -> %d %x > %x\n",
 504                                 sel, !sel, seq1, aps->aps_ackmin[!sel]);
 505 #endif
 506                         sel = aps->aps_sel[1 - out] = !sel;
 507                 }
 508
 509                 if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) {
 510                         seq2 = aps->aps_ackoff[sel];
 511                         tcp->th_ack = htonl(seq1 - seq2);
 512                         ch = 1;
 513                 }
 514         } else {
 515                 seq1 = ntohl(tcp->th_seq);
 516                 sel = aps->aps_sel[out];
 517
 518                 /* switch to other set ? */
 519                 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
 520                     (seq1 > aps->aps_ackmin[!sel])) {
 521 #if PROXY_DEBUG
 522                         printf("proxy in switch set ack %d -> %d %x > %x\n",
 523                                 sel, !sel, seq1, aps->aps_ackmin[!sel]);
 524 #endif
 525                         sel = aps->aps_sel[out] = !sel;
 526                 }
 527
 528                 if (aps->aps_ackoff[sel]) {
 529                         seq2 = aps->aps_ackmin[sel] - aps->aps_ackoff[sel];
 530                         if (seq1 > seq2) {
 531                                 seq2 = aps->aps_ackoff[sel];
 532                                 seq1 += seq2;
 533                                 tcp->th_seq = htonl(seq1);
 534                                 ch = 1;
 535                         }
 536                 }
 537
 538                 if (inc && (seq1 > aps->aps_ackmin[!sel])) {
 539                         aps->aps_ackmin[!sel] = seq1 + nlen - 1;
 540                         aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc;
 541 #if PROXY_DEBUG
 542                         printf("proxy ack set %d at %x to %d + %d\n", !sel,
 543                                 aps->aps_seqmin[!sel], aps->aps_seqoff[sel],
 544                                 inc);
 545 #endif
 546                 }
 547
 548                 /***/
 549
 550                 seq1 = ntohl(tcp->th_ack);
 551                 sel = aps->aps_sel[1 - out];
 552
 553                 /* switch to other set ? */
 554                 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
 555                     (seq1 > aps->aps_seqmin[!sel])) {
 556 #if PROXY_DEBUG
 557                         printf("proxy in switch set seq %d -> %d %x > %x\n",
 558                                 sel, !sel, seq1, aps->aps_seqmin[!sel]);
 559 #endif
 560                         sel = aps->aps_sel[1 - out] = !sel;
 561                 }
 562
 563                 if (aps->aps_seqoff[sel] != 0) {
 564 #if PROXY_DEBUG
 565                         printf("sel %d seqoff %d seq1 %x seqmin %x\n", sel,
 566                                 aps->aps_seqoff[sel], seq1,
 567                                 aps->aps_seqmin[sel]);
 568 #endif
 569                         if (seq1 > aps->aps_seqmin[sel]) {
 570                                 seq2 = aps->aps_seqoff[sel];
 571                                 tcp->th_ack = htonl(seq1 - seq2);
 572                                 ch = 1;
 573                         }
 574                 }
 575         }
 576 #if PROXY_DEBUG
 577         printf("appr_fixseqack: seq %x ack %x\n", ntohl(tcp->th_seq),
 578                 ntohl(tcp->th_ack));
 579 #endif
 580         return ch ? 2 : 0;
 581 }
 582
 583
 584 /*
 585  * Initialise hook for kernel application proxies.
 586  * Call the initialise routine for all the compiled in kernel proxies.
 587  */
 588 int appr_init()
 589 {
 590         aproxy_t *ap;
 591         int err = 0;
 592
 593         for (ap = ap_proxies; ap->apr_p; ap++) {
 594                 err = (*ap->apr_init)();
 595                 if (err != 0)
 596                         break;
 597         }
 598         return err;
 599 }
 600
 601
 602 /*
 603  * Unload hook for kernel application proxies.
 604  * Call the finialise routine for all the compiled in kernel proxies.
 605  */
 606 void appr_unload()
 607 {
 608         aproxy_t *ap;
 609
 610         for (ap = ap_proxies; ap->apr_p; ap++)
 611                 if (ap->apr_fini)
 612                         (*ap->apr_fini)();
 613         for (ap = ap_proxylist; ap; ap = ap->apr_next)
 614                 if (ap->apr_fini)
 615                         (*ap->apr_fini)();
 616 }