17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * Copyright (C) 1998-2003 by Darren Reed
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
57c478bd9Sstevel@tonic-gate *
6ab25eeb5Syz * $Id: ip_rcmd_pxy.c,v 1.41.2.4 2005/02/04 10:22:55 darrenr Exp $
77c478bd9Sstevel@tonic-gate *
8*33f2fefdSDarren Reed * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
97c478bd9Sstevel@tonic-gate * Use is subject to license terms.
107c478bd9Sstevel@tonic-gate *
117c478bd9Sstevel@tonic-gate * Simple RCMD transparent proxy for in-kernel use. For use with the NAT
127c478bd9Sstevel@tonic-gate * code.
137c478bd9Sstevel@tonic-gate */
147c478bd9Sstevel@tonic-gate
157c478bd9Sstevel@tonic-gate #define IPF_RCMD_PROXY
167c478bd9Sstevel@tonic-gate
17f4b3ec61Sdh typedef struct ifs_rcmdpxy {
18f4b3ec61Sdh frentry_t rcmdfr;
19f4b3ec61Sdh int rcmd_proxy_init;
20f4b3ec61Sdh } ifs_rcmdpxy_t;
217c478bd9Sstevel@tonic-gate
22f4b3ec61Sdh int ippr_rcmd_init __P((void **, ipf_stack_t *));
23f4b3ec61Sdh void ippr_rcmd_fini __P((void **, ipf_stack_t *));
24f4b3ec61Sdh int ippr_rcmd_new __P((fr_info_t *, ap_session_t *, nat_t *, void *));
25f4b3ec61Sdh int ippr_rcmd_out __P((fr_info_t *, ap_session_t *, nat_t *, void *));
26f4b3ec61Sdh int ippr_rcmd_in __P((fr_info_t *, ap_session_t *, nat_t *, void *));
277c478bd9Sstevel@tonic-gate u_short ipf_rcmd_atoi __P((char *));
28f4b3ec61Sdh int ippr_rcmd_portmsg __P((fr_info_t *, ap_session_t *, nat_t *, ifs_rcmdpxy_t *));
297c478bd9Sstevel@tonic-gate
307c478bd9Sstevel@tonic-gate /*
317c478bd9Sstevel@tonic-gate * RCMD application proxy initialization.
327c478bd9Sstevel@tonic-gate */
33f4b3ec61Sdh /*ARGSUSED*/
ippr_rcmd_init(private,ifs)34f4b3ec61Sdh int ippr_rcmd_init(private, ifs)
35f4b3ec61Sdh void **private;
36f4b3ec61Sdh ipf_stack_t *ifs;
377c478bd9Sstevel@tonic-gate {
38f4b3ec61Sdh ifs_rcmdpxy_t *ifsrcmd;
39f4b3ec61Sdh
40f4b3ec61Sdh KMALLOC(ifsrcmd, ifs_rcmdpxy_t *);
41f4b3ec61Sdh if (ifsrcmd == NULL)
42f4b3ec61Sdh return -1;
43f4b3ec61Sdh
44f4b3ec61Sdh bzero((char *)&ifsrcmd->rcmdfr, sizeof(ifsrcmd->rcmdfr));
45f4b3ec61Sdh ifsrcmd->rcmdfr.fr_ref = 1;
46f4b3ec61Sdh ifsrcmd->rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
47f4b3ec61Sdh MUTEX_INIT(&ifsrcmd->rcmdfr.fr_lock, "RCMD proxy rule lock");
48f4b3ec61Sdh ifsrcmd->rcmd_proxy_init = 1;
49f4b3ec61Sdh
50f4b3ec61Sdh *private = (void *)ifsrcmd;
517c478bd9Sstevel@tonic-gate
527c478bd9Sstevel@tonic-gate return 0;
537c478bd9Sstevel@tonic-gate }
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate
56f4b3ec61Sdh /*ARGSUSED*/
ippr_rcmd_fini(private,ifs)57f4b3ec61Sdh void ippr_rcmd_fini(private, ifs)
58f4b3ec61Sdh void **private;
59f4b3ec61Sdh ipf_stack_t *ifs;
607c478bd9Sstevel@tonic-gate {
61f4b3ec61Sdh ifs_rcmdpxy_t *ifsrcmd = *((ifs_rcmdpxy_t **)private);
62f4b3ec61Sdh
63f4b3ec61Sdh if (ifsrcmd->rcmd_proxy_init == 1) {
64f4b3ec61Sdh MUTEX_DESTROY(&ifsrcmd->rcmdfr.fr_lock);
65f4b3ec61Sdh ifsrcmd->rcmd_proxy_init = 0;
667c478bd9Sstevel@tonic-gate }
67f4b3ec61Sdh
68f4b3ec61Sdh KFREE(ifsrcmd);
69f4b3ec61Sdh *private = NULL;
707c478bd9Sstevel@tonic-gate }
717c478bd9Sstevel@tonic-gate
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /*
747c478bd9Sstevel@tonic-gate * Setup for a new RCMD proxy.
757c478bd9Sstevel@tonic-gate */
76f4b3ec61Sdh /*ARGSUSED*/
ippr_rcmd_new(fin,aps,nat,private)77f4b3ec61Sdh int ippr_rcmd_new(fin, aps, nat, private)
787c478bd9Sstevel@tonic-gate fr_info_t *fin;
797c478bd9Sstevel@tonic-gate ap_session_t *aps;
807c478bd9Sstevel@tonic-gate nat_t *nat;
81f4b3ec61Sdh void *private;
827c478bd9Sstevel@tonic-gate {
837c478bd9Sstevel@tonic-gate tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
847c478bd9Sstevel@tonic-gate
857c478bd9Sstevel@tonic-gate fin = fin; /* LINT */
867c478bd9Sstevel@tonic-gate nat = nat; /* LINT */
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate aps->aps_psiz = sizeof(u_32_t);
897c478bd9Sstevel@tonic-gate KMALLOCS(aps->aps_data, u_32_t *, sizeof(u_32_t));
907c478bd9Sstevel@tonic-gate if (aps->aps_data == NULL) {
917c478bd9Sstevel@tonic-gate #ifdef IP_RCMD_PROXY_DEBUG
927c478bd9Sstevel@tonic-gate printf("ippr_rcmd_new:KMALLOCS(%d) failed\n", sizeof(u_32_t));
937c478bd9Sstevel@tonic-gate #endif
947c478bd9Sstevel@tonic-gate return -1;
957c478bd9Sstevel@tonic-gate }
967c478bd9Sstevel@tonic-gate *(u_32_t *)aps->aps_data = 0;
977c478bd9Sstevel@tonic-gate aps->aps_sport = tcp->th_sport;
987c478bd9Sstevel@tonic-gate aps->aps_dport = tcp->th_dport;
997c478bd9Sstevel@tonic-gate return 0;
1007c478bd9Sstevel@tonic-gate }
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /*
1047c478bd9Sstevel@tonic-gate * ipf_rcmd_atoi - implement a simple version of atoi
1057c478bd9Sstevel@tonic-gate */
ipf_rcmd_atoi(ptr)1067c478bd9Sstevel@tonic-gate u_short ipf_rcmd_atoi(ptr)
1077c478bd9Sstevel@tonic-gate char *ptr;
1087c478bd9Sstevel@tonic-gate {
1097c478bd9Sstevel@tonic-gate register char *s = ptr, c;
1107c478bd9Sstevel@tonic-gate register u_short i = 0;
1117c478bd9Sstevel@tonic-gate
112ab25eeb5Syz while (((c = *s++) != '\0') && ISDIGIT(c)) {
1137c478bd9Sstevel@tonic-gate i *= 10;
1147c478bd9Sstevel@tonic-gate i += c - '0';
1157c478bd9Sstevel@tonic-gate }
1167c478bd9Sstevel@tonic-gate return i;
1177c478bd9Sstevel@tonic-gate }
1187c478bd9Sstevel@tonic-gate
1197c478bd9Sstevel@tonic-gate
ippr_rcmd_portmsg(fin,aps,nat,ifsrcmd)120f4b3ec61Sdh int ippr_rcmd_portmsg(fin, aps, nat, ifsrcmd)
1217c478bd9Sstevel@tonic-gate fr_info_t *fin;
1227c478bd9Sstevel@tonic-gate ap_session_t *aps;
1237c478bd9Sstevel@tonic-gate nat_t *nat;
124f4b3ec61Sdh ifs_rcmdpxy_t *ifsrcmd;
1257c478bd9Sstevel@tonic-gate {
1267c478bd9Sstevel@tonic-gate tcphdr_t *tcp, tcph, *tcp2 = &tcph;
1277c478bd9Sstevel@tonic-gate struct in_addr swip, swip2;
1287c478bd9Sstevel@tonic-gate int off, dlen, nflags;
1297c478bd9Sstevel@tonic-gate char portbuf[8], *s;
1307c478bd9Sstevel@tonic-gate fr_info_t fi;
1317c478bd9Sstevel@tonic-gate u_short sp;
1327c478bd9Sstevel@tonic-gate nat_t *nat2;
1337c478bd9Sstevel@tonic-gate ip_t *ip;
1347c478bd9Sstevel@tonic-gate mb_t *m;
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate tcp = (tcphdr_t *)fin->fin_dp;
1377c478bd9Sstevel@tonic-gate
1387c478bd9Sstevel@tonic-gate if (tcp->th_flags & TH_SYN) {
1397c478bd9Sstevel@tonic-gate *(u_32_t *)aps->aps_data = htonl(ntohl(tcp->th_seq) + 1);
1407c478bd9Sstevel@tonic-gate return 0;
1417c478bd9Sstevel@tonic-gate }
1427c478bd9Sstevel@tonic-gate
1437c478bd9Sstevel@tonic-gate if ((*(u_32_t *)aps->aps_data != 0) &&
1447c478bd9Sstevel@tonic-gate (tcp->th_seq != *(u_32_t *)aps->aps_data))
1457c478bd9Sstevel@tonic-gate return 0;
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate m = fin->fin_m;
1487c478bd9Sstevel@tonic-gate ip = fin->fin_ip;
149ab25eeb5Syz off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
150ab25eeb5Syz
151ab25eeb5Syz #ifdef __sgi
152ab25eeb5Syz dlen = fin->fin_plen - off;
153ab25eeb5Syz #else
1547c478bd9Sstevel@tonic-gate dlen = MSGDSIZE(m) - off;
155ab25eeb5Syz #endif
1567c478bd9Sstevel@tonic-gate if (dlen <= 0)
1577c478bd9Sstevel@tonic-gate return 0;
1587c478bd9Sstevel@tonic-gate
1597c478bd9Sstevel@tonic-gate bzero(portbuf, sizeof(portbuf));
1607c478bd9Sstevel@tonic-gate COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf);
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate portbuf[sizeof(portbuf) - 1] = '\0';
1637c478bd9Sstevel@tonic-gate s = portbuf;
1647c478bd9Sstevel@tonic-gate sp = ipf_rcmd_atoi(s);
1657c478bd9Sstevel@tonic-gate if (sp == 0) {
1667c478bd9Sstevel@tonic-gate #ifdef IP_RCMD_PROXY_DEBUG
1677c478bd9Sstevel@tonic-gate printf("ippr_rcmd_portmsg:sp == 0 dlen %d [%s]\n",
1687c478bd9Sstevel@tonic-gate dlen, portbuf);
1697c478bd9Sstevel@tonic-gate #endif
1707c478bd9Sstevel@tonic-gate return 0;
1717c478bd9Sstevel@tonic-gate }
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate /*
1747c478bd9Sstevel@tonic-gate * Add skeleton NAT entry for connection which will come back the
1757c478bd9Sstevel@tonic-gate * other way.
1767c478bd9Sstevel@tonic-gate */
1777c478bd9Sstevel@tonic-gate bcopy((char *)fin, (char *)&fi, sizeof(fi));
1787c478bd9Sstevel@tonic-gate fi.fin_flx |= FI_IGNORE;
1797c478bd9Sstevel@tonic-gate fi.fin_data[0] = sp;
180ab25eeb5Syz fi.fin_data[1] = 0;
1817c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
1827c478bd9Sstevel@tonic-gate nat2 = nat_outlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p,
1837c478bd9Sstevel@tonic-gate nat->nat_inip, nat->nat_oip);
1847c478bd9Sstevel@tonic-gate else
1857c478bd9Sstevel@tonic-gate nat2 = nat_inlookup(&fi, NAT_SEARCH|IPN_TCP, nat->nat_p,
1867c478bd9Sstevel@tonic-gate nat->nat_inip, nat->nat_oip);
1877c478bd9Sstevel@tonic-gate if (nat2 == NULL) {
1887c478bd9Sstevel@tonic-gate int slen;
1897c478bd9Sstevel@tonic-gate
1907c478bd9Sstevel@tonic-gate slen = ip->ip_len;
1917c478bd9Sstevel@tonic-gate ip->ip_len = fin->fin_hlen + sizeof(*tcp);
1927c478bd9Sstevel@tonic-gate bzero((char *)tcp2, sizeof(*tcp2));
1937c478bd9Sstevel@tonic-gate tcp2->th_win = htons(8192);
1947c478bd9Sstevel@tonic-gate tcp2->th_sport = htons(sp);
1957c478bd9Sstevel@tonic-gate tcp2->th_dport = 0; /* XXX - don't specify remote port */
1967c478bd9Sstevel@tonic-gate TCP_OFF_A(tcp2, 5);
1977c478bd9Sstevel@tonic-gate tcp2->th_flags = TH_SYN;
1987c478bd9Sstevel@tonic-gate fi.fin_dp = (char *)tcp2;
199f4b3ec61Sdh fi.fin_fr = &ifsrcmd->rcmdfr;
2007c478bd9Sstevel@tonic-gate fi.fin_dlen = sizeof(*tcp2);
2017c478bd9Sstevel@tonic-gate fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
2027c478bd9Sstevel@tonic-gate fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
2037c478bd9Sstevel@tonic-gate nflags = NAT_SLAVE|IPN_TCP|SI_W_DPORT;
2047c478bd9Sstevel@tonic-gate
2057c478bd9Sstevel@tonic-gate swip = ip->ip_src;
2067c478bd9Sstevel@tonic-gate swip2 = ip->ip_dst;
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND) {
2097c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_inip.s_addr;
2107c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_inip;
2117c478bd9Sstevel@tonic-gate } else {
2127c478bd9Sstevel@tonic-gate fi.fin_fi.fi_saddr = nat->nat_oip.s_addr;
2137c478bd9Sstevel@tonic-gate ip->ip_src = nat->nat_oip;
2147c478bd9Sstevel@tonic-gate nflags |= NAT_NOTRULEPORT;
2157c478bd9Sstevel@tonic-gate }
2167c478bd9Sstevel@tonic-gate
2177c478bd9Sstevel@tonic-gate nat2 = nat_new(&fi, nat->nat_ptr, NULL, nflags, nat->nat_dir);
2187c478bd9Sstevel@tonic-gate
2197c478bd9Sstevel@tonic-gate if (nat2 != NULL) {
2207c478bd9Sstevel@tonic-gate (void) nat_proto(&fi, nat2, IPN_TCP);
2217c478bd9Sstevel@tonic-gate nat_update(&fi, nat2, nat2->nat_ptr);
2227c478bd9Sstevel@tonic-gate fi.fin_ifp = NULL;
2237c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND) {
2247c478bd9Sstevel@tonic-gate fi.fin_fi.fi_daddr = nat->nat_inip.s_addr;
2257c478bd9Sstevel@tonic-gate ip->ip_dst = nat->nat_inip;
2267c478bd9Sstevel@tonic-gate }
2277c478bd9Sstevel@tonic-gate (void) fr_addstate(&fi, &nat2->nat_state, SI_W_DPORT);
2287c478bd9Sstevel@tonic-gate }
2297c478bd9Sstevel@tonic-gate ip->ip_len = slen;
2307c478bd9Sstevel@tonic-gate ip->ip_src = swip;
2317c478bd9Sstevel@tonic-gate ip->ip_dst = swip2;
2327c478bd9Sstevel@tonic-gate }
2337c478bd9Sstevel@tonic-gate return 0;
2347c478bd9Sstevel@tonic-gate }
2357c478bd9Sstevel@tonic-gate
2367c478bd9Sstevel@tonic-gate
ippr_rcmd_out(fin,aps,nat,private)237f4b3ec61Sdh int ippr_rcmd_out(fin, aps, nat, private)
2387c478bd9Sstevel@tonic-gate fr_info_t *fin;
2397c478bd9Sstevel@tonic-gate ap_session_t *aps;
2407c478bd9Sstevel@tonic-gate nat_t *nat;
241f4b3ec61Sdh void *private;
2427c478bd9Sstevel@tonic-gate {
2437c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
244f4b3ec61Sdh return ippr_rcmd_portmsg(fin, aps, nat, (ifs_rcmdpxy_t *)private);
2457c478bd9Sstevel@tonic-gate return 0;
2467c478bd9Sstevel@tonic-gate }
2477c478bd9Sstevel@tonic-gate
2487c478bd9Sstevel@tonic-gate
ippr_rcmd_in(fin,aps,nat,private)249f4b3ec61Sdh int ippr_rcmd_in(fin, aps, nat, private)
2507c478bd9Sstevel@tonic-gate fr_info_t *fin;
2517c478bd9Sstevel@tonic-gate ap_session_t *aps;
2527c478bd9Sstevel@tonic-gate nat_t *nat;
253f4b3ec61Sdh void *private;
2547c478bd9Sstevel@tonic-gate {
2557c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_INBOUND)
256f4b3ec61Sdh return ippr_rcmd_portmsg(fin, aps, nat, (ifs_rcmdpxy_t *)private);
2577c478bd9Sstevel@tonic-gate return 0;
2587c478bd9Sstevel@tonic-gate }
259