4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
10 * Simple RCMD transparent proxy for in-kernel use. For use with the NAT
15 #define IPF_RCMD_PROXY
17 typedef struct rcmdinfo {
18 u_32_t rcmd_port; /* Port number seen */
19 u_32_t rcmd_portseq; /* Sequence number where port is first seen */
20 ipnat_t *rcmd_rule; /* Template rule for back connection */
23 void ipf_p_rcmd_main_load __P((void));
24 void ipf_p_rcmd_main_unload __P((void));
26 int ipf_p_rcmd_init __P((void));
27 void ipf_p_rcmd_fini __P((void));
28 void ipf_p_rcmd_del __P((ipf_main_softc_t *, ap_session_t *));
29 int ipf_p_rcmd_new __P((void *, fr_info_t *, ap_session_t *, nat_t *));
30 int ipf_p_rcmd_out __P((void *, fr_info_t *, ap_session_t *, nat_t *));
31 int ipf_p_rcmd_in __P((void *, fr_info_t *, ap_session_t *, nat_t *));
32 u_short ipf_rcmd_atoi __P((char *));
33 int ipf_p_rcmd_portmsg __P((fr_info_t *, ap_session_t *, nat_t *));
35 static frentry_t rcmdfr;
37 static int rcmd_proxy_init = 0;
41 * RCMD application proxy initialization.
44 ipf_p_rcmd_main_load()
46 bzero((char *)&rcmdfr, sizeof(rcmdfr));
48 rcmdfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
49 MUTEX_INIT(&rcmdfr.fr_lock, "RCMD proxy rule lock");
55 ipf_p_rcmd_main_unload()
57 if (rcmd_proxy_init == 1) {
58 MUTEX_DESTROY(&rcmdfr.fr_lock);
65 * Setup for a new RCMD proxy.
68 ipf_p_rcmd_new(arg, fin, aps, nat)
74 tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
84 KMALLOC(rc, rcmdinfo_t *);
86 #ifdef IP_RCMD_PROXY_DEBUG
87 printf("ipf_p_rcmd_new:KMALLOCS(%d) failed\n", sizeof(*rc));
91 aps->aps_sport = tcp->th_sport;
92 aps->aps_dport = tcp->th_dport;
94 ipn = ipf_proxy_rule_rev(nat);
101 aps->aps_psiz = sizeof(*rc);
102 bzero((char *)rc, sizeof(*rc));
111 ipf_p_rcmd_del(softc, aps)
112 ipf_main_softc_t *softc;
119 rci->rcmd_rule->in_flags |= IPN_DELETE;
120 ipf_nat_rule_deref(softc, &rci->rcmd_rule);
126 * ipf_rcmd_atoi - implement a simple version of atoi
132 register char *s = ptr, c;
133 register u_short i = 0;
135 while (((c = *s++) != '\0') && ISDIGIT(c)) {
144 ipf_p_rcmd_portmsg(fin, aps, nat)
149 tcphdr_t *tcp, tcph, *tcp2 = &tcph;
150 int off, dlen, nflags, direction;
151 ipf_main_softc_t *softc;
152 ipf_nat_softc_t *softn;
162 int slen = 0; /* silence gcc */
166 tcp = (tcphdr_t *)fin->fin_dp;
170 tcpsz = TCP_OFF(tcp) << 2;
172 ip6 = (ip6_t *)fin->fin_ip;
174 softc = fin->fin_main_soft;
175 softn = softc->ipf_nat_soft;
176 off = (char *)tcp - (char *)ip + tcpsz + fin->fin_ipoff;
178 dlen = fin->fin_dlen - tcpsz;
182 rc = (rcmdinfo_t *)aps->aps_data;
183 if ((rc->rcmd_portseq != 0) &&
184 (tcp->th_seq != rc->rcmd_portseq))
187 bzero(portbuf, sizeof(portbuf));
188 COPYDATA(m, off, MIN(sizeof(portbuf), dlen), portbuf);
190 portbuf[sizeof(portbuf) - 1] = '\0';
192 sp = ipf_rcmd_atoi(s);
194 #ifdef IP_RCMD_PROXY_DEBUG
195 printf("ipf_p_rcmd_portmsg:sp == 0 dlen %d [%s]\n",
201 if (rc->rcmd_port != 0 && sp != rc->rcmd_port) {
202 #ifdef IP_RCMD_PROXY_DEBUG
203 printf("ipf_p_rcmd_portmsg:sp(%d) != rcmd_port(%d)\n",
210 rc->rcmd_portseq = tcp->th_seq;
213 * Initialise the packet info structure so we can search the NAT
214 * table to see if there already is soemthing present that matches
215 * up with what we want to add.
217 bcopy((char *)fin, (char *)&fi, sizeof(fi));
218 fi.fin_flx |= FI_IGNORE;
221 fi.fin_src6 = nat->nat_ndst6;
222 fi.fin_dst6 = nat->nat_nsrc6;
224 if (nat->nat_v[0] == 6) {
226 if (nat->nat_dir == NAT_OUTBOUND) {
227 nat2 = ipf_nat6_outlookup(&fi, NAT_SEARCH|IPN_TCP,
230 &nat->nat_odst6.in6);
232 nat2 = ipf_nat6_inlookup(&fi, NAT_SEARCH|IPN_TCP,
235 &nat->nat_odst6.in6);
241 if (nat->nat_dir == NAT_OUTBOUND) {
242 nat2 = ipf_nat_outlookup(&fi, NAT_SEARCH|IPN_TCP,
247 nat2 = ipf_nat_inlookup(&fi, NAT_SEARCH|IPN_TCP,
257 * Add skeleton NAT entry for connection which will come
258 * back the other way.
261 if (nat->nat_v[0] == 6) {
263 slen = ip6->ip6_plen;
264 ip6->ip6_plen = htons(sizeof(*tcp));
268 ip->ip_len = htons(fin->fin_hlen + sizeof(*tcp));
272 * Fill out the fake TCP header with a few fields that ipfilter
273 * considers to be important.
275 bzero((char *)tcp2, sizeof(*tcp2));
276 tcp2->th_win = htons(8192);
278 tcp2->th_flags = TH_SYN;
280 fi.fin_dp = (char *)tcp2;
282 fi.fin_dlen = sizeof(*tcp2);
283 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
284 fi.fin_flx &= FI_LOWTTL|FI_FRAG|FI_TCPUDP|FI_OPTIONS|FI_IGNORE;
286 if (nat->nat_dir == NAT_OUTBOUND) {
288 direction = NAT_INBOUND;
291 direction = NAT_OUTBOUND;
293 nflags = SI_W_SPORT|NAT_SLAVE|IPN_TCP;
295 MUTEX_ENTER(&softn->ipf_nat_new);
297 nat2 = ipf_nat_add(&fi, rc->rcmd_rule, NULL, nflags,
301 nat2 = ipf_nat6_add(&fi, rc->rcmd_rule, NULL, nflags,
304 MUTEX_EXIT(&softn->ipf_nat_new);
307 (void) ipf_nat_proto(&fi, nat2, IPN_TCP);
308 MUTEX_ENTER(&nat2->nat_lock);
309 ipf_nat_update(&fi, nat2);
310 MUTEX_EXIT(&nat2->nat_lock);
312 if (nat2->nat_dir == NAT_INBOUND)
313 fi.fin_dst6 = nat->nat_osrc6;
314 (void) ipf_state_add(softc, &fi, NULL, SI_W_SPORT);
316 if (nat->nat_v[0] == 6) {
318 ip6->ip6_plen = slen;
330 ipf_p_rcmd_out(arg, fin, aps, nat)
336 if (nat->nat_dir == NAT_OUTBOUND)
337 return ipf_p_rcmd_portmsg(fin, aps, nat);
343 ipf_p_rcmd_in(arg, fin, aps, nat)
349 if (nat->nat_dir == NAT_INBOUND)
350 return ipf_p_rcmd_portmsg(fin, aps, nat);