sys/contrib/ipfilter/netinet/ip_dns_pxy.c

   1 /*
   2  * Copyright (C) 2012 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  * $Id: ip_dns_pxy.c,v 1.1.2.10 2012/07/22 08:04:23 darren_r Exp $
   7  */
   8
   9 #define IPF_DNS_PROXY
  10
  11 /*
  12  * map ... proxy port dns/udp 53 { block .cnn.com; }
  13  */
  14 typedef struct  ipf_dns_filter  {
  15         struct  ipf_dns_filter  *idns_next;
  16         char                    *idns_name;
  17         int                     idns_namelen;
  18         int                     idns_pass;
  19 } ipf_dns_filter_t;
  20
  21
  22 typedef struct ipf_dns_softc_s {
  23         ipf_dns_filter_t        *ipf_p_dns_list;
  24         ipfrwlock_t             ipf_p_dns_rwlock;
  25         u_long                  ipf_p_dns_compress;
  26         u_long                  ipf_p_dns_toolong;
  27         u_long                  ipf_p_dns_nospace;
  28 } ipf_dns_softc_t;
  29
  30 int ipf_p_dns_allow_query __P((ipf_dns_softc_t *, dnsinfo_t *));
  31 int ipf_p_dns_ctl __P((ipf_main_softc_t *, void *, ap_ctl_t *));
  32 int ipf_p_dns_del __P((ipf_main_softc_t *, ap_session_t *));
  33 int ipf_p_dns_get_name __P((ipf_dns_softc_t *, char *, int, char *, int));
  34 int ipf_p_dns_inout __P((void *, fr_info_t *, ap_session_t *, nat_t *));
  35 int ipf_p_dns_match __P((fr_info_t *, ap_session_t *, nat_t *));
  36 int ipf_p_dns_match_names __P((ipf_dns_filter_t *, char *, int));
  37 int ipf_p_dns_new __P((void *, fr_info_t *, ap_session_t *, nat_t *));
  38 void *ipf_p_dns_soft_create __P((ipf_main_softc_t *));
  39 void ipf_p_dns_soft_destroy __P((ipf_main_softc_t *, void *));
  40
  41 typedef struct {
  42         u_char          dns_id[2];
  43         u_short         dns_ctlword;
  44         u_short         dns_qdcount;
  45         u_short         dns_ancount;
  46         u_short         dns_nscount;
  47         u_short         dns_arcount;
  48 } ipf_dns_hdr_t;
  49
  50 #define DNS_QR(x)       ((ntohs(x) & 0x8000) >> 15)
  51 #define DNS_OPCODE(x)   ((ntohs(x) & 0x7800) >> 11)
  52 #define DNS_AA(x)       ((ntohs(x) & 0x0400) >> 10)
  53 #define DNS_TC(x)       ((ntohs(x) & 0x0200) >> 9)
  54 #define DNS_RD(x)       ((ntohs(x) & 0x0100) >> 8)
  55 #define DNS_RA(x)       ((ntohs(x) & 0x0080) >> 7)
  56 #define DNS_Z(x)        ((ntohs(x) & 0x0070) >> 4)
  57 #define DNS_RCODE(x)    ((ntohs(x) & 0x000f) >> 0)
  58
  59
  60 void *
  61 ipf_p_dns_soft_create(softc)
  62         ipf_main_softc_t *softc;
  63 {
  64         ipf_dns_softc_t *softd;
  65
  66         KMALLOC(softd, ipf_dns_softc_t *);
  67         if (softd == NULL)
  68                 return NULL;
  69
  70         bzero((char *)softd, sizeof(*softd));
  71         RWLOCK_INIT(&softd->ipf_p_dns_rwlock, "ipf dns rwlock");
  72
  73         return softd;
  74 }
  75
  76
  77 void
  78 ipf_p_dns_soft_destroy(softc, arg)
  79         ipf_main_softc_t *softc;
  80         void *arg;
  81 {
  82         ipf_dns_softc_t *softd = arg;
  83         ipf_dns_filter_t *idns;
  84
  85         while ((idns = softd->ipf_p_dns_list) != NULL) {
  86                 KFREES(idns->idns_name, idns->idns_namelen);
  87                 idns->idns_name = NULL;
  88                 idns->idns_namelen = 0;
  89                 softd->ipf_p_dns_list = idns->idns_next;
  90                 KFREE(idns);
  91         }
  92         RW_DESTROY(&softd->ipf_p_dns_rwlock);
  93
  94         KFREE(softd);
  95 }
  96
  97
  98 int
  99 ipf_p_dns_ctl(softc, arg, ctl)
 100         ipf_main_softc_t *softc;
 101         void *arg;
 102         ap_ctl_t *ctl;
 103 {
 104         ipf_dns_softc_t *softd = arg;
 105         ipf_dns_filter_t *tmp, *idns, **idnsp;
 106         int error = 0;
 107
 108         /*
 109          * To make locking easier.
 110          */
 111         KMALLOC(tmp, ipf_dns_filter_t *);
 112
 113         WRITE_ENTER(&softd->ipf_p_dns_rwlock);
 114         for (idnsp = &softd->ipf_p_dns_list; (idns = *idnsp) != NULL;
 115              idnsp = &idns->idns_next) {
 116                 if (idns->idns_namelen != ctl->apc_dsize)
 117                         continue;
 118                 if (!strncmp(ctl->apc_data, idns->idns_name,
 119                     idns->idns_namelen))
 120                         break;
 121         }
 122
 123         switch (ctl->apc_cmd)
 124         {
 125         case APC_CMD_DEL :
 126                 if (idns == NULL) {
 127                         IPFERROR(80006);
 128                         error = ESRCH;
 129                         break;
 130                 }
 131                 *idnsp = idns->idns_next;
 132                 idns->idns_next = NULL;
 133                 KFREES(idns->idns_name, idns->idns_namelen);
 134                 idns->idns_name = NULL;
 135                 idns->idns_namelen = 0;
 136                 KFREE(idns);
 137                 break;
 138         case APC_CMD_ADD :
 139                 if (idns != NULL) {
 140                         IPFERROR(80007);
 141                         error = EEXIST;
 142                         break;
 143                 }
 144                 if (tmp == NULL) {
 145                         IPFERROR(80008);
 146                         error = ENOMEM;
 147                         break;
 148                 }
 149                 idns = tmp;
 150                 tmp = NULL;
 151                 idns->idns_namelen = ctl->apc_dsize;
 152                 idns->idns_name = ctl->apc_data;
 153                 idns->idns_pass = ctl->apc_arg;
 154                 idns->idns_next = NULL;
 155                 *idnsp = idns;
 156                 ctl->apc_data = NULL;
 157                 ctl->apc_dsize = 0;
 158                 break;
 159         default :
 160                 IPFERROR(80009);
 161                 error = EINVAL;
 162                 break;
 163         }
 164         RWLOCK_EXIT(&softd->ipf_p_dns_rwlock);
 165
 166         if (tmp != NULL) {
 167                 KFREE(tmp);
 168                 tmp = NULL;
 169         }
 170
 171         return error;
 172 }
 173
 174
 175 /* ARGSUSED */
 176 int
 177 ipf_p_dns_new(arg, fin, aps, nat)
 178         void *arg;
 179         fr_info_t *fin;
 180         ap_session_t *aps;
 181         nat_t *nat;
 182 {
 183         dnsinfo_t *di;
 184         int dlen;
 185
 186         if (fin->fin_v != 4)
 187                 return -1;
 188
 189         dlen = fin->fin_dlen - sizeof(udphdr_t);
 190         if (dlen < sizeof(ipf_dns_hdr_t)) {
 191                 /*
 192                  * No real DNS packet is smaller than that.
 193                  */
 194                 return -1;
 195         }
 196
 197         aps->aps_psiz = sizeof(dnsinfo_t);
 198         KMALLOCS(di, dnsinfo_t *, sizeof(dnsinfo_t));
 199         if (di == NULL) {
 200                 printf("ipf_dns_new:KMALLOCS(%d) failed\n", sizeof(*di));
 201                 return -1;
 202         }
 203
 204         MUTEX_INIT(&di->dnsi_lock, "dns lock");
 205
 206         aps->aps_data = di;
 207
 208         dlen = fin->fin_dlen - sizeof(udphdr_t);
 209         COPYDATA(fin->fin_m, fin->fin_hlen + sizeof(udphdr_t),
 210                  MIN(dlen, sizeof(di->dnsi_buffer)), di->dnsi_buffer);
 211         di->dnsi_id = (di->dnsi_buffer[0] << 8) | di->dnsi_buffer[1];
 212         return 0;
 213 }
 214
 215
 216 /* ARGSUSED */
 217 int
 218 ipf_p_dns_del(softc, aps)
 219         ipf_main_softc_t *softc;
 220         ap_session_t *aps;
 221 {
 222 #ifdef USE_MUTEXES
 223         dnsinfo_t *di = aps->aps_data;
 224
 225         MUTEX_DESTROY(&di->dnsi_lock);
 226 #endif
 227         KFREES(aps->aps_data, aps->aps_psiz);
 228         aps->aps_data = NULL;
 229         aps->aps_psiz = 0;
 230         return 0;
 231 }
 232
 233
 234 /*
 235  * Tries to match the base string (in our ACL) with the query from a packet.
 236  */
 237 int
 238 ipf_p_dns_match_names(idns, query, qlen)
 239         ipf_dns_filter_t *idns;
 240         char *query;
 241         int qlen;
 242 {
 243         int blen;
 244         char *base;
 245
 246         blen = idns->idns_namelen;
 247         base = idns->idns_name;
 248
 249         if (blen > qlen)
 250                 return 1;
 251
 252         if (blen == qlen)
 253                 return strncasecmp(base, query, qlen);
 254
 255         /*
 256          * If the base string string is shorter than the query, allow the
 257          * tail of the base to match the same length tail of the query *if*:
 258          * - the base string starts with a '*' (*cnn.com)
 259          * - the base string represents a domain (.cnn.com)
 260          * as otherwise it would not be possible to block just "cnn.com"
 261          * without also impacting "foocnn.com", etc.
 262          */
 263         if (*base == '*') {
 264                 base++;
 265                 blen--;
 266         } else if (*base != '.')
 267                 return 1;
 268
 269         return strncasecmp(base, query + qlen - blen, blen);
 270 }
 271
 272
 273 int
 274 ipf_p_dns_get_name(softd, start, len, buffer, buflen)
 275         ipf_dns_softc_t *softd;
 276         char *start;
 277         int len;
 278         char *buffer;
 279         int buflen;
 280 {
 281         char *s, *t, clen;
 282         int slen, blen;
 283
 284         s = start;
 285         t = buffer;
 286         slen = len;
 287         blen = buflen - 1;      /* Always make room for trailing \0 */
 288
 289         while (*s != '\0') {
 290                 clen = *s;
 291                 if ((clen & 0xc0) == 0xc0) {    /* Doesn't do compression */
 292                         softd->ipf_p_dns_compress++;
 293                         return 0;
 294                 }
 295                 if (clen > slen) {
 296                         softd->ipf_p_dns_toolong++;
 297                         return 0;       /* Does the name run off the end? */
 298                 }
 299                 if ((clen + 1) > blen) {
 300                         softd->ipf_p_dns_nospace++;
 301                         return 0;       /* Enough room for name+.? */
 302                 }
 303                 s++;
 304                 bcopy(s, t, clen);
 305                 t += clen;
 306                 s += clen;
 307                 *t++ = '.';
 308                 slen -= clen;
 309                 blen -= (clen + 1);
 310         }
 311
 312         *(t - 1) = '\0';
 313         return s - start;
 314 }
 315
 316
 317 int
 318 ipf_p_dns_allow_query(softd, dnsi)
 319         ipf_dns_softc_t *softd;
 320         dnsinfo_t *dnsi;
 321 {
 322         ipf_dns_filter_t *idns;
 323         int len;
 324
 325         len = strlen(dnsi->dnsi_buffer);
 326
 327         for (idns = softd->ipf_p_dns_list; idns != NULL; idns = idns->idns_next)
 328                 if (ipf_p_dns_match_names(idns, dnsi->dnsi_buffer, len) == 0)
 329                         return idns->idns_pass;
 330         return 0;
 331 }
 332
 333
 334 /* ARGSUSED */
 335 int
 336 ipf_p_dns_inout(arg, fin, aps, nat)
 337         void *arg;
 338         fr_info_t *fin;
 339         ap_session_t *aps;
 340         nat_t *nat;
 341 {
 342         ipf_dns_softc_t *softd = arg;
 343         ipf_dns_hdr_t *dns;
 344         dnsinfo_t *di;
 345         char *data;
 346         int dlen, q, rc = 0;
 347
 348         if (fin->fin_dlen < sizeof(*dns))
 349                 return APR_ERR(1);
 350
 351         dns = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t));
 352
 353         q = dns->dns_qdcount;
 354
 355         data = (char *)(dns + 1);
 356         dlen = fin->fin_dlen - sizeof(*dns) - sizeof(udphdr_t);
 357
 358         di = aps->aps_data;
 359
 360         READ_ENTER(&softd->ipf_p_dns_rwlock);
 361         MUTEX_ENTER(&di->dnsi_lock);
 362
 363         for (; (dlen > 0) && (q > 0); q--) {
 364                 int len;
 365
 366                 len = ipf_p_dns_get_name(softd, data, dlen, di->dnsi_buffer,
 367                                          sizeof(di->dnsi_buffer));
 368                 if (len == 0) {
 369                         rc = 1;
 370                         break;
 371                 }
 372                 rc = ipf_p_dns_allow_query(softd, di);
 373                 if (rc != 0)
 374                         break;
 375                 data += len;
 376                 dlen -= len;
 377         }
 378         MUTEX_EXIT(&di->dnsi_lock);
 379         RWLOCK_EXIT(&softd->ipf_p_dns_rwlock);
 380
 381         return APR_ERR(rc);
 382 }
 383
 384
 385 /* ARGSUSED */
 386 int
 387 ipf_p_dns_match(fin, aps, nat)
 388         fr_info_t *fin;
 389         ap_session_t *aps;
 390         nat_t *nat;
 391 {
 392         dnsinfo_t *di = aps->aps_data;
 393         ipf_dns_hdr_t *dnh;
 394
 395         if ((fin->fin_dlen < sizeof(u_short)) || (fin->fin_flx & FI_FRAG))
 396                 return -1;
 397
 398         dnh = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t));
 399         if (((dnh->dns_id[0] << 8) | dnh->dns_id[1]) != di->dnsi_id)
 400                 return -1;
 401         return 0;
 402 }