4 * Copyright (C) 1997-2003 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
8 #if defined(KERNEL) || defined(_KERNEL)
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
20 # include <sys/fcntl.h>
22 #if !defined(_KERNEL) && !defined(__KERNEL__)
35 # include <sys/protosw.h>
37 #include <sys/socket.h>
39 # if !defined(__NetBSD__) && !defined(sun) && !defined(__osf__) && \
40 !defined(__OpenBSD__) && !defined(__hpux) && !defined(__sgi) && \
42 # include <sys/ctype.h>
44 # include <sys/systm.h>
45 # if !defined(__SVR4) && !defined(__svr4__)
46 # include <sys/mbuf.h>
49 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
50 # include <sys/filio.h>
51 # include <sys/fcntl.h>
52 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
53 # include "opt_ipfilter.h"
56 # include <sys/ioctl.h>
58 #if defined(__SVR4) || defined(__svr4__)
59 # include <sys/byteorder.h>
61 # include <sys/dditypes.h>
63 # include <sys/stream.h>
64 # include <sys/kmem.h>
67 # include <sys/queue.h>
73 #include <net/route.h>
74 #include <netinet/in.h>
75 #include <netinet/in_systm.h>
76 #include <netinet/ip.h>
78 # include <netinet/ip_var.h>
80 #include <netinet/tcp.h>
81 #include <netinet/udp.h>
82 #include <netinet/ip_icmp.h>
83 #include "netinet/ip_compat.h"
84 #include <netinet/tcpip.h>
85 #include "netinet/ip_fil.h"
86 #include "netinet/ip_nat.h"
87 #include "netinet/ip_state.h"
88 #include "netinet/ip_proxy.h"
89 #if (__FreeBSD_version >= 300000)
90 # include <sys/malloc.h>
93 #include "netinet/ip_ftp_pxy.c"
94 #include "netinet/ip_rcmd_pxy.c"
95 # include "netinet/ip_pptp_pxy.c"
97 # include "netinet/ip_irc_pxy.c"
98 # include "netinet/ip_raudio_pxy.c"
99 # include "netinet/ip_netbios_pxy.c"
101 #include "netinet/ip_ipsec_pxy.c"
102 #include "netinet/ip_rpcb_pxy.c"
104 /* END OF INCLUDES */
107 static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.62.2.21 2007/06/02 21:22:28 darrenr Exp $";
110 static int appr_fixseqack __P((fr_info_t *, ip_t *, ap_session_t *, int ));
112 #define AP_SESS_SIZE 53
115 int ipf_proxy_debug = 0;
117 int ipf_proxy_debug = 2;
119 ap_session_t *ap_sess_tab[AP_SESS_SIZE];
120 ap_session_t *ap_sess_list = NULL;
121 aproxy_t *ap_proxylist = NULL;
122 aproxy_t ap_proxies[] = {
124 { NULL, "ftp", (char)IPPROTO_TCP, 0, 0, ippr_ftp_init, ippr_ftp_fini,
125 ippr_ftp_new, NULL, ippr_ftp_in, ippr_ftp_out, NULL, NULL },
128 { NULL, "irc", (char)IPPROTO_TCP, 0, 0, ippr_irc_init, ippr_irc_fini,
129 ippr_irc_new, NULL, NULL, ippr_irc_out, NULL, NULL },
131 #ifdef IPF_RCMD_PROXY
132 { NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, ippr_rcmd_init, ippr_rcmd_fini,
133 ippr_rcmd_new, NULL, ippr_rcmd_in, ippr_rcmd_out, NULL, NULL },
135 #ifdef IPF_RAUDIO_PROXY
136 { NULL, "raudio", (char)IPPROTO_TCP, 0, 0, ippr_raudio_init, ippr_raudio_fini,
137 ippr_raudio_new, NULL, ippr_raudio_in, ippr_raudio_out, NULL, NULL },
139 #ifdef IPF_MSNRPC_PROXY
140 { NULL, "msnrpc", (char)IPPROTO_TCP, 0, 0, ippr_msnrpc_init, ippr_msnrpc_fini,
141 ippr_msnrpc_new, NULL, ippr_msnrpc_in, ippr_msnrpc_out, NULL, NULL },
143 #ifdef IPF_NETBIOS_PROXY
144 { NULL, "netbios", (char)IPPROTO_UDP, 0, 0, ippr_netbios_init, ippr_netbios_fini,
145 NULL, NULL, NULL, ippr_netbios_out, NULL, NULL },
147 #ifdef IPF_IPSEC_PROXY
148 { NULL, "ipsec", (char)IPPROTO_UDP, 0, 0,
149 ippr_ipsec_init, ippr_ipsec_fini, ippr_ipsec_new, ippr_ipsec_del,
150 ippr_ipsec_inout, ippr_ipsec_inout, ippr_ipsec_match, NULL },
152 #ifdef IPF_PPTP_PROXY
153 { NULL, "pptp", (char)IPPROTO_TCP, 0, 0,
154 ippr_pptp_init, ippr_pptp_fini, ippr_pptp_new, ippr_pptp_del,
155 ippr_pptp_inout, ippr_pptp_inout, NULL, NULL },
157 #ifdef IPF_H323_PROXY
158 { NULL, "h323", (char)IPPROTO_TCP, 0, 0, ippr_h323_init, ippr_h323_fini,
159 ippr_h323_new, ippr_h323_del, ippr_h323_in, NULL, NULL, NULL },
160 { NULL, "h245", (char)IPPROTO_TCP, 0, 0, NULL, NULL,
161 ippr_h245_new, NULL, NULL, ippr_h245_out, NULL, NULL },
163 #ifdef IPF_RPCB_PROXY
165 { NULL, "rpcbt", (char)IPPROTO_TCP, 0, 0,
166 ippr_rpcb_init, ippr_rpcb_fini, ippr_rpcb_new, ippr_rpcb_del,
167 ippr_rpcb_in, ippr_rpcb_out, NULL, NULL },
169 { NULL, "rpcbu", (char)IPPROTO_UDP, 0, 0,
170 ippr_rpcb_init, ippr_rpcb_fini, ippr_rpcb_new, ippr_rpcb_del,
171 ippr_rpcb_in, ippr_rpcb_out, NULL, NULL },
173 { NULL, "", '\0', 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }
177 * Dynamically add a new kernel proxy. Ensure that it is unique in the
178 * collection compiled in and dynamically added.
185 for (a = ap_proxies; a->apr_p; a++)
186 if ((a->apr_p == ap->apr_p) &&
187 !strncmp(a->apr_label, ap->apr_label,
188 sizeof(ap->apr_label))) {
189 if (ipf_proxy_debug > 1)
190 printf("appr_add: %s/%d already present (B)\n",
191 a->apr_label, a->apr_p);
195 for (a = ap_proxylist; (a != NULL); a = a->apr_next)
196 if ((a->apr_p == ap->apr_p) &&
197 !strncmp(a->apr_label, ap->apr_label,
198 sizeof(ap->apr_label))) {
199 if (ipf_proxy_debug > 1)
200 printf("appr_add: %s/%d already present (D)\n",
201 a->apr_label, a->apr_p);
204 ap->apr_next = ap_proxylist;
206 if (ap->apr_init != NULL)
207 return (*ap->apr_init)();
213 * Check to see if the proxy this control request has come through for
214 * exists, and if it does and it has a control function then invoke that
223 a = appr_lookup(ctl->apc_p, ctl->apc_label);
225 if (ipf_proxy_debug > 1)
226 printf("appr_ctl: can't find %s/%d\n",
227 ctl->apc_label, ctl->apc_p);
229 } else if (a->apr_ctl == NULL) {
230 if (ipf_proxy_debug > 1)
231 printf("appr_ctl: no ctl function for %s/%d\n",
232 ctl->apc_label, ctl->apc_p);
235 error = (*a->apr_ctl)(a, ctl);
236 if ((error != 0) && (ipf_proxy_debug > 1))
237 printf("appr_ctl: %s/%d ctl error %d\n",
238 a->apr_label, a->apr_p, error);
245 * Delete a proxy that has been added dynamically from those available.
246 * If it is in use, return 1 (do not destroy NOW), not in use 0 or -1
247 * if it cannot be matched.
254 for (app = &ap_proxylist; ((a = *app) != NULL); app = &a->apr_next)
256 a->apr_flags |= APR_DELETE;
258 if (ap->apr_ref != 0) {
259 if (ipf_proxy_debug > 2)
260 printf("appr_del: orphaning %s/%d\n",
261 ap->apr_label, ap->apr_p);
266 if (ipf_proxy_debug > 1)
267 printf("appr_del: proxy %lx not found\n", (u_long)ap);
273 * Return 1 if the packet is a good match against a proxy, else 0.
275 int appr_ok(fin, tcp, nat)
280 aproxy_t *apr = nat->in_apr;
281 u_short dport = nat->in_dport;
283 if ((apr == NULL) || (apr->apr_flags & APR_DELETE) ||
284 (fin->fin_p != apr->apr_p))
286 if ((tcp == NULL) && dport)
292 int appr_ioctl(data, cmd, mode, ctx)
302 mode = mode; /* LINT */
307 error = BCOPYIN(data, &ctl, sizeof(ctl));
312 if (ctl.apc_dsize > 0) {
313 KMALLOCS(ptr, u_char *, ctl.apc_dsize);
317 error = copyinptr(ctl.apc_data, ptr,
328 error = appr_ctl(&ctl);
331 KFREES(ptr, ctl.apc_dsize);
343 * If a proxy has a match function, call that to do extended packet
346 int appr_match(fin, nat)
355 if (ipf_proxy_debug > 8)
356 printf("appr_match(%lx,%lx) aps %lx ptr %lx\n",
357 (u_long)fin, (u_long)nat, (u_long)nat->nat_aps,
360 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) != 0) {
361 if (ipf_proxy_debug > 0)
362 printf("appr_match: flx 0x%x (BAD|SHORT)\n",
368 if ((apr == NULL) || (apr->apr_flags & APR_DELETE)) {
369 if (ipf_proxy_debug > 0)
370 printf("appr_match:apr %lx apr_flags 0x%x\n",
371 (u_long)apr, apr ? apr->apr_flags : 0);
375 if (apr->apr_match != NULL) {
376 result = (*apr->apr_match)(fin, nat->nat_aps, nat);
378 if (ipf_proxy_debug > 4)
379 printf("appr_match: result %d\n", result);
388 * Allocate a new application proxy structure and fill it in with the
389 * relevant details. call the init function once complete, prior to
392 int appr_new(fin, nat)
396 register ap_session_t *aps;
399 if (ipf_proxy_debug > 8)
400 printf("appr_new(%lx,%lx) \n", (u_long)fin, (u_long)nat);
402 if ((nat->nat_ptr == NULL) || (nat->nat_aps != NULL)) {
403 if (ipf_proxy_debug > 0)
404 printf("appr_new: nat_ptr %lx nat_aps %lx\n",
405 (u_long)nat->nat_ptr, (u_long)nat->nat_aps);
409 apr = nat->nat_ptr->in_apr;
411 if ((apr->apr_flags & APR_DELETE) ||
412 (fin->fin_p != apr->apr_p)) {
413 if (ipf_proxy_debug > 2)
414 printf("appr_new: apr_flags 0x%x p %d/%d\n",
415 apr->apr_flags, fin->fin_p, apr->apr_p);
419 KMALLOC(aps, ap_session_t *);
421 if (ipf_proxy_debug > 0)
422 printf("appr_new: malloc failed (%lu)\n",
423 (u_long)sizeof(ap_session_t));
427 bzero((char *)aps, sizeof(*aps));
428 aps->aps_p = fin->fin_p;
429 aps->aps_data = NULL;
432 if (apr->apr_new != NULL)
433 if ((*apr->apr_new)(fin, aps, nat) == -1) {
434 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) {
435 KFREES(aps->aps_data, aps->aps_psiz);
438 if (ipf_proxy_debug > 2)
439 printf("appr_new: new(%lx) failed\n",
440 (u_long)apr->apr_new);
444 aps->aps_next = ap_sess_list;
453 * Check to see if a packet should be passed through an active proxy routine
454 * if one has been setup for it. We don't need to check the checksum here if
455 * IPFILTER_CKSUM is defined because if it is, a failed check causes FI_BAD
458 int appr_check(fin, nat)
462 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
463 # if defined(ICK_VALID)
468 tcphdr_t *tcp = NULL;
469 udphdr_t *udp = NULL;
475 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi)
479 if (fin->fin_flx & FI_BAD) {
480 if (ipf_proxy_debug > 0)
481 printf("appr_check: flx 0x%x (BAD)\n", fin->fin_flx);
485 #ifndef IPFILTER_CKSUM
486 if ((fin->fin_out == 0) && (fr_checkl4sum(fin) == -1)) {
487 if (ipf_proxy_debug > 0)
488 printf("appr_check: l4 checksum failure %d\n",
490 if (fin->fin_p == IPPROTO_TCP)
491 frstats[fin->fin_out].fr_tcpbad++;
497 if ((aps != NULL) && (aps->aps_p == fin->fin_p)) {
499 * If there is data in this packet to be proxied then try and
500 * get it all into the one buffer, else drop it.
502 #if defined(MENTAT) || defined(HAVE_M_PULLDOWN)
503 if ((fin->fin_dlen > 0) && !(fin->fin_flx & FI_COALESCE))
504 if (fr_coalesce(fin) == -1) {
505 if (ipf_proxy_debug > 0)
506 printf("appr_check: fr_coalesce failed %x\n", fin->fin_flx);
515 tcp = (tcphdr_t *)fin->fin_dp;
517 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID)
519 if (dohwcksum && (m->b_ick_flag == ICK_VALID))
523 * Don't bother the proxy with these...or in fact,
524 * should we free up proxy stuff when seen?
526 if ((fin->fin_tcpf & TH_RST) != 0)
530 udp = (udphdr_t *)fin->fin_dp;
538 if (fin->fin_out != 0) {
539 if (apr->apr_outpkt != NULL)
540 err = (*apr->apr_outpkt)(fin, aps, nat);
542 if (apr->apr_inpkt != NULL)
543 err = (*apr->apr_inpkt)(fin, aps, nat);
547 if (((ipf_proxy_debug > 0) && (rv != 0)) ||
548 (ipf_proxy_debug > 8))
549 printf("appr_check: out %d err %x rv %d\n",
550 fin->fin_out, err, rv);
561 * If err != 0 then the data size of the packet has changed
562 * so we need to recalculate the header checksums for the
565 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi)
567 short adjlen = err & 0xffff;
569 s1 = LONG_SUM(fin->fin_plen - adjlen);
570 s2 = LONG_SUM(fin->fin_plen);
571 CALC_SUMD(s1, s2, sd);
572 fix_outcksum(fin, &ip->ip_sum, sd);
577 * For TCP packets, we may need to adjust the sequence and
578 * acknowledgement numbers to reflect changes in size of the
581 * For both TCP and UDP, recalculate the layer 4 checksum,
582 * regardless, as we can't tell (here) if data has been
586 err = appr_fixseqack(fin, ip, aps, APR_INC(err));
587 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
589 tcp->th_sum = fr_cksum(fin->fin_qfm, ip,
593 tcp->th_sum = fr_cksum(fin->fin_m, ip,
597 } else if ((udp != NULL) && (udp->uh_sum != 0)) {
598 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
600 udp->uh_sum = fr_cksum(fin->fin_qfm, ip,
604 udp->uh_sum = fr_cksum(fin->fin_m, ip,
609 aps->aps_bytes += fin->fin_plen;
618 * Search for an proxy by the protocol it is being used with and its name.
620 aproxy_t *appr_lookup(pr, name)
626 if (ipf_proxy_debug > 8)
627 printf("appr_lookup(%d,%s)\n", pr, name);
629 for (ap = ap_proxies; ap->apr_p; ap++)
630 if ((ap->apr_p == pr) &&
631 !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
636 for (ap = ap_proxylist; ap; ap = ap->apr_next)
637 if ((ap->apr_p == pr) &&
638 !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
642 if (ipf_proxy_debug > 2)
643 printf("appr_lookup: failed for %d/%s\n", pr, name);
658 ap_session_t *a, **ap;
664 for (ap = &ap_sess_list; ((a = *ap) != NULL); ap = &a->aps_next)
671 if ((apr != NULL) && (apr->apr_del != NULL))
672 (*apr->apr_del)(aps);
674 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0))
675 KFREES(aps->aps_data, aps->aps_psiz);
681 * returns 2 if ack or seq number in TCP header is changed, returns 0 otherwise
683 static int appr_fixseqack(fin, ip, aps, inc)
689 int sel, ch = 0, out, nlen;
694 tcp = (tcphdr_t *)fin->fin_dp;
697 * fin->fin_plen has already been adjusted by 'inc'.
699 nlen = fin->fin_plen;
700 nlen -= (IP_HL(ip) << 2) + (TCP_OFF(tcp) << 2);
706 seq1 = (u_32_t)ntohl(tcp->th_seq);
707 sel = aps->aps_sel[out];
709 /* switch to other set ? */
710 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
711 (seq1 > aps->aps_seqmin[!sel])) {
712 if (ipf_proxy_debug > 7)
713 printf("proxy out switch set seq %d -> %d %x > %x\n",
715 aps->aps_seqmin[!sel]);
716 sel = aps->aps_sel[out] = !sel;
719 if (aps->aps_seqoff[sel]) {
720 seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel];
722 seq2 = aps->aps_seqoff[sel];
724 tcp->th_seq = htonl(seq1);
729 if (inc && (seq1 > aps->aps_seqmin[!sel])) {
730 aps->aps_seqmin[sel] = seq1 + nlen - 1;
731 aps->aps_seqoff[sel] = aps->aps_seqoff[sel] + inc;
732 if (ipf_proxy_debug > 7)
733 printf("proxy seq set %d at %x to %d + %d\n",
734 sel, aps->aps_seqmin[sel],
735 aps->aps_seqoff[sel], inc);
740 seq1 = ntohl(tcp->th_ack);
741 sel = aps->aps_sel[1 - out];
743 /* switch to other set ? */
744 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
745 (seq1 > aps->aps_ackmin[!sel])) {
746 if (ipf_proxy_debug > 7)
747 printf("proxy out switch set ack %d -> %d %x > %x\n",
749 aps->aps_ackmin[!sel]);
750 sel = aps->aps_sel[1 - out] = !sel;
753 if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) {
754 seq2 = aps->aps_ackoff[sel];
755 tcp->th_ack = htonl(seq1 - seq2);
759 seq1 = ntohl(tcp->th_seq);
760 sel = aps->aps_sel[out];
762 /* switch to other set ? */
763 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
764 (seq1 > aps->aps_ackmin[!sel])) {
765 if (ipf_proxy_debug > 7)
766 printf("proxy in switch set ack %d -> %d %x > %x\n",
767 sel, !sel, seq1, aps->aps_ackmin[!sel]);
768 sel = aps->aps_sel[out] = !sel;
771 if (aps->aps_ackoff[sel]) {
772 seq2 = aps->aps_ackmin[sel] - aps->aps_ackoff[sel];
774 seq2 = aps->aps_ackoff[sel];
776 tcp->th_seq = htonl(seq1);
781 if (inc && (seq1 > aps->aps_ackmin[!sel])) {
782 aps->aps_ackmin[!sel] = seq1 + nlen - 1;
783 aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc;
785 if (ipf_proxy_debug > 7)
786 printf("proxy ack set %d at %x to %d + %d\n",
787 !sel, aps->aps_seqmin[!sel],
788 aps->aps_seqoff[sel], inc);
793 seq1 = ntohl(tcp->th_ack);
794 sel = aps->aps_sel[1 - out];
796 /* switch to other set ? */
797 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
798 (seq1 > aps->aps_seqmin[!sel])) {
799 if (ipf_proxy_debug > 7)
800 printf("proxy in switch set seq %d -> %d %x > %x\n",
801 sel, !sel, seq1, aps->aps_seqmin[!sel]);
802 sel = aps->aps_sel[1 - out] = !sel;
805 if (aps->aps_seqoff[sel] != 0) {
806 if (ipf_proxy_debug > 7)
807 printf("sel %d seqoff %d seq1 %x seqmin %x\n",
808 sel, aps->aps_seqoff[sel], seq1,
809 aps->aps_seqmin[sel]);
810 if (seq1 > aps->aps_seqmin[sel]) {
811 seq2 = aps->aps_seqoff[sel];
812 tcp->th_ack = htonl(seq1 - seq2);
818 if (ipf_proxy_debug > 8)
819 printf("appr_fixseqack: seq %x ack %x\n",
820 (u_32_t)ntohl(tcp->th_seq), (u_32_t)ntohl(tcp->th_ack));
826 * Initialise hook for kernel application proxies.
827 * Call the initialise routine for all the compiled in kernel proxies.
834 for (ap = ap_proxies; ap->apr_p; ap++) {
835 if (ap->apr_init != NULL) {
836 err = (*ap->apr_init)();
846 * Unload hook for kernel application proxies.
847 * Call the finialise routine for all the compiled in kernel proxies.
853 for (ap = ap_proxies; ap->apr_p; ap++)
854 if (ap->apr_fini != NULL)
856 for (ap = ap_proxylist; ap; ap = ap->apr_next)
857 if (ap->apr_fini != NULL)