20#define SIOCPROXY _IOWR('r', 64, struct ap_control)
21#else
22#define SIOCPROXY _IOWR(r, 64, struct ap_control)
23#endif
24
25#ifndef APR_LABELLEN
26#define APR_LABELLEN 16
27#endif
28#define AP_SESS_SIZE 53
29
30struct nat;
31struct ipnat;
32struct ipstate;
33
34typedef struct ap_tcp {
35 u_short apt_sport; /* source port */
36 u_short apt_dport; /* destination port */
37 short apt_sel[2]; /* {seq,ack}{off,min} set selector */
38 short apt_seqoff[2]; /* sequence # difference */
39 u_32_t apt_seqmin[2]; /* don't change seq-off until after this */
40 short apt_ackoff[2]; /* sequence # difference */
41 u_32_t apt_ackmin[2]; /* don't change seq-off until after this */
42 u_char apt_state[2]; /* connection state */
43} ap_tcp_t;
44
45typedef struct ap_udp {
46 u_short apu_sport; /* source port */
47 u_short apu_dport; /* destination port */
48} ap_udp_t;
49
50typedef struct ap_session {
51 struct aproxy *aps_apr;
52 union {
53 struct ap_tcp apu_tcp;
54 struct ap_udp apu_udp;
55 } aps_un;
56 u_int aps_flags;
57 U_QUAD_T aps_bytes; /* bytes sent */
58 U_QUAD_T aps_pkts; /* packets sent */
59 void *aps_nat; /* pointer back to nat struct */
60 void *aps_data; /* private data */
61 int aps_p; /* protocol */
62 int aps_psiz; /* size of private data */
63 struct ap_session *aps_hnext;
64 struct ap_session *aps_next;
65} ap_session_t;
66
67#define aps_sport aps_un.apu_tcp.apt_sport
68#define aps_dport aps_un.apu_tcp.apt_dport
69#define aps_sel aps_un.apu_tcp.apt_sel
70#define aps_seqoff aps_un.apu_tcp.apt_seqoff
71#define aps_seqmin aps_un.apu_tcp.apt_seqmin
72#define aps_state aps_un.apu_tcp.apt_state
73#define aps_ackoff aps_un.apu_tcp.apt_ackoff
74#define aps_ackmin aps_un.apu_tcp.apt_ackmin
75
76
77typedef struct ap_control {
78 char apc_label[APR_LABELLEN];
79 u_char apc_p;
80 /*
81 * The following fields are upto the proxy's apr_ctl routine to deal
82 * with. When the proxy gets this in kernel space, apc_data will
83 * point to a malloc'd region of memory of apc_dsize bytes. If the
84 * proxy wants to keep that memory, it must set apc_data to NULL
85 * before it returns. It is expected if this happens that it will
86 * take care to free it in apr_fini or otherwise as appropriate.
87 * apc_cmd is provided as a standard place to put simple commands,
88 * with apc_arg being available to put a simple arg.
89 */
90 u_long apc_cmd;
91 u_long apc_arg;
92 void *apc_data;
93 size_t apc_dsize;
94} ap_ctl_t;
95
96
97typedef struct aproxy {
98 struct aproxy *apr_next;
99 char apr_label[APR_LABELLEN]; /* Proxy label # */
100 u_char apr_p; /* protocol */
101 int apr_ref; /* +1 per rule referencing it */
102 int apr_flags;
103 int (* apr_init) __P((void));
104 void (* apr_fini) __P((void));
105 int (* apr_new) __P((fr_info_t *, ap_session_t *, struct nat *));
106 void (* apr_del) __P((ap_session_t *));
107 int (* apr_inpkt) __P((fr_info_t *, ap_session_t *, struct nat *));
108 int (* apr_outpkt) __P((fr_info_t *, ap_session_t *, struct nat *));
109 int (* apr_match) __P((fr_info_t *, ap_session_t *, struct nat *));
110 int (* apr_ctl) __P((struct aproxy *, struct ap_control *));
111} aproxy_t;
112
113#define APR_DELETE 1
114
115#define APR_ERR(x) ((x) << 16)
116#define APR_EXIT(x) (((x) >> 16) & 0xffff)
117#define APR_INC(x) ((x) & 0xffff)
118
119/*
120 * Generic #define's to cover missing things in the kernel
121 */
122#ifndef isdigit
123#define isdigit(x) ((x) >= '0' && (x) <= '9')
124#endif
125#ifndef isupper
126#define isupper(x) (((unsigned)(x) >= 'A') && ((unsigned)(x) <= 'Z'))
127#endif
128#ifndef islower
129#define islower(x) (((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z'))
130#endif
131#ifndef isalpha
132#define isalpha(x) (isupper(x) || islower(x))
133#endif
134#ifndef toupper
135#define toupper(x) (isupper(x) ? (x) : (x) - 'a' + 'A')
136#endif
137#ifndef isspace
138#define isspace(x) (((x) == ' ') || ((x) == '\r') || ((x) == '\n') || \
139 ((x) == '\t') || ((x) == '\b'))
140#endif
141
142/*
143 * This is the scratch buffer size used to hold strings from the TCP stream
144 * that we may want to parse. It's an arbitrary size, really, but it must
145 * be at least as large as IPF_FTPBUFSZ.
146 */
147#define FTP_BUFSZ 120
148
149/*
150 * This buffer, however, doesn't need to be nearly so big. It just needs to
151 * be able to squeeze in the largest command it needs to rewrite, Which ones
152 * does it rewrite? EPRT, PORT, 227 replies.
153 */
154#define IPF_FTPBUFSZ 80 /* This *MUST* be >= 53! */
155
156typedef struct ftpside {
157 char *ftps_rptr;
158 char *ftps_wptr;
159 void *ftps_ifp;
160 u_32_t ftps_seq[2];
161 u_32_t ftps_len;
162 int ftps_junk; /* 2 = no cr/lf yet, 1 = cannot parse */
163 int ftps_cmds;
164 char ftps_buf[FTP_BUFSZ];
165} ftpside_t;
166
167typedef struct ftpinfo {
168 int ftp_passok;
169 int ftp_incok;
170 ftpside_t ftp_side[2];
171} ftpinfo_t;
172
173
174/*
175 * For the irc proxy.
176 */
177typedef struct ircinfo {
178 size_t irc_len;
179 char *irc_snick;
180 char *irc_dnick;
181 char *irc_type;
182 char *irc_arg;
183 char *irc_addr;
184 u_32_t irc_ipnum;
185 u_short irc_port;
186} ircinfo_t;
187
188
189/*
190 * Real audio proxy structure and #defines
191 */
192typedef struct raudio_s {
193 int rap_seenpna;
194 int rap_seenver;
195 int rap_version;
196 int rap_eos; /* End Of Startup */
197 int rap_gotid;
198 int rap_gotlen;
199 int rap_mode;
200 int rap_sdone;
201 u_short rap_plport;
202 u_short rap_prport;
203 u_short rap_srport;
204 char rap_svr[19];
205 u_32_t rap_sbf; /* flag to indicate which of the 19 bytes have
206 * been filled
207 */
208 u_32_t rap_sseq;
209} raudio_t;
210
211#define RA_ID_END 0
212#define RA_ID_UDP 1
213#define RA_ID_ROBUST 7
214
215#define RAP_M_UDP 1
216#define RAP_M_ROBUST 2
217#define RAP_M_TCP 4
218#define RAP_M_UDP_ROBUST (RAP_M_UDP|RAP_M_ROBUST)
219
220
221/*
222 * MSN RPC proxy
223 */
224typedef struct msnrpcinfo {
225 u_int mri_flags;
226 int mri_cmd[2];
227 u_int mri_valid;
228 struct in_addr mri_raddr;
229 u_short mri_rport;
230} msnrpcinfo_t;
231
232
233/*
234 * IPSec proxy
235 */
236typedef u_32_t ipsec_cookie_t[2];
237
238typedef struct ipsec_pxy {
239 ipsec_cookie_t ipsc_icookie;
240 ipsec_cookie_t ipsc_rcookie;
241 int ipsc_rckset;
242 ipnat_t ipsc_rule;
243 nat_t *ipsc_nat;
244 struct ipstate *ipsc_state;
245} ipsec_pxy_t;
246
247/*
248 * PPTP proxy
249 */
250typedef struct pptp_side {
251 u_32_t pptps_nexthdr;
252 u_32_t pptps_next;
253 int pptps_state;
254 int pptps_gothdr;
255 int pptps_len;
256 int pptps_bytes;
257 char *pptps_wptr;
258 char pptps_buffer[512];
259} pptp_side_t;
260
261typedef struct pptp_pxy {
262 ipnat_t pptp_rule;
263 nat_t *pptp_nat;
264 struct ipstate *pptp_state;
265 u_short pptp_call[2];
266 pptp_side_t pptp_side[2];
267} pptp_pxy_t;
268
269
270/*
271 * Sun RPCBIND proxy
272 */
273#define RPCB_MAXMSG 888
274#define RPCB_RES_PMAP 0 /* Response contains a v2 port. */
275#define RPCB_RES_STRING 1 /* " " " v3 (GETADDR) string. */
276#define RPCB_RES_LIST 2 /* " " " v4 (GETADDRLIST) list. */
277#define RPCB_MAXREQS 32 /* Arbitrary limit on tracked transactions */
278
279#define RPCB_REQMIN 40
280#define RPCB_REQMAX 888
281#define RPCB_REPMIN 20
282#define RPCB_REPMAX 604 /* XXX double check this! */
283
284/*
285 * These macros determine the number of bytes between p and the end of
286 * r->rs_buf relative to l.
287 */
288#define RPCB_BUF_END(r) (char *)((r)->rm_msgbuf + (r)->rm_buflen)
289#define RPCB_BUF_GEQ(r, p, l) \
290 ((RPCB_BUF_END((r)) > (char *)(p)) && \
291 ((RPCB_BUF_END((r)) - (char *)(p)) >= (l)))
292#define RPCB_BUF_EQ(r, p, l) \
293 (RPCB_BUF_END((r)) == ((char *)(p) + (l)))
294
295/*
296 * The following correspond to RPC(B) detailed in RFC183[13].
297 */
298#define RPCB_CALL 0
299#define RPCB_REPLY 1
300#define RPCB_MSG_VERSION 2
301#define RPCB_PROG 100000
302#define RPCB_GETPORT 3
303#define RPCB_GETADDR 3
304#define RPCB_GETADDRLIST 11
305#define RPCB_MSG_ACCEPTED 0
306#define RPCB_MSG_DENIED 1
307
308/* BEGIN (Generic XDR structures) */
309typedef struct xdr_string {
310 u_32_t *xs_len;
311 char *xs_str;
312} xdr_string_t;
313
314typedef struct xdr_auth {
315 /* u_32_t xa_flavor; */
316 xdr_string_t xa_string;
317} xdr_auth_t;
318
319typedef struct xdr_uaddr {
320 u_32_t xu_ip;
321 u_short xu_port;
322 xdr_string_t xu_str;
323} xdr_uaddr_t;
324
325typedef struct xdr_proto {
326 u_int xp_proto;
327 xdr_string_t xp_str;
328} xdr_proto_t;
329
330#define xu_xslen xu_str.xs_len
331#define xu_xsstr xu_str.xs_str
332#define xp_xslen xp_str.xs_len
333#define xp_xsstr xp_str.xs_str
334/* END (Generic XDR structures) */
335
336/* BEGIN (RPC call structures) */
337typedef struct pmap_args {
338 /* u_32_t pa_prog; */
339 /* u_32_t pa_vers; */
340 u_32_t *pa_prot;
341 /* u_32_t pa_port; */
342} pmap_args_t;
343
344typedef struct rpcb_args {
345 /* u_32_t *ra_prog; */
346 /* u_32_t *ra_vers; */
347 xdr_proto_t ra_netid;
348 xdr_uaddr_t ra_maddr;
349 /* xdr_string_t ra_owner; */
350} rpcb_args_t;
351
352typedef struct rpc_call {
353 /* u_32_t rc_rpcvers; */
354 /* u_32_t rc_prog; */
355 u_32_t *rc_vers;
356 u_32_t *rc_proc;
357 xdr_auth_t rc_authcred;
358 xdr_auth_t rc_authverf;
359 union {
360 pmap_args_t ra_pmapargs;
361 rpcb_args_t ra_rpcbargs;
362 } rpcb_args;
363} rpc_call_t;
364
365#define rc_pmapargs rpcb_args.ra_pmapargs
366#define rc_rpcbargs rpcb_args.ra_rpcbargs
367/* END (RPC call structures) */
368
369/* BEGIN (RPC reply structures) */
370typedef struct rpcb_entry {
371 xdr_uaddr_t re_maddr;
372 xdr_proto_t re_netid;
373 /* u_32_t re_semantics; */
374 xdr_string_t re_family;
375 xdr_proto_t re_proto;
376 u_32_t *re_more; /* 1 == another entry follows */
377} rpcb_entry_t;
378
379typedef struct rpcb_listp {
380 u_32_t *rl_list; /* 1 == list follows */
381 int rl_cnt;
382 rpcb_entry_t rl_entries[2]; /* TCP / UDP only */
383} rpcb_listp_t;
384
385typedef struct rpc_resp {
386 /* u_32_t rr_acceptdeny; */
387 /* Omitted 'message denied' fork; we don't care about rejects. */
388 xdr_auth_t rr_authverf;
389 /* u_32_t *rr_astat; */
390 union {
391 u_32_t *resp_pmap;
392 xdr_uaddr_t resp_getaddr;
393 rpcb_listp_t resp_getaddrlist;
394 } rpcb_reply;
395} rpc_resp_t;
396
397#define rr_v2 rpcb_reply.resp_pmap
398#define rr_v3 rpcb_reply.resp_getaddr
399#define rr_v4 rpcb_reply.resp_getaddrlist
400/* END (RPC reply structures) */
401
402/* BEGIN (RPC message structure & macros) */
403typedef struct rpc_msg {
404 char rm_msgbuf[RPCB_MAXMSG]; /* RPCB data buffer */
405 u_int rm_buflen;
406 u_32_t *rm_xid;
407 /* u_32_t Call vs Reply */
408 union {
409 rpc_call_t rb_call;
410 rpc_resp_t rb_resp;
411 } rm_body;
412} rpc_msg_t;
413
414#define rm_call rm_body.rb_call
415#define rm_resp rm_body.rb_resp
416/* END (RPC message structure & macros) */
417
418/*
419 * These code paths aren't hot enough to warrant per transaction
420 * mutexes.
421 */
422typedef struct rpcb_xact {
423 struct rpcb_xact *rx_next;
424 struct rpcb_xact **rx_pnext;
425 u_32_t rx_xid; /* RPC transmission ID */
426 u_int rx_type; /* RPCB response type */
427 u_int rx_ref; /* reference count */
428 u_int rx_proto; /* transport protocol (v2 only) */
429} rpcb_xact_t;
430
431typedef struct rpcb_session {
432 ipfmutex_t rs_rxlock;
433 rpcb_xact_t *rs_rxlist;
434} rpcb_session_t;
435
436/*
437 * For an explanation, please see the following:
438 * RFC1832 - Sections 3.11, 4.4, and 4.5.
439 */
440#define XDRALIGN(x) ((((x) % 4) != 0) ? ((((x) + 3) / 4) * 4) : (x))
441
442extern ap_session_t *ap_sess_tab[AP_SESS_SIZE];
443extern ap_session_t *ap_sess_list;
444extern aproxy_t ap_proxies[];
445extern int ippr_ftp_pasvonly;
446
447extern int appr_add __P((aproxy_t *));
448extern int appr_ctl __P((ap_ctl_t *));
449extern int appr_del __P((aproxy_t *));
450extern int appr_init __P((void));
451extern void appr_unload __P((void));
452extern int appr_ok __P((fr_info_t *, tcphdr_t *, struct ipnat *));
453extern int appr_match __P((fr_info_t *, struct nat *));
454extern void appr_free __P((aproxy_t *));
455extern void aps_free __P((ap_session_t *));
456extern int appr_check __P((fr_info_t *, struct nat *));
457extern aproxy_t *appr_lookup __P((u_int, char *));
458extern int appr_new __P((fr_info_t *, struct nat *));
459extern int appr_ioctl __P((caddr_t, ioctlcmd_t, int));
460
461#endif /* __IP_PROXY_H__ */
|