1/* 2 * Copyright (C) 2012 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * $Id$ 7 */ 8 9#define IPF_IRC_PROXY 10 11#define IPF_IRCBUFSZ 96 /* This *MUST* be >= 64! */ 12 13 14void ipf_p_irc_main_load __P((void)); 15void ipf_p_irc_main_unload __P((void)); 16int ipf_p_irc_new __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 17int ipf_p_irc_out __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 18int ipf_p_irc_send __P((fr_info_t *, nat_t *)); 19int ipf_p_irc_complete __P((ircinfo_t *, char *, size_t)); 20u_short ipf_irc_atoi __P((char **)); 21 22static frentry_t ircnatfr; 23 24int irc_proxy_init = 0; 25 26 27/* 28 * Initialize local structures. 29 */ 30void 31ipf_p_irc_main_load() 32{ 33 bzero((char *)&ircnatfr, sizeof(ircnatfr)); 34 ircnatfr.fr_ref = 1; 35 ircnatfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 36 MUTEX_INIT(&ircnatfr.fr_lock, "IRC proxy rule lock"); 37 irc_proxy_init = 1; 38} 39 40 41void 42ipf_p_irc_main_unload() 43{ 44 if (irc_proxy_init == 1) { 45 MUTEX_DESTROY(&ircnatfr.fr_lock); 46 irc_proxy_init = 0; 47 } 48} 49 50 51const char *ipf_p_irc_dcctypes[] = { 52 "CHAT ", /* CHAT chat ipnumber portnumber */ 53 "SEND ", /* SEND filename ipnumber portnumber */ 54 "MOVE ", 55 "TSEND ", 56 "SCHAT ", 57 NULL, 58}; 59 60 61/* 62 * :A PRIVMSG B :^ADCC CHAT chat 0 0^A\r\n 63 * PRIVMSG B ^ADCC CHAT chat 0 0^A\r\n 64 */ 65 66 67int 68ipf_p_irc_complete(ircp, buf, len) 69 ircinfo_t *ircp; 70 char *buf; 71 size_t len; 72{ 73 register char *s, c; 74 register size_t i; 75 u_32_t l; 76 int j, k; 77 78 ircp->irc_ipnum = 0; 79 ircp->irc_port = 0; 80 81 if (len < 31) 82 return 0; 83 s = buf; 84 c = *s++; 85 i = len - 1; 86 87 if ((c != ':') && (c != 'P')) 88 return 0; 89 90 if (c == ':') { 91 /* 92 * Loosely check that the source is a nickname of some sort 93 */ 94 s++; 95 c = *s; 96 ircp->irc_snick = s; 97 if (!ISALPHA(c)) 98 return 0; 99 i--; 100 for (c = *s; !ISSPACE(c) && (i > 0); i--) 101 c = *s++; 102 if (i < 31) 103 return 0; 104 if (c != 'P') 105 return 0; 106 } else 107 ircp->irc_snick = NULL; 108 109 /* 110 * Check command string 111 */ 112 if (strncmp(s, "PRIVMSG ", 8)) 113 return 0; 114 i -= 8; 115 s += 8; 116 c = *s; 117 ircp->irc_dnick = s; 118 119 /* 120 * Loosely check that the destination is a nickname of some sort 121 */ 122 if (!ISALPHA(c)) 123 return 0; 124 for (; !ISSPACE(c) && (i > 0); i--) 125 c = *s++; 126 if (i < 20) 127 return 0; 128 s++, 129 i--; 130 131 /* 132 * Look for a ^A to start the DCC 133 */ 134 c = *s; 135 if (c == ':') { 136 s++; 137 c = *s; 138 } 139 140 if (strncmp(s, "\001DCC ", 4)) 141 return 0; 142 143 i -= 4; 144 s += 4; 145 146 /* 147 * Check for a recognised DCC command 148 */ 149 for (j = 0, k = 0; ipf_p_irc_dcctypes[j]; j++) { 150 k = MIN(strlen(ipf_p_irc_dcctypes[j]), i); 151 if (!strncmp(ipf_p_irc_dcctypes[j], s, k)) 152 break; 153 } 154 if (!ipf_p_irc_dcctypes[j]) 155 return 0; 156 157 ircp->irc_type = s; 158 i -= k; 159 s += k; 160 161 if (i < 11) 162 return 0; 163 164 /* 165 * Check for the arg 166 */ 167 c = *s; 168 if (ISSPACE(c)) 169 return 0; 170 ircp->irc_arg = s; 171 for (; (c != ' ') && (c != '\001') && (i > 0); i--) 172 c = *s++; 173 174 if (c == '\001') /* In reality a ^A can quote another ^A...*/ 175 return 0; 176 177 if (i < 5) 178 return 0; 179 180 s++; 181 i--; 182 c = *s; 183 if (!ISDIGIT(c)) 184 return 0; 185 ircp->irc_addr = s; 186 /* 187 * Get the IP# 188 */ 189 for (l = 0; ISDIGIT(c) && (i > 0); i--) { 190 l *= 10; 191 l += c - '0'; 192 c = *s++; 193 } 194 195 if (i < 4) 196 return 0; 197 198 if (c != ' ') 199 return 0; 200 201 ircp->irc_ipnum = l; 202 s++; 203 i--; 204 c = *s; 205 if (!ISDIGIT(c)) 206 return 0; 207 /* 208 * Get the port# 209 */ 210 for (l = 0; ISDIGIT(c) && (i > 0); i--) { 211 l *= 10; 212 l += c - '0'; 213 c = *s++; 214 } 215 if (i < 3) 216 return 0; 217 if (strncmp(s, "\001\r\n", 3)) 218 return 0; 219 s += 3; 220 ircp->irc_len = s - buf; 221 ircp->irc_port = l; 222 return 1; 223} 224 225 226int 227ipf_p_irc_new(arg, fin, aps, nat) 228 void *arg; 229 fr_info_t *fin; 230 ap_session_t *aps; 231 nat_t *nat; 232{ 233 ircinfo_t *irc; 234 235 if (fin->fin_v != 4) 236 return -1; 237 238 KMALLOC(irc, ircinfo_t *); 239 if (irc == NULL) 240 return -1; 241 242 nat = nat; /* LINT */ 243 244 aps->aps_data = irc; 245 aps->aps_psiz = sizeof(ircinfo_t); 246 247 bzero((char *)irc, sizeof(*irc)); 248 return 0; 249} 250 251 252int 253ipf_p_irc_send(fin, nat) 254 fr_info_t *fin; 255 nat_t *nat; 256{ 257 char ctcpbuf[IPF_IRCBUFSZ], newbuf[IPF_IRCBUFSZ]; 258 tcphdr_t *tcp, tcph, *tcp2 = &tcph; 259 int off, inc = 0, i, dlen; 260 ipf_main_softc_t *softc; 261 size_t nlen = 0, olen; 262 struct in_addr swip; 263 u_short a5, sp; 264 ircinfo_t *irc; 265 fr_info_t fi; 266 nat_t *nat2; 267 u_int a1; 268 ip_t *ip; 269 mb_t *m; 270#ifdef MENTAT 271 mb_t *m1; 272#endif 273 softc = fin->fin_main_soft; 274 275 m = fin->fin_m; 276 ip = fin->fin_ip; 277 tcp = (tcphdr_t *)fin->fin_dp; 278 bzero(ctcpbuf, sizeof(ctcpbuf)); 279 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 280 281#ifdef __sgi 282 dlen = fin->fin_plen - off; 283#else 284 dlen = MSGDSIZE(m) - off; 285#endif 286 if (dlen <= 0) 287 return 0; 288 COPYDATA(m, off, MIN(sizeof(ctcpbuf), dlen), ctcpbuf); 289 290 if (dlen <= 0) 291 return 0; 292 ctcpbuf[sizeof(ctcpbuf) - 1] = '\0'; 293 *newbuf = '\0'; 294 295 irc = nat->nat_aps->aps_data; 296 if (ipf_p_irc_complete(irc, ctcpbuf, dlen) == 0) 297 return 0; 298 299 /* 300 * check that IP address in the DCC reply is the same as the 301 * sender of the command - prevents use for port scanning. 302 */ 303 if (irc->irc_ipnum != ntohl(nat->nat_osrcaddr)) 304 return 0; 305 306 a5 = irc->irc_port; 307 308 /* 309 * Calculate new address parts for the DCC command 310 */ 311 a1 = ntohl(ip->ip_src.s_addr); 312 olen = irc->irc_len; 313 i = irc->irc_addr - ctcpbuf; 314 i++; 315 (void) strncpy(newbuf, ctcpbuf, i); 316 /* DO NOT change these! */ 317#if defined(SNPRINTF) && defined(KERNEL) 318 SNPRINTF(newbuf, sizeof(newbuf) - i, "%u %u\001\r\n", a1, a5); 319#else 320 (void) sprintf(newbuf, "%u %u\001\r\n", a1, a5); 321#endif 322 323 nlen = strlen(newbuf); 324 inc = nlen - olen; 325 326 if ((inc + fin->fin_plen) > 65535) 327 return 0; 328 329#ifdef MENTAT 330 for (m1 = m; m1->b_cont; m1 = m1->b_cont) 331 ; 332 if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) { 333 mblk_t *nm; 334 335 /* alloc enough to keep same trailer space for lower driver */ 336 nm = allocb(nlen, BPRI_MED); 337 PANIC((!nm),("ipf_p_irc_out: allocb failed")); 338 339 nm->b_band = m1->b_band; 340 nm->b_wptr += nlen; 341 342 m1->b_wptr -= olen; 343 PANIC((m1->b_wptr < m1->b_rptr), 344 ("ipf_p_irc_out: cannot handle fragmented data block")); 345 346 linkb(m1, nm); 347 } else { 348# if SOLARIS && defined(ICK_VALID) 349 if (m1->b_datap->db_struiolim == m1->b_wptr) 350 m1->b_datap->db_struiolim += inc; 351 m1->b_datap->db_struioflag &= ~STRUIO_IP; 352# endif 353 m1->b_wptr += inc; 354 } 355#else 356 if (inc < 0) 357 m_adj(m, inc); 358 /* the mbuf chain will be extended if necessary by m_copyback() */ 359#endif 360 COPYBACK(m, off, nlen, newbuf); 361 fin->fin_flx |= FI_DOCKSUM; 362 363 if (inc != 0) { 364#if defined(MENTAT) || defined(__sgi) 365 register u_32_t sum1, sum2; 366 367 sum1 = fin->fin_plen; 368 sum2 = fin->fin_plen + inc; 369 370 /* Because ~1 == -2, We really need ~1 == -1 */ 371 if (sum1 > sum2) 372 sum2--; 373 sum2 -= sum1; 374 sum2 = (sum2 & 0xffff) + (sum2 >> 16); 375 376 ipf_fix_outcksum(0, &ip->ip_sum, sum2, 0); 377#endif 378 fin->fin_plen += inc; 379 ip->ip_len = htons(fin->fin_plen); 380 fin->fin_dlen += inc; 381 } 382 383 /* 384 * Add skeleton NAT entry for connection which will come back the 385 * other way. 386 */ 387 sp = htons(a5); 388 /* 389 * Don't allow the PORT command to specify a port < 1024 due to 390 * security crap. 391 */ 392 if (ntohs(sp) < 1024) 393 return 0; 394 395 /* 396 * The server may not make the connection back from port 20, but 397 * it is the most likely so use it here to check for a conflicting 398 * mapping. 399 */ 400 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi)); 401 fi.fin_data[0] = sp; 402 fi.fin_data[1] = fin->fin_data[1]; 403 nat2 = ipf_nat_outlookup(fin, IPN_TCP, nat->nat_pr[1], nat->nat_nsrcip, 404 ip->ip_dst); 405 if (nat2 == NULL) { 406#ifdef USE_MUTEXES 407 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 408#endif 409 410 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi)); 411 bzero((char *)tcp2, sizeof(*tcp2)); 412 tcp2->th_win = htons(8192); 413 tcp2->th_sport = sp; 414 tcp2->th_dport = 0; /* XXX - don't specify remote port */ 415 fi.fin_data[0] = ntohs(sp); 416 fi.fin_data[1] = 0; 417 fi.fin_dp = (char *)tcp2; 418 fi.fin_fr = &ircnatfr; 419 fi.fin_dlen = sizeof(*tcp2); 420 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 421 swip = ip->ip_src; 422 ip->ip_src = nat->nat_nsrcip; 423 MUTEX_ENTER(&softn->ipf_nat_new); 424 nat2 = ipf_nat_add(&fi, nat->nat_ptr, NULL, 425 NAT_SLAVE|IPN_TCP|SI_W_DPORT, NAT_OUTBOUND); 426 MUTEX_EXIT(&softn->ipf_nat_new); 427 if (nat2 != NULL) { 428 (void) ipf_nat_proto(&fi, nat2, 0); 429 MUTEX_ENTER(&nat2->nat_lock); 430 ipf_nat_update(&fi, nat2); 431 MUTEX_EXIT(&nat2->nat_lock); 432 433 (void) ipf_state_add(softc, &fi, NULL, SI_W_DPORT); 434 } 435 ip->ip_src = swip; 436 } 437 return inc; 438} 439 440 441int 442ipf_p_irc_out(arg, fin, aps, nat) 443 void *arg; 444 fr_info_t *fin; 445 ap_session_t *aps; 446 nat_t *nat; 447{ 448 aps = aps; /* LINT */ 449 return ipf_p_irc_send(fin, nat); 450} 451