1/* $FreeBSD: stable/11/sys/contrib/ipfilter/netinet/ip_proxy.c 369541 2021-04-01 13:29:16Z git2svn $ */ 2 3/* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8#if defined(KERNEL) || defined(_KERNEL) 9# undef KERNEL 10# undef _KERNEL 11# define KERNEL 1 12# define _KERNEL 1 13#endif 14#include <sys/errno.h> 15#include <sys/types.h> 16#include <sys/param.h> 17#include <sys/time.h> 18#include <sys/file.h> 19# include <sys/fcntl.h> 20#if !defined(_KERNEL) && !defined(__KERNEL__) 21# include <stdio.h> 22# include <string.h> 23# include <stdlib.h> 24# include <ctype.h> 25# define _KERNEL 26# include <sys/uio.h> 27# undef _KERNEL 28#endif 29# include <sys/protosw.h> 30#include <sys/socket.h> 31#if defined(_KERNEL) 32#ifdef __FreeBSD__ 33# include <sys/ctype.h> 34# endif 35# include <sys/systm.h> 36# if !defined(__SVR4) 37# include <sys/mbuf.h> 38# endif 39#endif 40#if defined(_KERNEL) && defined(__FreeBSD__) 41# include <sys/filio.h> 42# include <sys/fcntl.h> 43#else 44# include <sys/ioctl.h> 45#endif 46#if defined(__SVR4) 47# include <sys/byteorder.h> 48# ifdef _KERNEL 49# include <sys/dditypes.h> 50# endif 51# include <sys/stream.h> 52# include <sys/kmem.h> 53#endif 54#ifdef __FreeBSD__ 55# include <sys/queue.h> 56#endif 57#include <net/if.h> 58#if defined(__FreeBSD__) && defined(_KERNEL) 59#include <net/vnet.h> 60#else 61#define CURVNET_SET(arg) 62#define CURVNET_RESTORE() 63#define VNET_DEFINE(_t, _v) _t _v 64#define VNET_DECLARE(_t, _v) extern _t _v 65#define VNET(arg) arg 66#endif 67#ifdef sun 68# include <net/af.h> 69#endif 70#include <netinet/in.h> 71#include <netinet/in_systm.h> 72#include <netinet/ip.h> 73# include <netinet/ip_var.h> 74#include <netinet/tcp.h> 75#include <netinet/udp.h> 76#include <netinet/ip_icmp.h> 77#include "netinet/ip_compat.h" 78#include <netinet/tcpip.h> 79#include "netinet/ip_fil.h" 80#include "netinet/ip_nat.h" 81#include "netinet/ip_state.h" 82#include "netinet/ip_proxy.h" 83#if defined(__FreeBSD__) 84# include <sys/malloc.h> 85#endif 86 87/* END OF INCLUDES */ 88 89#include "netinet/ip_ftp_pxy.c" 90#include "netinet/ip_tftp_pxy.c" 91#include "netinet/ip_rcmd_pxy.c" 92#include "netinet/ip_pptp_pxy.c" 93#if defined(_KERNEL) 94# include "netinet/ip_irc_pxy.c" 95# include "netinet/ip_raudio_pxy.c" 96# include "netinet/ip_netbios_pxy.c" 97#endif 98#include "netinet/ip_ipsec_pxy.c" 99#include "netinet/ip_rpcb_pxy.c" 100 101#if !defined(lint) 102static const char rcsid[] = "@(#)$Id$"; 103#endif 104 105#define AP_SESS_SIZE 53 106 107static int ipf_proxy_fixseqack(fr_info_t *, ip_t *, ap_session_t *, int ); 108static aproxy_t *ipf_proxy_create_clone(ipf_main_softc_t *, aproxy_t *); 109 110typedef struct ipf_proxy_softc_s { 111 int ips_proxy_debug; 112 int ips_proxy_session_size; 113 ap_session_t **ips_sess_tab; 114 ap_session_t *ips_sess_list; 115 aproxy_t *ips_proxies; 116 int ips_init_run; 117 ipftuneable_t *ipf_proxy_tune; 118} ipf_proxy_softc_t; 119 120static ipftuneable_t ipf_proxy_tuneables[] = { 121 { { (void *)offsetof(ipf_proxy_softc_t, ips_proxy_debug) }, 122 "proxy_debug", 0, 0x1f, 123 stsizeof(ipf_proxy_softc_t, ips_proxy_debug), 124 0, NULL, NULL }, 125 { { NULL }, NULL, 0, 0, 126 0, 127 0, NULL, NULL} 128}; 129 130static aproxy_t *ap_proxylist = NULL; 131static aproxy_t ips_proxies[] = { 132#ifdef IPF_FTP_PROXY 133 { NULL, NULL, "ftp", (char)IPPROTO_TCP, 0, 0, 0, 134 ipf_p_ftp_main_load, ipf_p_ftp_main_unload, 135 ipf_p_ftp_soft_create, ipf_p_ftp_soft_destroy, 136 NULL, NULL, 137 ipf_p_ftp_new, ipf_p_ftp_del, ipf_p_ftp_in, ipf_p_ftp_out, NULL, 138 NULL, NULL, NULL, NULL }, 139#endif 140#ifdef IPF_TFTP_PROXY 141 { NULL, NULL, "tftp", (char)IPPROTO_UDP, 0, 0, 0, 142 ipf_p_tftp_main_load, ipf_p_tftp_main_unload, 143 ipf_p_tftp_soft_create, ipf_p_tftp_soft_destroy, 144 NULL, NULL, 145 ipf_p_tftp_new, ipf_p_tftp_del, 146 ipf_p_tftp_in, ipf_p_tftp_out, NULL, 147 NULL, NULL, NULL, NULL }, 148#endif 149#ifdef IPF_IRC_PROXY 150 { NULL, NULL, "irc", (char)IPPROTO_TCP, 0, 0, 0, 151 ipf_p_irc_main_load, ipf_p_irc_main_unload, 152 NULL, NULL, 153 NULL, NULL, 154 ipf_p_irc_new, NULL, NULL, ipf_p_irc_out, NULL, 155 NULL, NULL, NULL, NULL }, 156#endif 157#ifdef IPF_RCMD_PROXY 158 { NULL, NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, 0, 159 ipf_p_rcmd_main_load, ipf_p_rcmd_main_unload, 160 NULL, NULL, 161 NULL, NULL, 162 ipf_p_rcmd_new, ipf_p_rcmd_del, 163 ipf_p_rcmd_in, ipf_p_rcmd_out, NULL, 164 NULL, NULL, NULL, NULL }, 165#endif 166#ifdef IPF_RAUDIO_PROXY 167 { NULL, NULL, "raudio", (char)IPPROTO_TCP, 0, 0, 0, 168 ipf_p_raudio_main_load, ipf_p_raudio_main_unload, 169 NULL, NULL, 170 NULL, NULL, 171 ipf_p_raudio_new, NULL, ipf_p_raudio_in, ipf_p_raudio_out, NULL, 172 NULL, NULL, NULL, NULL }, 173#endif 174#ifdef IPF_MSNRPC_PROXY 175 { NULL, NULL, "msnrpc", (char)IPPROTO_TCP, 0, 0, 0, 176 ipf_p_msnrpc_init, ipf_p_msnrpc_fini, 177 NULL, NULL, 178 NULL, NULL, 179 ipf_p_msnrpc_new, NULL, ipf_p_msnrpc_in, ipf_p_msnrpc_out, NULL, 180 NULL, NULL, NULL, NULL }, 181#endif 182#ifdef IPF_NETBIOS_PROXY 183 { NULL, NULL, "netbios", (char)IPPROTO_UDP, 0, 0, 0, 184 ipf_p_netbios_main_load, ipf_p_netbios_main_unload, 185 NULL, NULL, 186 NULL, NULL, 187 NULL, NULL, NULL, ipf_p_netbios_out, NULL, 188 NULL, NULL, NULL, NULL }, 189#endif 190#ifdef IPF_IPSEC_PROXY 191 { NULL, NULL, "ipsec", (char)IPPROTO_UDP, 0, 0, 0, 192 NULL, NULL, 193 ipf_p_ipsec_soft_create, ipf_p_ipsec_soft_destroy, 194 ipf_p_ipsec_soft_init, ipf_p_ipsec_soft_fini, 195 ipf_p_ipsec_new, ipf_p_ipsec_del, 196 ipf_p_ipsec_inout, ipf_p_ipsec_inout, ipf_p_ipsec_match, 197 NULL, NULL, NULL, NULL }, 198#endif 199#ifdef IPF_DNS_PROXY 200 { NULL, NULL, "dns", (char)IPPROTO_UDP, 0, 0, 0, 201 NULL, NULL, 202 ipf_p_dns_soft_create, ipf_p_dns_soft_destroy, 203 NULL, NULL, 204 ipf_p_dns_new, ipf_p_ipsec_del, 205 ipf_p_dns_inout, ipf_p_dns_inout, ipf_p_dns_match, 206 ipf_p_dns_ctl, NULL, NULL, NULL }, 207#endif 208#ifdef IPF_PPTP_PROXY 209 { NULL, NULL, "pptp", (char)IPPROTO_TCP, 0, 0, 0, 210 ipf_p_pptp_main_load, ipf_p_pptp_main_unload, 211 NULL, NULL, 212 NULL, NULL, 213 ipf_p_pptp_new, ipf_p_pptp_del, 214 ipf_p_pptp_inout, ipf_p_pptp_inout, NULL, 215 NULL, NULL, NULL, NULL }, 216#endif 217#ifdef IPF_RPCB_PROXY 218# ifndef _KERNEL 219 { NULL, NULL, "rpcbt", (char)IPPROTO_TCP, 0, 0, 0, 220 NULL, NULL, 221 NULL, NULL, 222 NULL, NULL, 223 ipf_p_rpcb_new, ipf_p_rpcb_del, 224 ipf_p_rpcb_in, ipf_p_rpcb_out, NULL, 225 NULL, NULL, NULL, NULL }, 226# endif 227 { NULL, NULL, "rpcbu", (char)IPPROTO_UDP, 0, 0, 0, 228 ipf_p_rpcb_main_load, ipf_p_rpcb_main_unload, 229 NULL, NULL, 230 NULL, NULL, 231 ipf_p_rpcb_new, ipf_p_rpcb_del, 232 ipf_p_rpcb_in, ipf_p_rpcb_out, NULL, 233 NULL, NULL, NULL, NULL }, 234#endif 235 { NULL, NULL, "", '\0', 0, 0, 0, 236 NULL, NULL, 237 NULL, NULL, 238 NULL, NULL, 239 NULL, NULL, 240 NULL, NULL, NULL, 241 NULL, NULL, NULL, NULL } 242}; 243 244 245/* ------------------------------------------------------------------------ */ 246/* Function: ipf_proxy_main_load */ 247/* Returns: int - 0 == success, else failure. */ 248/* Parameters: Nil */ 249/* */ 250/* Initialise hook for kernel application proxies. */ 251/* Call the initialise routine for all the compiled in kernel proxies. */ 252/* ------------------------------------------------------------------------ */ 253int 254ipf_proxy_main_load() 255{ 256 aproxy_t *ap; 257 258 for (ap = ips_proxies; ap->apr_p; ap++) { 259 if (ap->apr_load != NULL) 260 (*ap->apr_load)(); 261 } 262 return 0; 263} 264 265 266/* ------------------------------------------------------------------------ */ 267/* Function: ipf_proxy_main_unload */ 268/* Returns: int - 0 == success, else failure. */ 269/* Parameters: Nil */ 270/* */ 271/* Unload hook for kernel application proxies. */ 272/* Call the finialise routine for all the compiled in kernel proxies. */ 273/* ------------------------------------------------------------------------ */ 274int 275ipf_proxy_main_unload() 276{ 277 aproxy_t *ap; 278 279 for (ap = ips_proxies; ap->apr_p; ap++) 280 if (ap->apr_unload != NULL) 281 (*ap->apr_unload)(); 282 for (ap = ap_proxylist; ap; ap = ap->apr_next) 283 if (ap->apr_unload != NULL) 284 (*ap->apr_unload)(); 285 286 return 0; 287} 288 289 290/* ------------------------------------------------------------------------ */ 291/* Function: ipf_proxy_soft_create */ 292/* Returns: void * - */ 293/* Parameters: softc(I) - pointer to soft context main structure */ 294/* */ 295/* Build the structure to hold all of the run time data to support proxies. */ 296/* ------------------------------------------------------------------------ */ 297void * 298ipf_proxy_soft_create(softc) 299 ipf_main_softc_t *softc; 300{ 301 ipf_proxy_softc_t *softp; 302 aproxy_t *last; 303 aproxy_t *apn; 304 aproxy_t *ap; 305 306 KMALLOC(softp, ipf_proxy_softc_t *); 307 if (softp == NULL) 308 return softp; 309 310 bzero((char *)softp, sizeof(*softp)); 311 312#if defined(_KERNEL) 313 softp->ips_proxy_debug = 0; 314#else 315 softp->ips_proxy_debug = 2; 316#endif 317 softp->ips_proxy_session_size = AP_SESS_SIZE; 318 319 softp->ipf_proxy_tune = ipf_tune_array_copy(softp, 320 sizeof(ipf_proxy_tuneables), 321 ipf_proxy_tuneables); 322 if (softp->ipf_proxy_tune == NULL) { 323 ipf_proxy_soft_destroy(softc, softp); 324 return NULL; 325 } 326 if (ipf_tune_array_link(softc, softp->ipf_proxy_tune) == -1) { 327 ipf_proxy_soft_destroy(softc, softp); 328 return NULL; 329 } 330 331 last = NULL; 332 for (ap = ips_proxies; ap->apr_p; ap++) { 333 apn = ipf_proxy_create_clone(softc, ap); 334 if (apn == NULL) 335 goto failed; 336 if (last != NULL) 337 last->apr_next = apn; 338 else 339 softp->ips_proxies = apn; 340 last = apn; 341 } 342 for (ap = ips_proxies; ap != NULL; ap = ap->apr_next) { 343 apn = ipf_proxy_create_clone(softc, ap); 344 if (apn == NULL) 345 goto failed; 346 if (last != NULL) 347 last->apr_next = apn; 348 else 349 softp->ips_proxies = apn; 350 last = apn; 351 } 352 353 return softp; 354failed: 355 ipf_proxy_soft_destroy(softc, softp); 356 return NULL; 357} 358 359 360/* ------------------------------------------------------------------------ */ 361/* Function: ipf_proxy_soft_create */ 362/* Returns: void * - */ 363/* Parameters: softc(I) - pointer to soft context main structure */ 364/* orig(I) - pointer to proxy definition to copy */ 365/* */ 366/* This function clones a proxy definition given by orig and returns a */ 367/* a pointer to that copy. */ 368/* ------------------------------------------------------------------------ */ 369static aproxy_t * 370ipf_proxy_create_clone(softc, orig) 371 ipf_main_softc_t *softc; 372 aproxy_t *orig; 373{ 374 aproxy_t *apn; 375 376 KMALLOC(apn, aproxy_t *); 377 if (apn == NULL) 378 return NULL; 379 380 bcopy((char *)orig, (char *)apn, sizeof(*apn)); 381 apn->apr_next = NULL; 382 apn->apr_soft = NULL; 383 384 if (apn->apr_create != NULL) { 385 apn->apr_soft = (*apn->apr_create)(softc); 386 if (apn->apr_soft == NULL) { 387 KFREE(apn); 388 return NULL; 389 } 390 } 391 392 apn->apr_parent = orig; 393 orig->apr_clones++; 394 395 return apn; 396} 397 398 399/* ------------------------------------------------------------------------ */ 400/* Function: ipf_proxy_soft_create */ 401/* Returns: int - 0 == success, else failure. */ 402/* Parameters: softc(I) - pointer to soft context main structure */ 403/* arg(I) - pointer to proxy contect data */ 404/* */ 405/* Initialise the proxy context and walk through each of the proxies and */ 406/* call its initialisation function. This allows for proxies to do any */ 407/* local setup prior to actual use. */ 408/* ------------------------------------------------------------------------ */ 409int 410ipf_proxy_soft_init(softc, arg) 411 ipf_main_softc_t *softc; 412 void *arg; 413{ 414 ipf_proxy_softc_t *softp; 415 aproxy_t *ap; 416 u_int size; 417 int err; 418 419 softp = arg; 420 size = softp->ips_proxy_session_size * sizeof(ap_session_t *); 421 422 KMALLOCS(softp->ips_sess_tab, ap_session_t **, size); 423 424 if (softp->ips_sess_tab == NULL) 425 return -1; 426 427 bzero(softp->ips_sess_tab, size); 428 429 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) { 430 if (ap->apr_init != NULL) { 431 err = (*ap->apr_init)(softc, ap->apr_soft); 432 if (err != 0) 433 return -2; 434 } 435 } 436 softp->ips_init_run = 1; 437 438 return 0; 439} 440 441 442/* ------------------------------------------------------------------------ */ 443/* Function: ipf_proxy_soft_create */ 444/* Returns: int - 0 == success, else failure. */ 445/* Parameters: softc(I) - pointer to soft context main structure */ 446/* arg(I) - pointer to proxy contect data */ 447/* */ 448/* This function should always succeed. It is responsible for ensuring that */ 449/* the proxy context can be safely called when ipf_proxy_soft_destroy is */ 450/* called and suring all of the proxies have similarly been instructed. */ 451/* ------------------------------------------------------------------------ */ 452int 453ipf_proxy_soft_fini(softc, arg) 454 ipf_main_softc_t *softc; 455 void *arg; 456{ 457 ipf_proxy_softc_t *softp = arg; 458 aproxy_t *ap; 459 460 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) { 461 if (ap->apr_fini != NULL) { 462 (*ap->apr_fini)(softc, ap->apr_soft); 463 } 464 } 465 466 if (softp->ips_sess_tab != NULL) { 467 KFREES(softp->ips_sess_tab, 468 softp->ips_proxy_session_size * sizeof(ap_session_t *)); 469 softp->ips_sess_tab = NULL; 470 } 471 softp->ips_init_run = 0; 472 473 return 0; 474} 475 476 477/* ------------------------------------------------------------------------ */ 478/* Function: ipf_proxy_soft_destroy */ 479/* Returns: Nil */ 480/* Parameters: softc(I) - pointer to soft context main structure */ 481/* arg(I) - pointer to proxy contect data */ 482/* */ 483/* Free up all of the local data structures allocated during creation. */ 484/* ------------------------------------------------------------------------ */ 485void 486ipf_proxy_soft_destroy(softc, arg) 487 ipf_main_softc_t *softc; 488 void *arg; 489{ 490 ipf_proxy_softc_t *softp = arg; 491 aproxy_t *ap; 492 493 while ((ap = softp->ips_proxies) != NULL) { 494 softp->ips_proxies = ap->apr_next; 495 if (ap->apr_destroy != NULL) 496 (*ap->apr_destroy)(softc, ap->apr_soft); 497 ap->apr_parent->apr_clones--; 498 KFREE(ap); 499 } 500 501 if (softp->ipf_proxy_tune != NULL) { 502 ipf_tune_array_unlink(softc, softp->ipf_proxy_tune); 503 KFREES(softp->ipf_proxy_tune, sizeof(ipf_proxy_tuneables)); 504 softp->ipf_proxy_tune = NULL; 505 } 506 507 KFREE(softp); 508} 509 510 511/* ------------------------------------------------------------------------ */ 512/* Function: ipf_proxy_flush */ 513/* Returns: Nil */ 514/* Parameters: arg(I) - pointer to proxy contect data */ 515/* how(I) - indicates the type of flush operation */ 516/* */ 517/* Walk through all of the proxies and pass on the flush command as either */ 518/* a flush or a clear. */ 519/* ------------------------------------------------------------------------ */ 520void 521ipf_proxy_flush(arg, how) 522 void *arg; 523 int how; 524{ 525 ipf_proxy_softc_t *softp = arg; 526 aproxy_t *ap; 527 528 switch (how) 529 { 530 case 0 : 531 for (ap = softp->ips_proxies; ap; ap = ap->apr_next) 532 if (ap->apr_flush != NULL) 533 (*ap->apr_flush)(ap, how); 534 break; 535 case 1 : 536 for (ap = softp->ips_proxies; ap; ap = ap->apr_next) 537 if (ap->apr_clear != NULL) 538 (*ap->apr_clear)(ap); 539 break; 540 default : 541 break; 542 } 543} 544 545 546/* ------------------------------------------------------------------------ */ 547/* Function: ipf_proxy_add */ 548/* Returns: int - 0 == success, else failure. */ 549/* Parameters: ap(I) - pointer to proxy structure */ 550/* */ 551/* Dynamically add a new kernel proxy. Ensure that it is unique in the */ 552/* collection compiled in and dynamically added. */ 553/* ------------------------------------------------------------------------ */ 554int 555ipf_proxy_add(arg, ap) 556 void *arg; 557 aproxy_t *ap; 558{ 559 ipf_proxy_softc_t *softp = arg; 560 561 aproxy_t *a; 562 563 for (a = ips_proxies; a->apr_p; a++) 564 if ((a->apr_p == ap->apr_p) && 565 !strncmp(a->apr_label, ap->apr_label, 566 sizeof(ap->apr_label))) { 567 if (softp->ips_proxy_debug & 0x01) 568 printf("ipf_proxy_add: %s/%d present (B)\n", 569 a->apr_label, a->apr_p); 570 return -1; 571 } 572 573 for (a = ap_proxylist; (a != NULL); a = a->apr_next) 574 if ((a->apr_p == ap->apr_p) && 575 !strncmp(a->apr_label, ap->apr_label, 576 sizeof(ap->apr_label))) { 577 if (softp->ips_proxy_debug & 0x01) 578 printf("ipf_proxy_add: %s/%d present (D)\n", 579 a->apr_label, a->apr_p); 580 return -1; 581 } 582 ap->apr_next = ap_proxylist; 583 ap_proxylist = ap; 584 if (ap->apr_load != NULL) 585 (*ap->apr_load)(); 586 return 0; 587} 588 589 590/* ------------------------------------------------------------------------ */ 591/* Function: ipf_proxy_ctl */ 592/* Returns: int - 0 == success, else error */ 593/* Parameters: softc(I) - pointer to soft context main structure */ 594/* arg(I) - pointer to proxy context */ 595/* ctl(I) - pointer to proxy control structure */ 596/* */ 597/* Check to see if the proxy this control request has come through for */ 598/* exists, and if it does and it has a control function then invoke that */ 599/* control function. */ 600/* ------------------------------------------------------------------------ */ 601int 602ipf_proxy_ctl(softc, arg, ctl) 603 ipf_main_softc_t *softc; 604 void *arg; 605 ap_ctl_t *ctl; 606{ 607 ipf_proxy_softc_t *softp = arg; 608 aproxy_t *a; 609 int error; 610 611 a = ipf_proxy_lookup(arg, ctl->apc_p, ctl->apc_label); 612 if (a == NULL) { 613 if (softp->ips_proxy_debug & 0x01) 614 printf("ipf_proxy_ctl: can't find %s/%d\n", 615 ctl->apc_label, ctl->apc_p); 616 IPFERROR(80001); 617 error = ESRCH; 618 } else if (a->apr_ctl == NULL) { 619 if (softp->ips_proxy_debug & 0x01) 620 printf("ipf_proxy_ctl: no ctl function for %s/%d\n", 621 ctl->apc_label, ctl->apc_p); 622 IPFERROR(80002); 623 error = ENXIO; 624 } else { 625 error = (*a->apr_ctl)(softc, a->apr_soft, ctl); 626 if ((error != 0) && (softp->ips_proxy_debug & 0x02)) 627 printf("ipf_proxy_ctl: %s/%d ctl error %d\n", 628 a->apr_label, a->apr_p, error); 629 } 630 return error; 631} 632 633 634/* ------------------------------------------------------------------------ */ 635/* Function: ipf_proxy_del */ 636/* Returns: int - 0 == success, else failure. */ 637/* Parameters: ap(I) - pointer to proxy structure */ 638/* */ 639/* Delete a proxy that has been added dynamically from those available. */ 640/* If it is in use, return 1 (do not destroy NOW), not in use 0 or -1 */ 641/* if it cannot be matched. */ 642/* ------------------------------------------------------------------------ */ 643int 644ipf_proxy_del(ap) 645 aproxy_t *ap; 646{ 647 aproxy_t *a, **app; 648 649 for (app = &ap_proxylist; ((a = *app) != NULL); app = &a->apr_next) { 650 if (a == ap) { 651 a->apr_flags |= APR_DELETE; 652 if (ap->apr_ref == 0 && ap->apr_clones == 0) { 653 *app = a->apr_next; 654 return 0; 655 } 656 return 1; 657 } 658 } 659 660 return -1; 661} 662 663 664/* ------------------------------------------------------------------------ */ 665/* Function: ipf_proxy_ok */ 666/* Returns: int - 1 == good match else not. */ 667/* Parameters: fin(I) - pointer to packet information */ 668/* tcp(I) - pointer to TCP/UDP header */ 669/* nat(I) - pointer to current NAT session */ 670/* */ 671/* This function extends the NAT matching to ensure that a packet that has */ 672/* arrived matches the proxy information attached to the NAT rule. Notably, */ 673/* if the proxy is scheduled to be deleted then packets will not match the */ 674/* rule even if the rule is still active. */ 675/* ------------------------------------------------------------------------ */ 676int 677ipf_proxy_ok(fin, tcp, np) 678 fr_info_t *fin; 679 tcphdr_t *tcp; 680 ipnat_t *np; 681{ 682 aproxy_t *apr = np->in_apr; 683 u_short dport = np->in_odport; 684 685 if ((apr == NULL) || (apr->apr_flags & APR_DELETE) || 686 (fin->fin_p != apr->apr_p)) 687 return 0; 688 if ((tcp == NULL) && dport) 689 return 0; 690 return 1; 691} 692 693 694/* ------------------------------------------------------------------------ */ 695/* Function: ipf_proxy_ioctl */ 696/* Returns: int - 0 == success, else error */ 697/* Parameters: softc(I) - pointer to soft context main structure */ 698/* data(I) - pointer to ioctl data */ 699/* cmd(I) - ioctl command */ 700/* mode(I) - mode bits for device */ 701/* ctx(I) - pointer to context information */ 702/* */ 703/* ------------------------------------------------------------------------ */ 704int 705ipf_proxy_ioctl(softc, data, cmd, mode, ctx) 706 ipf_main_softc_t *softc; 707 caddr_t data; 708 ioctlcmd_t cmd; 709 int mode; 710 void *ctx; 711{ 712 ap_ctl_t ctl; 713 caddr_t ptr; 714 int error; 715 716 mode = mode; /* LINT */ 717 718 switch (cmd) 719 { 720 case SIOCPROXY : 721 error = ipf_inobj(softc, data, NULL, &ctl, IPFOBJ_PROXYCTL); 722 if (error != 0) { 723 return error; 724 } 725 ptr = NULL; 726 727 if (ctl.apc_dsize > 0) { 728 KMALLOCS(ptr, caddr_t, ctl.apc_dsize); 729 if (ptr == NULL) { 730 IPFERROR(80003); 731 error = ENOMEM; 732 } else { 733 error = copyinptr(softc, ctl.apc_data, ptr, 734 ctl.apc_dsize); 735 if (error == 0) 736 ctl.apc_data = ptr; 737 } 738 } else { 739 ctl.apc_data = NULL; 740 error = 0; 741 } 742 743 if (error == 0) 744 error = ipf_proxy_ctl(softc, softc->ipf_proxy_soft, 745 &ctl); 746 747 if ((error != 0) && (ptr != NULL)) { 748 KFREES(ptr, ctl.apc_dsize); 749 } 750 break; 751 752 default : 753 IPFERROR(80004); 754 error = EINVAL; 755 } 756 return error; 757} 758 759 760/* ------------------------------------------------------------------------ */ 761/* Function: ipf_proxy_match */ 762/* Returns: int - 0 == success, else error */ 763/* Parameters: fin(I) - pointer to packet information */ 764/* nat(I) - pointer to current NAT session */ 765/* */ 766/* If a proxy has a match function, call that to do extended packet */ 767/* matching. Whilst other parts of the NAT code are rather lenient when it */ 768/* comes to the quality of the packet that it will transform, the proxy */ 769/* matching is not because they need to work with data, not just headers. */ 770/* ------------------------------------------------------------------------ */ 771int 772ipf_proxy_match(fin, nat) 773 fr_info_t *fin; 774 nat_t *nat; 775{ 776 ipf_main_softc_t *softc = fin->fin_main_soft; 777 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 778 aproxy_t *apr; 779 ipnat_t *ipn; 780 int result; 781 782 ipn = nat->nat_ptr; 783 if (softp->ips_proxy_debug & 0x04) 784 printf("ipf_proxy_match(%lx,%lx) aps %lx ptr %lx\n", 785 (u_long)fin, (u_long)nat, (u_long)nat->nat_aps, 786 (u_long)ipn); 787 788 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) != 0) { 789 if (softp->ips_proxy_debug & 0x08) 790 printf("ipf_proxy_match: flx 0x%x (BAD|SHORT)\n", 791 fin->fin_flx); 792 return -1; 793 } 794 795 apr = ipn->in_apr; 796 if ((apr == NULL) || (apr->apr_flags & APR_DELETE)) { 797 if (softp->ips_proxy_debug & 0x08) 798 printf("ipf_proxy_match:apr %lx apr_flags 0x%x\n", 799 (u_long)apr, apr ? apr->apr_flags : 0); 800 return -1; 801 } 802 803 if (apr->apr_match != NULL) { 804 result = (*apr->apr_match)(fin, nat->nat_aps, nat); 805 if (result != 0) { 806 if (softp->ips_proxy_debug & 0x08) 807 printf("ipf_proxy_match: result %d\n", result); 808 return -1; 809 } 810 } 811 return 0; 812} 813 814 815/* ------------------------------------------------------------------------ */ 816/* Function: ipf_proxy_new */ 817/* Returns: int - 0 == success, else error */ 818/* Parameters: fin(I) - pointer to packet information */ 819/* nat(I) - pointer to current NAT session */ 820/* */ 821/* Allocate a new application proxy structure and fill it in with the */ 822/* relevant details. call the init function once complete, prior to */ 823/* returning. */ 824/* ------------------------------------------------------------------------ */ 825int 826ipf_proxy_new(fin, nat) 827 fr_info_t *fin; 828 nat_t *nat; 829{ 830 ipf_main_softc_t *softc = fin->fin_main_soft; 831 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 832 register ap_session_t *aps; 833 aproxy_t *apr; 834 835 if (softp->ips_proxy_debug & 0x04) 836 printf("ipf_proxy_new(%lx,%lx) \n", (u_long)fin, (u_long)nat); 837 838 if ((nat->nat_ptr == NULL) || (nat->nat_aps != NULL)) { 839 if (softp->ips_proxy_debug & 0x08) 840 printf("ipf_proxy_new: nat_ptr %lx nat_aps %lx\n", 841 (u_long)nat->nat_ptr, (u_long)nat->nat_aps); 842 return -1; 843 } 844 845 apr = nat->nat_ptr->in_apr; 846 847 if ((apr->apr_flags & APR_DELETE) || 848 (fin->fin_p != apr->apr_p)) { 849 if (softp->ips_proxy_debug & 0x08) 850 printf("ipf_proxy_new: apr_flags 0x%x p %d/%d\n", 851 apr->apr_flags, fin->fin_p, apr->apr_p); 852 return -1; 853 } 854 855 KMALLOC(aps, ap_session_t *); 856 if (!aps) { 857 if (softp->ips_proxy_debug & 0x08) 858 printf("ipf_proxy_new: malloc failed (%lu)\n", 859 (u_long)sizeof(ap_session_t)); 860 return -1; 861 } 862 863 bzero((char *)aps, sizeof(*aps)); 864 aps->aps_data = NULL; 865 aps->aps_apr = apr; 866 aps->aps_psiz = 0; 867 if (apr->apr_new != NULL) 868 if ((*apr->apr_new)(apr->apr_soft, fin, aps, nat) == -1) { 869 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) { 870 KFREES(aps->aps_data, aps->aps_psiz); 871 } 872 KFREE(aps); 873 if (softp->ips_proxy_debug & 0x08) 874 printf("ipf_proxy_new: new(%lx) failed\n", 875 (u_long)apr->apr_new); 876 return -1; 877 } 878 aps->aps_nat = nat; 879 aps->aps_next = softp->ips_sess_list; 880 softp->ips_sess_list = aps; 881 nat->nat_aps = aps; 882 883 return 0; 884} 885 886 887/* ------------------------------------------------------------------------ */ 888/* Function: ipf_proxy_check */ 889/* Returns: int - -1 == error, 0 == success */ 890/* Parameters: fin(I) - pointer to packet information */ 891/* nat(I) - pointer to current NAT session */ 892/* */ 893/* Check to see if a packet should be passed through an active proxy */ 894/* routine if one has been setup for it. We don't need to check the */ 895/* checksum here if IPFILTER_CKSUM is defined because if it is, a failed */ 896/* check causes FI_BAD to be set. */ 897/* ------------------------------------------------------------------------ */ 898int 899ipf_proxy_check(fin, nat) 900 fr_info_t *fin; 901 nat_t *nat; 902{ 903 ipf_main_softc_t *softc = fin->fin_main_soft; 904 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 905#if SOLARIS && defined(_KERNEL) && defined(ICK_VALID) 906 mb_t *m; 907#endif 908 tcphdr_t *tcp = NULL; 909 udphdr_t *udp = NULL; 910 ap_session_t *aps; 911 aproxy_t *apr; 912 short adjlen; 913 int dosum; 914 ip_t *ip; 915 short rv; 916 int err; 917#if !defined(_KERNEL) || SOLARIS 918 u_32_t s1, s2, sd; 919#endif 920 921 if (fin->fin_flx & FI_BAD) { 922 if (softp->ips_proxy_debug & 0x08) 923 printf("ipf_proxy_check: flx 0x%x (BAD)\n", 924 fin->fin_flx); 925 return -1; 926 } 927 928#ifndef IPFILTER_CKSUM 929 if ((fin->fin_out == 0) && (ipf_checkl4sum(fin) == -1)) { 930 if (softp->ips_proxy_debug & 0x08) 931 printf("ipf_proxy_check: l4 checksum failure %d\n", 932 fin->fin_p); 933 if (fin->fin_p == IPPROTO_TCP) 934 softc->ipf_stats[fin->fin_out].fr_tcpbad++; 935 return -1; 936 } 937#endif 938 939 aps = nat->nat_aps; 940 if (aps != NULL) { 941 /* 942 * If there is data in this packet to be proxied then try and 943 * get it all into the one buffer, else drop it. 944 */ 945#if SOLARIS || defined(HAVE_M_PULLDOWN) 946 if ((fin->fin_dlen > 0) && !(fin->fin_flx & FI_COALESCE)) 947 if (ipf_coalesce(fin) == -1) { 948 if (softp->ips_proxy_debug & 0x08) 949 printf("ipf_proxy_check: %s %x\n", 950 "coalesce failed", fin->fin_flx); 951 return -1; 952 } 953#endif 954 ip = fin->fin_ip; 955 if (fin->fin_cksum > FI_CK_SUMOK) 956 dosum = 0; 957 else 958 dosum = 1; 959 960 switch (fin->fin_p) 961 { 962 case IPPROTO_TCP : 963 tcp = (tcphdr_t *)fin->fin_dp; 964#if SOLARIS && defined(_KERNEL) && defined(ICK_VALID) 965 m = fin->fin_qfm; 966 if (dohwcksum && (m->b_ick_flag == ICK_VALID)) 967 dosum = 0; 968#endif 969 break; 970 case IPPROTO_UDP : 971 udp = (udphdr_t *)fin->fin_dp; 972 break; 973 default : 974 break; 975 } 976 977 apr = aps->aps_apr; 978 err = 0; 979 if (fin->fin_out != 0) { 980 if (apr->apr_outpkt != NULL) 981 err = (*apr->apr_outpkt)(apr->apr_soft, fin, 982 aps, nat); 983 } else { 984 if (apr->apr_inpkt != NULL) 985 err = (*apr->apr_inpkt)(apr->apr_soft, fin, 986 aps, nat); 987 } 988 989 rv = APR_EXIT(err); 990 if (((softp->ips_proxy_debug & 0x08) && (rv != 0)) || 991 (softp->ips_proxy_debug & 0x04)) 992 printf("ipf_proxy_check: out %d err %x rv %d\n", 993 fin->fin_out, err, rv); 994 if (rv == 1) 995 return -1; 996 997 if (rv == 2) { 998 ipf_proxy_deref(apr); 999 nat->nat_aps = NULL; 1000 return -1; 1001 } 1002 1003 /* 1004 * If err != 0 then the data size of the packet has changed 1005 * so we need to recalculate the header checksums for the 1006 * packet. 1007 */ 1008 adjlen = APR_INC(err); 1009#if !defined(_KERNEL) || SOLARIS 1010 s1 = LONG_SUM(fin->fin_plen - adjlen); 1011 s2 = LONG_SUM(fin->fin_plen); 1012 CALC_SUMD(s1, s2, sd); 1013 if ((err != 0) && (fin->fin_cksum < FI_CK_L4PART) && 1014 fin->fin_v == 4) 1015 ipf_fix_outcksum(0, &ip->ip_sum, sd, 0); 1016#endif 1017 if (fin->fin_flx & FI_DOCKSUM) 1018 dosum = 1; 1019 1020 /* 1021 * For TCP packets, we may need to adjust the sequence and 1022 * acknowledgement numbers to reflect changes in size of the 1023 * data stream. 1024 * 1025 * For both TCP and UDP, recalculate the layer 4 checksum, 1026 * regardless, as we can't tell (here) if data has been 1027 * changed or not. 1028 */ 1029 if (tcp != NULL) { 1030 err = ipf_proxy_fixseqack(fin, ip, aps, adjlen); 1031 if (fin->fin_cksum == FI_CK_L4PART) { 1032 u_short sum = ntohs(tcp->th_sum); 1033 sum += adjlen; 1034 tcp->th_sum = htons(sum); 1035 } else if (fin->fin_cksum < FI_CK_L4PART) { 1036 tcp->th_sum = fr_cksum(fin, ip, 1037 IPPROTO_TCP, tcp); 1038 } 1039 } else if ((udp != NULL) && (udp->uh_sum != 0)) { 1040 if (fin->fin_cksum == FI_CK_L4PART) { 1041 u_short sum = ntohs(udp->uh_sum); 1042 sum += adjlen; 1043 udp->uh_sum = htons(sum); 1044 } else if (dosum) { 1045 udp->uh_sum = fr_cksum(fin, ip, 1046 IPPROTO_UDP, udp); 1047 } 1048 } 1049 aps->aps_bytes += fin->fin_plen; 1050 aps->aps_pkts++; 1051 } 1052 return 1; 1053} 1054 1055 1056/* ------------------------------------------------------------------------ */ 1057/* Function: ipf_proxy_lookup */ 1058/* Returns: int - -1 == error, 0 == success */ 1059/* Parameters: arg(I) - pointer to proxy context information */ 1060/* pr(I) - protocol number for proxy */ 1061/* name(I) - proxy name */ 1062/* */ 1063/* Search for an proxy by the protocol it is being used with and its name. */ 1064/* ------------------------------------------------------------------------ */ 1065aproxy_t * 1066ipf_proxy_lookup(arg, pr, name) 1067 void *arg; 1068 u_int pr; 1069 char *name; 1070{ 1071 ipf_proxy_softc_t *softp = arg; 1072 aproxy_t *ap; 1073 1074 if (softp->ips_proxy_debug & 0x04) 1075 printf("ipf_proxy_lookup(%d,%s)\n", pr, name); 1076 1077 for (ap = softp->ips_proxies; ap != NULL; ap = ap->apr_next) 1078 if ((ap->apr_p == pr) && 1079 !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) { 1080 ap->apr_ref++; 1081 return ap; 1082 } 1083 1084 if (softp->ips_proxy_debug & 0x08) 1085 printf("ipf_proxy_lookup: failed for %d/%s\n", pr, name); 1086 return NULL; 1087} 1088 1089 1090/* ------------------------------------------------------------------------ */ 1091/* Function: ipf_proxy_deref */ 1092/* Returns: Nil */ 1093/* Parameters: ap(I) - pointer to proxy structure */ 1094/* */ 1095/* Drop the reference counter associated with the proxy. */ 1096/* ------------------------------------------------------------------------ */ 1097void 1098ipf_proxy_deref(ap) 1099 aproxy_t *ap; 1100{ 1101 ap->apr_ref--; 1102} 1103 1104 1105/* ------------------------------------------------------------------------ */ 1106/* Function: ipf_proxy_free */ 1107/* Returns: Nil */ 1108/* Parameters: softc(I) - pointer to soft context main structure */ 1109/* aps(I) - pointer to current proxy session */ 1110/* Locks Held: ipf_nat_new, ipf_nat(W) */ 1111/* */ 1112/* Free up proxy session information allocated to be used with a NAT */ 1113/* session. */ 1114/* ------------------------------------------------------------------------ */ 1115void 1116ipf_proxy_free(softc, aps) 1117 ipf_main_softc_t *softc; 1118 ap_session_t *aps; 1119{ 1120 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 1121 ap_session_t *a, **ap; 1122 aproxy_t *apr; 1123 1124 if (!aps) 1125 return; 1126 1127 for (ap = &softp->ips_sess_list; ((a = *ap) != NULL); ap = &a->aps_next) 1128 if (a == aps) { 1129 *ap = a->aps_next; 1130 break; 1131 } 1132 1133 apr = aps->aps_apr; 1134 if ((apr != NULL) && (apr->apr_del != NULL)) 1135 (*apr->apr_del)(softc, aps); 1136 1137 if ((aps->aps_data != NULL) && (aps->aps_psiz != 0)) 1138 KFREES(aps->aps_data, aps->aps_psiz); 1139 KFREE(aps); 1140} 1141 1142 1143/* ------------------------------------------------------------------------ */ 1144/* Function: ipf_proxy_fixseqack */ 1145/* Returns: int - 2 if TCP ack/seq is changed, else 0 */ 1146/* Parameters: fin(I) - pointer to packet information */ 1147/* ip(I) - pointer to IP header */ 1148/* nat(I) - pointer to current NAT session */ 1149/* inc(I) - delta to apply to TCP sequence numbering */ 1150/* */ 1151/* Adjust the TCP sequence/acknowledge numbers in the TCP header based on */ 1152/* whether or not the new header is past the point at which an adjustment */ 1153/* occurred. This might happen because of (say) an FTP string being changed */ 1154/* and the new string being a different length to the old. */ 1155/* ------------------------------------------------------------------------ */ 1156static int 1157ipf_proxy_fixseqack(fin, ip, aps, inc) 1158 fr_info_t *fin; 1159 ip_t *ip; 1160 ap_session_t *aps; 1161 int inc; 1162{ 1163 ipf_main_softc_t *softc = fin->fin_main_soft; 1164 ipf_proxy_softc_t *softp = softc->ipf_proxy_soft; 1165 int sel, ch = 0, out, nlen; 1166 u_32_t seq1, seq2; 1167 tcphdr_t *tcp; 1168 short inc2; 1169 1170 tcp = (tcphdr_t *)fin->fin_dp; 1171 out = fin->fin_out; 1172 /* 1173 * ip_len has already been adjusted by 'inc'. 1174 */ 1175 nlen = fin->fin_dlen; 1176 nlen -= (TCP_OFF(tcp) << 2); 1177 1178 inc2 = inc; 1179 inc = (int)inc2; 1180 1181 if (out != 0) { 1182 seq1 = (u_32_t)ntohl(tcp->th_seq); 1183 sel = aps->aps_sel[out]; 1184 1185 /* switch to other set ? */ 1186 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) && 1187 (seq1 > aps->aps_seqmin[!sel])) { 1188 if (softp->ips_proxy_debug & 0x10) 1189 printf("proxy out switch set seq %d -> %d %x > %x\n", 1190 sel, !sel, seq1, 1191 aps->aps_seqmin[!sel]); 1192 sel = aps->aps_sel[out] = !sel; 1193 } 1194 1195 if (aps->aps_seqoff[sel]) { 1196 seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel]; 1197 if (seq1 > seq2) { 1198 seq2 = aps->aps_seqoff[sel]; 1199 seq1 += seq2; 1200 tcp->th_seq = htonl(seq1); 1201 ch = 1; 1202 } 1203 } 1204 1205 if (inc && (seq1 > aps->aps_seqmin[!sel])) { 1206 aps->aps_seqmin[sel] = seq1 + nlen - 1; 1207 aps->aps_seqoff[sel] = aps->aps_seqoff[sel] + inc; 1208 if (softp->ips_proxy_debug & 0x10) 1209 printf("proxy seq set %d at %x to %d + %d\n", 1210 sel, aps->aps_seqmin[sel], 1211 aps->aps_seqoff[sel], inc); 1212 } 1213 1214 /***/ 1215 1216 seq1 = ntohl(tcp->th_ack); 1217 sel = aps->aps_sel[1 - out]; 1218 1219 /* switch to other set ? */ 1220 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) && 1221 (seq1 > aps->aps_ackmin[!sel])) { 1222 if (softp->ips_proxy_debug & 0x10) 1223 printf("proxy out switch set ack %d -> %d %x > %x\n", 1224 sel, !sel, seq1, 1225 aps->aps_ackmin[!sel]); 1226 sel = aps->aps_sel[1 - out] = !sel; 1227 } 1228 1229 if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) { 1230 seq2 = aps->aps_ackoff[sel]; 1231 tcp->th_ack = htonl(seq1 - seq2); 1232 ch = 1; 1233 } 1234 } else { 1235 seq1 = ntohl(tcp->th_seq); 1236 sel = aps->aps_sel[out]; 1237 1238 /* switch to other set ? */ 1239 if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) && 1240 (seq1 > aps->aps_ackmin[!sel])) { 1241 if (softp->ips_proxy_debug & 0x10) 1242 printf("proxy in switch set ack %d -> %d %x > %x\n", 1243 sel, !sel, seq1, aps->aps_ackmin[!sel]); 1244 sel = aps->aps_sel[out] = !sel; 1245 } 1246 1247 if (aps->aps_ackoff[sel]) { 1248 seq2 = aps->aps_ackmin[sel] - aps->aps_ackoff[sel]; 1249 if (seq1 > seq2) { 1250 seq2 = aps->aps_ackoff[sel]; 1251 seq1 += seq2; 1252 tcp->th_seq = htonl(seq1); 1253 ch = 1; 1254 } 1255 } 1256 1257 if (inc && (seq1 > aps->aps_ackmin[!sel])) { 1258 aps->aps_ackmin[!sel] = seq1 + nlen - 1; 1259 aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc; 1260 1261 if (softp->ips_proxy_debug & 0x10) 1262 printf("proxy ack set %d at %x to %d + %d\n", 1263 !sel, aps->aps_seqmin[!sel], 1264 aps->aps_seqoff[sel], inc); 1265 } 1266 1267 /***/ 1268 1269 seq1 = ntohl(tcp->th_ack); 1270 sel = aps->aps_sel[1 - out]; 1271 1272 /* switch to other set ? */ 1273 if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) && 1274 (seq1 > aps->aps_seqmin[!sel])) { 1275 if (softp->ips_proxy_debug & 0x10) 1276 printf("proxy in switch set seq %d -> %d %x > %x\n", 1277 sel, !sel, seq1, aps->aps_seqmin[!sel]); 1278 sel = aps->aps_sel[1 - out] = !sel; 1279 } 1280 1281 if (aps->aps_seqoff[sel] != 0) { 1282 if (softp->ips_proxy_debug & 0x10) 1283 printf("sel %d seqoff %d seq1 %x seqmin %x\n", 1284 sel, aps->aps_seqoff[sel], seq1, 1285 aps->aps_seqmin[sel]); 1286 if (seq1 > aps->aps_seqmin[sel]) { 1287 seq2 = aps->aps_seqoff[sel]; 1288 tcp->th_ack = htonl(seq1 - seq2); 1289 ch = 1; 1290 } 1291 } 1292 } 1293 1294 if (softp->ips_proxy_debug & 0x10) 1295 printf("ipf_proxy_fixseqack: seq %u ack %u\n", 1296 (u_32_t)ntohl(tcp->th_seq), (u_32_t)ntohl(tcp->th_ack)); 1297 return ch ? 2 : 0; 1298} 1299 1300 1301/* ------------------------------------------------------------------------ */ 1302/* Function: ipf_proxy_rule_rev */ 1303/* Returns: ipnat_t * - NULL = failure, else pointer to new rule */ 1304/* Parameters: nat(I) - pointer to NAT session to create rule from */ 1305/* */ 1306/* This function creates a NAT rule that is based upon the reverse packet */ 1307/* flow associated with this NAT session. Thus if this NAT session was */ 1308/* created with a map rule then this function will create a rdr rule. */ 1309/* Only address fields and network interfaces are assigned in this function */ 1310/* and the address fields are formed such that an exact is required. If the */ 1311/* original rule had a netmask, that is not replicated here not is it */ 1312/* desired. The ultimate goal here is to create a NAT rule to support a NAT */ 1313/* session being created that does not have a user configured rule. The */ 1314/* classic example is supporting the FTP proxy, where a data channel needs */ 1315/* to be setup, based on the addresses used for the control connection. In */ 1316/* that case, this function is used to handle creating NAT rules to support */ 1317/* data connections with the PORT and EPRT commands. */ 1318/* ------------------------------------------------------------------------ */ 1319ipnat_t * 1320ipf_proxy_rule_rev(nat) 1321 nat_t *nat; 1322{ 1323 ipnat_t *old; 1324 ipnat_t *ipn; 1325 int size; 1326 1327 old = nat->nat_ptr; 1328 size = old->in_size; 1329 1330 KMALLOCS(ipn, ipnat_t *, size); 1331 if (ipn == NULL) 1332 return NULL; 1333 1334 bzero((char *)ipn, size); 1335 1336 ipn->in_use = 1; 1337 ipn->in_hits = 1; 1338 ipn->in_ippip = 1; 1339 ipn->in_apr = NULL; 1340 ipn->in_size = size; 1341 ipn->in_pr[0] = old->in_pr[1]; 1342 ipn->in_pr[1] = old->in_pr[0]; 1343 ipn->in_v[0] = old->in_v[1]; 1344 ipn->in_v[1] = old->in_v[0]; 1345 ipn->in_ifps[0] = old->in_ifps[1]; 1346 ipn->in_ifps[1] = old->in_ifps[0]; 1347 ipn->in_flags = (old->in_flags | IPN_PROXYRULE); 1348 1349 ipn->in_nsrcip6 = nat->nat_odst6; 1350 ipn->in_osrcip6 = nat->nat_ndst6; 1351 1352 if ((old->in_redir & NAT_REDIRECT) != 0) { 1353 ipn->in_redir = NAT_MAP; 1354 if (ipn->in_v[0] == 4) { 1355 ipn->in_snip = ntohl(nat->nat_odstaddr); 1356 ipn->in_dnip = ntohl(nat->nat_nsrcaddr); 1357 } else { 1358#ifdef USE_INET6 1359 ipn->in_snip6 = nat->nat_odst6; 1360 ipn->in_dnip6 = nat->nat_nsrc6; 1361#endif 1362 } 1363 ipn->in_ndstip6 = nat->nat_nsrc6; 1364 ipn->in_odstip6 = nat->nat_osrc6; 1365 } else { 1366 ipn->in_redir = NAT_REDIRECT; 1367 if (ipn->in_v[0] == 4) { 1368 ipn->in_snip = ntohl(nat->nat_odstaddr); 1369 ipn->in_dnip = ntohl(nat->nat_osrcaddr); 1370 } else { 1371#ifdef USE_INET6 1372 ipn->in_snip6 = nat->nat_odst6; 1373 ipn->in_dnip6 = nat->nat_osrc6; 1374#endif 1375 } 1376 ipn->in_ndstip6 = nat->nat_osrc6; 1377 ipn->in_odstip6 = nat->nat_nsrc6; 1378 } 1379 1380 IP6_SETONES(&ipn->in_osrcmsk6); 1381 IP6_SETONES(&ipn->in_nsrcmsk6); 1382 IP6_SETONES(&ipn->in_odstmsk6); 1383 IP6_SETONES(&ipn->in_ndstmsk6); 1384 1385 ipn->in_namelen = old->in_namelen; 1386 ipn->in_ifnames[0] = old->in_ifnames[1]; 1387 ipn->in_ifnames[1] = old->in_ifnames[0]; 1388 bcopy(old->in_names, ipn->in_names, ipn->in_namelen); 1389 MUTEX_INIT(&ipn->in_lock, "ipnat rev rule lock"); 1390 1391 return ipn; 1392} 1393 1394 1395/* ------------------------------------------------------------------------ */ 1396/* Function: ipf_proxy_rule_fwd */ 1397/* Returns: ipnat_t * - NULL = failure, else pointer to new rule */ 1398/* Parameters: nat(I) - pointer to NAT session to create rule from */ 1399/* */ 1400/* The purpose and rationale of this function is much the same as the above */ 1401/* function, ipf_proxy_rule_rev, except that a rule is created that matches */ 1402/* the same direction as that of the existing NAT session. Thus if this NAT */ 1403/* session was created with a map rule then this function will also create */ 1404/* a data structure to represent a map rule. Whereas ipf_proxy_rule_rev is */ 1405/* used to support PORT/EPRT, this function supports PASV/EPSV. */ 1406/* ------------------------------------------------------------------------ */ 1407ipnat_t * 1408ipf_proxy_rule_fwd(nat) 1409 nat_t *nat; 1410{ 1411 ipnat_t *old; 1412 ipnat_t *ipn; 1413 int size; 1414 1415 old = nat->nat_ptr; 1416 size = old->in_size; 1417 1418 KMALLOCS(ipn, ipnat_t *, size); 1419 if (ipn == NULL) 1420 return NULL; 1421 1422 bzero((char *)ipn, size); 1423 1424 ipn->in_use = 1; 1425 ipn->in_hits = 1; 1426 ipn->in_ippip = 1; 1427 ipn->in_apr = NULL; 1428 ipn->in_size = size; 1429 ipn->in_pr[0] = old->in_pr[0]; 1430 ipn->in_pr[1] = old->in_pr[1]; 1431 ipn->in_v[0] = old->in_v[0]; 1432 ipn->in_v[1] = old->in_v[1]; 1433 ipn->in_ifps[0] = nat->nat_ifps[0]; 1434 ipn->in_ifps[1] = nat->nat_ifps[1]; 1435 ipn->in_flags = (old->in_flags | IPN_PROXYRULE); 1436 1437 ipn->in_nsrcip6 = nat->nat_nsrc6; 1438 ipn->in_osrcip6 = nat->nat_osrc6; 1439 ipn->in_ndstip6 = nat->nat_ndst6; 1440 ipn->in_odstip6 = nat->nat_odst6; 1441 ipn->in_redir = old->in_redir; 1442 1443 if (ipn->in_v[0] == 4) { 1444 ipn->in_snip = ntohl(nat->nat_nsrcaddr); 1445 ipn->in_dnip = ntohl(nat->nat_ndstaddr); 1446 } else { 1447#ifdef USE_INET6 1448 ipn->in_snip6 = nat->nat_nsrc6; 1449 ipn->in_dnip6 = nat->nat_ndst6; 1450#endif 1451 } 1452 1453 IP6_SETONES(&ipn->in_osrcmsk6); 1454 IP6_SETONES(&ipn->in_nsrcmsk6); 1455 IP6_SETONES(&ipn->in_odstmsk6); 1456 IP6_SETONES(&ipn->in_ndstmsk6); 1457 1458 ipn->in_namelen = old->in_namelen; 1459 ipn->in_ifnames[0] = old->in_ifnames[0]; 1460 ipn->in_ifnames[1] = old->in_ifnames[1]; 1461 bcopy(old->in_names, ipn->in_names, ipn->in_namelen); 1462 MUTEX_INIT(&ipn->in_lock, "ipnat fwd rule lock"); 1463 1464 return ipn; 1465} 1466