1/* $NetBSD: ip_proxy.h,v 1.10 2009/08/19 08:36:12 darrenr Exp $ */ 2 3/* 4 * Copyright (C) 1997-2001 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id: ip_proxy.h,v 2.31.2.6 2007/10/26 12:15:13 darrenr Exp 9 */ 10 11#ifndef _NETINET_IP_PROXY_H_ 12#define _NETINET_IP_PROXY_H_ 13 14#ifndef SOLARIS 15#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) 16#endif 17 18#if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51) 19#define SIOCPROXY _IOWR('r', 64, struct ap_control) 20#else 21#define SIOCPROXY _IOWR(r, 64, struct ap_control) 22#endif 23 24#ifndef APR_LABELLEN 25#define APR_LABELLEN 16 26#endif 27#define AP_SESS_SIZE 53 28 29struct nat; 30struct ipnat; 31struct ipstate; 32 33typedef struct ap_tcp { 34 u_short apt_sport; /* source port */ 35 u_short apt_dport; /* destination port */ 36 short apt_sel[2]; /* {seq,ack}{off,min} set selector */ 37 short apt_seqoff[2]; /* sequence # difference */ 38 u_32_t apt_seqmin[2]; /* don't change seq-off until after this */ 39 short apt_ackoff[2]; /* sequence # difference */ 40 u_32_t apt_ackmin[2]; /* don't change seq-off until after this */ 41 u_char apt_state[2]; /* connection state */ 42} ap_tcp_t; 43 44typedef struct ap_udp { 45 u_short apu_sport; /* source port */ 46 u_short apu_dport; /* destination port */ 47} ap_udp_t; 48 49typedef struct ap_session { 50 struct aproxy *aps_apr; 51 union { 52 struct ap_tcp apu_tcp; 53 struct ap_udp apu_udp; 54 } aps_un; 55 u_int aps_flags; 56 U_QUAD_T aps_bytes; /* bytes sent */ 57 U_QUAD_T aps_pkts; /* packets sent */ 58 void *aps_nat; /* pointer back to nat struct */ 59 void *aps_data; /* private data */ 60 int aps_p; /* protocol */ 61 int aps_psiz; /* size of private data */ 62 struct ap_session *aps_hnext; 63 struct ap_session *aps_next; 64} ap_session_t; 65 66#define aps_sport aps_un.apu_tcp.apt_sport 67#define aps_dport aps_un.apu_tcp.apt_dport 68#define aps_sel aps_un.apu_tcp.apt_sel 69#define aps_seqoff aps_un.apu_tcp.apt_seqoff 70#define aps_seqmin aps_un.apu_tcp.apt_seqmin 71#define aps_state aps_un.apu_tcp.apt_state 72#define aps_ackoff aps_un.apu_tcp.apt_ackoff 73#define aps_ackmin aps_un.apu_tcp.apt_ackmin 74 75 76typedef struct ap_control { 77 char apc_label[APR_LABELLEN]; 78 u_char apc_p; 79 /* 80 * The following fields are upto the proxy's apr_ctl routine to deal 81 * with. When the proxy gets this in kernel space, apc_data will 82 * point to a malloc'd region of memory of apc_dsize bytes. If the 83 * proxy wants to keep that memory, it must set apc_data to NULL 84 * before it returns. It is expected if this happens that it will 85 * take care to free it in apr_fini or otherwise as appropriate. 86 * apc_cmd is provided as a standard place to put simple commands, 87 * with apc_arg being available to put a simple arg. 88 */ 89 u_long apc_cmd; 90 u_long apc_arg; 91 void *apc_data; 92 size_t apc_dsize; 93} ap_ctl_t; 94 95 96typedef struct aproxy { 97 struct aproxy *apr_next; 98 char apr_label[APR_LABELLEN]; /* Proxy label # */ 99 u_char apr_p; /* protocol */ 100 int apr_ref; /* +1 per rule referencing it */ 101 int apr_flags; 102 int (* apr_init)(void); 103 void (* apr_fini)(void); 104 int (* apr_new)(fr_info_t *, ap_session_t *, struct nat *); 105 void (* apr_del)(ap_session_t *); 106 int (* apr_inpkt)(fr_info_t *, ap_session_t *, struct nat *); 107 int (* apr_outpkt)(fr_info_t *, ap_session_t *, struct nat *); 108 int (* apr_match)(fr_info_t *, ap_session_t *, struct nat *); 109 int (* apr_ctl)(struct aproxy *, struct ap_control *); 110} aproxy_t; 111 112#define APR_DELETE 1 113 114#define APR_ERR(x) ((x) << 16) 115#define APR_EXIT(x) (((x) >> 16) & 0xffff) 116#define APR_INC(x) ((x) & 0xffff) 117 118/* 119 * Generic #define's to cover missing things in the kernel 120 */ 121#ifndef isdigit 122#define isdigit(x) ((x) >= '0' && (x) <= '9') 123#endif 124#ifndef isupper 125#define isupper(x) (((unsigned)(x) >= 'A') && ((unsigned)(x) <= 'Z')) 126#endif 127#ifndef islower 128#define islower(x) (((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z')) 129#endif 130#ifndef isalpha 131#define isalpha(x) (isupper(x) || islower(x)) 132#endif 133#ifndef toupper 134#define toupper(x) (isupper(x) ? (x) : (x) - 'a' + 'A') 135#endif 136#ifndef isspace 137#define isspace(x) (((x) == ' ') || ((x) == '\r') || ((x) == '\n') || \ 138 ((x) == '\t') || ((x) == '\b')) 139#endif 140 141/* 142 * This is the scratch buffer size used to hold strings from the TCP stream 143 * that we may want to parse. It's an arbitrary size, really, but it must 144 * be at least as large as IPF_FTPBUFSZ. 145 */ 146#define FTP_BUFSZ 120 147 148/* 149 * This buffer, however, doesn't need to be nearly so big. It just needs to 150 * be able to squeeze in the largest command it needs to rewrite, Which ones 151 * does it rewrite? EPRT, PORT, 227 replies. 152 */ 153#define IPF_FTPBUFSZ 80 /* This *MUST* be >= 53! */ 154 155typedef struct ftpside { 156 char *ftps_rptr; 157 char *ftps_wptr; 158 void *ftps_ifp; 159 u_32_t ftps_seq[2]; 160 u_32_t ftps_len; 161 int ftps_junk; /* 2 = no cr/lf yet, 1 = cannot parse */ 162 int ftps_cmds; 163 char ftps_buf[FTP_BUFSZ]; 164} ftpside_t; 165 166typedef struct ftpinfo { 167 int ftp_passok; 168 int ftp_incok; 169 ftpside_t ftp_side[2]; 170} ftpinfo_t; 171 172 173/* 174 * For the irc proxy. 175 */ 176typedef struct ircinfo { 177 size_t irc_len; 178 char *irc_snick; 179 char *irc_dnick; 180 char *irc_type; 181 char *irc_arg; 182 char *irc_addr; 183 u_32_t irc_ipnum; 184 u_short irc_port; 185} ircinfo_t; 186 187 188/* 189 * Real audio proxy structure and #defines 190 */ 191typedef struct raudio_s { 192 int rap_seenpna; 193 int rap_seenver; 194 int rap_version; 195 int rap_eos; /* End Of Startup */ 196 int rap_gotid; 197 int rap_gotlen; 198 int rap_mode; 199 int rap_sdone; 200 u_short rap_plport; 201 u_short rap_prport; 202 u_short rap_srport; 203 char rap_svr[19]; 204 u_32_t rap_sbf; /* flag to indicate which of the 19 bytes have 205 * been filled 206 */ 207 u_32_t rap_sseq; 208} raudio_t; 209 210#define RA_ID_END 0 211#define RA_ID_UDP 1 212#define RA_ID_ROBUST 7 213 214#define RAP_M_UDP 1 215#define RAP_M_ROBUST 2 216#define RAP_M_TCP 4 217#define RAP_M_UDP_ROBUST (RAP_M_UDP|RAP_M_ROBUST) 218 219 220/* 221 * MSN RPC proxy 222 */ 223typedef struct msnrpcinfo { 224 u_int mri_flags; 225 int mri_cmd[2]; 226 u_int mri_valid; 227 struct in_addr mri_raddr; 228 u_short mri_rport; 229} msnrpcinfo_t; 230 231 232/* 233 * IPSec proxy 234 */ 235typedef u_32_t ipsec_cookie_t[2]; 236 237typedef struct ipsec_pxy { 238 ipsec_cookie_t ipsc_icookie; 239 ipsec_cookie_t ipsc_rcookie; 240 int ipsc_rckset; 241 ipnat_t ipsc_rule; 242 nat_t *ipsc_nat; 243 struct ipstate *ipsc_state; 244} ipsec_pxy_t; 245 246/* 247 * PPTP proxy 248 */ 249typedef struct pptp_side { 250 u_32_t pptps_nexthdr; 251 u_32_t pptps_next; 252 int pptps_state; 253 int pptps_gothdr; 254 int pptps_len; 255 int pptps_bytes; 256 char *pptps_wptr; 257 char pptps_buffer[512]; 258} pptp_side_t; 259 260typedef struct pptp_pxy { 261 ipnat_t pptp_rule; 262 nat_t *pptp_nat; 263 struct ipstate *pptp_state; 264 u_short pptp_call[2]; 265 pptp_side_t pptp_side[2]; 266} pptp_pxy_t; 267 268 269/* 270 * Sun RPCBIND proxy 271 */ 272#define RPCB_MAXMSG 888 273#define RPCB_RES_PMAP 0 /* Response contains a v2 port. */ 274#define RPCB_RES_STRING 1 /* " " " v3 (GETADDR) string. */ 275#define RPCB_RES_LIST 2 /* " " " v4 (GETADDRLIST) list. */ 276#define RPCB_MAXREQS 32 /* Arbitrary limit on tracked transactions */ 277 278#define RPCB_REQMIN 40 279#define RPCB_REQMAX 888 280#define RPCB_REPMIN 20 281#define RPCB_REPMAX 604 /* XXX double check this! */ 282 283/* 284 * These macros determine the number of bytes between p and the end of 285 * r->rs_buf relative to l. 286 */ 287#define RPCB_BUF_END(r) (char *)((r)->rm_msgbuf + (r)->rm_buflen) 288#define RPCB_BUF_GEQ(r, p, l) \ 289 ((RPCB_BUF_END((r)) > (char *)(p)) && \ 290 ((RPCB_BUF_END((r)) - (char *)(p)) >= (l))) 291#define RPCB_BUF_EQ(r, p, l) \ 292 (RPCB_BUF_END((r)) == ((char *)(p) + (l))) 293 294/* 295 * The following correspond to RPC(B) detailed in RFC183[13]. 296 */ 297#define RPCB_CALL 0 298#define RPCB_REPLY 1 299#define RPCB_MSG_VERSION 2 300#define RPCB_PROG 100000 301#define RPCB_GETPORT 3 302#define RPCB_GETADDR 3 303#define RPCB_GETADDRLIST 11 304#define RPCB_MSG_ACCEPTED 0 305#define RPCB_MSG_DENIED 1 306 307/* BEGIN (Generic XDR structures) */ 308typedef struct xdr_string { 309 u_32_t *xs_len; 310 char *xs_str; 311} xdr_string_t; 312 313typedef struct xdr_auth { 314 /* u_32_t xa_flavor; */ 315 xdr_string_t xa_string; 316} xdr_auth_t; 317 318typedef struct xdr_uaddr { 319 u_32_t xu_ip; 320 u_short xu_port; 321 xdr_string_t xu_str; 322} xdr_uaddr_t; 323 324typedef struct xdr_proto { 325 u_int xp_proto; 326 xdr_string_t xp_str; 327} xdr_proto_t; 328 329#define xu_xslen xu_str.xs_len 330#define xu_xsstr xu_str.xs_str 331#define xp_xslen xp_str.xs_len 332#define xp_xsstr xp_str.xs_str 333/* END (Generic XDR structures) */ 334 335/* BEGIN (RPC call structures) */ 336typedef struct pmap_args { 337 /* u_32_t pa_prog; */ 338 /* u_32_t pa_vers; */ 339 u_32_t *pa_prot; 340 /* u_32_t pa_port; */ 341} pmap_args_t; 342 343typedef struct rpcb_args { 344 /* u_32_t *ra_prog; */ 345 /* u_32_t *ra_vers; */ 346 xdr_proto_t ra_netid; 347 xdr_uaddr_t ra_maddr; 348 /* xdr_string_t ra_owner; */ 349} rpcb_args_t; 350 351typedef struct rpc_call { 352 /* u_32_t rc_rpcvers; */ 353 /* u_32_t rc_prog; */ 354 u_32_t *rc_vers; 355 u_32_t *rc_proc; 356 xdr_auth_t rc_authcred; 357 xdr_auth_t rc_authverf; 358 union { 359 pmap_args_t ra_pmapargs; 360 rpcb_args_t ra_rpcbargs; 361 } rpcb_args; 362} rpc_call_t; 363 364#define rc_pmapargs rpcb_args.ra_pmapargs 365#define rc_rpcbargs rpcb_args.ra_rpcbargs 366/* END (RPC call structures) */ 367 368/* BEGIN (RPC reply structures) */ 369typedef struct rpcb_entry { 370 xdr_uaddr_t re_maddr; 371 xdr_proto_t re_netid; 372 /* u_32_t re_semantics; */ 373 xdr_string_t re_family; 374 xdr_proto_t re_proto; 375 u_32_t *re_more; /* 1 == another entry follows */ 376} rpcb_entry_t; 377 378typedef struct rpcb_listp { 379 u_32_t *rl_list; /* 1 == list follows */ 380 int rl_cnt; 381 rpcb_entry_t rl_entries[2]; /* TCP / UDP only */ 382} rpcb_listp_t; 383 384typedef struct rpc_resp { 385 /* u_32_t rr_acceptdeny; */ 386 /* Omitted 'message denied' fork; we don't care about rejects. */ 387 xdr_auth_t rr_authverf; 388 /* u_32_t *rr_astat; */ 389 union { 390 u_32_t *resp_pmap; 391 xdr_uaddr_t resp_getaddr; 392 rpcb_listp_t resp_getaddrlist; 393 } rpcb_reply; 394} rpc_resp_t; 395 396#define rr_v2 rpcb_reply.resp_pmap 397#define rr_v3 rpcb_reply.resp_getaddr 398#define rr_v4 rpcb_reply.resp_getaddrlist 399/* END (RPC reply structures) */ 400 401/* BEGIN (RPC message structure & macros) */ 402typedef struct rpc_msg { 403 char rm_msgbuf[RPCB_MAXMSG]; /* RPCB data buffer */ 404 u_int rm_buflen; 405 u_32_t *rm_xid; 406 /* u_32_t Call vs Reply */ 407 union { 408 rpc_call_t rb_call; 409 rpc_resp_t rb_resp; 410 } rm_body; 411} rpc_msg_t; 412 413#define rm_call rm_body.rb_call 414#define rm_resp rm_body.rb_resp 415/* END (RPC message structure & macros) */ 416 417/* 418 * These code paths aren't hot enough to warrant per transaction 419 * mutexes. 420 */ 421typedef struct rpcb_xact { 422 struct rpcb_xact *rx_next; 423 struct rpcb_xact **rx_pnext; 424 u_32_t rx_xid; /* RPC transmission ID */ 425 u_int rx_type; /* RPCB response type */ 426 u_int rx_ref; /* reference count */ 427 u_int rx_proto; /* transport protocol (v2 only) */ 428} rpcb_xact_t; 429 430typedef struct rpcb_session { 431 ipfmutex_t rs_rxlock; 432 rpcb_xact_t *rs_rxlist; 433} rpcb_session_t; 434 435/* 436 * For an explanation, please see the following: 437 * RFC1832 - Sections 3.11, 4.4, and 4.5. 438 */ 439#define XDRALIGN(x) ((((x) % 4) != 0) ? ((((x) + 3) / 4) * 4) : (x)) 440 441extern ap_session_t *ap_sess_tab[AP_SESS_SIZE]; 442extern ap_session_t *ap_sess_list; 443extern aproxy_t ap_proxies[]; 444extern int ippr_ftp_pasvonly; 445extern int ipf_proxy_debug; 446 447extern int appr_add(aproxy_t *); 448extern int appr_ctl(ap_ctl_t *); 449extern int appr_del(aproxy_t *); 450extern int appr_init(void); 451extern void appr_unload(void); 452extern int appr_ok(fr_info_t *, tcphdr_t *, struct ipnat *); 453extern int appr_match(fr_info_t *, struct nat *); 454extern void appr_free(aproxy_t *); 455extern void aps_free(ap_session_t *); 456extern int appr_check(fr_info_t *, struct nat *); 457extern aproxy_t *appr_lookup(u_int, char *); 458extern int appr_new(fr_info_t *, struct nat *); 459extern int appr_ioctl(void *, ioctlcmd_t, int, void *); 460 461#endif /* _NETINET_IP_PROXY_H_ */ 462