1 /* $NetBSD: ip_irc_pxy.c,v 1.2 2012/07/22 14:27:35 darrenr Exp $ */
2
3 /*
4 * Copyright (C) 2012 by Darren Reed.
5 *
6 * See the IPFILTER.LICENCE file for details on licencing.
7 *
8 * Id: ip_irc_pxy.c,v 1.1.1.2 2012/07/22 13:44:17 darrenr Exp
9 */
10
11 #define IPF_IRC_PROXY
12
13 #define IPF_IRCBUFSZ 96 /* This *MUST* be >= 64! */
14
15
16 void ipf_p_irc_main_load __P((void));
17 void ipf_p_irc_main_unload __P((void));
18 int ipf_p_irc_new __P((void *, fr_info_t *, ap_session_t *, nat_t *));
19 int ipf_p_irc_out __P((void *, fr_info_t *, ap_session_t *, nat_t *));
20 int ipf_p_irc_send __P((fr_info_t *, nat_t *));
21 int ipf_p_irc_complete __P((ircinfo_t *, char *, size_t));
22 u_short ipf_irc_atoi __P((char **));
23
24 static frentry_t ircnatfr;
25
26 int irc_proxy_init = 0;
27
28
29 /*
30 * Initialize local structures.
31 */
32 void
ipf_p_irc_main_load()33 ipf_p_irc_main_load()
34 {
35 bzero((char *)&ircnatfr, sizeof(ircnatfr));
36 ircnatfr.fr_ref = 1;
37 ircnatfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
38 MUTEX_INIT(&ircnatfr.fr_lock, "IRC proxy rule lock");
39 irc_proxy_init = 1;
40 }
41
42
43 void
ipf_p_irc_main_unload()44 ipf_p_irc_main_unload()
45 {
46 if (irc_proxy_init == 1) {
47 MUTEX_DESTROY(&ircnatfr.fr_lock);
48 irc_proxy_init = 0;
49 }
50 }
51
52
53 const char *ipf_p_irc_dcctypes[] = {
54 "CHAT ", /* CHAT chat ipnumber portnumber */
55 "SEND ", /* SEND filename ipnumber portnumber */
56 "MOVE ",
57 "TSEND ",
58 "SCHAT ",
59 NULL,
60 };
61
62
63 /*
64 * :A PRIVMSG B :^ADCC CHAT chat 0 0^A\r\n
65 * PRIVMSG B ^ADCC CHAT chat 0 0^A\r\n
66 */
67
68
69 int
ipf_p_irc_complete(ircp,buf,len)70 ipf_p_irc_complete(ircp, buf, len)
71 ircinfo_t *ircp;
72 char *buf;
73 size_t len;
74 {
75 register char *s, c;
76 register size_t i;
77 u_32_t l;
78 int j, k;
79
80 ircp->irc_ipnum = 0;
81 ircp->irc_port = 0;
82
83 if (len < 31)
84 return 0;
85 s = buf;
86 c = *s++;
87 i = len - 1;
88
89 if ((c != ':') && (c != 'P'))
90 return 0;
91
92 if (c == ':') {
93 /*
94 * Loosely check that the source is a nickname of some sort
95 */
96 s++;
97 c = *s;
98 ircp->irc_snick = s;
99 if (!ISALPHA(c))
100 return 0;
101 i--;
102 for (c = *s; !ISSPACE(c) && (i > 0); i--)
103 c = *s++;
104 if (i < 31)
105 return 0;
106 if (c != 'P')
107 return 0;
108 } else
109 ircp->irc_snick = NULL;
110
111 /*
112 * Check command string
113 */
114 if (strncmp(s, "PRIVMSG ", 8))
115 return 0;
116 i -= 8;
117 s += 8;
118 c = *s;
119 ircp->irc_dnick = s;
120
121 /*
122 * Loosely check that the destination is a nickname of some sort
123 */
124 if (!ISALPHA(c))
125 return 0;
126 for (; !ISSPACE(c) && (i > 0); i--)
127 c = *s++;
128 if (i < 20)
129 return 0;
130 s++,
131 i--;
132
133 /*
134 * Look for a ^A to start the DCC
135 */
136 c = *s;
137 if (c == ':') {
138 s++;
139 c = *s;
140 }
141
142 if (strncmp(s, "\001DCC ", 4))
143 return 0;
144
145 i -= 4;
146 s += 4;
147
148 /*
149 * Check for a recognised DCC command
150 */
151 for (j = 0, k = 0; ipf_p_irc_dcctypes[j]; j++) {
152 k = MIN(strlen(ipf_p_irc_dcctypes[j]), i);
153 if (!strncmp(ipf_p_irc_dcctypes[j], s, k))
154 break;
155 }
156 if (!ipf_p_irc_dcctypes[j])
157 return 0;
158
159 ircp->irc_type = s;
160 i -= k;
161 s += k;
162
163 if (i < 11)
164 return 0;
165
166 /*
167 * Check for the arg
168 */
169 c = *s;
170 if (ISSPACE(c))
171 return 0;
172 ircp->irc_arg = s;
173 for (; (c != ' ') && (c != '\001') && (i > 0); i--)
174 c = *s++;
175
176 if (c == '\001') /* In reality a ^A can quote another ^A...*/
177 return 0;
178
179 if (i < 5)
180 return 0;
181
182 s++;
183 i--;
184 c = *s;
185 if (!ISDIGIT(c))
186 return 0;
187 ircp->irc_addr = s;
188 /*
189 * Get the IP#
190 */
191 for (l = 0; ISDIGIT(c) && (i > 0); i--) {
192 l *= 10;
193 l += c - '0';
194 c = *s++;
195 }
196
197 if (i < 4)
198 return 0;
199
200 if (c != ' ')
201 return 0;
202
203 ircp->irc_ipnum = l;
204 s++;
205 i--;
206 c = *s;
207 if (!ISDIGIT(c))
208 return 0;
209 /*
210 * Get the port#
211 */
212 for (l = 0; ISDIGIT(c) && (i > 0); i--) {
213 l *= 10;
214 l += c - '0';
215 c = *s++;
216 }
217 if (i < 3)
218 return 0;
219 if (strncmp(s, "\001\r\n", 3))
220 return 0;
221 s += 3;
222 ircp->irc_len = s - buf;
223 ircp->irc_port = l;
224 return 1;
225 }
226
227
228 int
ipf_p_irc_new(arg,fin,aps,nat)229 ipf_p_irc_new(arg, fin, aps, nat)
230 void *arg;
231 fr_info_t *fin;
232 ap_session_t *aps;
233 nat_t *nat;
234 {
235 ircinfo_t *irc;
236
237 if (fin->fin_v != 4)
238 return -1;
239
240 KMALLOC(irc, ircinfo_t *);
241 if (irc == NULL)
242 return -1;
243
244 nat = nat; /* LINT */
245
246 aps->aps_data = irc;
247 aps->aps_psiz = sizeof(ircinfo_t);
248
249 bzero((char *)irc, sizeof(*irc));
250 return 0;
251 }
252
253
254 int
ipf_p_irc_send(fin,nat)255 ipf_p_irc_send(fin, nat)
256 fr_info_t *fin;
257 nat_t *nat;
258 {
259 char ctcpbuf[IPF_IRCBUFSZ], newbuf[IPF_IRCBUFSZ];
260 tcphdr_t *tcp, tcph, *tcp2 = &tcph;
261 int off, inc = 0, i, dlen;
262 ipf_main_softc_t *softc;
263 size_t nlen = 0, olen;
264 struct in_addr swip;
265 u_short a5, sp;
266 ircinfo_t *irc;
267 fr_info_t fi;
268 nat_t *nat2;
269 u_int a1;
270 ip_t *ip;
271 mb_t *m;
272 #ifdef MENTAT
273 mb_t *m1;
274 #endif
275 softc = fin->fin_main_soft;
276
277 m = fin->fin_m;
278 ip = fin->fin_ip;
279 tcp = (tcphdr_t *)fin->fin_dp;
280 bzero(ctcpbuf, sizeof(ctcpbuf));
281 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
282
283 #ifdef __sgi
284 dlen = fin->fin_plen - off;
285 #else
286 dlen = MSGDSIZE(m) - off;
287 #endif
288 if (dlen <= 0)
289 return 0;
290 COPYDATA(m, off, MIN(sizeof(ctcpbuf), dlen), ctcpbuf);
291
292 if (dlen <= 0)
293 return 0;
294 ctcpbuf[sizeof(ctcpbuf) - 1] = '\0';
295 *newbuf = '\0';
296
297 irc = nat->nat_aps->aps_data;
298 if (ipf_p_irc_complete(irc, ctcpbuf, dlen) == 0)
299 return 0;
300
301 /*
302 * check that IP address in the DCC reply is the same as the
303 * sender of the command - prevents use for port scanning.
304 */
305 if (irc->irc_ipnum != ntohl(nat->nat_osrcaddr))
306 return 0;
307
308 a5 = irc->irc_port;
309
310 /*
311 * Calculate new address parts for the DCC command
312 */
313 a1 = ntohl(ip->ip_src.s_addr);
314 olen = irc->irc_len;
315 i = irc->irc_addr - ctcpbuf;
316 i++;
317 (void) strncpy(newbuf, ctcpbuf, i);
318 /* DO NOT change these! */
319 #if defined(SNPRINTF) && defined(KERNEL)
320 SNPRINTF(newbuf, sizeof(newbuf) - i, "%u %u\001\r\n", a1, a5);
321 #else
322 (void) sprintf(newbuf, "%u %u\001\r\n", a1, a5);
323 #endif
324
325 nlen = strlen(newbuf);
326 inc = nlen - olen;
327
328 if ((inc + fin->fin_plen) > 65535)
329 return 0;
330
331 #ifdef MENTAT
332 for (m1 = m; m1->b_cont; m1 = m1->b_cont)
333 ;
334 if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) {
335 mblk_t *nm;
336
337 /* alloc enough to keep same trailer space for lower driver */
338 nm = allocb(nlen, BPRI_MED);
339 PANIC((!nm),("ipf_p_irc_out: allocb failed"));
340
341 nm->b_band = m1->b_band;
342 nm->b_wptr += nlen;
343
344 m1->b_wptr -= olen;
345 PANIC((m1->b_wptr < m1->b_rptr),
346 ("ipf_p_irc_out: cannot handle fragmented data block"));
347
348 linkb(m1, nm);
349 } else {
350 # if SOLARIS && defined(ICK_VALID)
351 if (m1->b_datap->db_struiolim == m1->b_wptr)
352 m1->b_datap->db_struiolim += inc;
353 m1->b_datap->db_struioflag &= ~STRUIO_IP;
354 # endif
355 m1->b_wptr += inc;
356 }
357 #else
358 if (inc < 0)
359 m_adj(m, inc);
360 /* the mbuf chain will be extended if necessary by m_copyback() */
361 #endif
362 COPYBACK(m, off, nlen, newbuf);
363 fin->fin_flx |= FI_DOCKSUM;
364
365 if (inc != 0) {
366 #if defined(MENTAT) || defined(__sgi)
367 register u_32_t sum1, sum2;
368
369 sum1 = fin->fin_plen;
370 sum2 = fin->fin_plen + inc;
371
372 /* Because ~1 == -2, We really need ~1 == -1 */
373 if (sum1 > sum2)
374 sum2--;
375 sum2 -= sum1;
376 sum2 = (sum2 & 0xffff) + (sum2 >> 16);
377
378 ipf_fix_outcksum(0, &ip->ip_sum, sum2, 0);
379 #endif
380 fin->fin_plen += inc;
381 ip->ip_len = htons(fin->fin_plen);
382 fin->fin_dlen += inc;
383 }
384
385 /*
386 * Add skeleton NAT entry for connection which will come back the
387 * other way.
388 */
389 sp = htons(a5);
390 /*
391 * Don't allow the PORT command to specify a port < 1024 due to
392 * security crap.
393 */
394 if (ntohs(sp) < 1024)
395 return 0;
396
397 /*
398 * The server may not make the connection back from port 20, but
399 * it is the most likely so use it here to check for a conflicting
400 * mapping.
401 */
402 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi));
403 fi.fin_data[0] = sp;
404 fi.fin_data[1] = fin->fin_data[1];
405 nat2 = ipf_nat_outlookup(fin, IPN_TCP, nat->nat_pr[1], nat->nat_nsrcip,
406 ip->ip_dst);
407 if (nat2 == NULL) {
408 #ifdef USE_MUTEXES
409 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
410 #endif
411
412 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi));
413 bzero((char *)tcp2, sizeof(*tcp2));
414 tcp2->th_win = htons(8192);
415 tcp2->th_sport = sp;
416 tcp2->th_dport = 0; /* XXX - don't specify remote port */
417 fi.fin_data[0] = ntohs(sp);
418 fi.fin_data[1] = 0;
419 fi.fin_dp = (char *)tcp2;
420 fi.fin_fr = &ircnatfr;
421 fi.fin_dlen = sizeof(*tcp2);
422 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
423 swip = ip->ip_src;
424 ip->ip_src = nat->nat_nsrcip;
425 MUTEX_ENTER(&softn->ipf_nat_new);
426 nat2 = ipf_nat_add(&fi, nat->nat_ptr, NULL,
427 NAT_SLAVE|IPN_TCP|SI_W_DPORT, NAT_OUTBOUND);
428 MUTEX_EXIT(&softn->ipf_nat_new);
429 if (nat2 != NULL) {
430 (void) ipf_nat_proto(&fi, nat2, 0);
431 MUTEX_ENTER(&nat2->nat_lock);
432 ipf_nat_update(&fi, nat2);
433 MUTEX_EXIT(&nat2->nat_lock);
434
435 (void) ipf_state_add(softc, &fi, NULL, SI_W_DPORT);
436 }
437 ip->ip_src = swip;
438 }
439 return inc;
440 }
441
442
443 int
ipf_p_irc_out(arg,fin,aps,nat)444 ipf_p_irc_out(arg, fin, aps, nat)
445 void *arg;
446 fr_info_t *fin;
447 ap_session_t *aps;
448 nat_t *nat;
449 {
450 aps = aps; /* LINT */
451 return ipf_p_irc_send(fin, nat);
452 }
453