1 /* $NetBSD: ip_irc_pxy.c,v 1.2 2012/07/22 14:27:35 darrenr Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id: ip_irc_pxy.c,v 1.1.1.2 2012/07/22 13:44:17 darrenr Exp 9 */ 10 11 #define IPF_IRC_PROXY 12 13 #define IPF_IRCBUFSZ 96 /* This *MUST* be >= 64! */ 14 15 16 void ipf_p_irc_main_load __P((void)); 17 void ipf_p_irc_main_unload __P((void)); 18 int ipf_p_irc_new __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 19 int ipf_p_irc_out __P((void *, fr_info_t *, ap_session_t *, nat_t *)); 20 int ipf_p_irc_send __P((fr_info_t *, nat_t *)); 21 int ipf_p_irc_complete __P((ircinfo_t *, char *, size_t)); 22 u_short ipf_irc_atoi __P((char **)); 23 24 static frentry_t ircnatfr; 25 26 int irc_proxy_init = 0; 27 28 29 /* 30 * Initialize local structures. 31 */ 32 void 33 ipf_p_irc_main_load() 34 { 35 bzero((char *)&ircnatfr, sizeof(ircnatfr)); 36 ircnatfr.fr_ref = 1; 37 ircnatfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE; 38 MUTEX_INIT(&ircnatfr.fr_lock, "IRC proxy rule lock"); 39 irc_proxy_init = 1; 40 } 41 42 43 void 44 ipf_p_irc_main_unload() 45 { 46 if (irc_proxy_init == 1) { 47 MUTEX_DESTROY(&ircnatfr.fr_lock); 48 irc_proxy_init = 0; 49 } 50 } 51 52 53 const char *ipf_p_irc_dcctypes[] = { 54 "CHAT ", /* CHAT chat ipnumber portnumber */ 55 "SEND ", /* SEND filename ipnumber portnumber */ 56 "MOVE ", 57 "TSEND ", 58 "SCHAT ", 59 NULL, 60 }; 61 62 63 /* 64 * :A PRIVMSG B :^ADCC CHAT chat 0 0^A\r\n 65 * PRIVMSG B ^ADCC CHAT chat 0 0^A\r\n 66 */ 67 68 69 int 70 ipf_p_irc_complete(ircp, buf, len) 71 ircinfo_t *ircp; 72 char *buf; 73 size_t len; 74 { 75 register char *s, c; 76 register size_t i; 77 u_32_t l; 78 int j, k; 79 80 ircp->irc_ipnum = 0; 81 ircp->irc_port = 0; 82 83 if (len < 31) 84 return 0; 85 s = buf; 86 c = *s++; 87 i = len - 1; 88 89 if ((c != ':') && (c != 'P')) 90 return 0; 91 92 if (c == ':') { 93 /* 94 * Loosely check that the source is a nickname of some sort 95 */ 96 s++; 97 c = *s; 98 ircp->irc_snick = s; 99 if (!ISALPHA(c)) 100 return 0; 101 i--; 102 for (c = *s; !ISSPACE(c) && (i > 0); i--) 103 c = *s++; 104 if (i < 31) 105 return 0; 106 if (c != 'P') 107 return 0; 108 } else 109 ircp->irc_snick = NULL; 110 111 /* 112 * Check command string 113 */ 114 if (strncmp(s, "PRIVMSG ", 8)) 115 return 0; 116 i -= 8; 117 s += 8; 118 c = *s; 119 ircp->irc_dnick = s; 120 121 /* 122 * Loosely check that the destination is a nickname of some sort 123 */ 124 if (!ISALPHA(c)) 125 return 0; 126 for (; !ISSPACE(c) && (i > 0); i--) 127 c = *s++; 128 if (i < 20) 129 return 0; 130 s++, 131 i--; 132 133 /* 134 * Look for a ^A to start the DCC 135 */ 136 c = *s; 137 if (c == ':') { 138 s++; 139 c = *s; 140 } 141 142 if (strncmp(s, "\001DCC ", 4)) 143 return 0; 144 145 i -= 4; 146 s += 4; 147 148 /* 149 * Check for a recognised DCC command 150 */ 151 for (j = 0, k = 0; ipf_p_irc_dcctypes[j]; j++) { 152 k = MIN(strlen(ipf_p_irc_dcctypes[j]), i); 153 if (!strncmp(ipf_p_irc_dcctypes[j], s, k)) 154 break; 155 } 156 if (!ipf_p_irc_dcctypes[j]) 157 return 0; 158 159 ircp->irc_type = s; 160 i -= k; 161 s += k; 162 163 if (i < 11) 164 return 0; 165 166 /* 167 * Check for the arg 168 */ 169 c = *s; 170 if (ISSPACE(c)) 171 return 0; 172 ircp->irc_arg = s; 173 for (; (c != ' ') && (c != '\001') && (i > 0); i--) 174 c = *s++; 175 176 if (c == '\001') /* In reality a ^A can quote another ^A...*/ 177 return 0; 178 179 if (i < 5) 180 return 0; 181 182 s++; 183 i--; 184 c = *s; 185 if (!ISDIGIT(c)) 186 return 0; 187 ircp->irc_addr = s; 188 /* 189 * Get the IP# 190 */ 191 for (l = 0; ISDIGIT(c) && (i > 0); i--) { 192 l *= 10; 193 l += c - '0'; 194 c = *s++; 195 } 196 197 if (i < 4) 198 return 0; 199 200 if (c != ' ') 201 return 0; 202 203 ircp->irc_ipnum = l; 204 s++; 205 i--; 206 c = *s; 207 if (!ISDIGIT(c)) 208 return 0; 209 /* 210 * Get the port# 211 */ 212 for (l = 0; ISDIGIT(c) && (i > 0); i--) { 213 l *= 10; 214 l += c - '0'; 215 c = *s++; 216 } 217 if (i < 3) 218 return 0; 219 if (strncmp(s, "\001\r\n", 3)) 220 return 0; 221 s += 3; 222 ircp->irc_len = s - buf; 223 ircp->irc_port = l; 224 return 1; 225 } 226 227 228 int 229 ipf_p_irc_new(arg, fin, aps, nat) 230 void *arg; 231 fr_info_t *fin; 232 ap_session_t *aps; 233 nat_t *nat; 234 { 235 ircinfo_t *irc; 236 237 if (fin->fin_v != 4) 238 return -1; 239 240 KMALLOC(irc, ircinfo_t *); 241 if (irc == NULL) 242 return -1; 243 244 nat = nat; /* LINT */ 245 246 aps->aps_data = irc; 247 aps->aps_psiz = sizeof(ircinfo_t); 248 249 bzero((char *)irc, sizeof(*irc)); 250 return 0; 251 } 252 253 254 int 255 ipf_p_irc_send(fin, nat) 256 fr_info_t *fin; 257 nat_t *nat; 258 { 259 char ctcpbuf[IPF_IRCBUFSZ], newbuf[IPF_IRCBUFSZ]; 260 tcphdr_t *tcp, tcph, *tcp2 = &tcph; 261 int off, inc = 0, i, dlen; 262 ipf_main_softc_t *softc; 263 size_t nlen = 0, olen; 264 struct in_addr swip; 265 u_short a5, sp; 266 ircinfo_t *irc; 267 fr_info_t fi; 268 nat_t *nat2; 269 u_int a1; 270 ip_t *ip; 271 mb_t *m; 272 #ifdef MENTAT 273 mb_t *m1; 274 #endif 275 softc = fin->fin_main_soft; 276 277 m = fin->fin_m; 278 ip = fin->fin_ip; 279 tcp = (tcphdr_t *)fin->fin_dp; 280 bzero(ctcpbuf, sizeof(ctcpbuf)); 281 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff; 282 283 #ifdef __sgi 284 dlen = fin->fin_plen - off; 285 #else 286 dlen = MSGDSIZE(m) - off; 287 #endif 288 if (dlen <= 0) 289 return 0; 290 COPYDATA(m, off, MIN(sizeof(ctcpbuf), dlen), ctcpbuf); 291 292 if (dlen <= 0) 293 return 0; 294 ctcpbuf[sizeof(ctcpbuf) - 1] = '\0'; 295 *newbuf = '\0'; 296 297 irc = nat->nat_aps->aps_data; 298 if (ipf_p_irc_complete(irc, ctcpbuf, dlen) == 0) 299 return 0; 300 301 /* 302 * check that IP address in the DCC reply is the same as the 303 * sender of the command - prevents use for port scanning. 304 */ 305 if (irc->irc_ipnum != ntohl(nat->nat_osrcaddr)) 306 return 0; 307 308 a5 = irc->irc_port; 309 310 /* 311 * Calculate new address parts for the DCC command 312 */ 313 a1 = ntohl(ip->ip_src.s_addr); 314 olen = irc->irc_len; 315 i = irc->irc_addr - ctcpbuf; 316 i++; 317 (void) strncpy(newbuf, ctcpbuf, i); 318 /* DO NOT change these! */ 319 #if defined(SNPRINTF) && defined(KERNEL) 320 SNPRINTF(newbuf, sizeof(newbuf) - i, "%u %u\001\r\n", a1, a5); 321 #else 322 (void) sprintf(newbuf, "%u %u\001\r\n", a1, a5); 323 #endif 324 325 nlen = strlen(newbuf); 326 inc = nlen - olen; 327 328 if ((inc + fin->fin_plen) > 65535) 329 return 0; 330 331 #ifdef MENTAT 332 for (m1 = m; m1->b_cont; m1 = m1->b_cont) 333 ; 334 if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) { 335 mblk_t *nm; 336 337 /* alloc enough to keep same trailer space for lower driver */ 338 nm = allocb(nlen, BPRI_MED); 339 PANIC((!nm),("ipf_p_irc_out: allocb failed")); 340 341 nm->b_band = m1->b_band; 342 nm->b_wptr += nlen; 343 344 m1->b_wptr -= olen; 345 PANIC((m1->b_wptr < m1->b_rptr), 346 ("ipf_p_irc_out: cannot handle fragmented data block")); 347 348 linkb(m1, nm); 349 } else { 350 # if SOLARIS && defined(ICK_VALID) 351 if (m1->b_datap->db_struiolim == m1->b_wptr) 352 m1->b_datap->db_struiolim += inc; 353 m1->b_datap->db_struioflag &= ~STRUIO_IP; 354 # endif 355 m1->b_wptr += inc; 356 } 357 #else 358 if (inc < 0) 359 m_adj(m, inc); 360 /* the mbuf chain will be extended if necessary by m_copyback() */ 361 #endif 362 COPYBACK(m, off, nlen, newbuf); 363 fin->fin_flx |= FI_DOCKSUM; 364 365 if (inc != 0) { 366 #if defined(MENTAT) || defined(__sgi) 367 register u_32_t sum1, sum2; 368 369 sum1 = fin->fin_plen; 370 sum2 = fin->fin_plen + inc; 371 372 /* Because ~1 == -2, We really need ~1 == -1 */ 373 if (sum1 > sum2) 374 sum2--; 375 sum2 -= sum1; 376 sum2 = (sum2 & 0xffff) + (sum2 >> 16); 377 378 ipf_fix_outcksum(0, &ip->ip_sum, sum2, 0); 379 #endif 380 fin->fin_plen += inc; 381 ip->ip_len = htons(fin->fin_plen); 382 fin->fin_dlen += inc; 383 } 384 385 /* 386 * Add skeleton NAT entry for connection which will come back the 387 * other way. 388 */ 389 sp = htons(a5); 390 /* 391 * Don't allow the PORT command to specify a port < 1024 due to 392 * security crap. 393 */ 394 if (ntohs(sp) < 1024) 395 return 0; 396 397 /* 398 * The server may not make the connection back from port 20, but 399 * it is the most likely so use it here to check for a conflicting 400 * mapping. 401 */ 402 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi)); 403 fi.fin_data[0] = sp; 404 fi.fin_data[1] = fin->fin_data[1]; 405 nat2 = ipf_nat_outlookup(fin, IPN_TCP, nat->nat_pr[1], nat->nat_nsrcip, 406 ip->ip_dst); 407 if (nat2 == NULL) { 408 #ifdef USE_MUTEXES 409 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 410 #endif 411 412 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi)); 413 bzero((char *)tcp2, sizeof(*tcp2)); 414 tcp2->th_win = htons(8192); 415 tcp2->th_sport = sp; 416 tcp2->th_dport = 0; /* XXX - don't specify remote port */ 417 fi.fin_data[0] = ntohs(sp); 418 fi.fin_data[1] = 0; 419 fi.fin_dp = (char *)tcp2; 420 fi.fin_fr = &ircnatfr; 421 fi.fin_dlen = sizeof(*tcp2); 422 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2); 423 swip = ip->ip_src; 424 ip->ip_src = nat->nat_nsrcip; 425 MUTEX_ENTER(&softn->ipf_nat_new); 426 nat2 = ipf_nat_add(&fi, nat->nat_ptr, NULL, 427 NAT_SLAVE|IPN_TCP|SI_W_DPORT, NAT_OUTBOUND); 428 MUTEX_EXIT(&softn->ipf_nat_new); 429 if (nat2 != NULL) { 430 (void) ipf_nat_proto(&fi, nat2, 0); 431 MUTEX_ENTER(&nat2->nat_lock); 432 ipf_nat_update(&fi, nat2); 433 MUTEX_EXIT(&nat2->nat_lock); 434 435 (void) ipf_state_add(softc, &fi, NULL, SI_W_DPORT); 436 } 437 ip->ip_src = swip; 438 } 439 return inc; 440 } 441 442 443 int 444 ipf_p_irc_out(arg, fin, aps, nat) 445 void *arg; 446 fr_info_t *fin; 447 ap_session_t *aps; 448 nat_t *nat; 449 { 450 aps = aps; /* LINT */ 451 return ipf_p_irc_send(fin, nat); 452 } 453