1 /*
2 * Copyright (C) 2012 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 *
6 * $Id$
7 */
8
9 #define IPF_IRC_PROXY
10
11 #define IPF_IRCBUFSZ 96 /* This *MUST* be >= 64! */
12
13
14 void ipf_p_irc_main_load __P((void));
15 void ipf_p_irc_main_unload __P((void));
16 int ipf_p_irc_new __P((void *, fr_info_t *, ap_session_t *, nat_t *));
17 int ipf_p_irc_out __P((void *, fr_info_t *, ap_session_t *, nat_t *));
18 int ipf_p_irc_send __P((fr_info_t *, nat_t *));
19 int ipf_p_irc_complete __P((ircinfo_t *, char *, size_t));
20 u_short ipf_irc_atoi __P((char **));
21
22 static frentry_t ircnatfr;
23
24 int irc_proxy_init = 0;
25
26
27 /*
28 * Initialize local structures.
29 */
30 void
ipf_p_irc_main_load()31 ipf_p_irc_main_load()
32 {
33 bzero((char *)&ircnatfr, sizeof(ircnatfr));
34 ircnatfr.fr_ref = 1;
35 ircnatfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
36 MUTEX_INIT(&ircnatfr.fr_lock, "IRC proxy rule lock");
37 irc_proxy_init = 1;
38 }
39
40
41 void
ipf_p_irc_main_unload()42 ipf_p_irc_main_unload()
43 {
44 if (irc_proxy_init == 1) {
45 MUTEX_DESTROY(&ircnatfr.fr_lock);
46 irc_proxy_init = 0;
47 }
48 }
49
50
51 const char *ipf_p_irc_dcctypes[] = {
52 "CHAT ", /* CHAT chat ipnumber portnumber */
53 "SEND ", /* SEND filename ipnumber portnumber */
54 "MOVE ",
55 "TSEND ",
56 "SCHAT ",
57 NULL,
58 };
59
60
61 /*
62 * :A PRIVMSG B :^ADCC CHAT chat 0 0^A\r\n
63 * PRIVMSG B ^ADCC CHAT chat 0 0^A\r\n
64 */
65
66
67 int
ipf_p_irc_complete(ircp,buf,len)68 ipf_p_irc_complete(ircp, buf, len)
69 ircinfo_t *ircp;
70 char *buf;
71 size_t len;
72 {
73 register char *s, c;
74 register size_t i;
75 u_32_t l;
76 int j, k;
77
78 ircp->irc_ipnum = 0;
79 ircp->irc_port = 0;
80
81 if (len < 31)
82 return 0;
83 s = buf;
84 c = *s++;
85 i = len - 1;
86
87 if ((c != ':') && (c != 'P'))
88 return 0;
89
90 if (c == ':') {
91 /*
92 * Loosely check that the source is a nickname of some sort
93 */
94 s++;
95 c = *s;
96 ircp->irc_snick = s;
97 if (!ISALPHA(c))
98 return 0;
99 i--;
100 for (c = *s; !ISSPACE(c) && (i > 0); i--)
101 c = *s++;
102 if (i < 31)
103 return 0;
104 if (c != 'P')
105 return 0;
106 } else
107 ircp->irc_snick = NULL;
108
109 /*
110 * Check command string
111 */
112 if (strncmp(s, "PRIVMSG ", 8))
113 return 0;
114 i -= 8;
115 s += 8;
116 c = *s;
117 ircp->irc_dnick = s;
118
119 /*
120 * Loosely check that the destination is a nickname of some sort
121 */
122 if (!ISALPHA(c))
123 return 0;
124 for (; !ISSPACE(c) && (i > 0); i--)
125 c = *s++;
126 if (i < 20)
127 return 0;
128 s++,
129 i--;
130
131 /*
132 * Look for a ^A to start the DCC
133 */
134 c = *s;
135 if (c == ':') {
136 s++;
137 c = *s;
138 }
139
140 if (strncmp(s, "\001DCC ", 4))
141 return 0;
142
143 i -= 4;
144 s += 4;
145
146 /*
147 * Check for a recognised DCC command
148 */
149 for (j = 0, k = 0; ipf_p_irc_dcctypes[j]; j++) {
150 k = MIN(strlen(ipf_p_irc_dcctypes[j]), i);
151 if (!strncmp(ipf_p_irc_dcctypes[j], s, k))
152 break;
153 }
154 if (!ipf_p_irc_dcctypes[j])
155 return 0;
156
157 ircp->irc_type = s;
158 i -= k;
159 s += k;
160
161 if (i < 11)
162 return 0;
163
164 /*
165 * Check for the arg
166 */
167 c = *s;
168 if (ISSPACE(c))
169 return 0;
170 ircp->irc_arg = s;
171 for (; (c != ' ') && (c != '\001') && (i > 0); i--)
172 c = *s++;
173
174 if (c == '\001') /* In reality a ^A can quote another ^A...*/
175 return 0;
176
177 if (i < 5)
178 return 0;
179
180 s++;
181 i--;
182 c = *s;
183 if (!ISDIGIT(c))
184 return 0;
185 ircp->irc_addr = s;
186 /*
187 * Get the IP#
188 */
189 for (l = 0; ISDIGIT(c) && (i > 0); i--) {
190 l *= 10;
191 l += c - '0';
192 c = *s++;
193 }
194
195 if (i < 4)
196 return 0;
197
198 if (c != ' ')
199 return 0;
200
201 ircp->irc_ipnum = l;
202 s++;
203 i--;
204 c = *s;
205 if (!ISDIGIT(c))
206 return 0;
207 /*
208 * Get the port#
209 */
210 for (l = 0; ISDIGIT(c) && (i > 0); i--) {
211 l *= 10;
212 l += c - '0';
213 c = *s++;
214 }
215 if (i < 3)
216 return 0;
217 if (strncmp(s, "\001\r\n", 3))
218 return 0;
219 s += 3;
220 ircp->irc_len = s - buf;
221 ircp->irc_port = l;
222 return 1;
223 }
224
225
226 int
ipf_p_irc_new(arg,fin,aps,nat)227 ipf_p_irc_new(arg, fin, aps, nat)
228 void *arg;
229 fr_info_t *fin;
230 ap_session_t *aps;
231 nat_t *nat;
232 {
233 ircinfo_t *irc;
234
235 if (fin->fin_v != 4)
236 return -1;
237
238 KMALLOC(irc, ircinfo_t *);
239 if (irc == NULL)
240 return -1;
241
242 nat = nat; /* LINT */
243
244 aps->aps_data = irc;
245 aps->aps_psiz = sizeof(ircinfo_t);
246
247 bzero((char *)irc, sizeof(*irc));
248 return 0;
249 }
250
251
252 int
ipf_p_irc_send(fin,nat)253 ipf_p_irc_send(fin, nat)
254 fr_info_t *fin;
255 nat_t *nat;
256 {
257 char ctcpbuf[IPF_IRCBUFSZ], newbuf[IPF_IRCBUFSZ];
258 tcphdr_t *tcp, tcph, *tcp2 = &tcph;
259 int off, inc = 0, i, dlen;
260 ipf_main_softc_t *softc;
261 size_t nlen = 0, olen;
262 struct in_addr swip;
263 u_short a5, sp;
264 ircinfo_t *irc;
265 fr_info_t fi;
266 nat_t *nat2;
267 u_int a1;
268 ip_t *ip;
269 mb_t *m;
270 #ifdef MENTAT
271 mb_t *m1;
272 #endif
273 softc = fin->fin_main_soft;
274
275 m = fin->fin_m;
276 ip = fin->fin_ip;
277 tcp = (tcphdr_t *)fin->fin_dp;
278 bzero(ctcpbuf, sizeof(ctcpbuf));
279 off = (char *)tcp - (char *)ip + (TCP_OFF(tcp) << 2) + fin->fin_ipoff;
280
281 #ifdef __sgi
282 dlen = fin->fin_plen - off;
283 #else
284 dlen = MSGDSIZE(m) - off;
285 #endif
286 if (dlen <= 0)
287 return 0;
288 COPYDATA(m, off, MIN(sizeof(ctcpbuf), dlen), ctcpbuf);
289
290 if (dlen <= 0)
291 return 0;
292 ctcpbuf[sizeof(ctcpbuf) - 1] = '\0';
293 *newbuf = '\0';
294
295 irc = nat->nat_aps->aps_data;
296 if (ipf_p_irc_complete(irc, ctcpbuf, dlen) == 0)
297 return 0;
298
299 /*
300 * check that IP address in the DCC reply is the same as the
301 * sender of the command - prevents use for port scanning.
302 */
303 if (irc->irc_ipnum != ntohl(nat->nat_osrcaddr))
304 return 0;
305
306 a5 = irc->irc_port;
307
308 /*
309 * Calculate new address parts for the DCC command
310 */
311 a1 = ntohl(ip->ip_src.s_addr);
312 olen = irc->irc_len;
313 i = irc->irc_addr - ctcpbuf;
314 i++;
315 (void) strncpy(newbuf, ctcpbuf, i);
316 /* DO NOT change these! */
317 #if defined(SNPRINTF) && defined(KERNEL)
318 SNPRINTF(newbuf, sizeof(newbuf) - i, "%u %u\001\r\n", a1, a5);
319 #else
320 (void) sprintf(newbuf, "%u %u\001\r\n", a1, a5);
321 #endif
322
323 nlen = strlen(newbuf);
324 inc = nlen - olen;
325
326 if ((inc + fin->fin_plen) > 65535)
327 return 0;
328
329 #ifdef MENTAT
330 for (m1 = m; m1->b_cont; m1 = m1->b_cont)
331 ;
332 if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) {
333 mblk_t *nm;
334
335 /* alloc enough to keep same trailer space for lower driver */
336 nm = allocb(nlen, BPRI_MED);
337 PANIC((!nm),("ipf_p_irc_out: allocb failed"));
338
339 nm->b_band = m1->b_band;
340 nm->b_wptr += nlen;
341
342 m1->b_wptr -= olen;
343 PANIC((m1->b_wptr < m1->b_rptr),
344 ("ipf_p_irc_out: cannot handle fragmented data block"));
345
346 linkb(m1, nm);
347 } else {
348 # if SOLARIS && defined(ICK_VALID)
349 if (m1->b_datap->db_struiolim == m1->b_wptr)
350 m1->b_datap->db_struiolim += inc;
351 m1->b_datap->db_struioflag &= ~STRUIO_IP;
352 # endif
353 m1->b_wptr += inc;
354 }
355 #else
356 if (inc < 0)
357 m_adj(m, inc);
358 /* the mbuf chain will be extended if necessary by m_copyback() */
359 #endif
360 COPYBACK(m, off, nlen, newbuf);
361 fin->fin_flx |= FI_DOCKSUM;
362
363 if (inc != 0) {
364 #if defined(MENTAT) || defined(__sgi)
365 register u_32_t sum1, sum2;
366
367 sum1 = fin->fin_plen;
368 sum2 = fin->fin_plen + inc;
369
370 /* Because ~1 == -2, We really need ~1 == -1 */
371 if (sum1 > sum2)
372 sum2--;
373 sum2 -= sum1;
374 sum2 = (sum2 & 0xffff) + (sum2 >> 16);
375
376 ipf_fix_outcksum(0, &ip->ip_sum, sum2, 0);
377 #endif
378 fin->fin_plen += inc;
379 ip->ip_len = htons(fin->fin_plen);
380 fin->fin_dlen += inc;
381 }
382
383 /*
384 * Add skeleton NAT entry for connection which will come back the
385 * other way.
386 */
387 sp = htons(a5);
388 /*
389 * Don't allow the PORT command to specify a port < 1024 due to
390 * security crap.
391 */
392 if (ntohs(sp) < 1024)
393 return 0;
394
395 /*
396 * The server may not make the connection back from port 20, but
397 * it is the most likely so use it here to check for a conflicting
398 * mapping.
399 */
400 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi));
401 fi.fin_data[0] = sp;
402 fi.fin_data[1] = fin->fin_data[1];
403 nat2 = ipf_nat_outlookup(fin, IPN_TCP, nat->nat_pr[1], nat->nat_nsrcip,
404 ip->ip_dst);
405 if (nat2 == NULL) {
406 #ifdef USE_MUTEXES
407 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
408 #endif
409
410 bcopy((caddr_t)fin, (caddr_t)&fi, sizeof(fi));
411 bzero((char *)tcp2, sizeof(*tcp2));
412 tcp2->th_win = htons(8192);
413 tcp2->th_sport = sp;
414 tcp2->th_dport = 0; /* XXX - don't specify remote port */
415 fi.fin_data[0] = ntohs(sp);
416 fi.fin_data[1] = 0;
417 fi.fin_dp = (char *)tcp2;
418 fi.fin_fr = &ircnatfr;
419 fi.fin_dlen = sizeof(*tcp2);
420 fi.fin_plen = fi.fin_hlen + sizeof(*tcp2);
421 swip = ip->ip_src;
422 ip->ip_src = nat->nat_nsrcip;
423 MUTEX_ENTER(&softn->ipf_nat_new);
424 nat2 = ipf_nat_add(&fi, nat->nat_ptr, NULL,
425 NAT_SLAVE|IPN_TCP|SI_W_DPORT, NAT_OUTBOUND);
426 MUTEX_EXIT(&softn->ipf_nat_new);
427 if (nat2 != NULL) {
428 (void) ipf_nat_proto(&fi, nat2, 0);
429 MUTEX_ENTER(&nat2->nat_lock);
430 ipf_nat_update(&fi, nat2);
431 MUTEX_EXIT(&nat2->nat_lock);
432
433 (void) ipf_state_add(softc, &fi, NULL, SI_W_DPORT);
434 }
435 ip->ip_src = swip;
436 }
437 return inc;
438 }
439
440
441 int
ipf_p_irc_out(arg,fin,aps,nat)442 ipf_p_irc_out(arg, fin, aps, nat)
443 void *arg;
444 fr_info_t *fin;
445 ap_session_t *aps;
446 nat_t *nat;
447 {
448 aps = aps; /* LINT */
449 return ipf_p_irc_send(fin, nat);
450 }
451