1 /* $FreeBSD: stable/9/sys/contrib/ipfilter/netinet/ip_proxy.h 170268 2007-06-04 02:54:36Z darrenr $ */ 2 3 /* 4 * Copyright (C) 1997-2001 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * $FreeBSD: stable/9/sys/contrib/ipfilter/netinet/ip_proxy.h 170268 2007-06-04 02:54:36Z darrenr $ 9 * Id: ip_proxy.h,v 2.31.2.2 2005/03/12 19:33:48 darrenr Exp 10 */ 11 12 #ifndef __IP_PROXY_H__ 13 #define __IP_PROXY_H__ 14 15 #ifndef SOLARIS 16 #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) 17 #endif 18 19 #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51) 20 #define SIOCPROXY _IOWR('r', 64, struct ap_control) 21 #else 22 #define SIOCPROXY _IOWR(r, 64, struct ap_control) 23 #endif 24 25 #ifndef APR_LABELLEN 26 #define APR_LABELLEN 16 27 #endif 28 #define AP_SESS_SIZE 53 29 30 struct nat; 31 struct ipnat; 32 struct ipstate; 33 34 typedef struct ap_tcp { 35 u_short apt_sport; /* source port */ 36 u_short apt_dport; /* destination port */ 37 short apt_sel[2]; /* {seq,ack}{off,min} set selector */ 38 short apt_seqoff[2]; /* sequence # difference */ 39 u_32_t apt_seqmin[2]; /* don't change seq-off until after this */ 40 short apt_ackoff[2]; /* sequence # difference */ 41 u_32_t apt_ackmin[2]; /* don't change seq-off until after this */ 42 u_char apt_state[2]; /* connection state */ 43 } ap_tcp_t; 44 45 typedef struct ap_udp { 46 u_short apu_sport; /* source port */ 47 u_short apu_dport; /* destination port */ 48 } ap_udp_t; 49 50 typedef struct ap_session { 51 struct aproxy *aps_apr; 52 union { 53 struct ap_tcp apu_tcp; 54 struct ap_udp apu_udp; 55 } aps_un; 56 u_int aps_flags; 57 U_QUAD_T aps_bytes; /* bytes sent */ 58 U_QUAD_T aps_pkts; /* packets sent */ 59 void *aps_nat; /* pointer back to nat struct */ 60 void *aps_data; /* private data */ 61 int aps_p; /* protocol */ 62 int aps_psiz; /* size of private data */ 63 struct ap_session *aps_hnext; 64 struct ap_session *aps_next; 65 } ap_session_t; 66 67 #define aps_sport aps_un.apu_tcp.apt_sport 68 #define aps_dport aps_un.apu_tcp.apt_dport 69 #define aps_sel aps_un.apu_tcp.apt_sel 70 #define aps_seqoff aps_un.apu_tcp.apt_seqoff 71 #define aps_seqmin aps_un.apu_tcp.apt_seqmin 72 #define aps_state aps_un.apu_tcp.apt_state 73 #define aps_ackoff aps_un.apu_tcp.apt_ackoff 74 #define aps_ackmin aps_un.apu_tcp.apt_ackmin 75 76 77 typedef struct ap_control { 78 char apc_label[APR_LABELLEN]; 79 u_char apc_p; 80 /* 81 * The following fields are upto the proxy's apr_ctl routine to deal 82 * with. When the proxy gets this in kernel space, apc_data will 83 * point to a malloc'd region of memory of apc_dsize bytes. If the 84 * proxy wants to keep that memory, it must set apc_data to NULL 85 * before it returns. It is expected if this happens that it will 86 * take care to free it in apr_fini or otherwise as appropriate. 87 * apc_cmd is provided as a standard place to put simple commands, 88 * with apc_arg being available to put a simple arg. 89 */ 90 u_long apc_cmd; 91 u_long apc_arg; 92 void *apc_data; 93 size_t apc_dsize; 94 } ap_ctl_t; 95 96 97 typedef struct aproxy { 98 struct aproxy *apr_next; 99 char apr_label[APR_LABELLEN]; /* Proxy label # */ 100 u_char apr_p; /* protocol */ 101 int apr_ref; /* +1 per rule referencing it */ 102 int apr_flags; 103 int (* apr_init) __P((void)); 104 void (* apr_fini) __P((void)); 105 int (* apr_new) __P((fr_info_t *, ap_session_t *, struct nat *)); 106 void (* apr_del) __P((ap_session_t *)); 107 int (* apr_inpkt) __P((fr_info_t *, ap_session_t *, struct nat *)); 108 int (* apr_outpkt) __P((fr_info_t *, ap_session_t *, struct nat *)); 109 int (* apr_match) __P((fr_info_t *, ap_session_t *, struct nat *)); 110 int (* apr_ctl) __P((struct aproxy *, struct ap_control *)); 111 } aproxy_t; 112 113 #define APR_DELETE 1 114 115 #define APR_ERR(x) ((x) << 16) 116 #define APR_EXIT(x) (((x) >> 16) & 0xffff) 117 #define APR_INC(x) ((x) & 0xffff) 118 119 /* 120 * Generic #define's to cover missing things in the kernel 121 */ 122 #ifndef isdigit 123 #define isdigit(x) ((x) >= '0' && (x) <= '9') 124 #endif 125 #ifndef isupper 126 #define isupper(x) (((unsigned)(x) >= 'A') && ((unsigned)(x) <= 'Z')) 127 #endif 128 #ifndef islower 129 #define islower(x) (((unsigned)(x) >= 'a') && ((unsigned)(x) <= 'z')) 130 #endif 131 #ifndef isalpha 132 #define isalpha(x) (isupper(x) || islower(x)) 133 #endif 134 #ifndef toupper 135 #define toupper(x) (isupper(x) ? (x) : (x) - 'a' + 'A') 136 #endif 137 #ifndef isspace 138 #define isspace(x) (((x) == ' ') || ((x) == '\r') || ((x) == '\n') || \ 139 ((x) == '\t') || ((x) == '\b')) 140 #endif 141 142 /* 143 * This is the scratch buffer size used to hold strings from the TCP stream 144 * that we may want to parse. It's an arbitrary size, really, but it must 145 * be at least as large as IPF_FTPBUFSZ. 146 */ 147 #define FTP_BUFSZ 120 148 149 /* 150 * This buffer, however, doesn't need to be nearly so big. It just needs to 151 * be able to squeeze in the largest command it needs to rewrite, Which ones 152 * does it rewrite? EPRT, PORT, 227 replies. 153 */ 154 #define IPF_FTPBUFSZ 80 /* This *MUST* be >= 53! */ 155 156 typedef struct ftpside { 157 char *ftps_rptr; 158 char *ftps_wptr; 159 void *ftps_ifp; 160 u_32_t ftps_seq[2]; 161 u_32_t ftps_len; 162 int ftps_junk; /* 2 = no cr/lf yet, 1 = cannot parse */ 163 int ftps_cmds; 164 char ftps_buf[FTP_BUFSZ]; 165 } ftpside_t; 166 167 typedef struct ftpinfo { 168 int ftp_passok; 169 int ftp_incok; 170 ftpside_t ftp_side[2]; 171 } ftpinfo_t; 172 173 174 /* 175 * For the irc proxy. 176 */ 177 typedef struct ircinfo { 178 size_t irc_len; 179 char *irc_snick; 180 char *irc_dnick; 181 char *irc_type; 182 char *irc_arg; 183 char *irc_addr; 184 u_32_t irc_ipnum; 185 u_short irc_port; 186 } ircinfo_t; 187 188 189 /* 190 * Real audio proxy structure and #defines 191 */ 192 typedef struct raudio_s { 193 int rap_seenpna; 194 int rap_seenver; 195 int rap_version; 196 int rap_eos; /* End Of Startup */ 197 int rap_gotid; 198 int rap_gotlen; 199 int rap_mode; 200 int rap_sdone; 201 u_short rap_plport; 202 u_short rap_prport; 203 u_short rap_srport; 204 char rap_svr[19]; 205 u_32_t rap_sbf; /* flag to indicate which of the 19 bytes have 206 * been filled 207 */ 208 u_32_t rap_sseq; 209 } raudio_t; 210 211 #define RA_ID_END 0 212 #define RA_ID_UDP 1 213 #define RA_ID_ROBUST 7 214 215 #define RAP_M_UDP 1 216 #define RAP_M_ROBUST 2 217 #define RAP_M_TCP 4 218 #define RAP_M_UDP_ROBUST (RAP_M_UDP|RAP_M_ROBUST) 219 220 221 /* 222 * MSN RPC proxy 223 */ 224 typedef struct msnrpcinfo { 225 u_int mri_flags; 226 int mri_cmd[2]; 227 u_int mri_valid; 228 struct in_addr mri_raddr; 229 u_short mri_rport; 230 } msnrpcinfo_t; 231 232 233 /* 234 * IPSec proxy 235 */ 236 typedef u_32_t ipsec_cookie_t[2]; 237 238 typedef struct ipsec_pxy { 239 ipsec_cookie_t ipsc_icookie; 240 ipsec_cookie_t ipsc_rcookie; 241 int ipsc_rckset; 242 ipnat_t ipsc_rule; 243 nat_t *ipsc_nat; 244 struct ipstate *ipsc_state; 245 } ipsec_pxy_t; 246 247 /* 248 * PPTP proxy 249 */ 250 typedef struct pptp_side { 251 u_32_t pptps_nexthdr; 252 u_32_t pptps_next; 253 int pptps_state; 254 int pptps_gothdr; 255 int pptps_len; 256 int pptps_bytes; 257 char *pptps_wptr; 258 char pptps_buffer[512]; 259 } pptp_side_t; 260 261 typedef struct pptp_pxy { 262 ipnat_t pptp_rule; 263 nat_t *pptp_nat; 264 struct ipstate *pptp_state; 265 u_short pptp_call[2]; 266 pptp_side_t pptp_side[2]; 267 } pptp_pxy_t; 268 269 270 /* 271 * Sun RPCBIND proxy 272 */ 273 #define RPCB_MAXMSG 888 274 #define RPCB_RES_PMAP 0 /* Response contains a v2 port. */ 275 #define RPCB_RES_STRING 1 /* " " " v3 (GETADDR) string. */ 276 #define RPCB_RES_LIST 2 /* " " " v4 (GETADDRLIST) list. */ 277 #define RPCB_MAXREQS 32 /* Arbitrary limit on tracked transactions */ 278 279 #define RPCB_REQMIN 40 280 #define RPCB_REQMAX 888 281 #define RPCB_REPMIN 20 282 #define RPCB_REPMAX 604 /* XXX double check this! */ 283 284 /* 285 * These macros determine the number of bytes between p and the end of 286 * r->rs_buf relative to l. 287 */ 288 #define RPCB_BUF_END(r) (char *)((r)->rm_msgbuf + (r)->rm_buflen) 289 #define RPCB_BUF_GEQ(r, p, l) \ 290 ((RPCB_BUF_END((r)) > (char *)(p)) && \ 291 ((RPCB_BUF_END((r)) - (char *)(p)) >= (l))) 292 #define RPCB_BUF_EQ(r, p, l) \ 293 (RPCB_BUF_END((r)) == ((char *)(p) + (l))) 294 295 /* 296 * The following correspond to RPC(B) detailed in RFC183[13]. 297 */ 298 #define RPCB_CALL 0 299 #define RPCB_REPLY 1 300 #define RPCB_MSG_VERSION 2 301 #define RPCB_PROG 100000 302 #define RPCB_GETPORT 3 303 #define RPCB_GETADDR 3 304 #define RPCB_GETADDRLIST 11 305 #define RPCB_MSG_ACCEPTED 0 306 #define RPCB_MSG_DENIED 1 307 308 /* BEGIN (Generic XDR structures) */ 309 typedef struct xdr_string { 310 u_32_t *xs_len; 311 char *xs_str; 312 } xdr_string_t; 313 314 typedef struct xdr_auth { 315 /* u_32_t xa_flavor; */ 316 xdr_string_t xa_string; 317 } xdr_auth_t; 318 319 typedef struct xdr_uaddr { 320 u_32_t xu_ip; 321 u_short xu_port; 322 xdr_string_t xu_str; 323 } xdr_uaddr_t; 324 325 typedef struct xdr_proto { 326 u_int xp_proto; 327 xdr_string_t xp_str; 328 } xdr_proto_t; 329 330 #define xu_xslen xu_str.xs_len 331 #define xu_xsstr xu_str.xs_str 332 #define xp_xslen xp_str.xs_len 333 #define xp_xsstr xp_str.xs_str 334 /* END (Generic XDR structures) */ 335 336 /* BEGIN (RPC call structures) */ 337 typedef struct pmap_args { 338 /* u_32_t pa_prog; */ 339 /* u_32_t pa_vers; */ 340 u_32_t *pa_prot; 341 /* u_32_t pa_port; */ 342 } pmap_args_t; 343 344 typedef struct rpcb_args { 345 /* u_32_t *ra_prog; */ 346 /* u_32_t *ra_vers; */ 347 xdr_proto_t ra_netid; 348 xdr_uaddr_t ra_maddr; 349 /* xdr_string_t ra_owner; */ 350 } rpcb_args_t; 351 352 typedef struct rpc_call { 353 /* u_32_t rc_rpcvers; */ 354 /* u_32_t rc_prog; */ 355 u_32_t *rc_vers; 356 u_32_t *rc_proc; 357 xdr_auth_t rc_authcred; 358 xdr_auth_t rc_authverf; 359 union { 360 pmap_args_t ra_pmapargs; 361 rpcb_args_t ra_rpcbargs; 362 } rpcb_args; 363 } rpc_call_t; 364 365 #define rc_pmapargs rpcb_args.ra_pmapargs 366 #define rc_rpcbargs rpcb_args.ra_rpcbargs 367 /* END (RPC call structures) */ 368 369 /* BEGIN (RPC reply structures) */ 370 typedef struct rpcb_entry { 371 xdr_uaddr_t re_maddr; 372 xdr_proto_t re_netid; 373 /* u_32_t re_semantics; */ 374 xdr_string_t re_family; 375 xdr_proto_t re_proto; 376 u_32_t *re_more; /* 1 == another entry follows */ 377 } rpcb_entry_t; 378 379 typedef struct rpcb_listp { 380 u_32_t *rl_list; /* 1 == list follows */ 381 int rl_cnt; 382 rpcb_entry_t rl_entries[2]; /* TCP / UDP only */ 383 } rpcb_listp_t; 384 385 typedef struct rpc_resp { 386 /* u_32_t rr_acceptdeny; */ 387 /* Omitted 'message denied' fork; we don't care about rejects. */ 388 xdr_auth_t rr_authverf; 389 /* u_32_t *rr_astat; */ 390 union { 391 u_32_t *resp_pmap; 392 xdr_uaddr_t resp_getaddr; 393 rpcb_listp_t resp_getaddrlist; 394 } rpcb_reply; 395 } rpc_resp_t; 396 397 #define rr_v2 rpcb_reply.resp_pmap 398 #define rr_v3 rpcb_reply.resp_getaddr 399 #define rr_v4 rpcb_reply.resp_getaddrlist 400 /* END (RPC reply structures) */ 401 402 /* BEGIN (RPC message structure & macros) */ 403 typedef struct rpc_msg { 404 char rm_msgbuf[RPCB_MAXMSG]; /* RPCB data buffer */ 405 u_int rm_buflen; 406 u_32_t *rm_xid; 407 /* u_32_t Call vs Reply */ 408 union { 409 rpc_call_t rb_call; 410 rpc_resp_t rb_resp; 411 } rm_body; 412 } rpc_msg_t; 413 414 #define rm_call rm_body.rb_call 415 #define rm_resp rm_body.rb_resp 416 /* END (RPC message structure & macros) */ 417 418 /* 419 * These code paths aren't hot enough to warrant per transaction 420 * mutexes. 421 */ 422 typedef struct rpcb_xact { 423 struct rpcb_xact *rx_next; 424 struct rpcb_xact **rx_pnext; 425 u_32_t rx_xid; /* RPC transmission ID */ 426 u_int rx_type; /* RPCB response type */ 427 u_int rx_ref; /* reference count */ 428 u_int rx_proto; /* transport protocol (v2 only) */ 429 } rpcb_xact_t; 430 431 typedef struct rpcb_session { 432 ipfmutex_t rs_rxlock; 433 rpcb_xact_t *rs_rxlist; 434 } rpcb_session_t; 435 436 /* 437 * For an explanation, please see the following: 438 * RFC1832 - Sections 3.11, 4.4, and 4.5. 439 */ 440 #define XDRALIGN(x) ((((x) % 4) != 0) ? ((((x) + 3) / 4) * 4) : (x)) 441 442 extern ap_session_t *ap_sess_tab[AP_SESS_SIZE]; 443 extern ap_session_t *ap_sess_list; 444 extern aproxy_t ap_proxies[]; 445 extern int ippr_ftp_pasvonly; 446 extern int ipf_proxy_debug; 447 448 extern int appr_add __P((aproxy_t *)); 449 extern int appr_ctl __P((ap_ctl_t *)); 450 extern int appr_del __P((aproxy_t *)); 451 extern int appr_init __P((void)); 452 extern void appr_unload __P((void)); 453 extern int appr_ok __P((fr_info_t *, tcphdr_t *, struct ipnat *)); 454 extern int appr_match __P((fr_info_t *, struct nat *)); 455 extern void appr_free __P((aproxy_t *)); 456 extern void aps_free __P((ap_session_t *)); 457 extern int appr_check __P((fr_info_t *, struct nat *)); 458 extern aproxy_t *appr_lookup __P((u_int, char *)); 459 extern int appr_new __P((fr_info_t *, struct nat *)); 460 extern int appr_ioctl __P((caddr_t, ioctlcmd_t, int, void *)); 461 462 #endif /* __IP_PROXY_H__ */ 463