int
AliasHandlePptpGreOut(struct ip *pip)
{
GreHdr *gr;
struct alias_link *link;
gr = (GreHdr *)((char *)pip + (pip->ip_hl << 2));
/* Check GRE header bits. */
if ((ntohl(*((u_int32_t *)gr)) & PPTP_INIT_MASK) != PPTP_INIT_VALUE)
return (-1);
link = FindPptpOutByPeerCallId(pip->ip_src, pip->ip_dst, gr->gh_call_id);
if (link != NULL) {
struct in_addr alias_addr = GetAliasAddress(link);
/* Change source IP address. */
DifferentialChecksum(&pip->ip_sum,
(u_short *)&alias_addr,
(u_short *)&pip->ip_src,
2);
pip->ip_src = alias_addr;
}
return (0);
}
static int
ProtoAliasOut(struct libalias *la, struct in_addr *ip_src,
struct in_addr ip_dst, u_char ip_p, u_short *ip_sum, int create)
{
/*
Handle outgoing IP packets. The
only thing which is done in this case is to alias
the source IP address of the packet.
*/
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
(void)create;
/* Return if proxy-only mode is enabled */
if (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return (PKT_ALIAS_OK);
lnk = FindProtoOut(la, *ip_src, ip_dst, ip_p);
if (lnk != NULL) {
struct in_addr alias_address;
alias_address = GetAliasAddress(lnk);
/* Change source address */
DifferentialChecksum(ip_sum,
&alias_address, ip_src, 2);
*ip_src = alias_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
ProtoAliasIn(struct libalias *la, struct in_addr ip_src,
struct in_addr *ip_dst, u_char ip_p, u_short *ip_sum)
{
/*
Handle incoming IP packets. The
only thing which is done in this case is to alias
the dest IP address of the packet to our inside
machine.
*/
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
/* Return if proxy-only mode is enabled */
if (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return (PKT_ALIAS_OK);
lnk = FindProtoIn(la, ip_src, *ip_dst, ip_p);
if (lnk != NULL) {
struct in_addr original_address;
original_address = GetOriginalAddress(lnk);
/* Restore original IP address */
DifferentialChecksum(ip_sum,
&original_address, ip_dst, 2);
*ip_dst = original_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
ProtoAliasIn(struct ip *pip)
{
/*
Handle incoming IP packets. The
only thing which is done in this case is to alias
the dest IP address of the packet to our inside
machine.
*/
struct alias_link *link;
/* Return if proxy-only mode is enabled */
if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return PKT_ALIAS_OK;
link = FindProtoIn(pip->ip_src, pip->ip_dst, pip->ip_p);
if (link != NULL)
{
struct in_addr original_address;
original_address = GetOriginalAddress(link);
/* Restore original IP address */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &original_address,
(u_short *) &pip->ip_dst,
2);
pip->ip_dst = original_address;
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_IGNORED);
}
static int
ProtoAliasOut(struct ip *pip)
{
/*
Handle outgoing IP packets. The
only thing which is done in this case is to alias
the source IP address of the packet.
*/
struct alias_link *link;
/* Return if proxy-only mode is enabled */
if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return PKT_ALIAS_OK;
link = FindProtoOut(pip->ip_src, pip->ip_dst, pip->ip_p);
if (link != NULL)
{
struct in_addr alias_address;
alias_address = GetAliasAddress(link);
/* Change source address */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &alias_address,
(u_short *) &pip->ip_src,
2);
pip->ip_src = alias_address;
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_IGNORED);
}
static int
AliasHandlePptpGreIn(struct libalias *la, struct ip *pip)
{
GreHdr *gr;
struct alias_link *lnk;
gr = (GreHdr *) ip_next(pip);
/* Check GRE header bits. */
if ((ntohl(*((u_int32_t *) gr)) & PPTP_INIT_MASK) != PPTP_INIT_VALUE)
return (-1);
lnk = FindPptpInByPeerCallId(la, pip->ip_src, pip->ip_dst, gr->gh_call_id);
if (lnk != NULL) {
struct in_addr src_addr = GetOriginalAddress(lnk);
/* De-alias the Peer's Call Id. */
gr->gh_call_id = GetOriginalPort(lnk);
/* Restore original IP address. */
DifferentialChecksum(&pip->ip_sum,
&src_addr, &pip->ip_dst, 2);
pip->ip_dst = src_addr;
}
return (0);
}
static int
UdpAliasOut(struct libalias *la, struct ip *pip, int create)
{
struct udphdr *ud;
struct alias_link *lnk;
int error;
LIBALIAS_LOCK_ASSERT(la);
/* Return if proxy-only mode is enabled */
if (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return (PKT_ALIAS_OK);
ud = (struct udphdr *)ip_next(pip);
lnk = FindUdpTcpOut(la, pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, create);
if (lnk != NULL) {
u_short alias_port;
struct in_addr alias_address;
struct alias_data ad;
ad.lnk = lnk;
ad.oaddr = NULL;
ad.aaddr = &alias_address;
ad.aport = &alias_port;
ad.sport = &ud->uh_sport;
ad.dport = &ud->uh_dport;
ad.maxpktsize = 0;
alias_address = GetAliasAddress(lnk);
alias_port = GetAliasPort(lnk);
/* Walk out chain. */
error = find_handler(OUT, UDP, la, pip, &ad);
/* If UDP checksum is not zero, adjust since source port is */
/* being aliased and source address is being altered */
if (ud->uh_sum != 0) {
int accumulate;
accumulate = ud->uh_sport;
accumulate -= alias_port;
accumulate += twowords(&pip->ip_src);
accumulate -= twowords(&alias_address);
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* Put alias port in UDP header */
ud->uh_sport = alias_port;
/* Change source address */
DifferentialChecksum(&pip->ip_sum,
&alias_address, &pip->ip_src, 2);
pip->ip_src = alias_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
FragmentOut(struct libalias *la, struct ip *pip)
{
struct in_addr alias_address;
LIBALIAS_LOCK_ASSERT(la);
alias_address = FindAliasAddress(la, pip->ip_src);
DifferentialChecksum(&pip->ip_sum,
&alias_address, &pip->ip_src, 2);
pip->ip_src = alias_address;
return (PKT_ALIAS_OK);
}
static int
FragmentOut(struct ip *pip)
{
struct in_addr alias_address;
alias_address = FindAliasAddress(pip->ip_src);
DifferentialChecksum(&pip->ip_sum,
(u_short *) &alias_address,
(u_short *) &pip->ip_src,
2);
pip->ip_src = alias_address;
return(PKT_ALIAS_OK);
}
static int
IcmpAliasOut1(struct ip *pip)
{
/*
Alias outgoing echo and timestamp requests.
De-alias outgoing echo and timestamp replies.
*/
struct alias_link *link;
struct icmp *ic;
ic = (struct icmp *) ((char *) pip + (pip->ip_hl << 2));
/* Save overwritten data for when echo packet returns */
link = FindIcmpOut(pip->ip_src, pip->ip_dst, ic->icmp_id, 1);
if (link != NULL)
{
u_short alias_id;
int accumulate;
alias_id = GetAliasPort(link);
/* Since data field is being modified, adjust ICMP checksum */
accumulate = ic->icmp_id;
accumulate -= alias_id;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/* Alias sequence number */
ic->icmp_id = alias_id;
/* Change source address */
{
struct in_addr alias_address;
alias_address = GetAliasAddress(link);
DifferentialChecksum(&pip->ip_sum,
(u_short *) &alias_address,
(u_short *) &pip->ip_src,
2);
pip->ip_src = alias_address;
}
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_IGNORED);
}
static int
IcmpAliasIn1(struct libalias *la, struct ip *pip)
{
/*
De-alias incoming echo and timestamp replies.
Alias incoming echo and timestamp requests.
*/
struct alias_link *lnk;
struct icmp *ic;
LIBALIAS_LOCK_ASSERT(la);
ic = (struct icmp *)ip_next(pip);
/* Get source address from ICMP data field and restore original data */
lnk = FindIcmpIn(la, pip->ip_src, pip->ip_dst, ic->icmp_id, 1);
if (lnk != NULL) {
u_short original_id;
int accumulate;
original_id = GetOriginalPort(lnk);
/* Adjust ICMP checksum */
accumulate = ic->icmp_id;
accumulate -= original_id;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/* Put original sequence number back in */
ic->icmp_id = original_id;
/* Put original address back into IP header */
{
struct in_addr original_address;
original_address = GetOriginalAddress(lnk);
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
}
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
FragmentIn(struct libalias *la, struct ip *pip)
{
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
lnk = FindFragmentIn2(la, pip->ip_src, pip->ip_dst, pip->ip_id);
if (lnk != NULL) {
struct in_addr original_address;
GetFragmentAddr(lnk, &original_address);
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_UNRESOLVED_FRAGMENT);
}
void
PacketAliasFragmentIn(char *ptr, /* Points to correctly de-aliased
header fragment */
char *ptr_fragment /* Points to fragment which must
be de-aliased */
)
{
struct ip *pip;
struct ip *fpip;
pip = (struct ip *) ptr;
fpip = (struct ip *) ptr_fragment;
DifferentialChecksum(&fpip->ip_sum,
(u_short *) &pip->ip_dst,
(u_short *) &fpip->ip_dst,
2);
fpip->ip_dst = pip->ip_dst;
}
void
LibAliasFragmentIn(struct libalias *la, char *ptr, /* Points to correctly
* de-aliased header
* fragment */
char *ptr_fragment /* Points to fragment which must be
* de-aliased */
)
{
struct ip *pip;
struct ip *fpip;
LIBALIAS_LOCK(la);
(void)la;
pip = (struct ip *)ptr;
fpip = (struct ip *)ptr_fragment;
DifferentialChecksum(&fpip->ip_sum,
&pip->ip_dst, &fpip->ip_dst, 2);
fpip->ip_dst = pip->ip_dst;
LIBALIAS_UNLOCK(la);
}
static int
FragmentIn(struct ip *pip)
{
struct alias_link *link;
link = FindFragmentIn2(pip->ip_src, pip->ip_dst, pip->ip_id);
if (link != NULL)
{
struct in_addr original_address;
GetFragmentAddr(link, &original_address);
DifferentialChecksum(&pip->ip_sum,
(u_short *) &original_address,
(u_short *) &pip->ip_dst,
2);
pip->ip_dst = original_address;
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_UNRESOLVED_FRAGMENT);
}
static void
NewFtpMessage(struct libalias *la, struct ip *pip,
struct alias_link *lnk,
int maxpacketsize,
int ftp_message_type)
{
struct alias_link *ftp_lnk;
/* Security checks. */
if (pip->ip_src.s_addr != la->true_addr.s_addr)
return;
if (la->true_port < IPPORT_RESERVED)
return;
/* Establish link to address and port found in FTP control message. */
ftp_lnk = FindUdpTcpOut(la, la->true_addr, GetDestAddress(lnk),
htons(la->true_port), 0, IPPROTO_TCP, 1);
if (ftp_lnk != NULL) {
int slen, hlen, tlen, dlen;
struct tcphdr *tc;
#ifndef NO_FW_PUNCH
/* Punch hole in firewall */
PunchFWHole(ftp_lnk);
#endif
/* Calculate data length of TCP packet */
tc = (struct tcphdr *)ip_next(pip);
hlen = (pip->ip_hl + tc->th_off) << 2;
tlen = ntohs(pip->ip_len);
dlen = tlen - hlen;
/* Create new FTP message. */
{
char stemp[MAX_MESSAGE_SIZE + 1];
char *sptr;
u_short alias_port;
u_char *ptr;
int a1, a2, a3, a4, p1, p2;
struct in_addr alias_address;
/* Decompose alias address into quad format */
alias_address = GetAliasAddress(lnk);
ptr = (u_char *) & alias_address.s_addr;
a1 = *ptr++;
a2 = *ptr++;
a3 = *ptr++;
a4 = *ptr;
alias_port = GetAliasPort(ftp_lnk);
/* Prepare new command */
switch (ftp_message_type) {
case FTP_PORT_COMMAND:
case FTP_227_REPLY:
/* Decompose alias port into pair format. */
ptr = (char *)&alias_port;
p1 = *ptr++;
p2 = *ptr;
if (ftp_message_type == FTP_PORT_COMMAND) {
/* Generate PORT command string. */
sprintf(stemp, "PORT %d,%d,%d,%d,%d,%d\r\n",
a1, a2, a3, a4, p1, p2);
} else {
/* Generate 227 reply string. */
sprintf(stemp,
"227 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n",
a1, a2, a3, a4, p1, p2);
}
break;
case FTP_EPRT_COMMAND:
/* Generate EPRT command string. */
sprintf(stemp, "EPRT |1|%d.%d.%d.%d|%d|\r\n",
a1, a2, a3, a4, ntohs(alias_port));
break;
case FTP_229_REPLY:
/* Generate 229 reply string. */
sprintf(stemp, "229 Entering Extended Passive Mode (|||%d|)\r\n",
ntohs(alias_port));
break;
}
/* Save string length for IP header modification */
slen = strlen(stemp);
/* Copy modified buffer into IP packet. */
sptr = (char *)pip;
sptr += hlen;
strncpy(sptr, stemp, maxpacketsize - hlen);
}
/* Save information regarding modified seq and ack numbers */
{
int delta;
SetAckModified(lnk);
tc = (struct tcphdr *)ip_next(pip);
delta = GetDeltaSeqOut(tc->th_seq, lnk);
AddSeq(lnk, delta + slen - dlen, pip->ip_hl,
pip->ip_len, tc->th_seq, tc->th_off);
}
/* Revise IP header */
{
u_short new_len;
new_len = htons(hlen + slen);
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
1);
pip->ip_len = new_len;
}
/* Compute TCP checksum for revised packet */
tc->th_sum = 0;
#ifdef _KERNEL
tc->th_x2 = 1;
#else
tc->th_sum = TcpChecksum(pip);
#endif
} else {
#ifdef LIBALIAS_DEBUG
fprintf(stderr,
"PacketAlias/HandleFtpOut: Cannot allocate FTP data port\n");
#endif
}
}
static int
alias_rtsp_out(struct libalias *la, struct ip *pip,
struct alias_link *lnk,
char *data,
const char *port_str)
{
int hlen, tlen, dlen;
struct tcphdr *tc;
int i, j, pos, state, port_dlen, new_dlen, delta;
u_short p[2], new_len;
u_short sport, eport, base_port;
u_short salias = 0, ealias = 0, base_alias = 0;
const char *transport_str = "transport:";
char newdata[2048], *port_data, *port_newdata, stemp[80];
int links_created = 0, pkt_updated = 0;
struct alias_link *rtsp_lnk = NULL;
struct in_addr null_addr;
/* Calculate data length of TCP packet */
tc = (struct tcphdr *)ip_next(pip);
hlen = (pip->ip_hl + tc->th_off) << 2;
tlen = ntohs(pip->ip_len);
dlen = tlen - hlen;
/* Find keyword, "Transport: " */
pos = search_string(data, dlen, transport_str);
if (pos < 0) {
return (-1);
}
port_data = data + pos;
port_dlen = dlen - pos;
memcpy(newdata, data, pos);
port_newdata = newdata + pos;
while (port_dlen > (int)strlen(port_str)) {
/* Find keyword, appropriate port string */
pos = search_string(port_data, port_dlen, port_str);
if (pos < 0) {
break;
}
memcpy(port_newdata, port_data, pos + 1);
port_newdata += (pos + 1);
p[0] = p[1] = 0;
sport = eport = 0;
state = 0;
for (i = pos; i < port_dlen; i++) {
switch (state) {
case 0:
if (port_data[i] == '=') {
state++;
}
break;
case 1:
if (ISDIGIT(port_data[i])) {
p[0] = p[0] * 10 + port_data[i] - '0';
} else {
if (port_data[i] == ';') {
state = 3;
}
if (port_data[i] == '-') {
state++;
}
}
break;
case 2:
if (ISDIGIT(port_data[i])) {
p[1] = p[1] * 10 + port_data[i] - '0';
} else {
state++;
}
break;
case 3:
base_port = p[0];
sport = htons(p[0]);
eport = htons(p[1]);
if (!links_created) {
links_created = 1;
/*
* Find an even numbered port
* number base that satisfies the
* contiguous number of ports we
* need
*/
null_addr.s_addr = 0;
if (0 == (salias = FindNewPortGroup(la, null_addr,
FindAliasAddress(la, pip->ip_src),
sport, 0,
RTSP_PORT_GROUP,
IPPROTO_UDP, 1))) {
#ifdef LIBALIAS_DEBUG
fprintf(stderr,
"PacketAlias/RTSP: Cannot find contiguous RTSP data ports\n");
#endif
} else {
base_alias = ntohs(salias);
for (j = 0; j < RTSP_PORT_GROUP; j++) {
/*
* Establish link
* to port found in
* RTSP packet
*/
rtsp_lnk = FindRtspOut(la, GetOriginalAddress(lnk), null_addr,
htons(base_port + j), htons(base_alias + j),
IPPROTO_UDP);
if (rtsp_lnk != NULL) {
#ifndef NO_FW_PUNCH
/*
* Punch
* hole in
* firewall
*/
PunchFWHole(rtsp_lnk);
#endif
} else {
#ifdef LIBALIAS_DEBUG
fprintf(stderr,
"PacketAlias/RTSP: Cannot allocate RTSP data ports\n");
#endif
break;
}
}
}
ealias = htons(base_alias + (RTSP_PORT_GROUP - 1));
}
if (salias && rtsp_lnk) {
pkt_updated = 1;
/* Copy into IP packet */
sprintf(stemp, "%d", ntohs(salias));
memcpy(port_newdata, stemp, strlen(stemp));
port_newdata += strlen(stemp);
if (eport != 0) {
*port_newdata = '-';
port_newdata++;
/* Copy into IP packet */
sprintf(stemp, "%d", ntohs(ealias));
memcpy(port_newdata, stemp, strlen(stemp));
port_newdata += strlen(stemp);
}
*port_newdata = ';';
port_newdata++;
}
state++;
break;
}
if (state > 3) {
break;
}
}
port_data += i;
port_dlen -= i;
}
if (!pkt_updated)
return (-1);
memcpy(port_newdata, port_data, port_dlen);
port_newdata += port_dlen;
*port_newdata = '\0';
/* Create new packet */
new_dlen = port_newdata - newdata;
memcpy(data, newdata, new_dlen);
SetAckModified(lnk);
tc = (struct tcphdr *)ip_next(pip);
delta = GetDeltaSeqOut(tc->th_seq, lnk);
AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len,
tc->th_seq, tc->th_off);
new_len = htons(hlen + new_dlen);
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
1);
pip->ip_len = new_len;
tc->th_sum = 0;
#ifdef _KERNEL
tc->th_x2 = 1;
#else
tc->th_sum = TcpChecksum(pip);
#endif
return (0);
}
static int
UdpAliasIn(struct libalias *la, struct ip *pip)
{
struct udphdr *ud;
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
ud = (struct udphdr *)ip_next(pip);
lnk = FindUdpTcpIn(la, pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, !(la->packetAliasMode & PKT_ALIAS_PROXY_ONLY));
if (lnk != NULL) {
struct in_addr alias_address;
struct in_addr original_address;
struct in_addr proxy_address;
u_short alias_port;
u_short proxy_port;
int accumulate;
int error;
struct alias_data ad = {
.lnk = lnk,
.oaddr = &original_address,
.aaddr = &alias_address,
.aport = &alias_port,
.sport = &ud->uh_sport,
.dport = &ud->uh_dport,
.maxpktsize = 0
};
alias_address = GetAliasAddress(lnk);
original_address = GetOriginalAddress(lnk);
proxy_address = GetProxyAddress(lnk);
alias_port = ud->uh_dport;
ud->uh_dport = GetOriginalPort(lnk);
proxy_port = GetProxyPort(lnk);
/* Walk out chain. */
error = find_handler(IN, UDP, la, pip, &ad);
/* If we cannot figure out the packet, ignore it. */
if (error < 0)
return (PKT_ALIAS_IGNORED);
/* If UDP checksum is not zero, then adjust since destination port */
/* is being unaliased and destination address is being altered. */
if (ud->uh_sum != 0) {
accumulate = alias_port;
accumulate -= ud->uh_dport;
accumulate += twowords(&alias_address);
accumulate -= twowords(&original_address);
/* If this is a proxy packet, modify checksum because of source change.*/
if (proxy_port != 0) {
accumulate += ud->uh_sport;
accumulate -= proxy_port;
}
if (proxy_address.s_addr != 0) {
accumulate += twowords(&pip->ip_src);
accumulate -= twowords(&proxy_address);
}
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* XXX: Could the two if's below be concatenated to one ? */
/* Restore source port and/or address in case of proxying*/
if (proxy_port != 0)
ud->uh_sport = proxy_port;
if (proxy_address.s_addr != 0) {
DifferentialChecksum(&pip->ip_sum,
&proxy_address, &pip->ip_src, 2);
pip->ip_src = proxy_address;
}
/* Restore original IP address */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
UdpAliasOut(struct libalias *la, struct ip *pip, int maxpacketsize, int create)
{
struct udphdr *ud;
struct alias_link *lnk;
struct in_addr dest_address;
struct in_addr proxy_server_address;
u_short dest_port;
u_short proxy_server_port;
int proxy_type;
int error;
LIBALIAS_LOCK_ASSERT(la);
/* Return if proxy-only mode is enabled and not proxyrule found.*/
ud = (struct udphdr *)ip_next(pip);
proxy_type = ProxyCheck(la, &proxy_server_address,
&proxy_server_port, pip->ip_src, pip->ip_dst,
ud->uh_dport, pip->ip_p);
if (proxy_type == 0 && (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY))
return (PKT_ALIAS_OK);
/* If this is a transparent proxy, save original destination,
* then alter the destination and adjust checksums */
dest_port = ud->uh_dport;
dest_address = pip->ip_dst;
if (proxy_type != 0) {
int accumulate;
accumulate = twowords(&pip->ip_dst);
accumulate -= twowords(&proxy_server_address);
ADJUST_CHECKSUM(accumulate, pip->ip_sum);
if (ud->uh_sum != 0) {
accumulate = twowords(&pip->ip_dst);
accumulate -= twowords(&proxy_server_address);
accumulate += ud->uh_dport;
accumulate -= proxy_server_port;
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
pip->ip_dst = proxy_server_address;
ud->uh_dport = proxy_server_port;
}
lnk = FindUdpTcpOut(la, pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, create);
if (lnk != NULL) {
u_short alias_port;
struct in_addr alias_address;
struct alias_data ad = {
.lnk = lnk,
.oaddr = NULL,
.aaddr = &alias_address,
.aport = &alias_port,
.sport = &ud->uh_sport,
.dport = &ud->uh_dport,
.maxpktsize = 0
};
/* Save original destination address, if this is a proxy packet.
* Also modify packet to include destination encoding. This may
* change the size of IP header. */
if (proxy_type != 0) {
SetProxyPort(lnk, dest_port);
SetProxyAddress(lnk, dest_address);
ProxyModify(la, lnk, pip, maxpacketsize, proxy_type);
ud = (struct udphdr *)ip_next(pip);
}
alias_address = GetAliasAddress(lnk);
alias_port = GetAliasPort(lnk);
/* Walk out chain. */
error = find_handler(OUT, UDP, la, pip, &ad);
/* If UDP checksum is not zero, adjust since source port is */
/* being aliased and source address is being altered */
if (ud->uh_sum != 0) {
int accumulate;
accumulate = ud->uh_sport;
accumulate -= alias_port;
accumulate += twowords(&pip->ip_src);
accumulate -= twowords(&alias_address);
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* Put alias port in UDP header */
ud->uh_sport = alias_port;
/* Change source address */
DifferentialChecksum(&pip->ip_sum,
&alias_address, &pip->ip_src, 2);
pip->ip_src = alias_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
TcpAliasIn(struct libalias *la, struct ip *pip)
{
struct tcphdr *tc;
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
tc = (struct tcphdr *)ip_next(pip);
lnk = FindUdpTcpIn(la, pip->ip_src, pip->ip_dst,
tc->th_sport, tc->th_dport,
IPPROTO_TCP,
!(la->packetAliasMode & PKT_ALIAS_PROXY_ONLY));
if (lnk != NULL) {
struct in_addr alias_address;
struct in_addr original_address;
struct in_addr proxy_address;
u_short alias_port;
u_short proxy_port;
int accumulate, error;
/*
* The init of MANY vars is a bit below, but aliashandlepptpin
* seems to need the destination port that came within the
* packet and not the original one looks below [*].
*/
struct alias_data ad = {
.lnk = lnk,
.oaddr = NULL,
.aaddr = NULL,
.aport = NULL,
.sport = &tc->th_sport,
.dport = &tc->th_dport,
.maxpktsize = 0
};
/* Walk out chain. */
error = find_handler(IN, TCP, la, pip, &ad);
alias_address = GetAliasAddress(lnk);
original_address = GetOriginalAddress(lnk);
proxy_address = GetProxyAddress(lnk);
alias_port = tc->th_dport;
tc->th_dport = GetOriginalPort(lnk);
proxy_port = GetProxyPort(lnk);
/*
* Look above, if anyone is going to add find_handler AFTER
* this aliashandlepptpin/point, please redo alias_data too.
* Uncommenting the piece here below should be enough.
*/
#if 0
struct alias_data ad = {
.lnk = lnk,
.oaddr = &original_address,
.aaddr = &alias_address,
.aport = &alias_port,
.sport = &ud->uh_sport,
.dport = &ud->uh_dport,
.maxpktsize = 0
};
/* Walk out chain. */
error = find_handler(la, pip, &ad);
if (error == EHDNOF)
printf("Protocol handler not found\n");
#endif
/* Adjust TCP checksum since destination port is being unaliased */
/* and destination port is being altered. */
accumulate = alias_port;
accumulate -= tc->th_dport;
accumulate += twowords(&alias_address);
accumulate -= twowords(&original_address);
/* If this is a proxy, then modify the TCP source port and
checksum accumulation */
if (proxy_port != 0) {
accumulate += tc->th_sport;
tc->th_sport = proxy_port;
accumulate -= tc->th_sport;
accumulate += twowords(&pip->ip_src);
accumulate -= twowords(&proxy_address);
}
/* See if ACK number needs to be modified */
if (GetAckModified(lnk) == 1) {
int delta;
tc = (struct tcphdr *)ip_next(pip);
delta = GetDeltaAckIn(tc->th_ack, lnk);
if (delta != 0) {
accumulate += twowords(&tc->th_ack);
tc->th_ack = htonl(ntohl(tc->th_ack) - delta);
accumulate -= twowords(&tc->th_ack);
}
}
ADJUST_CHECKSUM(accumulate, tc->th_sum);
/* Restore original IP address */
accumulate = twowords(&pip->ip_dst);
pip->ip_dst = original_address;
accumulate -= twowords(&pip->ip_dst);
/* If this is a transparent proxy packet, then modify the source
address */
if (proxy_address.s_addr != 0) {
accumulate += twowords(&pip->ip_src);
pip->ip_src = proxy_address;
accumulate -= twowords(&pip->ip_src);
}
ADJUST_CHECKSUM(accumulate, pip->ip_sum);
/* Monitor TCP connection state */
tc = (struct tcphdr *)ip_next(pip);
TcpMonitorIn(tc->th_flags, lnk);
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
TcpAliasOut(struct libalias *la, struct ip *pip, int maxpacketsize, int create)
{
int proxy_type, error;
u_short dest_port;
u_short proxy_server_port;
struct in_addr dest_address;
struct in_addr proxy_server_address;
struct tcphdr *tc;
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
tc = (struct tcphdr *)ip_next(pip);
if (create)
proxy_type = ProxyCheck(la, &proxy_server_address,
&proxy_server_port, pip->ip_src, pip->ip_dst,
tc->th_dport, pip->ip_p);
else
proxy_type = 0;
if (proxy_type == 0 && (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY))
return (PKT_ALIAS_OK);
/* If this is a transparent proxy, save original destination,
then alter the destination and adjust checksums */
dest_port = tc->th_dport;
dest_address = pip->ip_dst;
if (proxy_type != 0) {
int accumulate;
accumulate = tc->th_dport;
tc->th_dport = proxy_server_port;
accumulate -= tc->th_dport;
accumulate += twowords(&pip->ip_dst);
accumulate -= twowords(&proxy_server_address);
ADJUST_CHECKSUM(accumulate, tc->th_sum);
accumulate = twowords(&pip->ip_dst);
pip->ip_dst = proxy_server_address;
accumulate -= twowords(&pip->ip_dst);
ADJUST_CHECKSUM(accumulate, pip->ip_sum);
}
lnk = FindUdpTcpOut(la, pip->ip_src, pip->ip_dst,
tc->th_sport, tc->th_dport,
IPPROTO_TCP, create);
if (lnk == NULL)
return (PKT_ALIAS_IGNORED);
if (lnk != NULL) {
u_short alias_port;
struct in_addr alias_address;
int accumulate;
struct alias_data ad = {
.lnk = lnk,
.oaddr = NULL,
.aaddr = &alias_address,
.aport = &alias_port,
.sport = &tc->th_sport,
.dport = &tc->th_dport,
.maxpktsize = maxpacketsize
};
/* Save original destination address, if this is a proxy packet.
Also modify packet to include destination encoding. This may
change the size of IP header. */
if (proxy_type != 0) {
SetProxyPort(lnk, dest_port);
SetProxyAddress(lnk, dest_address);
ProxyModify(la, lnk, pip, maxpacketsize, proxy_type);
tc = (struct tcphdr *)ip_next(pip);
}
/* Get alias address and port */
alias_port = GetAliasPort(lnk);
alias_address = GetAliasAddress(lnk);
/* Monitor TCP connection state */
tc = (struct tcphdr *)ip_next(pip);
TcpMonitorOut(tc->th_flags, lnk);
/* Walk out chain. */
error = find_handler(OUT, TCP, la, pip, &ad);
/* Adjust TCP checksum since source port is being aliased */
/* and source address is being altered */
accumulate = tc->th_sport;
tc->th_sport = alias_port;
accumulate -= tc->th_sport;
accumulate += twowords(&pip->ip_src);
accumulate -= twowords(&alias_address);
/* Modify sequence number if necessary */
if (GetAckModified(lnk) == 1) {
int delta;
tc = (struct tcphdr *)ip_next(pip);
delta = GetDeltaSeqOut(tc->th_seq, lnk);
if (delta != 0) {
accumulate += twowords(&tc->th_seq);
tc->th_seq = htonl(ntohl(tc->th_seq) + delta);
accumulate -= twowords(&tc->th_seq);
}
}
ADJUST_CHECKSUM(accumulate, tc->th_sum);
/* Change source address */
accumulate = twowords(&pip->ip_src);
pip->ip_src = alias_address;
accumulate -= twowords(&pip->ip_src);
ADJUST_CHECKSUM(accumulate, pip->ip_sum);
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
/* Fragment Handling
FragmentIn()
FragmentOut()
The packet aliasing module has a limited ability for handling IP
fragments. If the ICMP, TCP or UDP header is in the first fragment
received, then the ID number of the IP packet is saved, and other
fragments are identified according to their ID number and IP address
they were sent from. Pointers to unresolved fragments can also be
saved and recalled when a header fragment is seen.
*/
/* Local prototypes */
static int FragmentIn(struct libalias *la, struct in_addr ip_src,
struct in_addr *ip_dst, u_short ip_id, u_short *ip_sum);
static int FragmentOut(struct libalias *, struct in_addr *ip_src,
u_short *ip_sum);
static int
FragmentIn(struct libalias *la, struct in_addr ip_src, struct in_addr *ip_dst,
u_short ip_id, u_short *ip_sum)
{
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
lnk = FindFragmentIn2(la, ip_src, *ip_dst, ip_id);
if (lnk != NULL) {
struct in_addr original_address;
GetFragmentAddr(lnk, &original_address);
DifferentialChecksum(ip_sum,
&original_address, ip_dst, 2);
*ip_dst = original_address;
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_UNRESOLVED_FRAGMENT);
}
static int
FragmentOut(struct libalias *la, struct in_addr *ip_src, u_short *ip_sum)
{
struct in_addr alias_address;
LIBALIAS_LOCK_ASSERT(la);
alias_address = FindAliasAddress(la, *ip_src);
DifferentialChecksum(ip_sum,
&alias_address, ip_src, 2);
*ip_src = alias_address;
return (PKT_ALIAS_OK);
}
/* Outside World Access
PacketAliasSaveFragment()
PacketAliasGetFragment()
PacketAliasFragmentIn()
PacketAliasIn()
PacketAliasOut()
PacketUnaliasOut()
(prototypes in alias.h)
*/
int
LibAliasSaveFragment(struct libalias *la, char *ptr)
{
int iresult;
struct alias_link *lnk;
struct ip *pip;
LIBALIAS_LOCK(la);
pip = (struct ip *)ptr;
lnk = AddFragmentPtrLink(la, pip->ip_src, pip->ip_id);
iresult = PKT_ALIAS_ERROR;
if (lnk != NULL) {
SetFragmentPtr(lnk, ptr);
iresult = PKT_ALIAS_OK;
}
LIBALIAS_UNLOCK(la);
return (iresult);
}
char *
LibAliasGetFragment(struct libalias *la, char *ptr)
{
struct alias_link *lnk;
char *fptr;
struct ip *pip;
LIBALIAS_LOCK(la);
pip = (struct ip *)ptr;
lnk = FindFragmentPtr(la, pip->ip_src, pip->ip_id);
if (lnk != NULL) {
GetFragmentPtr(lnk, &fptr);
SetFragmentPtr(lnk, NULL);
SetExpire(lnk, 0); /* Deletes link */
} else
fptr = NULL;
LIBALIAS_UNLOCK(la);
return (fptr);
}
void
LibAliasFragmentIn(struct libalias *la, char *ptr, /* Points to correctly
* de-aliased header
* fragment */
char *ptr_fragment /* Points to fragment which must be
* de-aliased */
)
{
struct ip *pip;
struct ip *fpip;
LIBALIAS_LOCK(la);
(void)la;
pip = (struct ip *)ptr;
fpip = (struct ip *)ptr_fragment;
DifferentialChecksum(&fpip->ip_sum,
&pip->ip_dst, &fpip->ip_dst, 2);
fpip->ip_dst = pip->ip_dst;
LIBALIAS_UNLOCK(la);
}
/* Local prototypes */
static int
LibAliasOutLocked(struct libalias *la, char *ptr,
int maxpacketsize, int create);
static int
LibAliasInLocked(struct libalias *la, char *ptr,
int maxpacketsize);
int
LibAliasIn(struct libalias *la, char *ptr, int maxpacketsize)
{
int res;
LIBALIAS_LOCK(la);
res = LibAliasInLocked(la, ptr, maxpacketsize);
LIBALIAS_UNLOCK(la);
return (res);
}
int
PacketUnaliasOut(char *ptr, /* valid IP packet */
int maxpacketsize /* for error checking */
)
{
struct ip *pip;
struct icmp *ic;
struct udphdr *ud;
struct tcphdr *tc;
struct alias_link *link;
int iresult = PKT_ALIAS_IGNORED;
pip = (struct ip *) ptr;
/* Defense against mangled packets */
if (ntohs(pip->ip_len) > maxpacketsize
|| (pip->ip_hl<<2) > maxpacketsize)
return(iresult);
ud = (struct udphdr *) ((char *) pip + (pip->ip_hl << 2));
tc = (struct tcphdr *) ud;
ic = (struct icmp *) ud;
/* Find a link */
if (pip->ip_p == IPPROTO_UDP)
link = FindUdpTcpIn(pip->ip_dst, pip->ip_src,
ud->uh_dport, ud->uh_sport,
IPPROTO_UDP, 0);
else if (pip->ip_p == IPPROTO_TCP)
link = FindUdpTcpIn(pip->ip_dst, pip->ip_src,
tc->th_dport, tc->th_sport,
IPPROTO_TCP, 0);
else if (pip->ip_p == IPPROTO_ICMP)
link = FindIcmpIn(pip->ip_dst, pip->ip_src, ic->icmp_id, 0);
else
link = NULL;
/* Change it from an aliased packet to an unaliased packet */
if (link != NULL)
{
if (pip->ip_p == IPPROTO_UDP || pip->ip_p == IPPROTO_TCP)
{
u_short *sptr;
int accumulate;
struct in_addr original_address;
u_short original_port;
original_address = GetOriginalAddress(link);
original_port = GetOriginalPort(link);
/* Adjust TCP/UDP checksum */
sptr = (u_short *) &(pip->ip_src);
accumulate = *sptr++;
accumulate += *sptr;
sptr = (u_short *) &original_address;
accumulate -= *sptr++;
accumulate -= *sptr;
if (pip->ip_p == IPPROTO_UDP) {
accumulate += ud->uh_sport;
accumulate -= original_port;
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
} else {
accumulate += tc->th_sport;
accumulate -= original_port;
ADJUST_CHECKSUM(accumulate, tc->th_sum);
}
/* Adjust IP checksum */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &original_address,
(u_short *) &pip->ip_src,
2);
/* Un-alias source address and port number */
pip->ip_src = original_address;
if (pip->ip_p == IPPROTO_UDP)
ud->uh_sport = original_port;
else
tc->th_sport = original_port;
iresult = PKT_ALIAS_OK;
} else if (pip->ip_p == IPPROTO_ICMP) {
u_short *sptr;
int accumulate;
struct in_addr original_address;
u_short original_id;
original_address = GetOriginalAddress(link);
original_id = GetOriginalPort(link);
/* Adjust ICMP checksum */
sptr = (u_short *) &(pip->ip_src);
accumulate = *sptr++;
accumulate += *sptr;
sptr = (u_short *) &original_address;
accumulate -= *sptr++;
accumulate -= *sptr;
accumulate += ic->icmp_id;
accumulate -= original_id;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/* Adjust IP checksum */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &original_address,
(u_short *) &pip->ip_src,
2);
/* Un-alias source address and port number */
pip->ip_src = original_address;
ic->icmp_id = original_id;
iresult = PKT_ALIAS_OK;
}
}
return(iresult);
}
static int
UdpAliasOut(struct ip *pip)
{
struct udphdr *ud;
struct alias_link *link;
/* Return if proxy-only mode is enabled */
if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return PKT_ALIAS_OK;
ud = (struct udphdr *) ((char *) pip + (pip->ip_hl << 2));
link = FindUdpTcpOut(pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, 1);
if (link != NULL)
{
u_short alias_port;
struct in_addr alias_address;
alias_address = GetAliasAddress(link);
alias_port = GetAliasPort(link);
/* Special processing for IP encoding protocols */
if (ntohs(ud->uh_dport) == CUSEEME_PORT_NUMBER)
AliasHandleCUSeeMeOut(pip, link);
/* If NETBIOS Datagram, It should be alias address in UDP Data, too */
else if (ntohs(ud->uh_dport) == NETBIOS_DGM_PORT_NUMBER
|| ntohs(ud->uh_sport) == NETBIOS_DGM_PORT_NUMBER)
AliasHandleUdpNbt(pip, link, &alias_address, alias_port);
else if (ntohs(ud->uh_dport) == NETBIOS_NS_PORT_NUMBER
|| ntohs(ud->uh_sport) == NETBIOS_NS_PORT_NUMBER)
AliasHandleUdpNbtNS(pip, link, &pip->ip_src, &ud->uh_sport,
&alias_address, &alias_port);
/*
* We don't know in advance what TID the TFTP server will choose,
* so we create a wilcard link (destination port is unspecified)
* that will match any TID from a given destination.
*/
else if (ntohs(ud->uh_dport) == TFTP_PORT_NUMBER)
FindRtspOut(pip->ip_src, pip->ip_dst,
ud->uh_sport, alias_port, IPPROTO_UDP);
/* If UDP checksum is not zero, adjust since source port is */
/* being aliased and source address is being altered */
if (ud->uh_sum != 0)
{
int accumulate;
u_short *sptr;
accumulate = ud->uh_sport;
accumulate -= alias_port;
sptr = (u_short *) &(pip->ip_src);
accumulate += *sptr++;
accumulate += *sptr;
sptr = (u_short *) &alias_address;
accumulate -= *sptr++;
accumulate -= *sptr;
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* Put alias port in UDP header */
ud->uh_sport = alias_port;
/* Change source address */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &alias_address,
(u_short *) &pip->ip_src,
2);
pip->ip_src = alias_address;
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_IGNORED);
}
static int
UdpAliasIn(struct ip *pip)
{
struct udphdr *ud;
struct alias_link *link;
/* Return if proxy-only mode is enabled */
if (packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return PKT_ALIAS_OK;
ud = (struct udphdr *) ((char *) pip + (pip->ip_hl << 2));
link = FindUdpTcpIn(pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, 1);
if (link != NULL)
{
struct in_addr alias_address;
struct in_addr original_address;
u_short alias_port;
int accumulate;
u_short *sptr;
int r = 0;
alias_address = GetAliasAddress(link);
original_address = GetOriginalAddress(link);
alias_port = ud->uh_dport;
ud->uh_dport = GetOriginalPort(link);
/* Special processing for IP encoding protocols */
if (ntohs(ud->uh_dport) == CUSEEME_PORT_NUMBER)
AliasHandleCUSeeMeIn(pip, original_address);
/* If NETBIOS Datagram, It should be alias address in UDP Data, too */
else if (ntohs(ud->uh_dport) == NETBIOS_DGM_PORT_NUMBER
|| ntohs(ud->uh_sport) == NETBIOS_DGM_PORT_NUMBER)
r = AliasHandleUdpNbt(pip, link, &original_address, ud->uh_dport);
else if (ntohs(ud->uh_dport) == NETBIOS_NS_PORT_NUMBER
|| ntohs(ud->uh_sport) == NETBIOS_NS_PORT_NUMBER)
r = AliasHandleUdpNbtNS(pip, link, &alias_address, &alias_port,
&original_address, &ud->uh_dport);
/* If UDP checksum is not zero, then adjust since destination port */
/* is being unaliased and destination address is being altered. */
if (ud->uh_sum != 0)
{
accumulate = alias_port;
accumulate -= ud->uh_dport;
sptr = (u_short *) &alias_address;
accumulate += *sptr++;
accumulate += *sptr;
sptr = (u_short *) &original_address;
accumulate -= *sptr++;
accumulate -= *sptr;
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* Restore original IP address */
DifferentialChecksum(&pip->ip_sum,
(u_short *) &original_address,
(u_short *) &pip->ip_dst,
2);
pip->ip_dst = original_address;
/*
* If we cannot figure out the packet, ignore it.
*/
if (r < 0)
return(PKT_ALIAS_IGNORED);
else
return(PKT_ALIAS_OK);
}
return(PKT_ALIAS_IGNORED);
}
static int
IcmpAliasOut2(struct libalias *la, struct ip *pip)
{
/*
Alias outgoing ICMP error messages containing
IP header and first 64 bits of datagram.
*/
struct ip *ip;
struct icmp *ic, *ic2;
struct udphdr *ud;
struct tcphdr *tc;
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
ic = (struct icmp *)ip_next(pip);
ip = &ic->icmp_ip;
ud = (struct udphdr *)ip_next(ip);
tc = (struct tcphdr *)ip_next(ip);
ic2 = (struct icmp *)ip_next(ip);
if (ip->ip_p == IPPROTO_UDP)
lnk = FindUdpTcpOut(la, ip->ip_dst, ip->ip_src,
ud->uh_dport, ud->uh_sport,
IPPROTO_UDP, 0);
else if (ip->ip_p == IPPROTO_TCP)
lnk = FindUdpTcpOut(la, ip->ip_dst, ip->ip_src,
tc->th_dport, tc->th_sport,
IPPROTO_TCP, 0);
else if (ip->ip_p == IPPROTO_ICMP) {
if (ic2->icmp_type == ICMP_ECHO || ic2->icmp_type == ICMP_TSTAMP)
lnk = FindIcmpOut(la, ip->ip_dst, ip->ip_src, ic2->icmp_id, 0);
else
lnk = NULL;
} else
lnk = NULL;
if (lnk != NULL) {
if (ip->ip_p == IPPROTO_UDP || ip->ip_p == IPPROTO_TCP) {
int accumulate;
struct in_addr alias_address;
u_short alias_port;
alias_address = GetAliasAddress(lnk);
alias_port = GetAliasPort(lnk);
/* Adjust ICMP checksum */
accumulate = twowords(&ip->ip_dst);
accumulate -= twowords(&alias_address);
accumulate += ud->uh_dport;
accumulate -= alias_port;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/*
* Alias address in IP header if it comes from the host
* the original TCP/UDP packet was destined for.
*/
if (pip->ip_src.s_addr == ip->ip_dst.s_addr) {
DifferentialChecksum(&pip->ip_sum,
&alias_address, &pip->ip_src, 2);
pip->ip_src = alias_address;
}
/* Alias address and port number of original IP packet
fragment contained in ICMP data section */
ip->ip_dst = alias_address;
ud->uh_dport = alias_port;
} else if (ip->ip_p == IPPROTO_ICMP) {
int accumulate;
struct in_addr alias_address;
u_short alias_id;
alias_address = GetAliasAddress(lnk);
alias_id = GetAliasPort(lnk);
/* Adjust ICMP checksum */
accumulate = twowords(&ip->ip_dst);
accumulate -= twowords(&alias_address);
accumulate += ic2->icmp_id;
accumulate -= alias_id;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/*
* Alias address in IP header if it comes from the host
* the original ICMP message was destined for.
*/
if (pip->ip_src.s_addr == ip->ip_dst.s_addr) {
DifferentialChecksum(&pip->ip_sum,
&alias_address, &pip->ip_src, 2);
pip->ip_src = alias_address;
}
/* Alias address of original IP packet and sequence number of
embedded ICMP datagram */
ip->ip_dst = alias_address;
ic2->icmp_id = alias_id;
}
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
static int
IcmpAliasIn2(struct libalias *la, struct ip *pip)
{
LIBALIAS_LOCK_ASSERT(la);
/*
Alias incoming ICMP error messages containing
IP header and first 64 bits of datagram.
*/
struct ip *ip;
struct icmp *ic, *ic2;
struct udphdr *ud;
struct tcphdr *tc;
struct alias_link *lnk;
ic = (struct icmp *)ip_next(pip);
ip = &ic->icmp_ip;
ud = (struct udphdr *)ip_next(ip);
tc = (struct tcphdr *)ip_next(ip);
ic2 = (struct icmp *)ip_next(ip);
if (ip->ip_p == IPPROTO_UDP)
lnk = FindUdpTcpIn(la, ip->ip_dst, ip->ip_src,
ud->uh_dport, ud->uh_sport,
IPPROTO_UDP, 0);
else if (ip->ip_p == IPPROTO_TCP)
lnk = FindUdpTcpIn(la, ip->ip_dst, ip->ip_src,
tc->th_dport, tc->th_sport,
IPPROTO_TCP, 0);
else if (ip->ip_p == IPPROTO_ICMP) {
if (ic2->icmp_type == ICMP_ECHO || ic2->icmp_type == ICMP_TSTAMP)
lnk = FindIcmpIn(la, ip->ip_dst, ip->ip_src, ic2->icmp_id, 0);
else
lnk = NULL;
} else
lnk = NULL;
if (lnk != NULL) {
if (ip->ip_p == IPPROTO_UDP || ip->ip_p == IPPROTO_TCP) {
int accumulate, accumulate2;
struct in_addr original_address;
u_short original_port;
original_address = GetOriginalAddress(lnk);
original_port = GetOriginalPort(lnk);
/* Adjust ICMP checksum */
accumulate = twowords(&ip->ip_src);
accumulate -= twowords(&original_address);
accumulate += ud->uh_sport;
accumulate -= original_port;
accumulate2 = accumulate;
accumulate2 += ip->ip_sum;
ADJUST_CHECKSUM(accumulate, ip->ip_sum);
accumulate2 -= ip->ip_sum;
ADJUST_CHECKSUM(accumulate2, ic->icmp_cksum);
/* Un-alias address in IP header */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
/* Un-alias address and port number of original IP packet
fragment contained in ICMP data section */
ip->ip_src = original_address;
ud->uh_sport = original_port;
} else if (ip->ip_p == IPPROTO_ICMP) {
int accumulate, accumulate2;
struct in_addr original_address;
u_short original_id;
original_address = GetOriginalAddress(lnk);
original_id = GetOriginalPort(lnk);
/* Adjust ICMP checksum */
accumulate = twowords(&ip->ip_src);
accumulate -= twowords(&original_address);
accumulate += ic2->icmp_id;
accumulate -= original_id;
accumulate2 = accumulate;
accumulate2 += ip->ip_sum;
ADJUST_CHECKSUM(accumulate, ip->ip_sum);
accumulate2 -= ip->ip_sum;
ADJUST_CHECKSUM(accumulate2, ic->icmp_cksum);
/* Un-alias address in IP header */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
/* Un-alias address of original IP packet and sequence number of
embedded ICMP datagram */
ip->ip_src = original_address;
ic2->icmp_id = original_id;
}
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
int
LibAliasUnaliasOut(struct libalias *la, char *ptr, /* valid IP packet */
int maxpacketsize /* for error checking */
)
{
struct ip *pip;
struct icmp *ic;
struct udphdr *ud;
struct tcphdr *tc;
struct alias_link *lnk;
int iresult = PKT_ALIAS_IGNORED;
LIBALIAS_LOCK(la);
pip = (struct ip *)ptr;
/* Defense against mangled packets */
if (ntohs(pip->ip_len) > maxpacketsize
|| (pip->ip_hl << 2) > maxpacketsize)
goto getout;
ud = (struct udphdr *)ip_next(pip);
tc = (struct tcphdr *)ip_next(pip);
ic = (struct icmp *)ip_next(pip);
/* Find a link */
if (pip->ip_p == IPPROTO_UDP)
lnk = FindUdpTcpIn(la, pip->ip_dst, pip->ip_src,
ud->uh_dport, ud->uh_sport,
IPPROTO_UDP, 0);
else if (pip->ip_p == IPPROTO_TCP)
lnk = FindUdpTcpIn(la, pip->ip_dst, pip->ip_src,
tc->th_dport, tc->th_sport,
IPPROTO_TCP, 0);
else if (pip->ip_p == IPPROTO_ICMP)
lnk = FindIcmpIn(la, pip->ip_dst, pip->ip_src, ic->icmp_id, 0);
else
lnk = NULL;
/* Change it from an aliased packet to an unaliased packet */
if (lnk != NULL) {
if (pip->ip_p == IPPROTO_UDP || pip->ip_p == IPPROTO_TCP) {
int accumulate;
struct in_addr original_address;
u_short original_port;
original_address = GetOriginalAddress(lnk);
original_port = GetOriginalPort(lnk);
/* Adjust TCP/UDP checksum */
accumulate = twowords(&pip->ip_src);
accumulate -= twowords(&original_address);
if (pip->ip_p == IPPROTO_UDP) {
accumulate += ud->uh_sport;
accumulate -= original_port;
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
} else {
accumulate += tc->th_sport;
accumulate -= original_port;
ADJUST_CHECKSUM(accumulate, tc->th_sum);
}
/* Adjust IP checksum */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_src, 2);
/* Un-alias source address and port number */
pip->ip_src = original_address;
if (pip->ip_p == IPPROTO_UDP)
ud->uh_sport = original_port;
else
tc->th_sport = original_port;
iresult = PKT_ALIAS_OK;
} else if (pip->ip_p == IPPROTO_ICMP) {
int accumulate;
struct in_addr original_address;
u_short original_id;
original_address = GetOriginalAddress(lnk);
original_id = GetOriginalPort(lnk);
/* Adjust ICMP checksum */
accumulate = twowords(&pip->ip_src);
accumulate -= twowords(&original_address);
accumulate += ic->icmp_id;
accumulate -= original_id;
ADJUST_CHECKSUM(accumulate, ic->icmp_cksum);
/* Adjust IP checksum */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_src, 2);
/* Un-alias source address and port number */
pip->ip_src = original_address;
ic->icmp_id = original_id;
iresult = PKT_ALIAS_OK;
}
}
getout:
LIBALIAS_UNLOCK(la);
return (iresult);
}
static void
AliasHandleIrcOut(struct libalias *la,
struct ip *pip, /* IP packet to examine */
struct alias_link *lnk, /* Which link are we on? */
int maxsize /* Maximum size of IP packet including
* headers */
)
{
int hlen, tlen, dlen;
struct in_addr true_addr;
u_short true_port;
char *sptr;
struct tcphdr *tc;
int i; /* Iterator through the source */
/* Calculate data length of TCP packet */
tc = (struct tcphdr *)ip_next(pip);
hlen = (pip->ip_hl + tc->th_off) << 2;
tlen = ntohs(pip->ip_len);
dlen = tlen - hlen;
/*
* Return if data length is too short - assume an entire PRIVMSG in
* each packet.
*/
if (dlen < (int)sizeof(":[email protected] PRIVMSG A :aDCC 1 1a") - 1)
return;
/* Place string pointer at beginning of data */
sptr = (char *)pip;
sptr += hlen;
maxsize -= hlen; /* We're interested in maximum size of
* data, not packet */
/* Search for a CTCP command [Note 1] */
for (i = 0; i < dlen; i++) {
if (sptr[i] == '\001')
goto lFOUND_CTCP;
}
return; /* No CTCP commands in */
/* Handle CTCP commands - the buffer may have to be copied */
lFOUND_CTCP:
{
char newpacket[65536]; /* Estimate of maximum packet size
* :) */
unsigned int copyat = i; /* Same */
unsigned int iCopy = 0; /* How much data have we written to
* copy-back string? */
unsigned long org_addr; /* Original IP address */
unsigned short org_port; /* Original source port
* address */
lCTCP_START:
if (i >= dlen || iCopy >= sizeof(newpacket))
goto lPACKET_DONE;
newpacket[iCopy++] = sptr[i++]; /* Copy the CTCP start
* character */
/* Start of a CTCP */
if (i + 4 >= dlen) /* Too short for DCC */
goto lBAD_CTCP;
if (sptr[i + 0] != 'D')
goto lBAD_CTCP;
if (sptr[i + 1] != 'C')
goto lBAD_CTCP;
if (sptr[i + 2] != 'C')
goto lBAD_CTCP;
if (sptr[i + 3] != ' ')
goto lBAD_CTCP;
/* We have a DCC command - handle it! */
i += 4; /* Skip "DCC " */
if (iCopy + 4 > sizeof(newpacket))
goto lPACKET_DONE;
newpacket[iCopy++] = 'D';
newpacket[iCopy++] = 'C';
newpacket[iCopy++] = 'C';
newpacket[iCopy++] = ' ';
DBprintf(("Found DCC\n"));
/*
* Skip any extra spaces (should not occur according to
* protocol, but DCC breaks CTCP protocol anyway
*/
while (sptr[i] == ' ') {
if (++i >= dlen) {
DBprintf(("DCC packet terminated in just spaces\n"));
goto lPACKET_DONE;
}
}
DBprintf(("Transferring command...\n"));
while (sptr[i] != ' ') {
newpacket[iCopy++] = sptr[i];
if (++i >= dlen || iCopy >= sizeof(newpacket)) {
DBprintf(("DCC packet terminated during command\n"));
goto lPACKET_DONE;
}
}
/* Copy _one_ space */
if (i + 1 < dlen && iCopy < sizeof(newpacket))
newpacket[iCopy++] = sptr[i++];
DBprintf(("Done command - removing spaces\n"));
/*
* Skip any extra spaces (should not occur according to
* protocol, but DCC breaks CTCP protocol anyway
*/
while (sptr[i] == ' ') {
if (++i >= dlen) {
DBprintf(("DCC packet terminated in just spaces (post-command)\n"));
goto lPACKET_DONE;
}
}
DBprintf(("Transferring filename...\n"));
while (sptr[i] != ' ') {
newpacket[iCopy++] = sptr[i];
if (++i >= dlen || iCopy >= sizeof(newpacket)) {
DBprintf(("DCC packet terminated during filename\n"));
goto lPACKET_DONE;
}
}
/* Copy _one_ space */
if (i + 1 < dlen && iCopy < sizeof(newpacket))
newpacket[iCopy++] = sptr[i++];
DBprintf(("Done filename - removing spaces\n"));
/*
* Skip any extra spaces (should not occur according to
* protocol, but DCC breaks CTCP protocol anyway
*/
while (sptr[i] == ' ') {
if (++i >= dlen) {
DBprintf(("DCC packet terminated in just spaces (post-filename)\n"));
goto lPACKET_DONE;
}
}
DBprintf(("Fetching IP address\n"));
/* Fetch IP address */
org_addr = 0;
while (i < dlen && isdigit(sptr[i])) {
if (org_addr > ULONG_MAX / 10UL) { /* Terminate on overflow */
DBprintf(("DCC Address overflow (org_addr == 0x%08lx, next char %c\n", org_addr, sptr[i]));
goto lBAD_CTCP;
}
org_addr *= 10;
org_addr += sptr[i++] - '0';
}
DBprintf(("Skipping space\n"));
if (i + 1 >= dlen || sptr[i] != ' ') {
DBprintf(("Overflow (%d >= %d) or bad character (%02x) terminating IP address\n", i + 1, dlen, sptr[i]));
goto lBAD_CTCP;
}
/*
* Skip any extra spaces (should not occur according to
* protocol, but DCC breaks CTCP protocol anyway, so we
* might as well play it safe
*/
while (sptr[i] == ' ') {
if (++i >= dlen) {
DBprintf(("Packet failure - space overflow.\n"));
goto lPACKET_DONE;
}
}
DBprintf(("Fetching port number\n"));
/* Fetch source port */
org_port = 0;
while (i < dlen && isdigit(sptr[i])) {
if (org_port > 6554) { /* Terminate on overflow
* (65536/10 rounded up */
DBprintf(("DCC: port number overflow\n"));
goto lBAD_CTCP;
}
org_port *= 10;
org_port += sptr[i++] - '0';
}
/* Skip illegal addresses (or early termination) */
if (i >= dlen || (sptr[i] != '\001' && sptr[i] != ' ')) {
DBprintf(("Bad port termination\n"));
goto lBAD_CTCP;
}
DBprintf(("Got IP %lu and port %u\n", org_addr, (unsigned)org_port));
/* We've got the address and port - now alias it */
{
struct alias_link *dcc_lnk;
struct in_addr destaddr;
true_port = htons(org_port);
true_addr.s_addr = htonl(org_addr);
destaddr.s_addr = 0;
/* Sanity/Security checking */
if (!org_addr || !org_port ||
pip->ip_src.s_addr != true_addr.s_addr ||
org_port < IPPORT_RESERVED)
goto lBAD_CTCP;
/*
* Steal the FTP_DATA_PORT - it doesn't really
* matter, and this would probably allow it through
* at least _some_ firewalls.
*/
dcc_lnk = FindUdpTcpOut(la, true_addr, destaddr,
true_port, 0,
IPPROTO_TCP, 1);
DBprintf(("Got a DCC link\n"));
if (dcc_lnk) {
struct in_addr alias_address; /* Address from aliasing */
u_short alias_port; /* Port given by
* aliasing */
int n;
#ifndef NO_FW_PUNCH
/* Generate firewall hole as appropriate */
PunchFWHole(dcc_lnk);
#endif
alias_address = GetAliasAddress(lnk);
n = snprintf(&newpacket[iCopy],
sizeof(newpacket) - iCopy,
"%lu ", (u_long) htonl(alias_address.s_addr));
if (n < 0) {
DBprintf(("DCC packet construct failure.\n"));
goto lBAD_CTCP;
}
if ((iCopy += n) >= sizeof(newpacket)) { /* Truncated/fit exactly
* - bad news */
DBprintf(("DCC constructed packet overflow.\n"));
goto lBAD_CTCP;
}
alias_port = GetAliasPort(dcc_lnk);
n = snprintf(&newpacket[iCopy],
sizeof(newpacket) - iCopy,
"%u", htons(alias_port));
if (n < 0) {
DBprintf(("DCC packet construct failure.\n"));
goto lBAD_CTCP;
}
iCopy += n;
/*
* Done - truncated cases will be taken
* care of by lBAD_CTCP
*/
DBprintf(("Aliased IP %lu and port %u\n", alias_address.s_addr, (unsigned)alias_port));
}
}
/*
* An uninteresting CTCP - state entered right after '\001'
* has been pushed. Also used to copy the rest of a DCC,
* after IP address and port has been handled
*/
lBAD_CTCP:
for (; i < dlen && iCopy < sizeof(newpacket); i++, iCopy++) {
newpacket[iCopy] = sptr[i]; /* Copy CTCP unchanged */
if (sptr[i] == '\001') {
goto lNORMAL_TEXT;
}
}
goto lPACKET_DONE;
/* Normal text */
lNORMAL_TEXT:
for (; i < dlen && iCopy < sizeof(newpacket); i++, iCopy++) {
newpacket[iCopy] = sptr[i]; /* Copy CTCP unchanged */
if (sptr[i] == '\001') {
goto lCTCP_START;
}
}
/* Handle the end of a packet */
lPACKET_DONE:
iCopy = iCopy > maxsize - copyat ? maxsize - copyat : iCopy;
memcpy(sptr + copyat, newpacket, iCopy);
/* Save information regarding modified seq and ack numbers */
{
int delta;
SetAckModified(lnk);
delta = GetDeltaSeqOut(pip, lnk);
AddSeq(pip, lnk, delta + copyat + iCopy - dlen);
}
/* Revise IP header */
{
u_short new_len;
new_len = htons(hlen + iCopy + copyat);
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
1);
pip->ip_len = new_len;
}
/* Compute TCP checksum for revised packet */
tc->th_sum = 0;
#ifdef _KERNEL
tc->th_x2 = 1;
#else
tc->th_sum = TcpChecksum(pip);
#endif
return;
}
}
static int
UdpAliasIn(struct libalias *la, struct ip *pip)
{
struct udphdr *ud;
struct alias_link *lnk;
LIBALIAS_LOCK_ASSERT(la);
/* Return if proxy-only mode is enabled */
if (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY)
return (PKT_ALIAS_OK);
ud = (struct udphdr *)ip_next(pip);
lnk = FindUdpTcpIn(la, pip->ip_src, pip->ip_dst,
ud->uh_sport, ud->uh_dport,
IPPROTO_UDP, 1);
if (lnk != NULL) {
struct in_addr alias_address;
struct in_addr original_address;
u_short alias_port;
int accumulate;
int r = 0, error;
struct alias_data ad;
ad.lnk = lnk;
ad.oaddr = &original_address;
ad.aaddr = &alias_address;
ad.aport = &alias_port;
ad.sport = &ud->uh_sport;
ad.dport = &ud->uh_dport;
ad.maxpktsize = 0;
alias_address = GetAliasAddress(lnk);
original_address = GetOriginalAddress(lnk);
alias_port = ud->uh_dport;
ud->uh_dport = GetOriginalPort(lnk);
/* Walk out chain. */
error = find_handler(IN, UDP, la, pip, &ad);
/* If UDP checksum is not zero, then adjust since destination port */
/* is being unaliased and destination address is being altered. */
if (ud->uh_sum != 0) {
accumulate = alias_port;
accumulate -= ud->uh_dport;
accumulate += twowords(&alias_address);
accumulate -= twowords(&original_address);
ADJUST_CHECKSUM(accumulate, ud->uh_sum);
}
/* Restore original IP address */
DifferentialChecksum(&pip->ip_sum,
&original_address, &pip->ip_dst, 2);
pip->ip_dst = original_address;
/*
* If we cannot figure out the packet, ignore it.
*/
if (r < 0)
return (PKT_ALIAS_IGNORED);
else
return (PKT_ALIAS_OK);
}
return (PKT_ALIAS_IGNORED);
}
