1 /*
2 * Copyright (C) 2012 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 *
6 * $Id: ip_dns_pxy.c,v 1.1.2.10 2012/07/22 08:04:23 darren_r Exp $
7 */
8
9 #define IPF_DNS_PROXY
10
11 /*
12 * map ... proxy port dns/udp 53 { block .cnn.com; }
13 */
14 typedef struct ipf_dns_filter {
15 struct ipf_dns_filter *idns_next;
16 char *idns_name;
17 int idns_namelen;
18 int idns_pass;
19 } ipf_dns_filter_t;
20
21
22 typedef struct ipf_dns_softc_s {
23 ipf_dns_filter_t *ipf_p_dns_list;
24 ipfrwlock_t ipf_p_dns_rwlock;
25 u_long ipf_p_dns_compress;
26 u_long ipf_p_dns_toolong;
27 u_long ipf_p_dns_nospace;
28 } ipf_dns_softc_t;
29
30 int ipf_p_dns_allow_query __P((ipf_dns_softc_t *, dnsinfo_t *));
31 int ipf_p_dns_ctl __P((ipf_main_softc_t *, void *, ap_ctl_t *));
32 void ipf_p_dns_del __P((ipf_main_softc_t *, ap_session_t *));
33 int ipf_p_dns_get_name __P((ipf_dns_softc_t *, char *, int, char *, int));
34 int ipf_p_dns_inout __P((void *, fr_info_t *, ap_session_t *, nat_t *));
35 int ipf_p_dns_match __P((fr_info_t *, ap_session_t *, nat_t *));
36 int ipf_p_dns_match_names __P((ipf_dns_filter_t *, char *, int));
37 int ipf_p_dns_new __P((void *, fr_info_t *, ap_session_t *, nat_t *));
38 void *ipf_p_dns_soft_create __P((ipf_main_softc_t *));
39 void ipf_p_dns_soft_destroy __P((ipf_main_softc_t *, void *));
40
41 typedef struct {
42 u_char dns_id[2];
43 u_short dns_ctlword;
44 u_short dns_qdcount;
45 u_short dns_ancount;
46 u_short dns_nscount;
47 u_short dns_arcount;
48 } ipf_dns_hdr_t;
49
50 #define DNS_QR(x) ((ntohs(x) & 0x8000) >> 15)
51 #define DNS_OPCODE(x) ((ntohs(x) & 0x7800) >> 11)
52 #define DNS_AA(x) ((ntohs(x) & 0x0400) >> 10)
53 #define DNS_TC(x) ((ntohs(x) & 0x0200) >> 9)
54 #define DNS_RD(x) ((ntohs(x) & 0x0100) >> 8)
55 #define DNS_RA(x) ((ntohs(x) & 0x0080) >> 7)
56 #define DNS_Z(x) ((ntohs(x) & 0x0070) >> 4)
57 #define DNS_RCODE(x) ((ntohs(x) & 0x000f) >> 0)
58
59
60 void *
ipf_p_dns_soft_create(softc)61 ipf_p_dns_soft_create(softc)
62 ipf_main_softc_t *softc;
63 {
64 ipf_dns_softc_t *softd;
65
66 KMALLOC(softd, ipf_dns_softc_t *);
67 if (softd == NULL)
68 return NULL;
69
70 bzero((char *)softd, sizeof(*softd));
71 RWLOCK_INIT(&softd->ipf_p_dns_rwlock, "ipf dns rwlock");
72
73 return softd;
74 }
75
76
77 void
ipf_p_dns_soft_destroy(softc,arg)78 ipf_p_dns_soft_destroy(softc, arg)
79 ipf_main_softc_t *softc;
80 void *arg;
81 {
82 ipf_dns_softc_t *softd = arg;
83 ipf_dns_filter_t *idns;
84
85 while ((idns = softd->ipf_p_dns_list) != NULL) {
86 KFREES(idns->idns_name, idns->idns_namelen);
87 idns->idns_name = NULL;
88 idns->idns_namelen = 0;
89 softd->ipf_p_dns_list = idns->idns_next;
90 KFREE(idns);
91 }
92 RW_DESTROY(&softd->ipf_p_dns_rwlock);
93
94 KFREE(softd);
95 }
96
97
98 int
ipf_p_dns_ctl(softc,arg,ctl)99 ipf_p_dns_ctl(softc, arg, ctl)
100 ipf_main_softc_t *softc;
101 void *arg;
102 ap_ctl_t *ctl;
103 {
104 ipf_dns_softc_t *softd = arg;
105 ipf_dns_filter_t *tmp, *idns, **idnsp;
106 int error = 0;
107
108 /*
109 * To make locking easier.
110 */
111 KMALLOC(tmp, ipf_dns_filter_t *);
112
113 WRITE_ENTER(&softd->ipf_p_dns_rwlock);
114 for (idnsp = &softd->ipf_p_dns_list; (idns = *idnsp) != NULL;
115 idnsp = &idns->idns_next) {
116 if (idns->idns_namelen != ctl->apc_dsize)
117 continue;
118 if (!strncmp(ctl->apc_data, idns->idns_name,
119 idns->idns_namelen))
120 break;
121 }
122
123 switch (ctl->apc_cmd)
124 {
125 case APC_CMD_DEL :
126 if (idns == NULL) {
127 IPFERROR(80006);
128 error = ESRCH;
129 break;
130 }
131 *idnsp = idns->idns_next;
132 idns->idns_next = NULL;
133 KFREES(idns->idns_name, idns->idns_namelen);
134 idns->idns_name = NULL;
135 idns->idns_namelen = 0;
136 KFREE(idns);
137 break;
138 case APC_CMD_ADD :
139 if (idns != NULL) {
140 IPFERROR(80007);
141 error = EEXIST;
142 break;
143 }
144 if (tmp == NULL) {
145 IPFERROR(80008);
146 error = ENOMEM;
147 break;
148 }
149 idns = tmp;
150 tmp = NULL;
151 idns->idns_namelen = ctl->apc_dsize;
152 idns->idns_name = ctl->apc_data;
153 idns->idns_pass = ctl->apc_arg;
154 idns->idns_next = NULL;
155 *idnsp = idns;
156 ctl->apc_data = NULL;
157 ctl->apc_dsize = 0;
158 break;
159 default :
160 IPFERROR(80009);
161 error = EINVAL;
162 break;
163 }
164 RWLOCK_EXIT(&softd->ipf_p_dns_rwlock);
165
166 if (tmp != NULL) {
167 KFREE(tmp);
168 tmp = NULL;
169 }
170
171 return error;
172 }
173
174
175 /* ARGSUSED */
176 int
ipf_p_dns_new(arg,fin,aps,nat)177 ipf_p_dns_new(arg, fin, aps, nat)
178 void *arg;
179 fr_info_t *fin;
180 ap_session_t *aps;
181 nat_t *nat;
182 {
183 dnsinfo_t *di;
184 int dlen;
185
186 if (fin->fin_v != 4)
187 return -1;
188
189 dlen = fin->fin_dlen - sizeof(udphdr_t);
190 if (dlen < sizeof(ipf_dns_hdr_t)) {
191 /*
192 * No real DNS packet is smaller than that.
193 */
194 return -1;
195 }
196
197 aps->aps_psiz = sizeof(dnsinfo_t);
198 KMALLOCS(di, dnsinfo_t *, sizeof(dnsinfo_t));
199 if (di == NULL) {
200 printf("ipf_dns_new:KMALLOCS(%d) failed\n", sizeof(*di));
201 return -1;
202 }
203
204 MUTEX_INIT(&di->dnsi_lock, "dns lock");
205
206 aps->aps_data = di;
207
208 dlen = fin->fin_dlen - sizeof(udphdr_t);
209 COPYDATA(fin->fin_m, fin->fin_hlen + sizeof(udphdr_t),
210 MIN(dlen, sizeof(di->dnsi_buffer)), di->dnsi_buffer);
211 di->dnsi_id = (di->dnsi_buffer[0] << 8) | di->dnsi_buffer[1];
212 return 0;
213 }
214
215
216 /* ARGSUSED */
217 void
ipf_p_dns_del(softc,aps)218 ipf_p_dns_del(softc, aps)
219 ipf_main_softc_t *softc;
220 ap_session_t *aps;
221 {
222 #ifdef USE_MUTEXES
223 dnsinfo_t *di = aps->aps_data;
224
225 MUTEX_DESTROY(&di->dnsi_lock);
226 #endif
227 KFREES(aps->aps_data, aps->aps_psiz);
228 aps->aps_data = NULL;
229 aps->aps_psiz = 0;
230 }
231
232
233 /*
234 * Tries to match the base string (in our ACL) with the query from a packet.
235 */
236 int
ipf_p_dns_match_names(idns,query,qlen)237 ipf_p_dns_match_names(idns, query, qlen)
238 ipf_dns_filter_t *idns;
239 char *query;
240 int qlen;
241 {
242 int blen;
243 char *base;
244
245 blen = idns->idns_namelen;
246 base = idns->idns_name;
247
248 if (blen > qlen)
249 return 1;
250
251 if (blen == qlen)
252 return strncasecmp(base, query, qlen);
253
254 /*
255 * If the base string string is shorter than the query, allow the
256 * tail of the base to match the same length tail of the query *if*:
257 * - the base string starts with a '*' (*cnn.com)
258 * - the base string represents a domain (.cnn.com)
259 * as otherwise it would not be possible to block just "cnn.com"
260 * without also impacting "foocnn.com", etc.
261 */
262 if (*base == '*') {
263 base++;
264 blen--;
265 } else if (*base != '.')
266 return 1;
267
268 return strncasecmp(base, query + qlen - blen, blen);
269 }
270
271
272 int
ipf_p_dns_get_name(softd,start,len,buffer,buflen)273 ipf_p_dns_get_name(softd, start, len, buffer, buflen)
274 ipf_dns_softc_t *softd;
275 char *start;
276 int len;
277 char *buffer;
278 int buflen;
279 {
280 char *s, *t, clen;
281 int slen, blen;
282
283 s = start;
284 t = buffer;
285 slen = len;
286 blen = buflen - 1; /* Always make room for trailing \0 */
287
288 while (*s != '\0') {
289 clen = *s;
290 if ((clen & 0xc0) == 0xc0) { /* Doesn't do compression */
291 softd->ipf_p_dns_compress++;
292 return 0;
293 }
294 if (clen > slen) {
295 softd->ipf_p_dns_toolong++;
296 return 0; /* Does the name run off the end? */
297 }
298 if ((clen + 1) > blen) {
299 softd->ipf_p_dns_nospace++;
300 return 0; /* Enough room for name+.? */
301 }
302 s++;
303 bcopy(s, t, clen);
304 t += clen;
305 s += clen;
306 *t++ = '.';
307 slen -= clen;
308 blen -= (clen + 1);
309 }
310
311 *(t - 1) = '\0';
312 return s - start;
313 }
314
315
316 int
ipf_p_dns_allow_query(softd,dnsi)317 ipf_p_dns_allow_query(softd, dnsi)
318 ipf_dns_softc_t *softd;
319 dnsinfo_t *dnsi;
320 {
321 ipf_dns_filter_t *idns;
322 int len;
323
324 len = strlen(dnsi->dnsi_buffer);
325
326 for (idns = softd->ipf_p_dns_list; idns != NULL; idns = idns->idns_next)
327 if (ipf_p_dns_match_names(idns, dnsi->dnsi_buffer, len) == 0)
328 return idns->idns_pass;
329 return 0;
330 }
331
332
333 /* ARGSUSED */
334 int
ipf_p_dns_inout(arg,fin,aps,nat)335 ipf_p_dns_inout(arg, fin, aps, nat)
336 void *arg;
337 fr_info_t *fin;
338 ap_session_t *aps;
339 nat_t *nat;
340 {
341 ipf_dns_softc_t *softd = arg;
342 ipf_dns_hdr_t *dns;
343 dnsinfo_t *di;
344 char *data;
345 int dlen, q, rc = 0;
346
347 if (fin->fin_dlen < sizeof(*dns))
348 return APR_ERR(1);
349
350 dns = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t));
351
352 q = dns->dns_qdcount;
353
354 data = (char *)(dns + 1);
355 dlen = fin->fin_dlen - sizeof(*dns) - sizeof(udphdr_t);
356
357 di = aps->aps_data;
358
359 READ_ENTER(&softd->ipf_p_dns_rwlock);
360 MUTEX_ENTER(&di->dnsi_lock);
361
362 for (; (dlen > 0) && (q > 0); q--) {
363 int len;
364
365 len = ipf_p_dns_get_name(softd, data, dlen, di->dnsi_buffer,
366 sizeof(di->dnsi_buffer));
367 if (len == 0) {
368 rc = 1;
369 break;
370 }
371 rc = ipf_p_dns_allow_query(softd, di);
372 if (rc != 0)
373 break;
374 data += len;
375 dlen -= len;
376 }
377 MUTEX_EXIT(&di->dnsi_lock);
378 RWLOCK_EXIT(&softd->ipf_p_dns_rwlock);
379
380 return APR_ERR(rc);
381 }
382
383
384 /* ARGSUSED */
385 int
ipf_p_dns_match(fin,aps,nat)386 ipf_p_dns_match(fin, aps, nat)
387 fr_info_t *fin;
388 ap_session_t *aps;
389 nat_t *nat;
390 {
391 dnsinfo_t *di = aps->aps_data;
392 ipf_dns_hdr_t *dnh;
393
394 if ((fin->fin_dlen < sizeof(u_short)) || (fin->fin_flx & FI_FRAG))
395 return -1;
396
397 dnh = (ipf_dns_hdr_t *)((char *)fin->fin_dp + sizeof(udphdr_t));
398 if (((dnh->dns_id[0] << 8) | dnh->dns_id[1]) != di->dnsi_id)
399 return -1;
400 return 0;
401 }
402