src/ip/Intercept.cc

   1 /*
   2  * DEBUG: section 89    NAT / IP Interception
   3  * AUTHOR: Robert Collins
   4  * AUTHOR: Amos Jeffries
   5  *
   6  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   7  * ----------------------------------------------------------
   8  *
   9  *  Squid is the result of efforts by numerous individuals from
  10  *  the Internet community; see the CONTRIBUTORS file for full
  11  *  details.   Many organizations have provided support for Squid's
  12  *  development; see the SPONSORS file for full details.  Squid is
  13  *  Copyrighted (C) 2001 by the Regents of the University of
  14  *  California; see the COPYRIGHT file for full details.  Squid
  15  *  incorporates software developed and/or copyrighted by other
  16  *  sources; see the CREDITS file for full details.
  17  *
  18  *  This program is free software; you can redistribute it and/or modify
  19  *  it under the terms of the GNU General Public License as published by
  20  *  the Free Software Foundation; either version 2 of the License, or
  21  *  (at your option) any later version.
  22  *
  23  *  This program is distributed in the hope that it will be useful,
  24  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  25  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26  *  GNU General Public License for more details.
  27  *
  28  *  You should have received a copy of the GNU General Public License
  29  *  along with this program; if not, write to the Free Software
  30  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  31  *
  32  */
  33 #include "config.h"
  34 #include "comm/Connection.h"
  35 #include "ip/Intercept.h"
  36 #include "fde.h"
  37
  38 #if IPF_TRANSPARENT
  39
  40 #if HAVE_SYS_IOCTL_H
  41 #include <sys/ioctl.h>
  42 #endif
  43 #if HAVE_NETINET_TCP_H
  44 #include <netinet/tcp.h>
  45 #endif
  46 #if HAVE_NET_IF_H
  47 #include <net/if.h>
  48 #endif
  49 #if HAVE_IPL_H
  50 #include <ipl.h>
  51 #elif HAVE_NETINET_IPL_H
  52 #include <netinet/ipl.h>
  53 #endif
  54 #if HAVE_IP_FIL_COMPAT_H
  55 #include <ip_fil_compat.h>
  56 #elif HAVE_NETINET_IP_FIL_COMPAT_H
  57 #include <netinet/ip_fil_compat.h>
  58 #elif HAVE_IP_COMPAT_H
  59 #include <ip_compat.h>
  60 #elif HAVE_NETINET_IP_COMPAT_H
  61 #include <netinet/ip_compat.h>
  62 #endif
  63 #if HAVE_IP_FIL_H
  64 #include <ip_fil.h>
  65 #elif HAVE_NETINET_IP_FIL_H
  66 #include <netinet/ip_fil.h>
  67 #endif
  68 #if HAVE_IP_NAT_H
  69 #include <ip_nat.h>
  70 #elif HAVE_NETINET_IP_NAT_H
  71 #include <netinet/ip_nat.h>
  72 #endif
  73
  74 #endif /* IPF_TRANSPARENT required headers */
  75
  76 #if PF_TRANSPARENT
  77 #include <sys/socket.h>
  78 #include <sys/ioctl.h>
  79 #include <sys/fcntl.h>
  80 #include <net/if.h>
  81 #include <netinet/in.h>
  82 #if HAVE_NET_PF_PFVAR_H
  83 #include <net/pf/pfvar.h>
  84 #endif /* HAVE_NET_PF_PFVAR_H */
  85 #if HAVE_NET_PFVAR_H
  86 #include <net/pfvar.h>
  87 #endif /* HAVE_NET_PFVAR_H */
  88 #endif /* PF_TRANSPARENT required headers */
  89
  90 #if LINUX_NETFILTER
  91 #include <linux/netfilter_ipv4.h>
  92 #endif
  93
  94 // single global instance for access by other components.
  95 Ip::Intercept Ip::Interceptor;
  96
  97 void
  98 Ip::Intercept::StopTransparency(const char *str)
  99 {
 100     if (transparentActive_) {
 101         debugs(89, DBG_IMPORTANT, "Stopping full transparency: " << str);
 102         transparentActive_ = 0;
 103     }
 104 }
 105
 106 void
 107 Ip::Intercept::StopInterception(const char *str)
 108 {
 109     if (interceptActive_) {
 110         debugs(89, DBG_IMPORTANT, "Stopping IP interception: " << str);
 111         interceptActive_ = 0;
 112     }
 113 }
 114
 115 bool
 116 Ip::Intercept::NetfilterInterception(const Comm::ConnectionPointer &newConn, int silent)
 117 {
 118 #if LINUX_NETFILTER
 119     struct sockaddr_in lookup;
 120     socklen_t len = sizeof(struct sockaddr_in);
 121     newConn->local.GetSockAddr(lookup);
 122
 123     /** \par
 124      * Try NAT lookup for REDIRECT or DNAT targets. */
 125     if ( getsockopt(newConn->fd, IPPROTO_IP, SO_ORIGINAL_DST, &lookup, &len) != 0) {
 126         if (!silent) {
 127             debugs(89, DBG_IMPORTANT, HERE << " NF getsockopt(SO_ORIGINAL_DST) failed on " << newConn << ": " << xstrerror());
 128             lastReported_ = squid_curtime;
 129         }
 130         debugs(89, 9, HERE << "address: " << newConn);
 131         return false;
 132     } else {
 133         newConn->local = lookup;
 134         debugs(89, 5, HERE << "address NAT: " << newConn);
 135         return true;
 136     }
 137 #endif
 138     return false;
 139 }
 140
 141 bool
 142 Ip::Intercept::NetfilterTransparent(const Comm::ConnectionPointer &newConn, int silent)
 143 {
 144 #if LINUX_NETFILTER
 145     /* Trust the user configured properly. If not no harm done.
 146      * We will simply attempt a bind outgoing on our own IP.
 147      */
 148     newConn->remote.SetPort(0); // allow random outgoing port to prevent address clashes
 149     debugs(89, 5, HERE << "address TPROXY: " << newConn);
 150     return true;
 151 #else
 152     return false;
 153 #endif
 154 }
 155
 156 bool
 157 Ip::Intercept::IpfwInterception(const Comm::ConnectionPointer &newConn, int silent)
 158 {
 159 #if IPFW_TRANSPARENT
 160     struct sockaddr_storage lookup;
 161     socklen_t len = sizeof(struct sockaddr_storage);
 162     newConn->local.GetSockAddr(lookup, AF_INET);
 163
 164     /** \par
 165      * Try lookup for IPFW interception. */
 166     if ( getsockname(newConn->fd, (struct sockaddr*)&lookup, &len) != 0 ) {
 167         if ( !silent ) {
 168             debugs(89, DBG_IMPORTANT, HERE << " IPFW getsockname(...) failed: " << xstrerror());
 169             lastReported_ = squid_curtime;
 170         }
 171         debugs(89, 9, HERE << "address: " << newConn);
 172         return false;
 173     } else {
 174         newConn->local = lookup;
 175         debugs(89, 5, HERE << "address NAT: " << newConn);
 176         return true;
 177     }
 178 #endif
 179     return false;
 180 }
 181
 182 bool
 183 Ip::Intercept::IpfInterception(const Comm::ConnectionPointer &newConn, int silent)
 184 {
 185 #if IPF_TRANSPARENT  /* --enable-ipf-transparent */
 186
 187     struct natlookup natLookup;
 188     static int natfd = -1;
 189     int x;
 190
 191     // all fields must be set to 0
 192     memset(natLookup, 0, sizeof(natLookup));
 193     // for NAT lookup set local and remote IP:port's
 194     natLookup.nl_inport = htons(newConn->local.GetPort());
 195     newConn->local.GetInAddr(natLookup.nl_inip);
 196     natLookup.nl_outport = htons(newConn->remote.GetPort());
 197     newConn->remote.GetInAddr(natLookup.nl_outip);
 198     // ... and the TCP flag
 199     natLookup.nl_flags = IPN_TCP;
 200
 201     if (natfd < 0) {
 202         int save_errno;
 203         enter_suid();
 204 #ifdef IPNAT_NAME
 205         natfd = open(IPNAT_NAME, O_RDONLY, 0);
 206 #else
 207         natfd = open(IPL_NAT, O_RDONLY, 0);
 208 #endif
 209         save_errno = errno;
 210         leave_suid();
 211         errno = save_errno;
 212     }
 213
 214     if (natfd < 0) {
 215         if (!silent) {
 216             debugs(89, DBG_IMPORTANT, "IPF (IPFilter) NAT open failed: " << xstrerror());
 217             lastReported_ = squid_curtime;
 218             return false;
 219         }
 220     }
 221
 222 #if defined(IPFILTER_VERSION) && (IPFILTER_VERSION >= 4000027)
 223     struct ipfobj obj;
 224     memset(&obj, 0, sizeof(obj));
 225     obj.ipfo_rev = IPFILTER_VERSION;
 226     obj.ipfo_size = sizeof(natLookup);
 227     obj.ipfo_ptr = &natLookup;
 228     obj.ipfo_type = IPFOBJ_NATLOOKUP;
 229
 230     x = ioctl(natfd, SIOCGNATL, &obj);
 231 #else
 232     /*
 233     * IP-Filter changed the type for SIOCGNATL between
 234     * 3.3 and 3.4.  It also changed the cmd value for
 235     * SIOCGNATL, so at least we can detect it.  We could
 236     * put something in configure and use ifdefs here, but
 237     * this seems simpler.
 238     */
 239     static int siocgnatl_cmd = SIOCGNATL & 0xff;
 240     if (63 == siocgnatl_cmd) {
 241         struct natlookup *nlp = &natLookup;
 242         x = ioctl(natfd, SIOCGNATL, &nlp);
 243     } else {
 244         x = ioctl(natfd, SIOCGNATL, &natLookup);
 245     }
 246
 247 #endif
 248     if (x < 0) {
 249         if (errno != ESRCH) {
 250             if (!silent) {
 251                 debugs(89, DBG_IMPORTANT, "IPF (IPFilter) NAT lookup failed: ioctl(SIOCGNATL) (v=" << IPFILTER_VERSION << "): " << xstrerror());
 252                 lastReported_ = squid_curtime;
 253             }
 254
 255             close(natfd);
 256             natfd = -1;
 257         }
 258
 259         debugs(89, 9, HERE << "address: " << newConn);
 260         return false;
 261     } else {
 262         newConn->local = natLookup.nl_realip;
 263         newConn->local.SetPort(ntohs(natLookup.nl_realport));
 264         debugs(89, 5, HERE << "address NAT: " << newConn);
 265         return true;
 266     }
 267
 268 #endif /* --enable-ipf-transparent */
 269     return false;
 270 }
 271
 272 bool
 273 Ip::Intercept::PfInterception(const Comm::ConnectionPointer &newConn, int silent)
 274 {
 275 #if PF_TRANSPARENT  /* --enable-pf-transparent */
 276
 277     struct pfioc_natlook nl;
 278     static int pffd = -1;
 279
 280     if (pffd < 0)
 281         pffd = open("/dev/pf", O_RDONLY);
 282
 283     if (pffd < 0) {
 284         if (!silent) {
 285             debugs(89, DBG_IMPORTANT, HERE << "PF open failed: " << xstrerror());
 286             lastReported_ = squid_curtime;
 287         }
 288         return false;
 289     }
 290
 291     memset(&nl, 0, sizeof(struct pfioc_natlook));
 292     newConn->remote.GetInAddr(nl.saddr.v4);
 293     nl.sport = htons(newConn->remote.GetPort());
 294
 295     newConn->local.GetInAddr(nl.daddr.v4);
 296     nl.dport = htons(newConn->local.GetPort());
 297
 298     nl.af = AF_INET;
 299     nl.proto = IPPROTO_TCP;
 300     nl.direction = PF_OUT;
 301
 302     if (ioctl(pffd, DIOCNATLOOK, &nl)) {
 303         if (errno != ENOENT) {
 304             if (!silent) {
 305                 debugs(89, DBG_IMPORTANT, HERE << "PF lookup failed: ioctl(DIOCNATLOOK)");
 306                 lastReported_ = squid_curtime;
 307             }
 308             close(pffd);
 309             pffd = -1;
 310         }
 311         debugs(89, 9, HERE << "address: " << newConn);
 312         return false;
 313     } else {
 314         newConn->local = nl.rdaddr.v4;
 315         newConn->local.SetPort(ntohs(nl.rdport));
 316         debugs(89, 5, HERE << "address NAT: " << newConn);
 317         return true;
 318     }
 319
 320 #endif /* --enable-pf-transparent */
 321     return false;
 322 }
 323
 324 bool
 325 Ip::Intercept::Lookup(const Comm::ConnectionPointer &newConn, const Comm::ConnectionPointer &listenConn)
 326 {
 327     /* --enable-linux-netfilter    */
 328     /* --enable-ipfw-transparent   */
 329     /* --enable-ipf-transparent    */
 330     /* --enable-pf-transparent     */
 331 #if IPF_TRANSPARENT || LINUX_NETFILTER || IPFW_TRANSPARENT || PF_TRANSPARENT
 332
 333 #if 0
 334     // Crop interception errors down to one per minute.
 335     int silent = (squid_curtime - lastReported_ > 60 ? 0 : 1);
 336 #else
 337     // Show all interception errors.
 338     int silent = 0;
 339 #endif
 340
 341     debugs(89, 5, HERE << "address BEGIN: me/client= " << newConn->local << ", destination/me= " << newConn->remote);
 342
 343     newConn->flags |= (listenConn->flags & (COMM_TRANSPARENT|COMM_INTERCEPTION));
 344
 345     /* NP: try TPROXY first, its much quieter than NAT when non-matching */
 346     if (transparentActive_ && listenConn->flags&COMM_TRANSPARENT) {
 347         if (NetfilterTransparent(newConn, silent)) return true;
 348     }
 349
 350     /* NAT is only available in IPv4 */
 351     if ( !newConn->local.IsIPv4()  ) return false;
 352     if ( !newConn->remote.IsIPv4() ) return false;
 353
 354     if (interceptActive_ && listenConn->flags&COMM_INTERCEPTION) {
 355         /* NAT methods that use sock-opts to return client address */
 356         if (NetfilterInterception(newConn, silent)) return true;
 357         if (IpfwInterception(newConn, silent)) return true;
 358
 359         /* NAT methods that use ioctl to return client address AND destination address */
 360         if (PfInterception(newConn, silent)) return true;
 361         if (IpfInterception(newConn, silent)) return true;
 362     }
 363
 364 #else /* none of the transparent options configured */
 365     debugs(89, DBG_IMPORTANT, "WARNING: transparent proxying not supported");
 366 #endif
 367
 368     return false;
 369 }
 370
 371 bool
 372 Ip::Intercept::ProbeForTproxy(Ip::Address &test)
 373 {
 374     debugs(3, 3, "Detect TPROXY support on port " << test);
 375
 376 #if defined(IP_TRANSPARENT)
 377
 378     int tos = 1;
 379     int tmp_sock = -1;
 380
 381     /* Probe to see if the Kernel TPROXY support is IPv6-enabled */
 382     if (test.IsIPv6()) {
 383         debugs(3, 3, "...Probing for IPv6 TPROXY support.");
 384
 385         struct sockaddr_in6 tmp_ip6;
 386         Ip::Address tmp = "::2";
 387         tmp.SetPort(0);
 388         tmp.GetSockAddr(tmp_ip6);
 389
 390         if ( (tmp_sock = socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP)) >= 0 &&
 391                 setsockopt(tmp_sock, SOL_IP, IP_TRANSPARENT, (char *)&tos, sizeof(int)) == 0 &&
 392                 bind(tmp_sock, (struct sockaddr*)&tmp_ip6, sizeof(struct sockaddr_in6)) == 0 ) {
 393
 394             debugs(3, 3, "IPv6 TPROXY support detected. Using.");
 395             close(tmp_sock);
 396             return true;
 397         }
 398         if (tmp_sock >= 0) {
 399             close(tmp_sock);
 400             tmp_sock = -1;
 401         }
 402     }
 403
 404     if ( test.IsIPv6() && !test.SetIPv4() ) {
 405         debugs(3, DBG_CRITICAL, "TPROXY lacks IPv6 support for " << test );
 406         return false;
 407     }
 408
 409     /* Probe to see if the Kernel TPROXY support is IPv4-enabled (aka present) */
 410     if (test.IsIPv4()) {
 411         debugs(3, 3, "...Probing for IPv4 TPROXY support.");
 412
 413         struct sockaddr_in tmp_ip4;
 414         Ip::Address tmp = "127.0.0.2";
 415         tmp.SetPort(0);
 416         tmp.GetSockAddr(tmp_ip4);
 417
 418         if ( (tmp_sock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) >= 0 &&
 419                 setsockopt(tmp_sock, SOL_IP, IP_TRANSPARENT, (char *)&tos, sizeof(int)) == 0 &&
 420                 bind(tmp_sock, (struct sockaddr*)&tmp_ip4, sizeof(struct sockaddr_in)) == 0 ) {
 421
 422             debugs(3, 3, "IPv4 TPROXY support detected. Using.");
 423             close(tmp_sock);
 424             return true;
 425         }
 426         if (tmp_sock >= 0) {
 427             close(tmp_sock);
 428         }
 429     }
 430
 431 #else /* undefined IP_TRANSPARENT */
 432     debugs(3, 3, "setsockopt(IP_TRANSPARENT) not supported on this platform. Disabling TPROXYv4.");
 433 #endif
 434     return false;
 435 }