src/ip/Intercept.h

   1 /*
   2  * DEBUG: section 89    NAT / IP Interception
   3  * AUTHOR: Robert Collins
   4  * AUTHOR: Amos Jeffries
   5  *
   6  */
   7 #ifndef SQUID_IP_IPINTERCEPT_H
   8 #define SQUID_IP_IPINTERCEPT_H
   9
  10 /* for time_t */
  11 #include "SquidTime.h"
  12
  13 namespace Ip
  14 {
  15
  16 class Address;
  17
  18 /**
  19  \defgroup IpInterceptAPI IP Interception and Transparent Proxy API
  20  \ingroup SquidComponent
  21  \par
  22  * There is no formal state-machine for transparency and interception
  23  * instead there is this neutral API which other connection state machines
  24  * and the comm layer use to co-ordinate their own state for transparency.
  25  */
  26 class Intercept
  27 {
  28 public:
  29     Intercept() : transparent_active(0), intercept_active(0), last_reported(0) {};
  30     ~Intercept() {};
  31
  32     /** Perform NAT lookups */
  33     int NatLookup(int fd, const Address &me, const Address &peer, Address &client, Address &dst);
  34
  35     /**
  36      * Test system networking calls for TPROXY support.
  37      * Detects IPv6 and IPv4 level of support matches the address being listened on
  38      * and if the compiled v2/v4 is usable as far down as a bind()ing.
  39      *
  40      * \param test    Address set on the http(s)_port being checked.
  41      * \retval true   TPROXY is available.
  42      * \retval false  TPROXY is not available.
  43      */
  44     bool ProbeForTproxy(Address &test);
  45
  46     /**
  47      \retval 0  Full transparency is disabled.
  48      \retval 1  Full transparency is enabled and active.
  49      */
  50     inline int TransparentActive() { return transparent_active; };
  51
  52     /** \par
  53      * Turn on fully Transparent-Proxy activities.
  54      * This function should be called during parsing of the squid.conf
  55      * When any option requiring full-transparency is encountered.
  56      */
  57     inline void StartTransparency() { transparent_active=1; };
  58
  59     /** \par
  60      * Turn off fully Transparent-Proxy activities on all new connections.
  61      * Existing transactions and connections are unaffected and will run
  62      * to their natural completion.
  63      \param str    Reason for stopping. Will be logged to cache.log
  64      */
  65     void StopTransparency(const char *str);
  66
  67     /**
  68      \retval 0  IP Interception is disabled.
  69      \retval 1  IP Interception is enabled and active.
  70      */
  71     inline int InterceptActive() { return intercept_active; };
  72
  73     /** \par
  74      * Turn on IP-Interception-Proxy activities.
  75      * This function should be called during parsing of the squid.conf
  76      * When any option requiring interception / NAT handling is encountered.
  77      */
  78     inline void StartInterception() { intercept_active=1; };
  79
  80     /** \par
  81      * Turn off IP-Interception-Proxy activities on all new connections.
  82      * Existing transactions and connections are unaffected and will run
  83      * to their natural completion.
  84      \param str    Reason for stopping. Will be logged to cache.log
  85      */
  86     inline void StopInterception(const char *str);
  87
  88
  89 private:
  90
  91     /**
  92      * perform Lookups on Netfilter interception targets (REDIRECT, DNAT).
  93      *
  94      \param silent   0 if errors are to be displayed. 1 if errors are to be hidden.
  95      \param fd       FD for the current TCP connection being tested.
  96      \param me       IP address Squid received the connection on
  97      \param client   IP address from which Squid received the connection.
  98      *               May be updated by the NAT table information.
  99      *               Default is the same value as the me IP address.
 100      \retval 0     Successfuly located the new address.
 101      \retval -1    An error occured during NAT lookups.
 102      */
 103     int NetfilterInterception(int fd, const Address &me, Address &client, int silent);
 104
 105     /**
 106      * perform Lookups on Netfilter fully-transparent interception targets (TPROXY).
 107      *
 108      \param silent   0 if errors are to be displayed. 1 if errors are to be hidden.
 109      \param fd       FD for the current TCP connection being tested.
 110      \param me       IP address Squid received the connection on
 111      \param dst      IP address to which the request was made.
 112      *               expected to be updated from the NAT table information.
 113      *               Default is the same value as the peer IP address sent to NatLookup().
 114      \retval 0     Successfuly located the new address.
 115      \retval -1    An error occured during NAT lookups.
 116      */
 117     int NetfilterTransparent(int fd, const Address &me, Address &dst, int silent);
 118
 119     /**
 120      * perform Lookups on IPFW interception.
 121      *
 122      \param silent   0 if errors are to be displayed. 1 if errors are to be hidden.
 123      \param fd       FD for the current TCP connection being tested.
 124      \param me       IP address Squid received the connection on
 125      \param client   IP address from which Squid received the connection.
 126      *               May be updated by the NAT table information.
 127      *               Default is the same value as the me IP address.
 128      \retval 0     Successfuly located the new address.
 129      \retval -1    An error occured during NAT lookups.
 130      */
 131     int IpfwInterception(int fd, const Address &me, Address &client, int silent);
 132
 133     /**
 134      * perform Lookups on IPF interception.
 135      *
 136      \param silent   0 if errors are to be displayed. 1 if errors are to be hidden.
 137      \param fd       FD for the current TCP connection being tested.
 138      \param me       IP address Squid received the connection on
 139      \param client   IP address from which Squid received the connection.
 140      *               May be updated by the NAT table information.
 141      *               Default is the same value as the me IP address.
 142      \param dst      IP address to which the request was made.
 143      *               expected to be updated from the NAT table information.
 144      *               Default is the same value as the peer IP address sent to NatLookup().
 145      \retval 0     Successfuly located the new address.
 146      \retval -1    An error occured during NAT lookups.
 147      */
 148     int IpfInterception(int fd, const Address &me, Address &client, Address &dst, int silent);
 149
 150     /**
 151      * perform Lookups on PF interception.
 152      *
 153      \param silent   0 if errors are to be displayed. 1 if errors are to be hidden.
 154      \param fd       FD for the current TCP connection being tested.
 155      \param me       IP address Squid received the connection on
 156      \param client   IP address from which Squid received the connection.
 157      *               May be updated by the NAT table information.
 158      *               Default is the same value as the me IP address.
 159      \param dst      IP address to which the request was made.
 160      *               expected to be updated from the NAT table information.
 161      *               Default is the same value as the peer IP address sent to NatLookup().
 162      \retval 0     Successfuly located the new address.
 163      \retval -1    An error occured during NAT lookups.
 164      */
 165     int PfInterception(int fd, const Address &me, Address &client, Address &dst, int silent);
 166
 167
 168     int transparent_active;
 169     int intercept_active;
 170     time_t last_reported; /**< Time of last error report. Throttles NAT error display to 1 per minute */
 171 };
 172
 173 #if LINUX_NETFILTER && !defined(IP_TRANSPARENT)
 174 /// \ingroup IpInterceptAPI
 175 #define IP_TRANSPARENT 19
 176 #endif
 177
 178 /**
 179  \ingroup IpInterceptAPI
 180  * Globally available instance of the IP Interception manager.
 181  */
 182 extern Intercept Interceptor;
 183
 184 }; // namespace Ip
 185
 186 #endif /* SQUID_IP_IPINTERCEPT_H */