1 | /* SPDX-License-Identifier: BSD-3-Clause */ |
2 | /* |
3 | * Copyright (c) 1982, 1986, 1988, 1990, 1993 |
4 | * The Regents of the University of California. All rights reserved. |
5 | * |
6 | * Redistribution and use in source and binary forms, with or without |
7 | * modification, are permitted provided that the following conditions |
8 | * are met: |
9 | * 1. Redistributions of source code must retain the above copyright |
10 | * notice, this list of conditions and the following disclaimer. |
11 | * 2. Redistributions in binary form must reproduce the above copyright |
12 | * notice, this list of conditions and the following disclaimer in the |
13 | * documentation and/or other materials provided with the distribution. |
14 | * 3. Neither the name of the University nor the names of its contributors |
15 | * may be used to endorse or promote products derived from this software |
16 | * without specific prior written permission. |
17 | * |
18 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
19 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
23 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
24 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
25 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
26 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
27 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
28 | * SUCH DAMAGE. |
29 | * |
30 | * @(#)tcp_subr.c 8.1 (Berkeley) 6/10/93 |
31 | * tcp_subr.c,v 1.5 1994/10/08 22:39:58 phk Exp |
32 | */ |
33 | |
34 | /* |
35 | * Changes and additions relating to SLiRP |
36 | * Copyright (c) 1995 Danny Gasparovski. |
37 | */ |
38 | |
39 | #include "slirp.h" |
40 | |
41 | /* patchable/settable parameters for tcp */ |
42 | /* Don't do rfc1323 performance enhancements */ |
43 | #define TCP_DO_RFC1323 0 |
44 | |
45 | /* |
46 | * Tcp initialization |
47 | */ |
48 | void tcp_init(Slirp *slirp) |
49 | { |
50 | slirp->tcp_iss = 1; /* wrong */ |
51 | slirp->tcb.so_next = slirp->tcb.so_prev = &slirp->tcb; |
52 | slirp->tcp_last_so = &slirp->tcb; |
53 | } |
54 | |
55 | void tcp_cleanup(Slirp *slirp) |
56 | { |
57 | while (slirp->tcb.so_next != &slirp->tcb) { |
58 | tcp_close(sototcpcb(slirp->tcb.so_next)); |
59 | } |
60 | } |
61 | |
62 | /* |
63 | * Create template to be used to send tcp packets on a connection. |
64 | * Call after host entry created, fills |
65 | * in a skeletal tcp/ip header, minimizing the amount of work |
66 | * necessary when the connection is used. |
67 | */ |
68 | void tcp_template(struct tcpcb *tp) |
69 | { |
70 | struct socket *so = tp->t_socket; |
71 | register struct tcpiphdr *n = &tp->t_template; |
72 | |
73 | n->ti_mbuf = NULL; |
74 | memset(&n->ti, 0, sizeof(n->ti)); |
75 | n->ti_x0 = 0; |
76 | switch (so->so_ffamily) { |
77 | case AF_INET: |
78 | n->ti_pr = IPPROTO_TCP; |
79 | n->ti_len = htons(sizeof(struct tcphdr)); |
80 | n->ti_src = so->so_faddr; |
81 | n->ti_dst = so->so_laddr; |
82 | n->ti_sport = so->so_fport; |
83 | n->ti_dport = so->so_lport; |
84 | break; |
85 | |
86 | case AF_INET6: |
87 | n->ti_nh6 = IPPROTO_TCP; |
88 | n->ti_len = htons(sizeof(struct tcphdr)); |
89 | n->ti_src6 = so->so_faddr6; |
90 | n->ti_dst6 = so->so_laddr6; |
91 | n->ti_sport = so->so_fport6; |
92 | n->ti_dport = so->so_lport6; |
93 | break; |
94 | |
95 | default: |
96 | g_assert_not_reached(); |
97 | } |
98 | |
99 | n->ti_seq = 0; |
100 | n->ti_ack = 0; |
101 | n->ti_x2 = 0; |
102 | n->ti_off = 5; |
103 | n->ti_flags = 0; |
104 | n->ti_win = 0; |
105 | n->ti_sum = 0; |
106 | n->ti_urp = 0; |
107 | } |
108 | |
109 | /* |
110 | * Send a single message to the TCP at address specified by |
111 | * the given TCP/IP header. If m == 0, then we make a copy |
112 | * of the tcpiphdr at ti and send directly to the addressed host. |
113 | * This is used to force keep alive messages out using the TCP |
114 | * template for a connection tp->t_template. If flags are given |
115 | * then we send a message back to the TCP which originated the |
116 | * segment ti, and discard the mbuf containing it and any other |
117 | * attached mbufs. |
118 | * |
119 | * In any case the ack and sequence number of the transmitted |
120 | * segment are as specified by the parameters. |
121 | */ |
122 | void tcp_respond(struct tcpcb *tp, struct tcpiphdr *ti, struct mbuf *m, |
123 | tcp_seq ack, tcp_seq seq, int flags, unsigned short af) |
124 | { |
125 | register int tlen; |
126 | int win = 0; |
127 | |
128 | DEBUG_CALL("tcp_respond" ); |
129 | DEBUG_ARG("tp = %p" , tp); |
130 | DEBUG_ARG("ti = %p" , ti); |
131 | DEBUG_ARG("m = %p" , m); |
132 | DEBUG_ARG("ack = %u" , ack); |
133 | DEBUG_ARG("seq = %u" , seq); |
134 | DEBUG_ARG("flags = %x" , flags); |
135 | |
136 | if (tp) |
137 | win = sbspace(&tp->t_socket->so_rcv); |
138 | if (m == NULL) { |
139 | if (!tp || (m = m_get(tp->t_socket->slirp)) == NULL) |
140 | return; |
141 | tlen = 0; |
142 | m->m_data += IF_MAXLINKHDR; |
143 | *mtod(m, struct tcpiphdr *) = *ti; |
144 | ti = mtod(m, struct tcpiphdr *); |
145 | switch (af) { |
146 | case AF_INET: |
147 | ti->ti.ti_i4.ih_x1 = 0; |
148 | break; |
149 | case AF_INET6: |
150 | ti->ti.ti_i6.ih_x1 = 0; |
151 | break; |
152 | default: |
153 | g_assert_not_reached(); |
154 | } |
155 | flags = TH_ACK; |
156 | } else { |
157 | /* |
158 | * ti points into m so the next line is just making |
159 | * the mbuf point to ti |
160 | */ |
161 | m->m_data = (char *)ti; |
162 | |
163 | m->m_len = sizeof(struct tcpiphdr); |
164 | tlen = 0; |
165 | #define xchg(a, b, type) \ |
166 | { \ |
167 | type t; \ |
168 | t = a; \ |
169 | a = b; \ |
170 | b = t; \ |
171 | } |
172 | switch (af) { |
173 | case AF_INET: |
174 | xchg(ti->ti_dst.s_addr, ti->ti_src.s_addr, uint32_t); |
175 | xchg(ti->ti_dport, ti->ti_sport, uint16_t); |
176 | break; |
177 | case AF_INET6: |
178 | xchg(ti->ti_dst6, ti->ti_src6, struct in6_addr); |
179 | xchg(ti->ti_dport, ti->ti_sport, uint16_t); |
180 | break; |
181 | default: |
182 | g_assert_not_reached(); |
183 | } |
184 | #undef xchg |
185 | } |
186 | ti->ti_len = htons((uint16_t)(sizeof(struct tcphdr) + tlen)); |
187 | tlen += sizeof(struct tcpiphdr); |
188 | m->m_len = tlen; |
189 | |
190 | ti->ti_mbuf = NULL; |
191 | ti->ti_x0 = 0; |
192 | ti->ti_seq = htonl(seq); |
193 | ti->ti_ack = htonl(ack); |
194 | ti->ti_x2 = 0; |
195 | ti->ti_off = sizeof(struct tcphdr) >> 2; |
196 | ti->ti_flags = flags; |
197 | if (tp) |
198 | ti->ti_win = htons((uint16_t)(win >> tp->rcv_scale)); |
199 | else |
200 | ti->ti_win = htons((uint16_t)win); |
201 | ti->ti_urp = 0; |
202 | ti->ti_sum = 0; |
203 | ti->ti_sum = cksum(m, tlen); |
204 | |
205 | struct tcpiphdr tcpiph_save = *(mtod(m, struct tcpiphdr *)); |
206 | struct ip *ip; |
207 | struct ip6 *ip6; |
208 | |
209 | switch (af) { |
210 | case AF_INET: |
211 | m->m_data += |
212 | sizeof(struct tcpiphdr) - sizeof(struct tcphdr) - sizeof(struct ip); |
213 | m->m_len -= |
214 | sizeof(struct tcpiphdr) - sizeof(struct tcphdr) - sizeof(struct ip); |
215 | ip = mtod(m, struct ip *); |
216 | ip->ip_len = m->m_len; |
217 | ip->ip_dst = tcpiph_save.ti_dst; |
218 | ip->ip_src = tcpiph_save.ti_src; |
219 | ip->ip_p = tcpiph_save.ti_pr; |
220 | |
221 | if (flags & TH_RST) { |
222 | ip->ip_ttl = MAXTTL; |
223 | } else { |
224 | ip->ip_ttl = IPDEFTTL; |
225 | } |
226 | |
227 | ip_output(NULL, m); |
228 | break; |
229 | |
230 | case AF_INET6: |
231 | m->m_data += sizeof(struct tcpiphdr) - sizeof(struct tcphdr) - |
232 | sizeof(struct ip6); |
233 | m->m_len -= sizeof(struct tcpiphdr) - sizeof(struct tcphdr) - |
234 | sizeof(struct ip6); |
235 | ip6 = mtod(m, struct ip6 *); |
236 | ip6->ip_pl = tcpiph_save.ti_len; |
237 | ip6->ip_dst = tcpiph_save.ti_dst6; |
238 | ip6->ip_src = tcpiph_save.ti_src6; |
239 | ip6->ip_nh = tcpiph_save.ti_nh6; |
240 | |
241 | ip6_output(NULL, m, 0); |
242 | break; |
243 | |
244 | default: |
245 | g_assert_not_reached(); |
246 | } |
247 | } |
248 | |
249 | /* |
250 | * Create a new TCP control block, making an |
251 | * empty reassembly queue and hooking it to the argument |
252 | * protocol control block. |
253 | */ |
254 | struct tcpcb *tcp_newtcpcb(struct socket *so) |
255 | { |
256 | register struct tcpcb *tp; |
257 | |
258 | tp = (struct tcpcb *)malloc(sizeof(*tp)); |
259 | if (tp == NULL) |
260 | return ((struct tcpcb *)0); |
261 | |
262 | memset((char *)tp, 0, sizeof(struct tcpcb)); |
263 | tp->seg_next = tp->seg_prev = (struct tcpiphdr *)tp; |
264 | tp->t_maxseg = (so->so_ffamily == AF_INET) ? TCP_MSS : TCP6_MSS; |
265 | |
266 | tp->t_flags = TCP_DO_RFC1323 ? (TF_REQ_SCALE | TF_REQ_TSTMP) : 0; |
267 | tp->t_socket = so; |
268 | |
269 | /* |
270 | * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no |
271 | * rtt estimate. Set rttvar so that srtt + 2 * rttvar gives |
272 | * reasonable initial retransmit time. |
273 | */ |
274 | tp->t_srtt = TCPTV_SRTTBASE; |
275 | tp->t_rttvar = TCPTV_SRTTDFLT << 2; |
276 | tp->t_rttmin = TCPTV_MIN; |
277 | |
278 | TCPT_RANGESET(tp->t_rxtcur, |
279 | ((TCPTV_SRTTBASE >> 2) + (TCPTV_SRTTDFLT << 2)) >> 1, |
280 | TCPTV_MIN, TCPTV_REXMTMAX); |
281 | |
282 | tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT; |
283 | tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT; |
284 | tp->t_state = TCPS_CLOSED; |
285 | |
286 | so->so_tcpcb = tp; |
287 | |
288 | return (tp); |
289 | } |
290 | |
291 | /* |
292 | * Drop a TCP connection, reporting |
293 | * the specified error. If connection is synchronized, |
294 | * then send a RST to peer. |
295 | */ |
296 | struct tcpcb *tcp_drop(struct tcpcb *tp, int err) |
297 | { |
298 | DEBUG_CALL("tcp_drop" ); |
299 | DEBUG_ARG("tp = %p" , tp); |
300 | DEBUG_ARG("errno = %d" , errno); |
301 | |
302 | if (TCPS_HAVERCVDSYN(tp->t_state)) { |
303 | tp->t_state = TCPS_CLOSED; |
304 | (void)tcp_output(tp); |
305 | } |
306 | return (tcp_close(tp)); |
307 | } |
308 | |
309 | /* |
310 | * Close a TCP control block: |
311 | * discard all space held by the tcp |
312 | * discard internet protocol block |
313 | * wake up any sleepers |
314 | */ |
315 | struct tcpcb *tcp_close(struct tcpcb *tp) |
316 | { |
317 | register struct tcpiphdr *t; |
318 | struct socket *so = tp->t_socket; |
319 | Slirp *slirp = so->slirp; |
320 | register struct mbuf *m; |
321 | |
322 | DEBUG_CALL("tcp_close" ); |
323 | DEBUG_ARG("tp = %p" , tp); |
324 | |
325 | /* free the reassembly queue, if any */ |
326 | t = tcpfrag_list_first(tp); |
327 | while (!tcpfrag_list_end(t, tp)) { |
328 | t = tcpiphdr_next(t); |
329 | m = tcpiphdr_prev(t)->ti_mbuf; |
330 | remque(tcpiphdr2qlink(tcpiphdr_prev(t))); |
331 | m_free(m); |
332 | } |
333 | free(tp); |
334 | so->so_tcpcb = NULL; |
335 | /* clobber input socket cache if we're closing the cached connection */ |
336 | if (so == slirp->tcp_last_so) |
337 | slirp->tcp_last_so = &slirp->tcb; |
338 | so->slirp->cb->unregister_poll_fd(so->s, so->slirp->opaque); |
339 | closesocket(so->s); |
340 | sbfree(&so->so_rcv); |
341 | sbfree(&so->so_snd); |
342 | sofree(so); |
343 | return ((struct tcpcb *)0); |
344 | } |
345 | |
346 | /* |
347 | * TCP protocol interface to socket abstraction. |
348 | */ |
349 | |
350 | /* |
351 | * User issued close, and wish to trail through shutdown states: |
352 | * if never received SYN, just forget it. If got a SYN from peer, |
353 | * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN. |
354 | * If already got a FIN from peer, then almost done; go to LAST_ACK |
355 | * state. In all other cases, have already sent FIN to peer (e.g. |
356 | * after PRU_SHUTDOWN), and just have to play tedious game waiting |
357 | * for peer to send FIN or not respond to keep-alives, etc. |
358 | * We can let the user exit from the close as soon as the FIN is acked. |
359 | */ |
360 | void tcp_sockclosed(struct tcpcb *tp) |
361 | { |
362 | DEBUG_CALL("tcp_sockclosed" ); |
363 | DEBUG_ARG("tp = %p" , tp); |
364 | |
365 | if (!tp) { |
366 | return; |
367 | } |
368 | |
369 | switch (tp->t_state) { |
370 | case TCPS_CLOSED: |
371 | case TCPS_LISTEN: |
372 | case TCPS_SYN_SENT: |
373 | tp->t_state = TCPS_CLOSED; |
374 | tp = tcp_close(tp); |
375 | break; |
376 | |
377 | case TCPS_SYN_RECEIVED: |
378 | case TCPS_ESTABLISHED: |
379 | tp->t_state = TCPS_FIN_WAIT_1; |
380 | break; |
381 | |
382 | case TCPS_CLOSE_WAIT: |
383 | tp->t_state = TCPS_LAST_ACK; |
384 | break; |
385 | } |
386 | tcp_output(tp); |
387 | } |
388 | |
389 | /* |
390 | * Connect to a host on the Internet |
391 | * Called by tcp_input |
392 | * Only do a connect, the tcp fields will be set in tcp_input |
393 | * return 0 if there's a result of the connect, |
394 | * else return -1 means we're still connecting |
395 | * The return value is almost always -1 since the socket is |
396 | * nonblocking. Connect returns after the SYN is sent, and does |
397 | * not wait for ACK+SYN. |
398 | */ |
399 | int tcp_fconnect(struct socket *so, unsigned short af) |
400 | { |
401 | int ret = 0; |
402 | |
403 | DEBUG_CALL("tcp_fconnect" ); |
404 | DEBUG_ARG("so = %p" , so); |
405 | |
406 | ret = so->s = slirp_socket(af, SOCK_STREAM, 0); |
407 | if (ret >= 0) { |
408 | int opt, s = so->s; |
409 | struct sockaddr_storage addr; |
410 | |
411 | slirp_set_nonblock(s); |
412 | so->slirp->cb->register_poll_fd(so->s, so->slirp->opaque); |
413 | slirp_socket_set_fast_reuse(s); |
414 | opt = 1; |
415 | setsockopt(s, SOL_SOCKET, SO_OOBINLINE, &opt, sizeof(opt)); |
416 | opt = 1; |
417 | setsockopt(s, IPPROTO_TCP, TCP_NODELAY, &opt, sizeof(opt)); |
418 | |
419 | addr = so->fhost.ss; |
420 | DEBUG_CALL(" connect()ing" ); |
421 | sotranslate_out(so, &addr); |
422 | |
423 | /* We don't care what port we get */ |
424 | ret = connect(s, (struct sockaddr *)&addr, sockaddr_size(&addr)); |
425 | |
426 | /* |
427 | * If it's not in progress, it failed, so we just return 0, |
428 | * without clearing SS_NOFDREF |
429 | */ |
430 | soisfconnecting(so); |
431 | } |
432 | |
433 | return (ret); |
434 | } |
435 | |
436 | /* |
437 | * Accept the socket and connect to the local-host |
438 | * |
439 | * We have a problem. The correct thing to do would be |
440 | * to first connect to the local-host, and only if the |
441 | * connection is accepted, then do an accept() here. |
442 | * But, a) we need to know who's trying to connect |
443 | * to the socket to be able to SYN the local-host, and |
444 | * b) we are already connected to the foreign host by |
445 | * the time it gets to accept(), so... We simply accept |
446 | * here and SYN the local-host. |
447 | */ |
448 | void tcp_connect(struct socket *inso) |
449 | { |
450 | Slirp *slirp = inso->slirp; |
451 | struct socket *so; |
452 | struct sockaddr_storage addr; |
453 | socklen_t addrlen = sizeof(struct sockaddr_storage); |
454 | struct tcpcb *tp; |
455 | int s, opt; |
456 | |
457 | DEBUG_CALL("tcp_connect" ); |
458 | DEBUG_ARG("inso = %p" , inso); |
459 | |
460 | /* |
461 | * If it's an SS_ACCEPTONCE socket, no need to socreate() |
462 | * another socket, just use the accept() socket. |
463 | */ |
464 | if (inso->so_state & SS_FACCEPTONCE) { |
465 | /* FACCEPTONCE already have a tcpcb */ |
466 | so = inso; |
467 | } else { |
468 | so = socreate(slirp); |
469 | if (tcp_attach(so) < 0) { |
470 | g_free(so); /* NOT sofree */ |
471 | return; |
472 | } |
473 | so->lhost = inso->lhost; |
474 | so->so_ffamily = inso->so_ffamily; |
475 | } |
476 | |
477 | tcp_mss(sototcpcb(so), 0); |
478 | |
479 | s = accept(inso->s, (struct sockaddr *)&addr, &addrlen); |
480 | if (s < 0) { |
481 | tcp_close(sototcpcb(so)); /* This will sofree() as well */ |
482 | return; |
483 | } |
484 | slirp_set_nonblock(s); |
485 | so->slirp->cb->register_poll_fd(so->s, so->slirp->opaque); |
486 | slirp_socket_set_fast_reuse(s); |
487 | opt = 1; |
488 | setsockopt(s, SOL_SOCKET, SO_OOBINLINE, &opt, sizeof(int)); |
489 | slirp_socket_set_nodelay(s); |
490 | |
491 | so->fhost.ss = addr; |
492 | sotranslate_accept(so); |
493 | |
494 | /* Close the accept() socket, set right state */ |
495 | if (inso->so_state & SS_FACCEPTONCE) { |
496 | /* If we only accept once, close the accept() socket */ |
497 | so->slirp->cb->unregister_poll_fd(so->s, so->slirp->opaque); |
498 | closesocket(so->s); |
499 | |
500 | /* Don't select it yet, even though we have an FD */ |
501 | /* if it's not FACCEPTONCE, it's already NOFDREF */ |
502 | so->so_state = SS_NOFDREF; |
503 | } |
504 | so->s = s; |
505 | so->so_state |= SS_INCOMING; |
506 | |
507 | so->so_iptos = tcp_tos(so); |
508 | tp = sototcpcb(so); |
509 | |
510 | tcp_template(tp); |
511 | |
512 | tp->t_state = TCPS_SYN_SENT; |
513 | tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT; |
514 | tp->iss = slirp->tcp_iss; |
515 | slirp->tcp_iss += TCP_ISSINCR / 2; |
516 | tcp_sendseqinit(tp); |
517 | tcp_output(tp); |
518 | } |
519 | |
520 | /* |
521 | * Attach a TCPCB to a socket. |
522 | */ |
523 | int tcp_attach(struct socket *so) |
524 | { |
525 | if ((so->so_tcpcb = tcp_newtcpcb(so)) == NULL) |
526 | return -1; |
527 | |
528 | insque(so, &so->slirp->tcb); |
529 | |
530 | return 0; |
531 | } |
532 | |
533 | /* |
534 | * Set the socket's type of service field |
535 | */ |
536 | static const struct tos_t tcptos[] = { |
537 | { 0, 20, IPTOS_THROUGHPUT, 0 }, /* ftp data */ |
538 | { 21, 21, IPTOS_LOWDELAY, EMU_FTP }, /* ftp control */ |
539 | { 0, 23, IPTOS_LOWDELAY, 0 }, /* telnet */ |
540 | { 0, 80, IPTOS_THROUGHPUT, 0 }, /* WWW */ |
541 | { 0, 513, IPTOS_LOWDELAY, EMU_RLOGIN | EMU_NOCONNECT }, /* rlogin */ |
542 | { 0, 544, IPTOS_LOWDELAY, EMU_KSH }, /* kshell */ |
543 | { 0, 543, IPTOS_LOWDELAY, 0 }, /* klogin */ |
544 | { 0, 6667, IPTOS_THROUGHPUT, EMU_IRC }, /* IRC */ |
545 | { 0, 6668, IPTOS_THROUGHPUT, EMU_IRC }, /* IRC undernet */ |
546 | { 0, 7070, IPTOS_LOWDELAY, EMU_REALAUDIO }, /* RealAudio control */ |
547 | { 0, 113, IPTOS_LOWDELAY, EMU_IDENT }, /* identd protocol */ |
548 | { 0, 0, 0, 0 } |
549 | }; |
550 | |
551 | static struct emu_t *tcpemu = NULL; |
552 | |
553 | /* |
554 | * Return TOS according to the above table |
555 | */ |
556 | uint8_t tcp_tos(struct socket *so) |
557 | { |
558 | int i = 0; |
559 | struct emu_t *emup; |
560 | |
561 | while (tcptos[i].tos) { |
562 | if ((tcptos[i].fport && (ntohs(so->so_fport) == tcptos[i].fport)) || |
563 | (tcptos[i].lport && (ntohs(so->so_lport) == tcptos[i].lport))) { |
564 | so->so_emu = tcptos[i].emu; |
565 | return tcptos[i].tos; |
566 | } |
567 | i++; |
568 | } |
569 | |
570 | /* Nope, lets see if there's a user-added one */ |
571 | for (emup = tcpemu; emup; emup = emup->next) { |
572 | if ((emup->fport && (ntohs(so->so_fport) == emup->fport)) || |
573 | (emup->lport && (ntohs(so->so_lport) == emup->lport))) { |
574 | so->so_emu = emup->emu; |
575 | return emup->tos; |
576 | } |
577 | } |
578 | |
579 | return 0; |
580 | } |
581 | |
582 | /* |
583 | * Emulate programs that try and connect to us |
584 | * This includes ftp (the data connection is |
585 | * initiated by the server) and IRC (DCC CHAT and |
586 | * DCC SEND) for now |
587 | * |
588 | * NOTE: It's possible to crash SLiRP by sending it |
589 | * unstandard strings to emulate... if this is a problem, |
590 | * more checks are needed here |
591 | * |
592 | * XXX Assumes the whole command came in one packet |
593 | * |
594 | * XXX Some ftp clients will have their TOS set to |
595 | * LOWDELAY and so Nagel will kick in. Because of this, |
596 | * we'll get the first letter, followed by the rest, so |
597 | * we simply scan for ORT instead of PORT... |
598 | * DCC doesn't have this problem because there's other stuff |
599 | * in the packet before the DCC command. |
600 | * |
601 | * Return 1 if the mbuf m is still valid and should be |
602 | * sbappend()ed |
603 | * |
604 | * NOTE: if you return 0 you MUST m_free() the mbuf! |
605 | */ |
606 | int tcp_emu(struct socket *so, struct mbuf *m) |
607 | { |
608 | Slirp *slirp = so->slirp; |
609 | unsigned n1, n2, n3, n4, n5, n6; |
610 | char buff[257]; |
611 | uint32_t laddr; |
612 | unsigned lport; |
613 | char *bptr; |
614 | |
615 | DEBUG_CALL("tcp_emu" ); |
616 | DEBUG_ARG("so = %p" , so); |
617 | DEBUG_ARG("m = %p" , m); |
618 | |
619 | switch (so->so_emu) { |
620 | int x, i; |
621 | |
622 | /* TODO: IPv6 */ |
623 | case EMU_IDENT: |
624 | /* |
625 | * Identification protocol as per rfc-1413 |
626 | */ |
627 | |
628 | { |
629 | struct socket *tmpso; |
630 | struct sockaddr_in addr; |
631 | socklen_t addrlen = sizeof(struct sockaddr_in); |
632 | char *eol = g_strstr_len(m->m_data, m->m_len, "\r\n" ); |
633 | |
634 | if (!eol) { |
635 | return 1; |
636 | } |
637 | |
638 | *eol = '\0'; |
639 | if (sscanf(m->m_data, "%u%*[ ,]%u" , &n1, &n2) == 2) { |
640 | HTONS(n1); |
641 | HTONS(n2); |
642 | /* n2 is the one on our host */ |
643 | for (tmpso = slirp->tcb.so_next; tmpso != &slirp->tcb; |
644 | tmpso = tmpso->so_next) { |
645 | if (tmpso->so_laddr.s_addr == so->so_laddr.s_addr && |
646 | tmpso->so_lport == n2 && |
647 | tmpso->so_faddr.s_addr == so->so_faddr.s_addr && |
648 | tmpso->so_fport == n1) { |
649 | if (getsockname(tmpso->s, (struct sockaddr *)&addr, |
650 | &addrlen) == 0) |
651 | n2 = addr.sin_port; |
652 | break; |
653 | } |
654 | } |
655 | NTOHS(n1); |
656 | NTOHS(n2); |
657 | m_inc(m, snprintf(NULL, 0, "%d,%d\r\n" , n1, n2) + 1); |
658 | m->m_len = snprintf(m->m_data, M_ROOM(m), "%d,%d\r\n" , n1, n2); |
659 | assert(m->m_len < M_ROOM(m)); |
660 | } else { |
661 | *eol = '\r'; |
662 | } |
663 | |
664 | return 1; |
665 | } |
666 | |
667 | case EMU_FTP: /* ftp */ |
668 | m_inc(m, m->m_len + 1); |
669 | *(m->m_data + m->m_len) = 0; /* NUL terminate for strstr */ |
670 | if ((bptr = (char *)strstr(m->m_data, "ORT" )) != NULL) { |
671 | /* |
672 | * Need to emulate the PORT command |
673 | */ |
674 | x = sscanf(bptr, "ORT %u,%u,%u,%u,%u,%u\r\n%256[^\177]" , &n1, &n2, |
675 | &n3, &n4, &n5, &n6, buff); |
676 | if (x < 6) |
677 | return 1; |
678 | |
679 | laddr = htonl((n1 << 24) | (n2 << 16) | (n3 << 8) | (n4)); |
680 | lport = htons((n5 << 8) | (n6)); |
681 | |
682 | if ((so = tcp_listen(slirp, INADDR_ANY, 0, laddr, lport, |
683 | SS_FACCEPTONCE)) == NULL) { |
684 | return 1; |
685 | } |
686 | n6 = ntohs(so->so_fport); |
687 | |
688 | n5 = (n6 >> 8) & 0xff; |
689 | n6 &= 0xff; |
690 | |
691 | laddr = ntohl(so->so_faddr.s_addr); |
692 | |
693 | n1 = ((laddr >> 24) & 0xff); |
694 | n2 = ((laddr >> 16) & 0xff); |
695 | n3 = ((laddr >> 8) & 0xff); |
696 | n4 = (laddr & 0xff); |
697 | |
698 | m->m_len = bptr - m->m_data; /* Adjust length */ |
699 | m->m_len += snprintf(bptr, m->m_size - m->m_len, |
700 | "ORT %d,%d,%d,%d,%d,%d\r\n%s" , n1, n2, n3, n4, |
701 | n5, n6, x == 7 ? buff : "" ); |
702 | return 1; |
703 | } else if ((bptr = (char *)strstr(m->m_data, "27 Entering" )) != NULL) { |
704 | /* |
705 | * Need to emulate the PASV response |
706 | */ |
707 | x = sscanf( |
708 | bptr, |
709 | "27 Entering Passive Mode (%u,%u,%u,%u,%u,%u)\r\n%256[^\177]" , |
710 | &n1, &n2, &n3, &n4, &n5, &n6, buff); |
711 | if (x < 6) |
712 | return 1; |
713 | |
714 | laddr = htonl((n1 << 24) | (n2 << 16) | (n3 << 8) | (n4)); |
715 | lport = htons((n5 << 8) | (n6)); |
716 | |
717 | if ((so = tcp_listen(slirp, INADDR_ANY, 0, laddr, lport, |
718 | SS_FACCEPTONCE)) == NULL) { |
719 | return 1; |
720 | } |
721 | n6 = ntohs(so->so_fport); |
722 | |
723 | n5 = (n6 >> 8) & 0xff; |
724 | n6 &= 0xff; |
725 | |
726 | laddr = ntohl(so->so_faddr.s_addr); |
727 | |
728 | n1 = ((laddr >> 24) & 0xff); |
729 | n2 = ((laddr >> 16) & 0xff); |
730 | n3 = ((laddr >> 8) & 0xff); |
731 | n4 = (laddr & 0xff); |
732 | |
733 | m->m_len = bptr - m->m_data; /* Adjust length */ |
734 | m->m_len += |
735 | snprintf(bptr, m->m_size - m->m_len, |
736 | "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s" , |
737 | n1, n2, n3, n4, n5, n6, x == 7 ? buff : "" ); |
738 | |
739 | return 1; |
740 | } |
741 | |
742 | return 1; |
743 | |
744 | case EMU_KSH: |
745 | /* |
746 | * The kshell (Kerberos rsh) and shell services both pass |
747 | * a local port port number to carry signals to the server |
748 | * and stderr to the client. It is passed at the beginning |
749 | * of the connection as a NUL-terminated decimal ASCII string. |
750 | */ |
751 | so->so_emu = 0; |
752 | for (lport = 0, i = 0; i < m->m_len - 1; ++i) { |
753 | if (m->m_data[i] < '0' || m->m_data[i] > '9') |
754 | return 1; /* invalid number */ |
755 | lport *= 10; |
756 | lport += m->m_data[i] - '0'; |
757 | } |
758 | if (m->m_data[m->m_len - 1] == '\0' && lport != 0 && |
759 | (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr, |
760 | htons(lport), SS_FACCEPTONCE)) != NULL) |
761 | m->m_len = |
762 | snprintf(m->m_data, m->m_size, "%d" , ntohs(so->so_fport)) + 1; |
763 | return 1; |
764 | |
765 | case EMU_IRC: |
766 | /* |
767 | * Need to emulate DCC CHAT, DCC SEND and DCC MOVE |
768 | */ |
769 | m_inc(m, m->m_len + 1); |
770 | *(m->m_data + m->m_len) = 0; /* NULL terminate the string for strstr */ |
771 | if ((bptr = (char *)strstr(m->m_data, "DCC" )) == NULL) |
772 | return 1; |
773 | |
774 | /* The %256s is for the broken mIRC */ |
775 | if (sscanf(bptr, "DCC CHAT %256s %u %u" , buff, &laddr, &lport) == 3) { |
776 | if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr), |
777 | htons(lport), SS_FACCEPTONCE)) == NULL) { |
778 | return 1; |
779 | } |
780 | m->m_len = bptr - m->m_data; /* Adjust length */ |
781 | m->m_len += snprintf(bptr, m->m_size, "DCC CHAT chat %lu %u%c\n" , |
782 | (unsigned long)ntohl(so->so_faddr.s_addr), |
783 | ntohs(so->so_fport), 1); |
784 | } else if (sscanf(bptr, "DCC SEND %256s %u %u %u" , buff, &laddr, &lport, |
785 | &n1) == 4) { |
786 | if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr), |
787 | htons(lport), SS_FACCEPTONCE)) == NULL) { |
788 | return 1; |
789 | } |
790 | m->m_len = bptr - m->m_data; /* Adjust length */ |
791 | m->m_len += |
792 | snprintf(bptr, m->m_size, "DCC SEND %s %lu %u %u%c\n" , buff, |
793 | (unsigned long)ntohl(so->so_faddr.s_addr), |
794 | ntohs(so->so_fport), n1, 1); |
795 | } else if (sscanf(bptr, "DCC MOVE %256s %u %u %u" , buff, &laddr, &lport, |
796 | &n1) == 4) { |
797 | if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr), |
798 | htons(lport), SS_FACCEPTONCE)) == NULL) { |
799 | return 1; |
800 | } |
801 | m->m_len = bptr - m->m_data; /* Adjust length */ |
802 | m->m_len += |
803 | snprintf(bptr, m->m_size, "DCC MOVE %s %lu %u %u%c\n" , buff, |
804 | (unsigned long)ntohl(so->so_faddr.s_addr), |
805 | ntohs(so->so_fport), n1, 1); |
806 | } |
807 | return 1; |
808 | |
809 | case EMU_REALAUDIO: |
810 | /* |
811 | * RealAudio emulation - JP. We must try to parse the incoming |
812 | * data and try to find the two characters that contain the |
813 | * port number. Then we redirect an udp port and replace the |
814 | * number with the real port we got. |
815 | * |
816 | * The 1.0 beta versions of the player are not supported |
817 | * any more. |
818 | * |
819 | * A typical packet for player version 1.0 (release version): |
820 | * |
821 | * 0000:50 4E 41 00 05 |
822 | * 0000:00 01 00 02 1B D7 00 00 67 E6 6C DC 63 00 12 50 ........g.l.c..P |
823 | * 0010:4E 43 4C 49 45 4E 54 20 31 30 31 20 41 4C 50 48 NCLIENT 101 ALPH |
824 | * 0020:41 6C 00 00 52 00 17 72 61 66 69 6C 65 73 2F 76 Al..R..rafiles/v |
825 | * 0030:6F 61 2F 65 6E 67 6C 69 73 68 5F 2E 72 61 79 42 oa/english_.rayB |
826 | * |
827 | * Now the port number 0x1BD7 is found at offset 0x04 of the |
828 | * Now the port number 0x1BD7 is found at offset 0x04 of the |
829 | * second packet. This time we received five bytes first and |
830 | * then the rest. You never know how many bytes you get. |
831 | * |
832 | * A typical packet for player version 2.0 (beta): |
833 | * |
834 | * 0000:50 4E 41 00 06 00 02 00 00 00 01 00 02 1B C1 00 PNA............. |
835 | * 0010:00 67 75 78 F5 63 00 0A 57 69 6E 32 2E 30 2E 30 .gux.c..Win2.0.0 |
836 | * 0020:2E 35 6C 00 00 52 00 1C 72 61 66 69 6C 65 73 2F .5l..R..rafiles/ |
837 | * 0030:77 65 62 73 69 74 65 2F 32 30 72 65 6C 65 61 73 website/20releas |
838 | * 0040:65 2E 72 61 79 53 00 00 06 36 42 e.rayS...6B |
839 | * |
840 | * Port number 0x1BC1 is found at offset 0x0d. |
841 | * |
842 | * This is just a horrible switch statement. Variable ra tells |
843 | * us where we're going. |
844 | */ |
845 | |
846 | bptr = m->m_data; |
847 | while (bptr < m->m_data + m->m_len) { |
848 | uint16_t p; |
849 | static int ra = 0; |
850 | char ra_tbl[4]; |
851 | |
852 | ra_tbl[0] = 0x50; |
853 | ra_tbl[1] = 0x4e; |
854 | ra_tbl[2] = 0x41; |
855 | ra_tbl[3] = 0; |
856 | |
857 | switch (ra) { |
858 | case 0: |
859 | case 2: |
860 | case 3: |
861 | if (*bptr++ != ra_tbl[ra]) { |
862 | ra = 0; |
863 | continue; |
864 | } |
865 | break; |
866 | |
867 | case 1: |
868 | /* |
869 | * We may get 0x50 several times, ignore them |
870 | */ |
871 | if (*bptr == 0x50) { |
872 | ra = 1; |
873 | bptr++; |
874 | continue; |
875 | } else if (*bptr++ != ra_tbl[ra]) { |
876 | ra = 0; |
877 | continue; |
878 | } |
879 | break; |
880 | |
881 | case 4: |
882 | /* |
883 | * skip version number |
884 | */ |
885 | bptr++; |
886 | break; |
887 | |
888 | case 5: |
889 | /* |
890 | * The difference between versions 1.0 and |
891 | * 2.0 is here. For future versions of |
892 | * the player this may need to be modified. |
893 | */ |
894 | if (*(bptr + 1) == 0x02) |
895 | bptr += 8; |
896 | else |
897 | bptr += 4; |
898 | break; |
899 | |
900 | case 6: |
901 | /* This is the field containing the port |
902 | * number that RA-player is listening to. |
903 | */ |
904 | lport = (((uint8_t *)bptr)[0] << 8) + ((uint8_t *)bptr)[1]; |
905 | if (lport < 6970) |
906 | lport += 256; /* don't know why */ |
907 | if (lport < 6970 || lport > 7170) |
908 | return 1; /* failed */ |
909 | |
910 | /* try to get udp port between 6970 - 7170 */ |
911 | for (p = 6970; p < 7071; p++) { |
912 | if (udp_listen(slirp, INADDR_ANY, htons(p), |
913 | so->so_laddr.s_addr, htons(lport), |
914 | SS_FACCEPTONCE)) { |
915 | break; |
916 | } |
917 | } |
918 | if (p == 7071) |
919 | p = 0; |
920 | *(uint8_t *)bptr++ = (p >> 8) & 0xff; |
921 | *(uint8_t *)bptr = p & 0xff; |
922 | ra = 0; |
923 | return 1; /* port redirected, we're done */ |
924 | break; |
925 | |
926 | default: |
927 | ra = 0; |
928 | } |
929 | ra++; |
930 | } |
931 | return 1; |
932 | |
933 | default: |
934 | /* Ooops, not emulated, won't call tcp_emu again */ |
935 | so->so_emu = 0; |
936 | return 1; |
937 | } |
938 | } |
939 | |
940 | /* |
941 | * Do misc. config of SLiRP while its running. |
942 | * Return 0 if this connections is to be closed, 1 otherwise, |
943 | * return 2 if this is a command-line connection |
944 | */ |
945 | int tcp_ctl(struct socket *so) |
946 | { |
947 | Slirp *slirp = so->slirp; |
948 | struct sbuf *sb = &so->so_snd; |
949 | struct gfwd_list *ex_ptr; |
950 | |
951 | DEBUG_CALL("tcp_ctl" ); |
952 | DEBUG_ARG("so = %p" , so); |
953 | |
954 | /* TODO: IPv6 */ |
955 | if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) { |
956 | /* Check if it's pty_exec */ |
957 | for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { |
958 | if (ex_ptr->ex_fport == so->so_fport && |
959 | so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { |
960 | if (ex_ptr->write_cb) { |
961 | so->s = -1; |
962 | so->guestfwd = ex_ptr; |
963 | return 1; |
964 | } |
965 | DEBUG_MISC(" executing %s" , ex_ptr->ex_exec); |
966 | return fork_exec(so, ex_ptr->ex_exec); |
967 | } |
968 | } |
969 | } |
970 | sb->sb_cc = |
971 | snprintf(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr - sb->sb_data), |
972 | "Error: No application configured.\r\n" ); |
973 | sb->sb_wptr += sb->sb_cc; |
974 | return 0; |
975 | } |
976 | |