/*
 * Sample transparent proxy program.
 *
 * Sample implementation of a program which intercepts a TCP connectiona and
 * just echos all data back to the origin.  Written to work via inetd as a
 * "nonwait" program running as root; ie.
 * tcpmux          stream  tcp     nowait root /usr/local/bin/proxy proxy
 * with a NAT rue like this:
 * rdr smc0 0/0 port 80 -> 127.0.0.1/32 port 1
 */
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <syslog.h>
#if !defined(__SVR4) && !defined(__svr4__)
#include <strings.h>
#else
#include <sys/byteorder.h>
#endif
#include <sys/types.h>
#include <sys/time.h>
#include <sys/param.h>
#include <stdlib.h>
#include <unistd.h>
#include <stddef.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#if defined(sun) && (defined(__svr4__) || defined(__SVR4))
# include <sys/ioccom.h>
# include <sys/sysmacros.h>
#endif
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <net/if.h>
#include <netdb.h>
#include <arpa/nameser.h>
#include <arpa/inet.h>
#include <resolv.h>
#include <ctype.h>
#include "netinet/ip_compat.h"
#include "netinet/ip_fil.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ip_nat.h"
#include "netinet/ipl.h"


main(argc, argv)
        int argc;
        char *argv[];
{
        struct  sockaddr_in     sin, sloc, sout;
        ipfobj_t        obj;
        natlookup_t     natlook;
        char    buffer[512];
        int     namelen, fd, n;

        /*
         * get IP# and port # of the remote end of the connection (at the
         * origin).
         */
        namelen = sizeof(sin);
        if (getpeername(0, (struct sockaddr *)&sin, &namelen) == -1) {
                perror("getpeername");
                exit(-1);
        }

        /*
         * get IP# and port # of the local end of the connection (at the
         * man-in-the-middle).
         */
        namelen = sizeof(sin);
        if (getsockname(0, (struct sockaddr *)&sloc, &namelen) == -1) {
                perror("getsockname");
                exit(-1);
        }

        bzero((char *)&obj, sizeof(obj));
        obj.ipfo_rev = IPFILTER_VERSION;
        obj.ipfo_size = sizeof(natlook);
        obj.ipfo_ptr = &natlook;
        obj.ipfo_type = IPFOBJ_NATLOOKUP;

        /*
         * Build up the NAT natlookup structure.
         */
        bzero((char *)&natlook, sizeof(natlook));
        natlook.nl_outip = sin.sin_addr;
        natlook.nl_inip = sloc.sin_addr;
        natlook.nl_flags = IPN_TCP;
        natlook.nl_outport = sin.sin_port;
        natlook.nl_inport = sloc.sin_port;

        /*
         * Open the NAT device and lookup the mapping pair.
         */
        fd = open(IPNAT_NAME, O_RDONLY);
        if (ioctl(fd, SIOCGNATL, &obj) == -1) {
                perror("ioctl(SIOCGNATL)");
                exit(-1);
        }

#define DO_NAT_OUT
#ifdef  DO_NAT_OUT
        if (argc > 1)
                do_nat_out(0, 1, fd, &natlook, argv[1]);
#else

        /*
         * Log it
         */
        syslog(LOG_DAEMON|LOG_INFO, "connect to %s,%d",
                inet_ntoa(natlook.nl_realip), ntohs(natlook.nl_realport));
        printf("connect to %s,%d\n",
                inet_ntoa(natlook.nl_realip), ntohs(natlook.nl_realport));

        /*
         * Just echo data read in from stdin to stdout
         */
        while ((n = read(0, buffer, sizeof(buffer))) > 0)
                if (write(1, buffer, n) != n)
                        break;
        close(0);
#endif
}


#ifdef  DO_NAT_OUT
do_nat_out(in, out, fd, nlp, extif)
        int fd;
        natlookup_t *nlp;
        char *extif;
{
        nat_save_t ns, *nsp = &ns;
        struct sockaddr_in usin;
        u_32_t sum1, sum2, sumd;
        int onoff, ofd, slen;
        ipfobj_t obj;
        ipnat_t *ipn;
        nat_t *nat;

        bzero((char *)&ns, sizeof(ns));

        nat = &ns.ipn_nat;
        nat->nat_p = IPPROTO_TCP;
        nat->nat_dir = NAT_OUTBOUND;
        if ((extif != NULL) && (*extif != '\0')) {
                strncpy(nat->nat_ifnames[0], extif,
                        sizeof(nat->nat_ifnames[0]));
                strncpy(nat->nat_ifnames[1], extif,
                        sizeof(nat->nat_ifnames[1]));
                nat->nat_ifnames[0][sizeof(nat->nat_ifnames[0]) - 1] = '\0';
                nat->nat_ifnames[1][sizeof(nat->nat_ifnames[1]) - 1] = '\0';
        }

        ofd = socket(AF_INET, SOCK_DGRAM, 0);
        bzero((char *)&usin, sizeof(usin));
        usin.sin_family = AF_INET;
        usin.sin_addr = nlp->nl_realip;
        usin.sin_port = nlp->nl_realport;
        (void) connect(ofd, (struct sockaddr *)&usin, sizeof(usin));
        slen = sizeof(usin);
        (void) getsockname(ofd, (struct sockaddr *)&usin, &slen);
        close(ofd);
printf("local IP# to use: %s\n", inet_ntoa(usin.sin_addr));

        if ((ofd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
                perror("socket");
        usin.sin_port = 0;
        if (bind(ofd, (struct sockaddr *)&usin, sizeof(usin)))
                perror("bind");
        slen = sizeof(usin);
        if (getsockname(ofd, (struct sockaddr *)&usin, &slen))
                perror("getsockname");
printf("local port# to use: %d\n", ntohs(usin.sin_port));

        nat->nat_inip = usin.sin_addr;
        nat->nat_outip = nlp->nl_outip;
        nat->nat_oip = nlp->nl_realip;

        sum1 = LONG_SUM(ntohl(usin.sin_addr.s_addr)) + ntohs(usin.sin_port);
        sum2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)) + ntohs(nlp->nl_outport);
        CALC_SUMD(sum1, sum2, sumd);
        nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
        nat->nat_sumd[1] = nat->nat_sumd[0];

        sum1 = LONG_SUM(ntohl(usin.sin_addr.s_addr));
        sum2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
        CALC_SUMD(sum1, sum2, sumd);
        nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);

        nat->nat_inport = usin.sin_port;
        nat->nat_outport = nlp->nl_outport;
        nat->nat_oport = nlp->nl_realport;

        nat->nat_flags = IPN_TCPUDP;

        bzero((char *)&obj, sizeof(obj));
        obj.ipfo_rev = IPFILTER_VERSION;
        obj.ipfo_size = sizeof(*nsp);
        obj.ipfo_ptr = nsp;
        obj.ipfo_type = IPFOBJ_NATSAVE;

        onoff = 1;
        if (ioctl(fd, SIOCSTLCK, &onoff) == 0) {
                if (ioctl(fd, SIOCSTPUT, &obj) != 0)
                        perror("SIOCSTPUT");
                onoff = 0;
                if (ioctl(fd, SIOCSTLCK, &onoff) != 0)
                        perror("SIOCSTLCK");
        }

        usin.sin_addr = nlp->nl_realip;
        usin.sin_port = nlp->nl_realport;
printf("remote end for connection: %s,%d\n", inet_ntoa(usin.sin_addr),
ntohs(usin.sin_port));
fflush(stdout);
        if (connect(ofd, (struct sockaddr *)&usin, sizeof(usin)))
                perror("connect");

        relay(in, out, ofd);
}


relay(in, out, net)
        int in, out, net;
{
        char netbuf[1024], outbuf[1024];
        char *nwptr, *nrptr, *owptr, *orptr;
        size_t nsz, osz;
        fd_set rd, wr;
        int i, n, maxfd;

        n = 0;
        maxfd = in;
        if (out > maxfd)
                maxfd = out;
        if (net > maxfd)
                maxfd = net;

        nrptr = netbuf;
        nwptr = netbuf;
        nsz = sizeof(netbuf);
        orptr = outbuf;
        owptr = outbuf;
        osz = sizeof(outbuf);

        while (n >= 0) {
                FD_ZERO(&rd);
                FD_ZERO(&wr);

                if (nrptr - netbuf < sizeof(netbuf))
                        FD_SET(in, &rd);
                if (orptr - outbuf < sizeof(outbuf))
                        FD_SET(net, &rd);

                if (nsz < sizeof(netbuf))
                        FD_SET(net, &wr);
                if (osz < sizeof(outbuf))
                        FD_SET(out, &wr);

                n = select(maxfd + 1, &rd, &wr, NULL, NULL);

                if ((n > 0) && FD_ISSET(in, &rd)) {
                        i = read(in, nrptr, sizeof(netbuf) - (nrptr - netbuf));
                        if (i <= 0)
                                break;
                        nsz -= i;
                        nrptr += i;
                        n--;
                }

                if ((n > 0) && FD_ISSET(net, &rd)) {
                        i = read(net, orptr, sizeof(outbuf) - (orptr - outbuf));
                        if (i <= 0)
                                break;
                        osz -= i;
                        orptr += i;
                        n--;
                }

                if ((n > 0) && FD_ISSET(out, &wr)) {
                        i = write(out, owptr, orptr - owptr);
                        if (i <= 0)
                                break;
                        osz += i;
                        if (osz == sizeof(outbuf) || owptr == orptr) {
                                orptr = outbuf;
                                owptr = outbuf;
                        } else
                                owptr += i;
                        n--;
                }

                if ((n > 0) && FD_ISSET(net, &wr)) {
                        i = write(net, nwptr, nrptr - nwptr);
                        if (i <= 0)
                                break;
                        nsz += i;
                        if (nsz == sizeof(netbuf) || nwptr == nrptr) {
                                nrptr = netbuf;
                                nwptr = netbuf;
                        } else
                                nwptr += i;
                }
        }

        close(net);
        close(out);
        close(in);
}
#endif