Great Circle Associates Firewalls
(December 1992)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: connect() *hack* for Sun gateway
From: Mark Verber <verber @ parc . xerox . com>
Date: Wed, 9 Dec 1992 11:29:23 PST
To: firewalls @ GreatCircle . COM

----------
X-Sun-Data-Type: text
X-Sun-Data-Description: text
X-Sun-Data-Name: text
X-Sun-Content-Lines: 7

The following code is what we are using to get through Sun's proxy server.
Your mileage might very.  This is a trival (but very useful) hack.  By creating
a replacement connect(), modifying application to go through a firewall
often only involves relinking.

Mark Verber
XEROX PARC
----------
X-Sun-Data-Type: c-file
X-Sun-Data-Description: c-file
X-Sun-Data-Name: connect.c
X-Sun-Content-Lines: 105

/* connect.c -- replacement for connect(2) system call that understands our
                internet gateway.
   David Nichols
   January, 1992
   Xerox Palo Alto Research Center

 */

#include <stdio.h>		/* for NULL */
#include <sys/syscall.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

extern char *index();

#define ClassANet(in)   ((in)->sin_addr.S_un.S_un_b.s_b1)
#define XeroxNet(in)	(ClassANet(in) == 13 || ClassANet(in) == IN_LOOPBACKNET)

extern int errno;

static int ReallyConnect(s, name, namelen)
    int s;
    struct sockaddr *name;
    int namelen;
{
    return syscall(SYS_connect, s, name, namelen);
}

static int Expect(s, len)
    int s;
    int len;
{
    char buf[100];
    int l, n;

    while (len > 0) {
	l = len;
	if (l > sizeof(buf))
	    l = sizeof(buf);
	n = read(s, buf, l);
	if (n <= 0)
	    return -1;
	len -= n;
    }
    return 0;
}

connect(s, name, namelen)
    int s;
    struct sockaddr *name;
    int namelen;
{
    struct sockaddr_in *iname = (struct sockaddr_in *) name;
    char buf[50];
    struct sockaddr_in gateway;
    struct hostent *he;
    struct servent *se;
    int len;
    int n;
    char *p;
    int type;
    int typeLen = sizeof(type);

    if (getsockopt(s, SOL_SOCKET, SO_TYPE, &type, &typeLen) < 0)
	return -1;
    if (type != SOCK_STREAM || name->sa_family != AF_INET || XeroxNet(iname))
	return ReallyConnect(s, name, namelen);
    sprintf(buf, "%d.%d.%d.%d %d\r\n",
	    iname->sin_addr.S_un.S_un_b.s_b1,
	    iname->sin_addr.S_un.S_un_b.s_b2,
	    iname->sin_addr.S_un.S_un_b.s_b3,
	    iname->sin_addr.S_un.S_un_b.s_b4,
	    ntohs(iname->sin_port));

    bzero(&gateway, sizeof(gateway));
    gateway.sin_family = AF_INET;
    he = gethostbyname("internet-gateway");
    if (he == NULL) {
	errno = EHOSTUNREACH;
	return -1;
    }
    bcopy(he->h_addr_list[0], &gateway.sin_addr, sizeof(gateway.sin_addr));
    se = getservbyname("telnet-passthru", "tcp");
    if (se == NULL)
	gateway.sin_port = htons(3514);
    else
	gateway.sin_port = se->s_port;

    if (connect(s, &gateway, sizeof(gateway)) < 0)
	return -1;
    len = strlen(buf);
    if (write(s, buf, len) != len)
	return -1;
    /** Expect: "(to) Trying xxx.xxx.xxx.xxx ...\n", followed by
                "connected to xxx.xxx.xxx.xxx\n". */
    p = index(buf, ' ');
    if (Expect(s, (p - buf) + 17) < 0)
	return -1;
    if (Expect(s, (p - buf) + 14) < 0)
	return -1;
    return 0;
}


Indexed By Date Previous: Re: packet filter metalanguage
From: Steve Kennedy <steve @ gbnet . org>
Next: an incident
From: smb @ research . att . com
Indexed By Thread Previous: Re: apcket filtering metalanguage
From: Richard Childers <rchilder @ us . oracle . com>
Next: an incident
From: smb @ research . att . com

Google
 
Search Internet Search www.greatcircle.com