21 *
22 * TODO: Shoud send ICMP error message when we discard packets.
23 */
24
25#include <sys/types.h>
26#include <sys/socket.h>
27#include <sys/param.h>
28#include <netinet/in.h>
29#include <arpa/inet.h>
30#include <netdb.h>
31#include <stdio.h>
32#include <stdlib.h>
33#include <strings.h>
34#include "command.h"
35#include "filter.h"
36
37static struct filterent filterdata;
38
39static u_long netmasks[33] = {
40 0x00000000,
41 0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
42 0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
43 0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000,
44 0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000,
45 0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000,
46 0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00,
47 0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0,
48 0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF,
49};
50
51int
52ParseAddr(argc, argv, paddr, pmask, pwidth)
53int argc;
54char **argv;
55struct in_addr *paddr;
56struct in_addr *pmask;
57int *pwidth;
58{
59 u_long addr;
60 int bits;
61 char *cp, *wp;
62
63 if (argc < 1) {
64#ifdef notdef
65 printf("address/mask is expected.\n");
66#endif
67 return(0);
68 }
69
|
71 cp = index(*argv, '/');
72 if (cp) *cp++ = '\0';
73 addr = inet_addr(*argv);
74 paddr->s_addr = addr;
75 if (cp && *cp) {
76 bits = strtol(cp, &wp, 0);
77 if (cp == wp || bits < 0 || bits > 32) {
78 printf("bad mask width.\n");
79 return(0);
80 }
81 } else {
82 /* if width is not given, assume whole 32 bits are meaningfull */
83 bits = 32;
84 }
85
86 *pwidth = bits;
87 pmask->s_addr = htonl(netmasks[bits]);
88
89 return(1);
90}
91
92static int
93ParseProto(argc, argv)
94int argc;
95char **argv;
96{
97 int proto;
98
99 if (argc < 1)
100 return(P_NONE);
101
102 if (STREQ(*argv, "tcp"))
103 proto = P_TCP;
104 else if (STREQ(*argv, "udp"))
105 proto = P_UDP;
106 else if (STREQ(*argv, "icmp"))
107 proto = P_ICMP;
108 else
109 proto = P_NONE;
110 return(proto);
111}
112
113static int
114ParsePort(service, proto)
115char *service;
116int proto;
117{
118 char *protocol_name, *cp;
119 struct servent *servent;
120 int port;
121
122 switch (proto) {
123 case P_UDP:
124 protocol_name = "udp";
125 break;
126 case P_TCP:
127 protocol_name = "tcp";
128 break;
129 default:
130 protocol_name = 0;
131 }
132
133 servent = getservbyname (service, protocol_name);
134 if (servent != 0)
135 return(ntohs(servent->s_port));
136
137 port = strtol(service, &cp, 0);
138 if (cp == service) {
139 printf("%s is not a port name or number.\n", service);
140 return(0);
141 }
142 return(port);
143}
144
145/*
146 * ICMP Syntax: src eq icmp_message_type
147 */
148static int
149ParseIcmp(argc, argv)
150int argc;
151char **argv;
152{
153 int type;
154 char *cp;
155
156 switch (argc) {
157 case 0:
158 /* permit/deny all ICMP types */
159 filterdata.opt.srcop = OP_NONE;
160 break;
161 default:
162 printf("bad icmp syntax.\n");
163 return(0);
164 case 3:
165 if (STREQ(*argv, "src") && STREQ(argv[1], "eq")) {
166 type = strtol(argv[2], &cp, 0);
167 if (cp == argv[2]) {
168 printf("type is expected.\n");
169 return(0);
170 }
171 filterdata.opt.srcop = OP_EQ;
172 filterdata.opt.srcport = type;
173 }
174 break;
175 }
176 return(1);
177}
178
179static int
180ParseOp(cp)
181char *cp;
182{
183 int op = OP_NONE;
184
185 if (STREQ(cp, "eq"))
186 op = OP_EQ;
187 else if (STREQ(cp, "gt"))
188 op = OP_GT;
189 else if (STREQ(cp, "lt"))
190 op = OP_LT;
191 return(op);
192}
193
194/*
195 * UDP Syntax: [src op port] [dst op port]
196 */
197static int
198ParseUdpOrTcp(argc, argv, proto)
199int argc;
200char **argv;
201int proto;
202{
203
204 if (argc == 0) {
205 /* permit/deny all tcp traffic */
206 filterdata.opt.srcop = filterdata.opt.dstop = A_NONE;
207 return(1);
208 }
209 if (argc < 3) {
210#ifdef notdef
211 printf("bad udp syntax.\n");
212#endif
213 return(0);
214 }
215 if (argc >= 3 && STREQ(*argv, "src")) {
216 filterdata.opt.srcop = ParseOp(argv[1]);
217 if (filterdata.opt.srcop == OP_NONE) {
218 printf("bad operation\n");
219 return(0);
220 }
221 filterdata.opt.srcport = ParsePort(argv[2], proto);
222 if (filterdata.opt.srcport == 0)
223 return(0);
224 argc -= 3; argv += 3;
225 if (argc == 0)
226 return(1);
227 }
228 if (argc >= 3 && STREQ(argv[0], "dst")) {
229 filterdata.opt.dstop = ParseOp(argv[1]);
230 if (filterdata.opt.dstop == OP_NONE) {
231 printf("bad operation\n");
232 return(0);
233 }
234 filterdata.opt.dstport = ParsePort(argv[2], proto);
235 if (filterdata.opt.dstport == 0)
236 return(0);
237 argc -= 3; argv += 3;
238 if (argc == 0)
239 return(1);
240 }
241 if (argc == 1) {
242 if (STREQ(*argv, "estab")) {
243 filterdata.opt.estab = 1;
244 return(1);
245 }
246 printf("estab is expected: %s\n", *argv);
247 return(0);
248 }
249 if (argc > 0)
250 printf("bad src/dst port syntax: %s\n", *argv);
251 return(0);
252}
253
254char *opname[] = { "none", "eq", "gt", "lt" };
255
256static int
257Parse(argc, argv, ofp)
258int argc;
259char **argv;
260struct filterent *ofp;
261{
262 int action, proto;
263 int val;
264 char *wp;
265 struct filterent *fp = &filterdata;
266
267 val = strtol(*argv, &wp, 0);
268 if (*argv == wp || val > MAXFILTERS) {
269 printf("invalid filter number.\n");
270 return(0);
271 }
272 if (val < 0) {
273 for (val = 0; val < MAXFILTERS; val++) {
274 ofp->action = A_NONE;
275 ofp++;
276 }
277 printf("filter cleard.\n");
278 return(1);
279 }
280 ofp += val;
281
282 if (--argc == 0) {
283 printf("missing action.\n");
284 return(0);
285 }
286 argv++;
287
288 proto = P_NONE;
289 bzero(&filterdata, sizeof(filterdata));
290
291 if (STREQ(*argv, "permit")) {
292 action = A_PERMIT;
293 } else if (STREQ(*argv, "deny")) {
294 action = A_DENY;
295 } else if (STREQ(*argv, "clear")) {
296 ofp->action = A_NONE;
297 return(1);
298 } else {
299 printf("bad action: %s\n", *argv);
300 return(0);
301 }
302 fp->action = action;
303
304 argc--; argv++;
305
306 if (ofp->action == A_DENY) {
307 if (STREQ(*argv, "host")) {
308 fp->action |= A_UHOST;
309 argc--; argv++;
310 } else if (STREQ(*argv, "port")) {
311 fp->action |= A_UPORT;
312 argc--; argv++;
313 }
314 }
315
316 proto = ParseProto(argc, argv);
317 if (proto == P_NONE) {
318 if (ParseAddr(argc, argv, &fp->saddr, &fp->smask, &fp->swidth)) {
319 argc--; argv++;
320 proto = ParseProto(argc, argv);
321 if (proto == P_NONE) {
322 if (ParseAddr(argc, argv, &fp->daddr, &fp->dmask, &fp->dwidth)) {
323 argc--; argv++;
324 }
325 proto = ParseProto(argc, argv);
326 if (proto) {
327 argc--; argv++;
328 }
329 }
330 } else {
331 printf("Address/protocol expected.\n");
332 return(0);
333 }
334 } else {
335 argc--; argv++;
336 }
337
338 val = 1;
339 fp->proto = proto;
340
341 switch (proto) {
342 case P_TCP:
343 val = ParseUdpOrTcp(argc, argv, P_TCP);
344 break;
345 case P_UDP:
346 val = ParseUdpOrTcp(argc, argv, P_UDP);
347 break;
348 case P_ICMP:
349 val = ParseIcmp(argc, argv);
350 break;
351 }
352
353#ifdef DEBUG
354 printf("src: %s/", inet_ntoa(fp->saddr));
355 printf("%s ", inet_ntoa(fp->smask));
356 printf("dst: %s/", inet_ntoa(fp->daddr));
357 printf("%s proto = %d\n", inet_ntoa(fp->dmask), proto);
358
359 printf("src: %s (%d)\n", opname[fp->opt.srcop], fp->opt.srcport);
360 printf("dst: %s (%d)\n", opname[fp->opt.dstop], fp->opt.dstport);
361 printf("estab: %d\n", fp->opt.estab);
362#endif
363
364 if (val)
365 *ofp = *fp;
366 return(val);
367}
368
369int
370SetIfilter(list, argc, argv)
371struct cmdtab *list;
372int argc;
373char **argv;
374{
375 if (argc > 0)
376 (void) Parse(argc, argv, ifilters);
377 else
378 printf("syntax error.\n");
379
380 return(1);
381}
382
383int
384SetOfilter(list, argc, argv)
385struct cmdtab *list;
386int argc;
387char **argv;
388{
389 if (argc > 0)
390 (void) Parse(argc, argv, ofilters);
391 else
392 printf("syntax error.\n");
393 return(1);
394}
395
396int
397SetDfilter(list, argc, argv)
398struct cmdtab *list;
399int argc;
400char **argv;
401{
402 if (argc > 0)
403 (void) Parse(argc, argv, dfilters);
404 else
405 printf("syntax error.\n");
406 return(1);
407}
408
409int
410SetAfilter(list, argc, argv)
411struct cmdtab *list;
412int argc;
413char **argv;
414{
415 if (argc > 0)
416 (void) Parse(argc, argv, afilters);
417 else
418 printf("syntax error.\n");
419 return(1);
420}
421
422static char *protoname[] = {
423 "none", "tcp", "udp", "icmp",
424};
425
426static char *actname[] = {
427 "none ", "permit ", "deny ",
428};
429
430static void
431ShowFilter(fp)
432struct filterent *fp;
433{
434 int n;
435
436 for (n = 0; n < MAXFILTERS; n++, fp++) {
437 if (fp->action != A_NONE) {
438 printf("%2d %s", n, actname[fp->action]);
439
440 printf("%s/%d ", inet_ntoa(fp->saddr), fp->swidth);
441 printf("%s/%d ", inet_ntoa(fp->daddr), fp->dwidth);
442 if (fp->proto) {
443 printf("%s", protoname[fp->proto]);
444
445 if (fp->opt.srcop)
446 printf(" src %s %d", opname[fp->opt.srcop], fp->opt.srcport);
447 if (fp->opt.dstop)
448 printf(" dst %s %d", opname[fp->opt.dstop], fp->opt.dstport);
449 if (fp->opt.estab)
450 printf(" estab");
451
452 }
453 printf("\n");
454 }
455 }
456}
457
458int
459ShowIfilter(list, argc, argv)
460struct cmdtab *list;
461int argc;
462char **argv;
463{
464 ShowFilter(ifilters);
465 return(1);
466}
467
468int
469ShowOfilter(list, argc, argv)
470struct cmdtab *list;
471int argc;
472char **argv;
473{
474 ShowFilter(ofilters);
475 return(1);
476}
477
478int
479ShowDfilter(list, argc, argv)
480struct cmdtab *list;
481int argc;
482char **argv;
483{
484 ShowFilter(dfilters);
485 return(1);
486}
487
488int
489ShowAfilter(list, argc, argv)
490struct cmdtab *list;
491int argc;
492char **argv;
493{
494 ShowFilter(afilters);
495 return(1);
496}
|