filter.c revision 48142
1/* 2 * PPP Filter command Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $Id: filter.c,v 1.29 1999/05/31 23:57:36 brian Exp $ 21 * 22 * TODO: Shoud send ICMP error message when we discard packets. 23 */ 24 25#include <sys/param.h> 26#include <netinet/in.h> 27#include <arpa/inet.h> 28#include <netdb.h> 29#include <netinet/in_systm.h> 30#include <netinet/ip.h> 31#include <sys/un.h> 32 33#include <stdio.h> 34#include <stdlib.h> 35#include <strings.h> 36#include <termios.h> 37 38#include "layer.h" 39#include "defs.h" 40#include "command.h" 41#include "mbuf.h" 42#include "log.h" 43#include "iplist.h" 44#include "timer.h" 45#include "throughput.h" 46#include "lqr.h" 47#include "hdlc.h" 48#include "fsm.h" 49#include "lcp.h" 50#include "ccp.h" 51#include "link.h" 52#include "slcompress.h" 53#include "ipcp.h" 54#include "filter.h" 55#include "descriptor.h" 56#include "prompt.h" 57#include "mp.h" 58#ifndef NORADIUS 59#include "radius.h" 60#endif 61#include "bundle.h" 62 63static int filter_Nam2Proto(int, char const *const *); 64static int filter_Nam2Op(const char *); 65 66static const u_int32_t netmasks[33] = { 67 0x00000000, 68 0x80000000, 0xC0000000, 0xE0000000, 0xF0000000, 69 0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000, 70 0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000, 71 0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000, 72 0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000, 73 0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00, 74 0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0, 75 0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF, 76}; 77 78struct in_addr 79bits2mask(int bits) 80{ 81 struct in_addr result; 82 83 result.s_addr = htonl(netmasks[bits]); 84 return result; 85} 86 87int 88ParseAddr(struct ipcp *ipcp, const char *data, 89 struct in_addr *paddr, struct in_addr *pmask, int *pwidth) 90{ 91 int bits, len; 92 char *wp; 93 const char *cp; 94 95 if (pmask) 96 pmask->s_addr = INADDR_BROADCAST; /* Assume 255.255.255.255 as default */ 97 98 cp = pmask || pwidth ? strchr(data, '/') : NULL; 99 len = cp ? cp - data : strlen(data); 100 101 if (ipcp && strncasecmp(data, "HISADDR", len) == 0) 102 *paddr = ipcp->peer_ip; 103 else if (ipcp && strncasecmp(data, "MYADDR", len) == 0) 104 *paddr = ipcp->my_ip; 105 else if (len > 15) 106 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data); 107 else { 108 char s[16]; 109 strncpy(s, data, len); 110 s[len] = '\0'; 111 if (inet_aton(s, paddr) == 0) { 112 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s); 113 return (0); 114 } 115 } 116 if (cp && *++cp) { 117 bits = strtol(cp, &wp, 0); 118 if (cp == wp || bits < 0 || bits > 32) { 119 log_Printf(LogWARN, "ParseAddr: bad mask width.\n"); 120 return (0); 121 } 122 } else if (paddr->s_addr == INADDR_ANY) 123 /* An IP of 0.0.0.0 without a width is anything */ 124 bits = 0; 125 else 126 /* If a valid IP is given without a width, assume 32 bits */ 127 bits = 32; 128 129 if (pwidth) 130 *pwidth = bits; 131 132 if (pmask) { 133 if (paddr->s_addr == INADDR_ANY) 134 pmask->s_addr = INADDR_ANY; 135 else 136 *pmask = bits2mask(bits); 137 } 138 139 return (1); 140} 141 142static int 143ParsePort(const char *service, int proto) 144{ 145 const char *protocol_name; 146 char *cp; 147 struct servent *servent; 148 int port; 149 150 switch (proto) { 151 case P_UDP: 152 protocol_name = "udp"; 153 break; 154 case P_TCP: 155 protocol_name = "tcp"; 156 break; 157 default: 158 protocol_name = 0; 159 } 160 161 servent = getservbyname(service, protocol_name); 162 if (servent != 0) 163 return (ntohs(servent->s_port)); 164 165 port = strtol(service, &cp, 0); 166 if (cp == service) { 167 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n", 168 service); 169 return (0); 170 } 171 return (port); 172} 173 174/* 175 * ICMP Syntax: src eq icmp_message_type 176 */ 177static int 178ParseIcmp(int argc, char const *const *argv, struct filterent *tgt) 179{ 180 int type; 181 char *cp; 182 183 switch (argc) { 184 case 0: 185 /* permit/deny all ICMP types */ 186 tgt->opt.srcop = OP_NONE; 187 break; 188 189 case 3: 190 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) { 191 type = strtol(argv[2], &cp, 0); 192 if (cp == argv[2]) { 193 log_Printf(LogWARN, "ParseIcmp: type is expected.\n"); 194 return (0); 195 } 196 tgt->opt.srcop = OP_EQ; 197 tgt->opt.srcport = type; 198 } 199 break; 200 201 default: 202 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n"); 203 return (0); 204 } 205 return (1); 206} 207 208/* 209 * UDP Syntax: [src op port] [dst op port] 210 */ 211static int 212ParseUdpOrTcp(int argc, char const *const *argv, int proto, 213 struct filterent *tgt) 214{ 215 tgt->opt.srcop = tgt->opt.dstop = OP_NONE; 216 tgt->opt.estab = tgt->opt.syn = tgt->opt.finrst = 0; 217 218 if (argc >= 3 && !strcmp(*argv, "src")) { 219 tgt->opt.srcop = filter_Nam2Op(argv[1]); 220 if (tgt->opt.srcop == OP_NONE) { 221 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 222 return (0); 223 } 224 tgt->opt.srcport = ParsePort(argv[2], proto); 225 if (tgt->opt.srcport == 0) 226 return (0); 227 argc -= 3; 228 argv += 3; 229 } 230 231 if (argc >= 3 && !strcmp(argv[0], "dst")) { 232 tgt->opt.dstop = filter_Nam2Op(argv[1]); 233 if (tgt->opt.dstop == OP_NONE) { 234 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 235 return (0); 236 } 237 tgt->opt.dstport = ParsePort(argv[2], proto); 238 if (tgt->opt.dstport == 0) 239 return (0); 240 argc -= 3; 241 argv += 3; 242 } 243 244 if (proto == P_TCP) { 245 for (; argc > 0; argc--, argv++) 246 if (!strcmp(*argv, "estab")) 247 tgt->opt.estab = 1; 248 else if (!strcmp(*argv, "syn")) 249 tgt->opt.syn = 1; 250 else if (!strcmp(*argv, "finrst")) 251 tgt->opt.finrst = 1; 252 else 253 break; 254 } 255 256 if (argc > 0) { 257 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv); 258 return 0; 259 } 260 261 return 1; 262} 263 264static int ParseIgmp(int argc, char const * const *argv, struct filterent *tgt) { 265 /* Filter currently is a catch-all. Requests are either permitted or 266 dropped. */ 267 if (argc != 0) { 268 log_Printf(LogWARN, "ParseIgmp: Too many parameters\n"); 269 return 0; 270 } else 271 tgt->opt.srcop = OP_NONE; 272 273 return 1; 274} 275 276static unsigned 277addrtype(const char *addr) 278{ 279 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/')) 280 return T_MYADDR; 281 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/')) 282 return T_HISADDR; 283 284 return T_ADDR; 285} 286 287static const char * 288addrstr(struct in_addr addr, unsigned type) 289{ 290 switch (type) { 291 case T_MYADDR: 292 return "MYADDR"; 293 case T_HISADDR: 294 return "HISADDR"; 295 } 296 return inet_ntoa(addr); 297} 298 299static int 300Parse(struct ipcp *ipcp, int argc, char const *const *argv, 301 struct filterent *ofp) 302{ 303 int action, proto; 304 int val; 305 char *wp; 306 struct filterent filterdata; 307 308 val = strtol(*argv, &wp, 0); 309 if (*argv == wp || val > MAXFILTERS) { 310 log_Printf(LogWARN, "Parse: invalid filter number.\n"); 311 return (0); 312 } 313 if (val < 0) { 314 for (val = 0; val < MAXFILTERS; val++) { 315 ofp->action = A_NONE; 316 ofp++; 317 } 318 log_Printf(LogWARN, "Parse: filter cleared.\n"); 319 return (1); 320 } 321 ofp += val; 322 323 if (--argc == 0) { 324 log_Printf(LogWARN, "Parse: missing action.\n"); 325 return (0); 326 } 327 argv++; 328 329 proto = P_NONE; 330 memset(&filterdata, '\0', sizeof filterdata); 331 332 if (!strcmp(*argv, "permit")) { 333 action = A_PERMIT; 334 } else if (!strcmp(*argv, "deny")) { 335 action = A_DENY; 336 } else if (!strcmp(*argv, "clear")) { 337 ofp->action = A_NONE; 338 return (1); 339 } else { 340 log_Printf(LogWARN, "Parse: bad action: %s\n", *argv); 341 return (0); 342 } 343 filterdata.action = action; 344 345 argc--; 346 argv++; 347 348 if (argc && filterdata.action == A_DENY) { 349 if (!strcmp(*argv, "host")) { 350 filterdata.action |= A_UHOST; 351 argc--; 352 argv++; 353 } else if (!strcmp(*argv, "port")) { 354 filterdata.action |= A_UPORT; 355 argc--; 356 argv++; 357 } 358 } 359 360 proto = filter_Nam2Proto(argc, argv); 361 if (proto == P_NONE) { 362 if (!argc) 363 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 364 else if (ParseAddr(ipcp, *argv, &filterdata.src.ipaddr, 365 &filterdata.src.mask, &filterdata.src.width)) { 366 filterdata.srctype = addrtype(*argv); 367 argc--; 368 argv++; 369 proto = filter_Nam2Proto(argc, argv); 370 if (!argc) 371 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 372 else if (proto == P_NONE) { 373 if (ParseAddr(ipcp, *argv, &filterdata.dst.ipaddr, &filterdata.dst.mask, 374 &filterdata.dst.width)) { 375 filterdata.dsttype = addrtype(*argv); 376 argc--; 377 argv++; 378 } else 379 filterdata.dsttype = T_ADDR; 380 proto = filter_Nam2Proto(argc, argv); 381 if (argc && proto != P_NONE) { 382 argc--; 383 argv++; 384 } 385 } else { 386 argc--; 387 argv++; 388 } 389 } else { 390 log_Printf(LogWARN, "Parse: Address/protocol expected.\n"); 391 return (0); 392 } 393 } else { 394 argc--; 395 argv++; 396 } 397 398 val = 1; 399 filterdata.proto = proto; 400 401 switch (proto) { 402 case P_TCP: 403 val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata); 404 break; 405 case P_UDP: 406 val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata); 407 break; 408 case P_ICMP: 409 val = ParseIcmp(argc, argv, &filterdata); 410 break; 411 case P_IGMP: 412 val = ParseIgmp(argc, argv, &filterdata); 413 break; 414 } 415 416 log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.src.ipaddr)); 417 log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.src.mask)); 418 log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.dst.ipaddr)); 419 log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.dst.mask)); 420 log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto); 421 422 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n", 423 filter_Op2Nam(filterdata.opt.srcop), filterdata.opt.srcport); 424 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n", 425 filter_Op2Nam(filterdata.opt.dstop), filterdata.opt.dstport); 426 log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.opt.estab); 427 log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.opt.syn); 428 log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.opt.finrst); 429 430 if (val) 431 *ofp = filterdata; 432 return (val); 433} 434 435int 436filter_Set(struct cmdargs const *arg) 437{ 438 struct filter *filter; 439 440 if (arg->argc < arg->argn+2) 441 return -1; 442 443 if (!strcmp(arg->argv[arg->argn], "in")) 444 filter = &arg->bundle->filter.in; 445 else if (!strcmp(arg->argv[arg->argn], "out")) 446 filter = &arg->bundle->filter.out; 447 else if (!strcmp(arg->argv[arg->argn], "dial")) 448 filter = &arg->bundle->filter.dial; 449 else if (!strcmp(arg->argv[arg->argn], "alive")) 450 filter = &arg->bundle->filter.alive; 451 else { 452 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n", 453 arg->argv[arg->argn]); 454 return -1; 455 } 456 457 Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1, 458 arg->argv + arg->argn + 1, filter->rule); 459 return 0; 460} 461 462const char * 463filter_Action2Nam(int act) 464{ 465 static const char *actname[] = { "none ", "permit ", "deny " }; 466 return actname[act & (A_PERMIT|A_DENY)]; 467} 468 469static void 470doShowFilter(struct filterent *fp, struct prompt *prompt) 471{ 472 int n; 473 474 for (n = 0; n < MAXFILTERS; n++, fp++) { 475 if (fp->action != A_NONE) { 476 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->action)); 477 if (fp->action & A_UHOST) 478 prompt_Printf(prompt, "host "); 479 else if (fp->action & A_UPORT) 480 prompt_Printf(prompt, "port "); 481 else 482 prompt_Printf(prompt, " "); 483 prompt_Printf(prompt, "%s/%d ", addrstr(fp->src.ipaddr, fp->srctype), 484 fp->src.width); 485 prompt_Printf(prompt, "%s/%d ", addrstr(fp->dst.ipaddr, fp->dsttype), 486 fp->dst.width); 487 if (fp->proto) { 488 prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->proto)); 489 490 if (fp->opt.srcop) 491 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->opt.srcop), 492 fp->opt.srcport); 493 if (fp->opt.dstop) 494 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->opt.dstop), 495 fp->opt.dstport); 496 if (fp->opt.estab) 497 prompt_Printf(prompt, " estab"); 498 if (fp->opt.syn) 499 prompt_Printf(prompt, " syn"); 500 if (fp->opt.finrst) 501 prompt_Printf(prompt, " finrst"); 502 } 503 prompt_Printf(prompt, "\n"); 504 } 505 } 506} 507 508int 509filter_Show(struct cmdargs const *arg) 510{ 511 if (arg->argc > arg->argn+1) 512 return -1; 513 514 if (arg->argc == arg->argn+1) { 515 struct filter *filter; 516 517 if (!strcmp(arg->argv[arg->argn], "in")) 518 filter = &arg->bundle->filter.in; 519 else if (!strcmp(arg->argv[arg->argn], "out")) 520 filter = &arg->bundle->filter.out; 521 else if (!strcmp(arg->argv[arg->argn], "dial")) 522 filter = &arg->bundle->filter.dial; 523 else if (!strcmp(arg->argv[arg->argn], "alive")) 524 filter = &arg->bundle->filter.alive; 525 else 526 return -1; 527 doShowFilter(filter->rule, arg->prompt); 528 } else { 529 struct filter *filter[4]; 530 int f; 531 532 filter[0] = &arg->bundle->filter.in; 533 filter[1] = &arg->bundle->filter.out; 534 filter[2] = &arg->bundle->filter.dial; 535 filter[3] = &arg->bundle->filter.alive; 536 for (f = 0; f < 4; f++) { 537 if (f) 538 prompt_Printf(arg->prompt, "\n"); 539 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name); 540 doShowFilter(filter[f]->rule, arg->prompt); 541 } 542 } 543 544 return 0; 545} 546 547static const char *protoname[] = { "none", "tcp", "udp", "icmp", "igmp" }; 548 549const char * 550filter_Proto2Nam(int proto) 551{ 552 if (proto >= sizeof protoname / sizeof protoname[0]) 553 return "unknown"; 554 return protoname[proto]; 555} 556 557static int 558filter_Nam2Proto(int argc, char const *const *argv) 559{ 560 int proto; 561 562 if (argc == 0) 563 proto = 0; 564 else 565 for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--) 566 if (!strcasecmp(*argv, protoname[proto])) 567 break; 568 569 return proto; 570} 571 572static const char *opname[] = {"none", "eq", "gt", "unknown", "lt"}; 573 574const char * 575filter_Op2Nam(int op) 576{ 577 if (op >= sizeof opname / sizeof opname[0]) 578 return "unknown"; 579 return opname[op]; 580 581} 582 583static int 584filter_Nam2Op(const char *cp) 585{ 586 int op; 587 588 for (op = sizeof opname / sizeof opname[0] - 1; op; op--) 589 if (!strcasecmp(cp, opname[op])) 590 break; 591 592 return op; 593} 594 595void 596filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip, 597 struct in_addr *peer_ip) 598{ 599 struct filterent *fp; 600 int n; 601 602 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++) 603 if (fp->action != A_NONE) { 604 if (my_ip) { 605 if (fp->srctype == T_MYADDR) 606 fp->src.ipaddr = *my_ip; 607 if (fp->dsttype == T_MYADDR) 608 fp->dst.ipaddr = *my_ip; 609 } 610 if (peer_ip) { 611 if (fp->srctype == T_HISADDR) 612 fp->src.ipaddr = *peer_ip; 613 if (fp->dsttype == T_HISADDR) 614 fp->dst.ipaddr = *peer_ip; 615 } 616 } 617} 618