filter.c revision 49144 
1/*
2 *		PPP Filter command Interface
3 *
4 *	    Written by Toshiharu OHNO (tony-o@iij.ad.jp)
5 *
6 *   Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd.
7 *
8 * Redistribution and use in source and binary forms are permitted
9 * provided that the above copyright notice and this paragraph are
10 * duplicated in all such forms and that any documentation,
11 * advertising materials, and other materials related to such
12 * distribution and use acknowledge that the software was developed
13 * by the Internet Initiative Japan.  The name of the
14 * IIJ may not be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19 *
20 * $Id: filter.c,v 1.32 1999/07/27 23:43:58 brian Exp $
21 *
22 *	TODO: Shoud send ICMP error message when we discard packets.
23 */
24
25#include <sys/param.h>
26#include <netinet/in.h>
27#include <arpa/inet.h>
28#include <netdb.h>
29#include <netinet/in_systm.h>
30#include <netinet/ip.h>
31#include <sys/un.h>
32
33#include <stdio.h>
34#include <stdlib.h>
35#include <strings.h>
36#include <termios.h>
37
38#include "layer.h"
39#include "defs.h"
40#include "command.h"
41#include "mbuf.h"
42#include "log.h"
43#include "iplist.h"
44#include "timer.h"
45#include "throughput.h"
46#include "lqr.h"
47#include "hdlc.h"
48#include "fsm.h"
49#include "lcp.h"
50#include "ccp.h"
51#include "link.h"
52#include "slcompress.h"
53#include "ipcp.h"
54#include "filter.h"
55#include "descriptor.h"
56#include "prompt.h"
57#include "mp.h"
58#ifndef NORADIUS
59#include "radius.h"
60#endif
61#include "bundle.h"
62
63static int filter_Nam2Proto(int, char const *const *);
64static int filter_Nam2Op(const char *);
65
66static const u_int32_t netmasks[33] = {
67  0x00000000,
68  0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
69  0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
70  0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000,
71  0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000,
72  0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000,
73  0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00,
74  0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0,
75  0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF,
76};
77
78struct in_addr
79bits2mask(int bits)
80{
81  struct in_addr result;
82
83  result.s_addr = htonl(netmasks[bits]);
84  return result;
85}
86
87int
88ParseAddr(struct ipcp *ipcp, const char *data,
89	  struct in_addr *paddr, struct in_addr *pmask, int *pwidth)
90{
91  int bits, len;
92  char *wp;
93  const char *cp;
94
95  if (pmask)
96    pmask->s_addr = INADDR_BROADCAST;	/* Assume 255.255.255.255 as default */
97
98  cp = pmask || pwidth ? strchr(data, '/') : NULL;
99  len = cp ? cp - data : strlen(data);
100
101  if (ipcp && strncasecmp(data, "HISADDR", len) == 0)
102    *paddr = ipcp->peer_ip;
103  else if (ipcp && strncasecmp(data, "MYADDR", len) == 0)
104    *paddr = ipcp->my_ip;
105  else if (len > 15)
106    log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data);
107  else {
108    char s[16];
109    strncpy(s, data, len);
110    s[len] = '\0';
111    if (inet_aton(s, paddr) == 0) {
112      log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s);
113      return 0;
114    }
115  }
116  if (cp && *++cp) {
117    bits = strtol(cp, &wp, 0);
118    if (cp == wp || bits < 0 || bits > 32) {
119      log_Printf(LogWARN, "ParseAddr: bad mask width.\n");
120      return 0;
121    }
122  } else if (paddr->s_addr == INADDR_ANY)
123    /* An IP of 0.0.0.0 without a width is anything */
124    bits = 0;
125  else
126    /* If a valid IP is given without a width, assume 32 bits */
127    bits = 32;
128
129  if (pwidth)
130    *pwidth = bits;
131
132  if (pmask) {
133    if (paddr->s_addr == INADDR_ANY)
134      pmask->s_addr = INADDR_ANY;
135    else
136      *pmask = bits2mask(bits);
137  }
138
139  return 1;
140}
141
142static int
143ParsePort(const char *service, int proto)
144{
145  const char *protocol_name;
146  char *cp;
147  struct servent *servent;
148  int port;
149
150  switch (proto) {
151  case P_UDP:
152    protocol_name = "udp";
153    break;
154  case P_TCP:
155    protocol_name = "tcp";
156    break;
157  default:
158    protocol_name = 0;
159  }
160
161  servent = getservbyname(service, protocol_name);
162  if (servent != 0)
163    return ntohs(servent->s_port);
164
165  port = strtol(service, &cp, 0);
166  if (cp == service) {
167    log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
168	      service);
169    return 0;
170  }
171  return port;
172}
173
174/*
175 *	ICMP Syntax:	src eq icmp_message_type
176 */
177static int
178ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
179{
180  int type;
181  char *cp;
182
183  switch (argc) {
184  case 0:
185    /* permit/deny all ICMP types */
186    tgt->f_srcop = OP_NONE;
187    break;
188
189  case 3:
190    if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
191      type = strtol(argv[2], &cp, 0);
192      if (cp == argv[2]) {
193	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
194	return 0;
195      }
196      tgt->f_srcop = OP_EQ;
197      tgt->f_srcport = type;
198    }
199    break;
200
201  default:
202    log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
203    return 0;
204  }
205  return 1;
206}
207
208/*
209 *	UDP Syntax: [src op port] [dst op port]
210 */
211static int
212ParseUdpOrTcp(int argc, char const *const *argv, int proto,
213              struct filterent *tgt)
214{
215  tgt->f_srcop = tgt->f_dstop = OP_NONE;
216  tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
217
218  if (argc >= 3 && !strcmp(*argv, "src")) {
219    tgt->f_srcop = filter_Nam2Op(argv[1]);
220    if (tgt->f_srcop == OP_NONE) {
221      log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
222      return 0;
223    }
224    tgt->f_srcport = ParsePort(argv[2], proto);
225    if (tgt->f_srcport == 0)
226      return 0;
227    argc -= 3;
228    argv += 3;
229  }
230
231  if (argc >= 3 && !strcmp(argv[0], "dst")) {
232    tgt->f_dstop = filter_Nam2Op(argv[1]);
233    if (tgt->f_dstop == OP_NONE) {
234      log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
235      return 0;
236    }
237    tgt->f_dstport = ParsePort(argv[2], proto);
238    if (tgt->f_dstport == 0)
239      return 0;
240    argc -= 3;
241    argv += 3;
242  }
243
244  if (proto == P_TCP) {
245    for (; argc > 0; argc--, argv++)
246      if (!strcmp(*argv, "estab"))
247        tgt->f_estab = 1;
248      else if (!strcmp(*argv, "syn"))
249        tgt->f_syn = 1;
250      else if (!strcmp(*argv, "finrst"))
251        tgt->f_finrst = 1;
252      else
253        break;
254  }
255
256  if (argc > 0) {
257    log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
258    return 0;
259  }
260
261  return 1;
262}
263
264static int ParseIgmp(int argc, char const * const *argv, struct filterent *tgt)
265{
266  /* Filter currently is a catch-all. Requests are either permitted or
267     dropped. */
268  if (argc != 0) {
269    log_Printf(LogWARN, "ParseIgmp: Too many parameters\n");
270    return 0;
271  } else
272    tgt->f_srcop = OP_NONE;
273
274  return 1;
275}
276
277static unsigned
278addrtype(const char *addr)
279{
280  if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
281    return T_MYADDR;
282  if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
283    return T_HISADDR;
284
285  return T_ADDR;
286}
287
288static const char *
289addrstr(struct in_addr addr, unsigned type)
290{
291  switch (type) {
292    case T_MYADDR:
293      return "MYADDR";
294    case T_HISADDR:
295      return "HISADDR";
296  }
297  return inet_ntoa(addr);
298}
299
300static const char *
301maskstr(int bits)
302{
303  static char str[4];
304
305  if (bits == 32)
306    *str = '\0';
307  else
308    snprintf(str, sizeof str, "/%d", bits);
309
310  return str;
311}
312
313static int
314Parse(struct ipcp *ipcp, int argc, char const *const *argv,
315      struct filterent *ofp)
316{
317  int action, proto;
318  int val, ruleno;
319  char *wp;
320  struct filterent filterdata;
321
322  ruleno = strtol(*argv, &wp, 0);
323  if (*argv == wp || ruleno >= MAXFILTERS) {
324    log_Printf(LogWARN, "Parse: invalid filter number.\n");
325    return 0;
326  }
327  if (ruleno < 0) {
328    for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
329      ofp->f_action = A_NONE;
330      ofp++;
331    }
332    log_Printf(LogWARN, "Parse: filter cleared.\n");
333    return 1;
334  }
335  ofp += ruleno;
336
337  if (--argc == 0) {
338    log_Printf(LogWARN, "Parse: missing action.\n");
339    return 0;
340  }
341  argv++;
342
343  proto = P_NONE;
344  memset(&filterdata, '\0', sizeof filterdata);
345
346  val = strtol(*argv, &wp, 0);
347  if (!*wp && val >= 0 && val < MAXFILTERS) {
348    if (val <= ruleno) {
349      log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
350                 ruleno);
351      return 0;
352    }
353    action = val;
354  } else if (!strcmp(*argv, "permit")) {
355    action = A_PERMIT;
356  } else if (!strcmp(*argv, "deny")) {
357    action = A_DENY;
358  } else if (!strcmp(*argv, "clear")) {
359    ofp->f_action = A_NONE;
360    return 1;
361  } else {
362    log_Printf(LogWARN, "Parse: bad action: %s\n", *argv);
363    return 0;
364  }
365  filterdata.f_action = action;
366
367  argc--;
368  argv++;
369
370  if (argc && argv[0][0] == '!' && !argv[0][1]) {
371    filterdata.f_invert = 1;
372    argc--;
373    argv++;
374  }
375
376  proto = filter_Nam2Proto(argc, argv);
377  if (proto == P_NONE) {
378    if (!argc)
379      log_Printf(LogWARN, "Parse: address/mask is expected.\n");
380    else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr,
381                       &filterdata.f_src.mask, &filterdata.f_src.width)) {
382      filterdata.f_srctype = addrtype(*argv);
383      argc--;
384      argv++;
385      proto = filter_Nam2Proto(argc, argv);
386      if (!argc)
387        log_Printf(LogWARN, "Parse: address/mask is expected.\n");
388      else if (proto == P_NONE) {
389	if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr,
390		      &filterdata.f_dst.mask, &filterdata.f_dst.width)) {
391          filterdata.f_dsttype = addrtype(*argv);
392	  argc--;
393	  argv++;
394	} else
395          filterdata.f_dsttype = T_ADDR;
396        if (argc) {
397	  proto = filter_Nam2Proto(argc, argv);
398	  if (proto == P_NONE) {
399            log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv);
400            return 0;
401          } else {
402	    argc--;
403	    argv++;
404	  }
405	}
406      } else {
407	argc--;
408	argv++;
409      }
410    } else {
411      log_Printf(LogWARN, "Parse: Address/protocol expected.\n");
412      return 0;
413    }
414  } else {
415    argc--;
416    argv++;
417  }
418
419  val = 1;
420  filterdata.f_proto = proto;
421
422  switch (proto) {
423  case P_TCP:
424    val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata);
425    break;
426  case P_UDP:
427    val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata);
428    break;
429  case P_ICMP:
430    val = ParseIcmp(argc, argv, &filterdata);
431    break;
432  case P_IGMP:
433    val = ParseIgmp(argc, argv, &filterdata);
434    break;
435  }
436
437  log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr));
438  log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask));
439  log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr));
440  log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask));
441  log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto);
442
443  log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
444            filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport);
445  log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
446            filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport);
447  log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab);
448  log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn);
449  log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst);
450
451  if (val)
452    *ofp = filterdata;
453
454  return val;
455}
456
457int
458filter_Set(struct cmdargs const *arg)
459{
460  struct filter *filter;
461
462  if (arg->argc < arg->argn+2)
463    return -1;
464
465  if (!strcmp(arg->argv[arg->argn], "in"))
466    filter = &arg->bundle->filter.in;
467  else if (!strcmp(arg->argv[arg->argn], "out"))
468    filter = &arg->bundle->filter.out;
469  else if (!strcmp(arg->argv[arg->argn], "dial"))
470    filter = &arg->bundle->filter.dial;
471  else if (!strcmp(arg->argv[arg->argn], "alive"))
472    filter = &arg->bundle->filter.alive;
473  else {
474    log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
475              arg->argv[arg->argn]);
476    return -1;
477  }
478
479  Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1,
480        arg->argv + arg->argn + 1, filter->rule);
481  return 0;
482}
483
484const char *
485filter_Action2Nam(int act)
486{
487  static const char *actname[] = { "  none ", "permit ", "  deny " };
488  static char	buf[8];
489
490  if (act >= 0 && act < MAXFILTERS) {
491    snprintf(buf, sizeof buf, "%6d ", act);
492    return buf;
493  } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
494    return actname[act - A_NONE];
495  else
496    return "?????? ";
497}
498
499static void
500doShowFilter(struct filterent *fp, struct prompt *prompt)
501{
502  int n;
503
504  for (n = 0; n < MAXFILTERS; n++, fp++) {
505    if (fp->f_action != A_NONE) {
506      prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->f_action));
507      prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
508      prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype),
509                    maskstr(fp->f_src.width));
510      prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype),
511                    maskstr(fp->f_dst.width));
512      if (fp->f_proto) {
513	prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto));
514
515	if (fp->f_srcop)
516	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
517		  fp->f_srcport);
518	if (fp->f_dstop)
519	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
520		  fp->f_dstport);
521	if (fp->f_estab)
522	  prompt_Printf(prompt, " estab");
523	if (fp->f_syn)
524	  prompt_Printf(prompt, " syn");
525	if (fp->f_finrst)
526	  prompt_Printf(prompt, " finrst");
527      }
528      prompt_Printf(prompt, "\n");
529    }
530  }
531}
532
533int
534filter_Show(struct cmdargs const *arg)
535{
536  if (arg->argc > arg->argn+1)
537    return -1;
538
539  if (arg->argc == arg->argn+1) {
540    struct filter *filter;
541
542    if (!strcmp(arg->argv[arg->argn], "in"))
543      filter = &arg->bundle->filter.in;
544    else if (!strcmp(arg->argv[arg->argn], "out"))
545      filter = &arg->bundle->filter.out;
546    else if (!strcmp(arg->argv[arg->argn], "dial"))
547      filter = &arg->bundle->filter.dial;
548    else if (!strcmp(arg->argv[arg->argn], "alive"))
549      filter = &arg->bundle->filter.alive;
550    else
551      return -1;
552    doShowFilter(filter->rule, arg->prompt);
553  } else {
554    struct filter *filter[4];
555    int f;
556
557    filter[0] = &arg->bundle->filter.in;
558    filter[1] = &arg->bundle->filter.out;
559    filter[2] = &arg->bundle->filter.dial;
560    filter[3] = &arg->bundle->filter.alive;
561    for (f = 0; f < 4; f++) {
562      if (f)
563        prompt_Printf(arg->prompt, "\n");
564      prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
565      doShowFilter(filter[f]->rule, arg->prompt);
566    }
567  }
568
569  return 0;
570}
571
572static const char *protoname[] = { "none", "tcp", "udp", "icmp", "igmp" };
573
574const char *
575filter_Proto2Nam(int proto)
576{
577  if (proto >= sizeof protoname / sizeof protoname[0])
578    return "unknown";
579  return protoname[proto];
580}
581
582static int
583filter_Nam2Proto(int argc, char const *const *argv)
584{
585  int proto;
586
587  if (argc == 0)
588    proto = 0;
589  else
590    for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--)
591      if (!strcasecmp(*argv, protoname[proto]))
592        break;
593
594  return proto;
595}
596
597static const char *opname[] = {"none", "eq", "gt", "unknown", "lt"};
598
599const char *
600filter_Op2Nam(int op)
601{
602  if (op >= sizeof opname / sizeof opname[0])
603    return "unknown";
604  return opname[op];
605
606}
607
608static int
609filter_Nam2Op(const char *cp)
610{
611  int op;
612
613  for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
614    if (!strcasecmp(cp, opname[op]))
615      break;
616
617  return op;
618}
619
620void
621filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip,
622                  struct in_addr *peer_ip)
623{
624  struct filterent *fp;
625  int n;
626
627  for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
628    if (fp->f_action != A_NONE) {
629      if (my_ip) {
630        if (fp->f_srctype == T_MYADDR)
631          fp->f_src.ipaddr = *my_ip;
632        if (fp->f_dsttype == T_MYADDR)
633          fp->f_dst.ipaddr = *my_ip;
634      }
635      if (peer_ip) {
636        if (fp->f_srctype == T_HISADDR)
637          fp->f_src.ipaddr = *peer_ip;
638        if (fp->f_dsttype == T_HISADDR)
639          fp->f_dst.ipaddr = *peer_ip;
640      }
641    }
642}
643