ip.c revision 49374
1/* 2 * PPP IP Protocol Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $Id: ip.c,v 1.66 1999/08/02 11:53:16 brian Exp $ 21 * 22 * TODO: 23 * o Return ICMP message for filterd packet 24 * and optionaly record it into log. 25 */ 26#include <sys/param.h> 27#if defined(__OpenBSD__) || defined(__NetBSD__) 28#include <sys/socket.h> 29#endif 30#include <netinet/in.h> 31#include <netinet/in_systm.h> 32#include <netinet/ip.h> 33#include <netinet/ip_icmp.h> 34#include <netinet/udp.h> 35#include <netinet/tcp.h> 36#include <arpa/inet.h> 37#include <sys/un.h> 38 39#include <errno.h> 40#include <stdio.h> 41#include <stdlib.h> 42#include <string.h> 43#include <termios.h> 44#include <unistd.h> 45 46#include "layer.h" 47#include "proto.h" 48#include "mbuf.h" 49#include "log.h" 50#include "defs.h" 51#include "timer.h" 52#include "fsm.h" 53#include "lqr.h" 54#include "hdlc.h" 55#include "throughput.h" 56#include "iplist.h" 57#include "slcompress.h" 58#include "ipcp.h" 59#include "filter.h" 60#include "descriptor.h" 61#include "lcp.h" 62#include "ccp.h" 63#include "link.h" 64#include "mp.h" 65#ifndef NORADIUS 66#include "radius.h" 67#endif 68#include "bundle.h" 69#include "vjcomp.h" 70#include "tun.h" 71#include "ip.h" 72 73static const u_short interactive_ports[32] = { 74 544, 513, 514, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 75 80, 81, 0, 0, 0, 21, 22, 23, 0, 0, 0, 0, 0, 0, 0, 543, 76}; 77 78#define INTERACTIVE(p) (interactive_ports[(p) & 0x1F] == (p)) 79 80static const char *TcpFlags[] = { "FIN", "SYN", "RST", "PSH", "ACK", "URG" }; 81 82static __inline int 83PortMatch(int op, u_short pport, u_short rport) 84{ 85 switch (op) { 86 case OP_EQ: 87 return (pport == rport); 88 case OP_GT: 89 return (pport > rport); 90 case OP_LT: 91 return (pport < rport); 92 default: 93 return (0); 94 } 95} 96 97/* 98 * Check a packet against a defined filter 99 * Returns 0 to accept the packet, non-zero to drop the packet 100 * 101 * If filtering is enabled, the initial fragment of a datagram must 102 * contain the complete protocol header, and subsequent fragments 103 * must not attempt to over-write it. 104 */ 105static int 106FilterCheck(const struct ip *pip, const struct filter *filter) 107{ 108 int gotinfo; /* true if IP payload decoded */ 109 int cproto; /* P_* protocol type if (gotinfo) */ 110 int estab, syn, finrst; /* TCP state flags if (gotinfo) */ 111 u_short sport, dport; /* src, dest port from packet if (gotinfo) */ 112 int n; /* filter rule to process */ 113 int len; /* bytes used in dbuff */ 114 int didname; /* true if filter header printed */ 115 int match; /* true if condition matched */ 116 const struct filterent *fp = filter->rule; 117 char dbuff[100]; 118 119 if (fp->f_action == A_NONE) 120 return (0); /* No rule is given. Permit this packet */ 121 122 /* Deny any packet fragment that tries to over-write the header. 123 * Since we no longer have the real header available, punt on the 124 * largest normal header - 20 bytes for TCP without options, rounded 125 * up to the next possible fragment boundary. Since the smallest 126 * `legal' MTU is 576, and the smallest recommended MTU is 296, any 127 * fragmentation within this range is dubious at best */ 128 len = ntohs(pip->ip_off) & IP_OFFMASK; /* fragment offset */ 129 if (len > 0) { /* Not first fragment within datagram */ 130 if (len < (24 >> 3)) /* don't allow fragment to over-write header */ 131 return (1); 132 /* permit fragments on in and out filter */ 133 return (filter->fragok); 134 } 135 136 cproto = gotinfo = estab = syn = finrst = didname = 0; 137 sport = dport = 0; 138 for (n = 0; n < MAXFILTERS; ) { 139 if (fp->f_action == A_NONE) { 140 n++; 141 fp++; 142 continue; 143 } 144 145 if (!didname) { 146 log_Printf(LogDEBUG, "%s filter:\n", filter->name); 147 didname = 1; 148 } 149 150 match = 0; 151 if (!((pip->ip_src.s_addr ^ fp->f_src.ipaddr.s_addr) & 152 fp->f_src.mask.s_addr) && 153 !((pip->ip_dst.s_addr ^ fp->f_dst.ipaddr.s_addr) & 154 fp->f_dst.mask.s_addr)) { 155 if (fp->f_proto != P_NONE) { 156 if (!gotinfo) { 157 const char *ptop = (const char *) pip + (pip->ip_hl << 2); 158 const struct tcphdr *th; 159 const struct udphdr *uh; 160 const struct icmp *ih; 161 int datalen; /* IP datagram length */ 162 163 datalen = ntohs(pip->ip_len) - (pip->ip_hl << 2); 164 switch (pip->ip_p) { 165 case IPPROTO_ICMP: 166 cproto = P_ICMP; 167 if (datalen < 8) /* ICMP must be at least 8 octets */ 168 return (1); 169 ih = (const struct icmp *) ptop; 170 sport = ih->icmp_type; 171 estab = syn = finrst = -1; 172 if (log_IsKept(LogDEBUG)) 173 snprintf(dbuff, sizeof dbuff, "sport = %d", sport); 174 break; 175 case IPPROTO_IGMP: 176 cproto = P_IGMP; 177 if (datalen < 8) /* IGMP uses 8-octet messages */ 178 return (1); 179 estab = syn = finrst = -1; 180 sport = ntohs(0); 181 break; 182#ifdef IPPROTO_OSPFIGP 183 case IPPROTO_OSPFIGP: 184 cproto = P_OSPF; 185 if (datalen < 8) /* IGMP uses 8-octet messages */ 186 return (1); 187 estab = syn = finrst = -1; 188 sport = ntohs(0); 189 break; 190#endif 191 case IPPROTO_UDP: 192 case IPPROTO_IPIP: 193 cproto = P_UDP; 194 if (datalen < 8) /* UDP header is 8 octets */ 195 return (1); 196 uh = (const struct udphdr *) ptop; 197 sport = ntohs(uh->uh_sport); 198 dport = ntohs(uh->uh_dport); 199 estab = syn = finrst = -1; 200 if (log_IsKept(LogDEBUG)) 201 snprintf(dbuff, sizeof dbuff, "sport = %d, dport = %d", 202 sport, dport); 203 break; 204 case IPPROTO_TCP: 205 cproto = P_TCP; 206 th = (const struct tcphdr *) ptop; 207 /* TCP headers are variable length. The following code 208 * ensures that the TCP header length isn't de-referenced if 209 * the datagram is too short 210 */ 211 if (datalen < 20 || datalen < (th->th_off << 2)) 212 return (1); 213 sport = ntohs(th->th_sport); 214 dport = ntohs(th->th_dport); 215 estab = (th->th_flags & TH_ACK); 216 syn = (th->th_flags & TH_SYN); 217 finrst = (th->th_flags & (TH_FIN|TH_RST)); 218 if (log_IsKept(LogDEBUG)) { 219 if (!estab) 220 snprintf(dbuff, sizeof dbuff, 221 "flags = %02x, sport = %d, dport = %d", 222 th->th_flags, sport, dport); 223 else 224 *dbuff = '\0'; 225 } 226 break; 227 default: 228 return (1); /* We'll block unknown type of packet */ 229 } 230 231 if (log_IsKept(LogDEBUG)) { 232 if (estab != -1) { 233 len = strlen(dbuff); 234 snprintf(dbuff + len, sizeof dbuff - len, 235 ", estab = %d, syn = %d, finrst = %d", 236 estab, syn, finrst); 237 } 238 log_Printf(LogDEBUG, " Filter: proto = %s, %s\n", 239 filter_Proto2Nam(cproto), dbuff); 240 } 241 gotinfo = 1; 242 } 243 if (log_IsKept(LogDEBUG)) { 244 if (fp->f_srcop != OP_NONE) { 245 snprintf(dbuff, sizeof dbuff, ", src %s %d", 246 filter_Op2Nam(fp->f_srcop), fp->f_srcport); 247 len = strlen(dbuff); 248 } else 249 len = 0; 250 if (fp->f_dstop != OP_NONE) { 251 snprintf(dbuff + len, sizeof dbuff - len, 252 ", dst %s %d", filter_Op2Nam(fp->f_dstop), 253 fp->f_dstport); 254 } else if (!len) 255 *dbuff = '\0'; 256 257 log_Printf(LogDEBUG, " rule = %d: Address match, " 258 "check against proto %s%s, action = %s\n", 259 n, filter_Proto2Nam(fp->f_proto), 260 dbuff, filter_Action2Nam(fp->f_action)); 261 } 262 263 if (cproto == fp->f_proto) { 264 if ((fp->f_srcop == OP_NONE || 265 PortMatch(fp->f_srcop, sport, fp->f_srcport)) && 266 (fp->f_dstop == OP_NONE || 267 PortMatch(fp->f_dstop, dport, fp->f_dstport)) && 268 (fp->f_estab == 0 || estab) && 269 (fp->f_syn == 0 || syn) && 270 (fp->f_finrst == 0 || finrst)) { 271 match = 1; 272 } 273 } 274 } else { 275 /* Address is matched and no protocol specified. Make a decision. */ 276 log_Printf(LogDEBUG, " rule = %d: Address match, action = %s\n", n, 277 filter_Action2Nam(fp->f_action)); 278 match = 1; 279 } 280 } else 281 log_Printf(LogDEBUG, " rule = %d: Address mismatch\n", n); 282 283 if (match != fp->f_invert) { 284 /* Take specified action */ 285 if (fp->f_action < A_NONE) 286 fp = &filter->rule[n = fp->f_action]; 287 else 288 return (fp->f_action != A_PERMIT); 289 } else { 290 n++; 291 fp++; 292 } 293 } 294 return (1); /* No rule is mached. Deny this packet */ 295} 296 297#ifdef notdef 298static void 299IcmpError(struct ip *pip, int code) 300{ 301 struct mbuf *bp; 302 303 if (pip->ip_p != IPPROTO_ICMP) { 304 bp = mbuf_Alloc(cnt, MB_IPIN); 305 memcpy(MBUF_CTOP(bp), ptr, cnt); 306 vj_SendFrame(bp); 307 ipcp_AddOutOctets(cnt); 308 } 309} 310#endif 311 312/* 313 * For debugging aid. 314 */ 315int 316PacketCheck(struct bundle *bundle, char *cp, int nb, struct filter *filter) 317{ 318 struct ip *pip; 319 struct tcphdr *th; 320 struct udphdr *uh; 321 struct icmp *icmph; 322 char *ptop; 323 int mask, len, n; 324 int pri = PRI_NORMAL; 325 int logit, loglen; 326 char logbuf[200]; 327 328 logit = log_IsKept(LogTCPIP) && filter->logok; 329 loglen = 0; 330 331 pip = (struct ip *) cp; 332 333 if (logit && loglen < sizeof logbuf) { 334 snprintf(logbuf + loglen, sizeof logbuf - loglen, "%s ", filter->name); 335 loglen += strlen(logbuf + loglen); 336 } 337 ptop = (cp + (pip->ip_hl << 2)); 338 339 switch (pip->ip_p) { 340 case IPPROTO_ICMP: 341 if (logit && loglen < sizeof logbuf) { 342 icmph = (struct icmp *) ptop; 343 snprintf(logbuf + loglen, sizeof logbuf - loglen, 344 "ICMP: %s:%d ---> ", inet_ntoa(pip->ip_src), icmph->icmp_type); 345 loglen += strlen(logbuf + loglen); 346 snprintf(logbuf + loglen, sizeof logbuf - loglen, 347 "%s:%d", inet_ntoa(pip->ip_dst), icmph->icmp_type); 348 loglen += strlen(logbuf + loglen); 349 } 350 break; 351 case IPPROTO_UDP: 352 if (logit && loglen < sizeof logbuf) { 353 uh = (struct udphdr *) ptop; 354 snprintf(logbuf + loglen, sizeof logbuf - loglen, 355 "UDP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(uh->uh_sport)); 356 loglen += strlen(logbuf + loglen); 357 snprintf(logbuf + loglen, sizeof logbuf - loglen, 358 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(uh->uh_dport)); 359 loglen += strlen(logbuf + loglen); 360 } 361 break; 362#ifdef IPPROTO_OSPFIGP 363 case IPPROTO_OSPFIGP: 364 if (logit && loglen < sizeof logbuf) { 365 snprintf(logbuf + loglen, sizeof logbuf - loglen, 366 "OSPF: %s ---> ", inet_ntoa(pip->ip_src)); 367 loglen += strlen(logbuf + loglen); 368 snprintf(logbuf + loglen, sizeof logbuf - loglen, 369 "%s", inet_ntoa(pip->ip_dst)); 370 loglen += strlen(logbuf + loglen); 371 } 372 break; 373#endif 374 case IPPROTO_IPIP: 375 if (logit && loglen < sizeof logbuf) { 376 uh = (struct udphdr *) ptop; 377 snprintf(logbuf + loglen, sizeof logbuf - loglen, 378 "IPIP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(uh->uh_sport)); 379 loglen += strlen(logbuf + loglen); 380 snprintf(logbuf + loglen, sizeof logbuf - loglen, 381 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(uh->uh_dport)); 382 loglen += strlen(logbuf + loglen); 383 } 384 break; 385 case IPPROTO_IGMP: 386 if (logit && loglen < sizeof logbuf) { 387 uh = (struct udphdr *) ptop; 388 snprintf(logbuf + loglen, sizeof logbuf - loglen, 389 "IGMP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(uh->uh_sport)); 390 loglen += strlen(logbuf + loglen); 391 snprintf(logbuf + loglen, sizeof logbuf - loglen, 392 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(uh->uh_dport)); 393 loglen += strlen(logbuf + loglen); 394 } 395 break; 396 case IPPROTO_TCP: 397 th = (struct tcphdr *) ptop; 398 if (pip->ip_tos == IPTOS_LOWDELAY) 399 pri = PRI_FAST; 400 else if ((ntohs(pip->ip_off) & IP_OFFMASK) == 0) { 401 if (INTERACTIVE(ntohs(th->th_sport)) || INTERACTIVE(ntohs(th->th_dport))) 402 pri = PRI_FAST; 403 } 404 if (logit && loglen < sizeof logbuf) { 405 len = ntohs(pip->ip_len) - (pip->ip_hl << 2) - (th->th_off << 2); 406 snprintf(logbuf + loglen, sizeof logbuf - loglen, 407 "TCP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(th->th_sport)); 408 loglen += strlen(logbuf + loglen); 409 snprintf(logbuf + loglen, sizeof logbuf - loglen, 410 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(th->th_dport)); 411 loglen += strlen(logbuf + loglen); 412 n = 0; 413 for (mask = TH_FIN; mask != 0x40; mask <<= 1) { 414 if (th->th_flags & mask) { 415 snprintf(logbuf + loglen, sizeof logbuf - loglen, " %s", TcpFlags[n]); 416 loglen += strlen(logbuf + loglen); 417 } 418 n++; 419 } 420 snprintf(logbuf + loglen, sizeof logbuf - loglen, 421 " seq:%lx ack:%lx (%d/%d)", 422 (u_long)ntohl(th->th_seq), (u_long)ntohl(th->th_ack), len, nb); 423 loglen += strlen(logbuf + loglen); 424 if ((th->th_flags & TH_SYN) && nb > 40) { 425 u_short *sp; 426 427 ptop += 20; 428 sp = (u_short *) ptop; 429 if (ntohs(sp[0]) == 0x0204) { 430 snprintf(logbuf + loglen, sizeof logbuf - loglen, 431 " MSS = %d", ntohs(sp[1])); 432 loglen += strlen(logbuf + loglen); 433 } 434 } 435 } 436 break; 437 } 438 439 if (FilterCheck(pip, filter)) { 440 if (logit) 441 log_Printf(LogTCPIP, "%s - BLOCKED\n", logbuf); 442#ifdef notdef 443 if (direction == 0) 444 IcmpError(pip, pri); 445#endif 446 return (-1); 447 } else { 448 /* Check Keep Alive filter */ 449 if (logit) { 450 if (FilterCheck(pip, &bundle->filter.alive)) 451 log_Printf(LogTCPIP, "%s - NO KEEPALIVE\n", logbuf); 452 else 453 log_Printf(LogTCPIP, "%s\n", logbuf); 454 } 455 return (pri); 456 } 457} 458 459struct mbuf * 460ip_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) 461{ 462 int nb, nw; 463 struct tun_data tun; 464 struct ip *pip; 465 466 if (bundle->ncp.ipcp.fsm.state != ST_OPENED) { 467 log_Printf(LogWARN, "ip_Input: IPCP not open - packet dropped\n"); 468 mbuf_Free(bp); 469 return NULL; 470 } 471 472 mbuf_SetType(bp, MB_IPIN); 473 tun_fill_header(tun, AF_INET); 474 nb = mbuf_Length(bp); 475 if (nb > sizeof tun.data) { 476 log_Printf(LogWARN, "ip_Input: %s: Packet too large (got %d, max %d)\n", 477 l->name, nb, (int)(sizeof tun.data)); 478 mbuf_Free(bp); 479 return NULL; 480 } 481 mbuf_Read(bp, tun.data, nb); 482 483 if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) 484 return NULL; 485 486 pip = (struct ip *)tun.data; 487 if (!FilterCheck(pip, &bundle->filter.alive)) 488 bundle_StartIdleTimer(bundle); 489 490 ipcp_AddInOctets(&bundle->ncp.ipcp, nb); 491 492 nb += sizeof tun - sizeof tun.data; 493 nw = write(bundle->dev.fd, &tun, nb); 494 if (nw != nb) { 495 if (nw == -1) 496 log_Printf(LogERROR, "ip_Input: %s: wrote %d, got %s\n", 497 l->name, nb, strerror(errno)); 498 else 499 log_Printf(LogERROR, "ip_Input: %s: wrote %d, got %d\n", l->name, nb, nw); 500 } 501 502 return NULL; 503} 504 505void 506ip_Enqueue(struct ipcp *ipcp, int pri, char *ptr, int count) 507{ 508 struct mbuf *bp; 509 510 if (pri < 0 || pri > sizeof ipcp->Queue / sizeof ipcp->Queue[0]) 511 log_Printf(LogERROR, "Can't store in ip queue %d\n", pri); 512 else { 513 /* 514 * We allocate an extra 6 bytes, four at the front and two at the end. 515 * This is an optimisation so that we need to do less work in 516 * mbuf_Prepend() in acf_LayerPush() and proto_LayerPush() and 517 * appending in hdlc_LayerPush(). 518 */ 519 bp = mbuf_Alloc(count + 6, MB_IPOUT); 520 bp->offset += 4; 521 bp->cnt -= 6; 522 memcpy(MBUF_CTOP(bp), ptr, count); 523 mbuf_Enqueue(&ipcp->Queue[pri], bp); 524 } 525} 526 527void 528ip_DeleteQueue(struct ipcp *ipcp) 529{ 530 struct mqueue *queue; 531 532 for (queue = ipcp->Queue; queue < ipcp->Queue + PRI_MAX; queue++) 533 while (queue->top) 534 mbuf_Free(mbuf_Dequeue(queue)); 535} 536 537int 538ip_QueueLen(struct ipcp *ipcp) 539{ 540 struct mqueue *queue; 541 int result = 0; 542 543 for (queue = ipcp->Queue; queue < ipcp->Queue + PRI_MAX; queue++) 544 result += queue->qlen; 545 546 return result; 547} 548 549int 550ip_PushPacket(struct link *l, struct bundle *bundle) 551{ 552 struct ipcp *ipcp = &bundle->ncp.ipcp; 553 struct mqueue *queue; 554 struct mbuf *bp; 555 struct ip *pip; 556 int cnt; 557 558 if (ipcp->fsm.state != ST_OPENED) 559 return 0; 560 561 for (queue = &ipcp->Queue[PRI_FAST]; queue >= ipcp->Queue; queue--) 562 if (queue->top) { 563 bp = mbuf_Contiguous(mbuf_Dequeue(queue)); 564 cnt = mbuf_Length(bp); 565 pip = (struct ip *)MBUF_CTOP(bp); 566 if (!FilterCheck(pip, &bundle->filter.alive)) 567 bundle_StartIdleTimer(bundle); 568 link_PushPacket(l, bp, bundle, PRI_NORMAL, PROTO_IP); 569 ipcp_AddOutOctets(ipcp, cnt); 570 return 1; 571 } 572 573 return 0; 574} 575