1/*-
2 * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org>
3 *          based on work by Toshiharu OHNO <tony-o@iij.ad.jp>
4 *                           Internet Initiative Japan, Inc (IIJ)
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD$
29 */
30
31#include <sys/param.h>
32#include <netinet/in.h>
33#include <netdb.h>
34#include <netinet/in_systm.h>
35#include <netinet/ip.h>
36#include <sys/socket.h>
37#include <sys/un.h>
38
39#include <stdarg.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>
43#include <termios.h>
44
45#include "layer.h"
46#include "defs.h"
47#include "command.h"
48#include "mbuf.h"
49#include "log.h"
50#include "iplist.h"
51#include "timer.h"
52#include "throughput.h"
53#include "lqr.h"
54#include "hdlc.h"
55#include "fsm.h"
56#include "lcp.h"
57#include "ccp.h"
58#include "link.h"
59#include "slcompress.h"
60#include "ncpaddr.h"
61#include "ipcp.h"
62#include "filter.h"
63#include "descriptor.h"
64#include "prompt.h"
65#include "mp.h"
66#ifndef NORADIUS
67#include "radius.h"
68#endif
69#include "ipv6cp.h"
70#include "ncp.h"
71#include "bundle.h"
72
73static unsigned filter_Nam2Op(const char *);
74
75static int
76ParsePort(const char *service, const char *proto)
77{
78  struct servent *servent;
79  char *cp;
80  int port;
81
82  servent = getservbyname(service, proto);
83  if (servent != 0)
84    return ntohs(servent->s_port);
85
86  port = strtol(service, &cp, 0);
87  if (cp == service) {
88    log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
89	      service);
90    return 0;
91  }
92  return port;
93}
94
95/*
96 *	ICMP Syntax:	src eq icmp_message_type
97 */
98static int
99ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
100{
101  int type;
102  char *cp;
103
104  switch (argc) {
105  case 0:
106    /* permit/deny all ICMP types */
107    tgt->f_srcop = tgt->f_dstop = OP_NONE;
108    break;
109
110  case 3:
111    if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
112      type = strtol(argv[2], &cp, 0);
113      if (cp == argv[2]) {
114	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
115	return 0;
116      }
117      tgt->f_srcop = OP_EQ;
118      tgt->f_srcport = type;
119      tgt->f_dstop = OP_NONE;
120    }
121    break;
122
123  default:
124    log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
125    return 0;
126  }
127  return 1;
128}
129
130/*
131 *	UDP Syntax: [src op port] [dst op port]
132 */
133static int
134ParseUdpOrTcp(int argc, char const *const *argv, const struct protoent *pe,
135              struct filterent *tgt)
136{
137  tgt->f_srcop = tgt->f_dstop = OP_NONE;
138  tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
139
140  if (argc >= 3 && !strcmp(*argv, "src")) {
141    tgt->f_srcop = filter_Nam2Op(argv[1]);
142    if (tgt->f_srcop == OP_NONE) {
143      log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
144      return 0;
145    }
146    if (pe == NULL)
147      return 0;
148    tgt->f_srcport = ParsePort(argv[2], pe->p_name);
149    if (tgt->f_srcport == 0)
150      return 0;
151    argc -= 3;
152    argv += 3;
153  }
154
155  if (argc >= 3 && !strcmp(argv[0], "dst")) {
156    tgt->f_dstop = filter_Nam2Op(argv[1]);
157    if (tgt->f_dstop == OP_NONE) {
158      log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
159      return 0;
160    }
161    if (pe == NULL)
162      return 0;
163    tgt->f_dstport = ParsePort(argv[2], pe->p_name);
164    if (tgt->f_dstport == 0)
165      return 0;
166    argc -= 3;
167    argv += 3;
168  }
169
170  if (pe && pe->p_proto == IPPROTO_TCP) {
171    for (; argc > 0; argc--, argv++)
172      if (!strcmp(*argv, "estab"))
173        tgt->f_estab = 1;
174      else if (!strcmp(*argv, "syn"))
175        tgt->f_syn = 1;
176      else if (!strcmp(*argv, "finrst"))
177        tgt->f_finrst = 1;
178      else
179        break;
180  }
181
182  if (argc > 0) {
183    log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
184    return 0;
185  }
186
187  return 1;
188}
189
190static int
191ParseGeneric(int argc, struct filterent *tgt)
192{
193  /*
194   * Filter currently is a catch-all. Requests are either permitted or
195   * dropped.
196   */
197  if (argc != 0) {
198    log_Printf(LogWARN, "ParseGeneric: Too many parameters\n");
199    return 0;
200  } else
201    tgt->f_srcop = tgt->f_dstop = OP_NONE;
202
203  return 1;
204}
205
206static unsigned
207addrtype(const char *addr)
208{
209  if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
210    return T_MYADDR;
211  if (!strncasecmp(addr, "MYADDR6", 7) && (addr[7] == '\0' || addr[7] == '/'))
212    return T_MYADDR6;
213  if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
214    return T_HISADDR;
215  if (!strncasecmp(addr, "HISADDR6", 8) && (addr[8] == '\0' || addr[8] == '/'))
216    return T_HISADDR6;
217  if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/'))
218    return T_DNS0;
219  if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/'))
220    return T_DNS1;
221
222  return T_ADDR;
223}
224
225static const char *
226addrstr(struct ncprange *addr, unsigned type)
227{
228  switch (type) {
229    case T_MYADDR:
230      return "MYADDR";
231    case T_HISADDR:
232      return "HISADDR";
233    case T_DNS0:
234      return "DNS0";
235    case T_DNS1:
236      return "DNS1";
237  }
238  return ncprange_ntoa(addr);
239}
240
241static int
242filter_Parse(struct ncp *ncp, int argc, char const *const *argv,
243             struct filterent *ofp)
244{
245  struct filterent fe;
246  struct protoent *pe;
247  char *wp;
248  int action, family, ruleno, val, width;
249
250  ruleno = strtol(*argv, &wp, 0);
251  if (*argv == wp || ruleno >= MAXFILTERS) {
252    log_Printf(LogWARN, "Parse: invalid filter number.\n");
253    return 0;
254  }
255  if (ruleno < 0) {
256    for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
257      ofp->f_action = A_NONE;
258      ofp++;
259    }
260    log_Printf(LogWARN, "Parse: filter cleared.\n");
261    return 1;
262  }
263  ofp += ruleno;
264
265  if (--argc == 0) {
266    log_Printf(LogWARN, "Parse: missing action.\n");
267    return 0;
268  }
269  argv++;
270
271  memset(&fe, '\0', sizeof fe);
272
273  val = strtol(*argv, &wp, 0);
274  if (!*wp && val >= 0 && val < MAXFILTERS) {
275    if (val <= ruleno) {
276      log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
277                 ruleno);
278      return 0;
279    }
280    action = val;
281  } else if (!strcmp(*argv, "permit")) {
282    action = A_PERMIT;
283  } else if (!strcmp(*argv, "deny")) {
284    action = A_DENY;
285  } else if (!strcmp(*argv, "clear")) {
286    ofp->f_action = A_NONE;
287    return 1;
288  } else {
289    log_Printf(LogWARN, "Parse: %s: bad action\n", *argv);
290    return 0;
291  }
292  fe.f_action = action;
293
294  argc--;
295  argv++;
296
297  if (argc && argv[0][0] == '!' && !argv[0][1]) {
298    fe.f_invert = 1;
299    argc--;
300    argv++;
301  }
302
303  ncprange_init(&fe.f_src);
304  ncprange_init(&fe.f_dst);
305
306  if (argc == 0)
307    pe = NULL;
308  else if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
309    if (argc < 2) {
310      log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
311      return 0;
312    } else if (strcasecmp(*argv, "any") == 0 ||
313               ncprange_aton(&fe.f_src, ncp, *argv)) {
314      family = ncprange_family(&fe.f_src);
315      if (!ncprange_getwidth(&fe.f_src, &width))
316        width = 0;
317      if (width == 0)
318        ncprange_init(&fe.f_src);
319      fe.f_srctype = addrtype(*argv);
320      argc--;
321      argv++;
322
323      if (strcasecmp(*argv, "any") == 0 ||
324          ncprange_aton(&fe.f_dst, ncp, *argv)) {
325        if (ncprange_family(&fe.f_dst) != AF_UNSPEC &&
326            ncprange_family(&fe.f_src) != AF_UNSPEC &&
327            family != ncprange_family(&fe.f_dst)) {
328          log_Printf(LogWARN, "Parse: src and dst address families differ\n");
329          return 0;
330        }
331        if (!ncprange_getwidth(&fe.f_dst, &width))
332          width = 0;
333        if (width == 0)
334          ncprange_init(&fe.f_dst);
335        fe.f_dsttype = addrtype(*argv);
336        argc--;
337        argv++;
338      } else {
339        log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
340        return 0;
341      }
342
343      if (argc) {
344        if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
345          log_Printf(LogWARN, "Parse: %s: Protocol expected\n", *argv);
346          return 0;
347        } else {
348          argc--;
349          argv++;
350        }
351      }
352    } else {
353      log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
354      return 0;
355    }
356  } else {
357    argc--;
358    argv++;
359  }
360
361  if (argc >= 2 && strcmp(*argv, "timeout") == 0) {
362    fe.timeout = strtoul(argv[1], NULL, 10);
363    argc -= 2;
364    argv += 2;
365  }
366
367  val = 1;
368  fe.f_proto = (pe == NULL) ? 0 : pe->p_proto;
369
370  switch (fe.f_proto) {
371  case IPPROTO_TCP:
372  case IPPROTO_UDP:
373  case IPPROTO_IPIP:
374#ifndef NOINET6
375  case IPPROTO_IPV6:
376#endif
377    val = ParseUdpOrTcp(argc, argv, pe, &fe);
378    break;
379  case IPPROTO_ICMP:
380#ifndef NOINET6
381  case IPPROTO_ICMPV6:
382#endif
383    val = ParseIcmp(argc, argv, &fe);
384    break;
385  default:
386    val = ParseGeneric(argc, &fe);
387    break;
388  }
389
390  log_Printf(LogDEBUG, "Parse: Src: %s\n", ncprange_ntoa(&fe.f_src));
391  log_Printf(LogDEBUG, "Parse: Dst: %s\n", ncprange_ntoa(&fe.f_dst));
392  log_Printf(LogDEBUG, "Parse: Proto: %d\n", fe.f_proto);
393
394  log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
395            filter_Op2Nam(fe.f_srcop), fe.f_srcport);
396  log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
397            filter_Op2Nam(fe.f_dstop), fe.f_dstport);
398  log_Printf(LogDEBUG, "Parse: estab: %u\n", fe.f_estab);
399  log_Printf(LogDEBUG, "Parse: syn: %u\n", fe.f_syn);
400  log_Printf(LogDEBUG, "Parse: finrst: %u\n", fe.f_finrst);
401
402  if (val)
403    *ofp = fe;
404
405  return val;
406}
407
408int
409filter_Set(struct cmdargs const *arg)
410{
411  struct filter *filter;
412
413  if (arg->argc < arg->argn+2)
414    return -1;
415
416  if (!strcmp(arg->argv[arg->argn], "in"))
417    filter = &arg->bundle->filter.in;
418  else if (!strcmp(arg->argv[arg->argn], "out"))
419    filter = &arg->bundle->filter.out;
420  else if (!strcmp(arg->argv[arg->argn], "dial"))
421    filter = &arg->bundle->filter.dial;
422  else if (!strcmp(arg->argv[arg->argn], "alive"))
423    filter = &arg->bundle->filter.alive;
424  else {
425    log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
426              arg->argv[arg->argn]);
427    return -1;
428  }
429
430  filter_Parse(&arg->bundle->ncp, arg->argc - arg->argn - 1,
431        arg->argv + arg->argn + 1, filter->rule);
432  return 0;
433}
434
435const char *
436filter_Action2Nam(unsigned act)
437{
438  static const char * const actname[] = { "  none ", "permit ", "  deny " };
439  static char buf[8];
440
441  if (act < MAXFILTERS) {
442    snprintf(buf, sizeof buf, "%6d ", act);
443    return buf;
444  } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
445    return actname[act - A_NONE];
446  else
447    return "?????? ";
448}
449
450static void
451doShowFilter(struct filterent *fp, struct prompt *prompt)
452{
453  struct protoent *pe;
454  int n;
455
456  for (n = 0; n < MAXFILTERS; n++, fp++) {
457    if (fp->f_action != A_NONE) {
458      prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->f_action));
459      prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
460
461      if (ncprange_isset(&fp->f_src))
462        prompt_Printf(prompt, "%s ", addrstr(&fp->f_src, fp->f_srctype));
463      else
464        prompt_Printf(prompt, "any ");
465
466      if (ncprange_isset(&fp->f_dst))
467        prompt_Printf(prompt, "%s ", addrstr(&fp->f_dst, fp->f_dsttype));
468      else
469        prompt_Printf(prompt, "any ");
470
471      if (fp->f_proto) {
472        if ((pe = getprotobynumber(fp->f_proto)) == NULL)
473	  prompt_Printf(prompt, "P:%d", fp->f_proto);
474        else
475	  prompt_Printf(prompt, "%s", pe->p_name);
476
477	if (fp->f_srcop)
478	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
479		  fp->f_srcport);
480	if (fp->f_dstop)
481	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
482		  fp->f_dstport);
483	if (fp->f_estab)
484	  prompt_Printf(prompt, " estab");
485	if (fp->f_syn)
486	  prompt_Printf(prompt, " syn");
487	if (fp->f_finrst)
488	  prompt_Printf(prompt, " finrst");
489      } else
490	prompt_Printf(prompt, "all");
491      if (fp->timeout != 0)
492	  prompt_Printf(prompt, " timeout %u", fp->timeout);
493      prompt_Printf(prompt, "\n");
494    }
495  }
496}
497
498int
499filter_Show(struct cmdargs const *arg)
500{
501  if (arg->argc > arg->argn+1)
502    return -1;
503
504  if (arg->argc == arg->argn+1) {
505    struct filter *filter;
506
507    if (!strcmp(arg->argv[arg->argn], "in"))
508      filter = &arg->bundle->filter.in;
509    else if (!strcmp(arg->argv[arg->argn], "out"))
510      filter = &arg->bundle->filter.out;
511    else if (!strcmp(arg->argv[arg->argn], "dial"))
512      filter = &arg->bundle->filter.dial;
513    else if (!strcmp(arg->argv[arg->argn], "alive"))
514      filter = &arg->bundle->filter.alive;
515    else
516      return -1;
517    doShowFilter(filter->rule, arg->prompt);
518  } else {
519    struct filter *filter[4];
520    int f;
521
522    filter[0] = &arg->bundle->filter.in;
523    filter[1] = &arg->bundle->filter.out;
524    filter[2] = &arg->bundle->filter.dial;
525    filter[3] = &arg->bundle->filter.alive;
526    for (f = 0; f < 4; f++) {
527      if (f)
528        prompt_Printf(arg->prompt, "\n");
529      prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
530      doShowFilter(filter[f]->rule, arg->prompt);
531    }
532  }
533
534  return 0;
535}
536
537static const char * const opname[] = {"none", "eq", "gt", "lt"};
538
539const char *
540filter_Op2Nam(unsigned op)
541{
542  if (op >= sizeof opname / sizeof opname[0])
543    return "unknown";
544  return opname[op];
545
546}
547
548static unsigned
549filter_Nam2Op(const char *cp)
550{
551  unsigned op;
552
553  for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
554    if (!strcasecmp(cp, opname[op]))
555      break;
556
557  return op;
558}
559
560void
561filter_AdjustAddr(struct filter *filter, struct ncpaddr *local,
562                  struct ncpaddr *remote, struct in_addr *dns)
563{
564  struct filterent *fp;
565  int n;
566
567  for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
568    if (fp->f_action != A_NONE) {
569      if (local) {
570        if (fp->f_srctype == T_MYADDR && ncpaddr_family(local) == AF_INET)
571          ncprange_sethost(&fp->f_src, local);
572        if (fp->f_dsttype == T_MYADDR && ncpaddr_family(local) == AF_INET)
573          ncprange_sethost(&fp->f_dst, local);
574#ifndef NOINET6
575        if (fp->f_srctype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
576          ncprange_sethost(&fp->f_src, local);
577        if (fp->f_dsttype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
578          ncprange_sethost(&fp->f_dst, local);
579#endif
580      }
581      if (remote) {
582        if (fp->f_srctype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
583          ncprange_sethost(&fp->f_src, remote);
584        if (fp->f_dsttype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
585          ncprange_sethost(&fp->f_dst, remote);
586#ifndef NOINET6
587        if (fp->f_srctype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
588          ncprange_sethost(&fp->f_src, remote);
589        if (fp->f_dsttype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
590          ncprange_sethost(&fp->f_dst, remote);
591#endif
592      }
593      if (dns) {
594        if (fp->f_srctype == T_DNS0)
595          ncprange_setip4host(&fp->f_src, dns[0]);
596        if (fp->f_dsttype == T_DNS0)
597          ncprange_setip4host(&fp->f_dst, dns[0]);
598        if (fp->f_srctype == T_DNS1)
599          ncprange_setip4host(&fp->f_src, dns[1]);
600        if (fp->f_dsttype == T_DNS1)
601          ncprange_setip4host(&fp->f_dst, dns[1]);
602      }
603    }
604}
605