ip.c revision 36285
1/* 2 * PPP IP Protocol Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $Id: ip.c,v 1.38.2.26 1998/05/06 23:50:11 brian Exp $ 21 * 22 * TODO: 23 * o Return ICMP message for filterd packet 24 * and optionaly record it into log. 25 */ 26#include <sys/types.h> 27#include <sys/socket.h> 28#include <netinet/in.h> 29#include <netinet/in_systm.h> 30#include <netinet/ip.h> 31#include <netinet/ip_icmp.h> 32#include <netinet/udp.h> 33#include <netinet/tcp.h> 34#include <arpa/inet.h> 35#include <net/if_tun.h> 36#include <sys/un.h> 37 38#ifndef NOALIAS 39#include <alias.h> 40#endif 41#include <errno.h> 42#include <stdio.h> 43#include <stdlib.h> 44#include <string.h> 45#include <unistd.h> 46 47#include "mbuf.h" 48#include "log.h" 49#include "defs.h" 50#include "timer.h" 51#include "fsm.h" 52#include "lqr.h" 53#include "hdlc.h" 54#include "loadalias.h" 55#include "throughput.h" 56#include "iplist.h" 57#include "slcompress.h" 58#include "ipcp.h" 59#include "filter.h" 60#include "descriptor.h" 61#include "lcp.h" 62#include "ccp.h" 63#include "link.h" 64#include "mp.h" 65#include "bundle.h" 66#include "vjcomp.h" 67#include "tun.h" 68#include "ip.h" 69 70static const u_short interactive_ports[32] = { 71 544, 513, 514, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 72 0, 0, 0, 0, 0, 21, 22, 23, 0, 0, 0, 0, 0, 0, 0, 543, 73}; 74 75#define INTERACTIVE(p) (interactive_ports[(p) & 0x1F] == (p)) 76 77static const char *TcpFlags[] = { "FIN", "SYN", "RST", "PSH", "ACK", "URG" }; 78 79static int 80PortMatch(int op, u_short pport, u_short rport) 81{ 82 switch (op) { 83 case OP_EQ: 84 return (pport == rport); 85 case OP_GT: 86 return (pport > rport); 87 case OP_LT: 88 return (pport < rport); 89 default: 90 return (0); 91 } 92} 93 94/* 95 * Check a packet against with defined filters 96 */ 97static int 98FilterCheck(struct ip *pip, struct filter *filter) 99{ 100 int gotinfo, cproto, estab, syn, finrst, n, len, didname; 101 struct tcphdr *th; 102 struct udphdr *uh; 103 struct icmp *ih; 104 char *ptop; 105 u_short sport, dport; 106 struct filterent *fp = filter->rule; 107 char dbuff[100]; 108 109 if (fp->action) { 110 cproto = gotinfo = estab = syn = finrst = didname = 0; 111 sport = dport = 0; 112 for (n = 0; n < MAXFILTERS; n++) { 113 if (fp->action) { 114 /* permit fragments on in and out filter */ 115 if (filter->fragok && (ntohs(pip->ip_off) & IP_OFFMASK) != 0) 116 return (A_PERMIT); 117 118 if (!didname) 119 log_Printf(LogDEBUG, "%s filter:\n", filter->name); 120 didname = 1; 121 122 if ((pip->ip_src.s_addr & fp->smask.s_addr) == 123 (fp->saddr.s_addr & fp->smask.s_addr) && 124 (pip->ip_dst.s_addr & fp->dmask.s_addr) == 125 (fp->daddr.s_addr & fp->dmask.s_addr)) { 126 if (fp->proto) { 127 if (!gotinfo) { 128 ptop = (char *) pip + (pip->ip_hl << 2); 129 130 switch (pip->ip_p) { 131 case IPPROTO_ICMP: 132 cproto = P_ICMP; 133 ih = (struct icmp *) ptop; 134 sport = ih->icmp_type; 135 estab = syn = finrst = -1; 136 if (log_IsKept(LogDEBUG)) 137 snprintf(dbuff, sizeof dbuff, "sport = %d", sport); 138 break; 139 case IPPROTO_UDP: 140 cproto = P_UDP; 141 uh = (struct udphdr *) ptop; 142 sport = ntohs(uh->uh_sport); 143 dport = ntohs(uh->uh_dport); 144 estab = syn = finrst = -1; 145 if (log_IsKept(LogDEBUG)) 146 snprintf(dbuff, sizeof dbuff, "sport = %d, dport = %d", 147 sport, dport); 148 break; 149 case IPPROTO_TCP: 150 cproto = P_TCP; 151 th = (struct tcphdr *) ptop; 152 sport = ntohs(th->th_sport); 153 dport = ntohs(th->th_dport); 154 estab = (th->th_flags & TH_ACK); 155 syn = (th->th_flags & TH_SYN); 156 finrst = (th->th_flags & (TH_FIN|TH_RST)); 157 if (log_IsKept(LogDEBUG) && !estab) 158 snprintf(dbuff, sizeof dbuff, 159 "flags = %02x, sport = %d, dport = %d", 160 th->th_flags, sport, dport); 161 break; 162 default: 163 return (A_DENY); /* We'll block unknown type of packet */ 164 } 165 if (log_IsKept(LogDEBUG)) { 166 if (estab != -1) { 167 len = strlen(dbuff); 168 snprintf(dbuff + len, sizeof dbuff - len, 169 ", estab = %d, syn = %d, finrst = %d", 170 estab, syn, finrst); 171 } 172 log_Printf(LogDEBUG, " Filter: proto = %s, %s\n", 173 filter_Proto2Nam(cproto), dbuff); 174 } 175 gotinfo = 1; 176 } 177 if (log_IsKept(LogDEBUG)) { 178 if (fp->opt.srcop != OP_NONE) { 179 snprintf(dbuff, sizeof dbuff, ", src %s %d", 180 filter_Op2Nam(fp->opt.srcop), fp->opt.srcport); 181 len = strlen(dbuff); 182 } else 183 len = 0; 184 if (fp->opt.dstop != OP_NONE) { 185 snprintf(dbuff + len, sizeof dbuff - len, 186 ", dst %s %d", filter_Op2Nam(fp->opt.dstop), 187 fp->opt.dstport); 188 } else if (!len) 189 *dbuff = '\0'; 190 191 log_Printf(LogDEBUG, " rule = %d: Address match, " 192 "check against proto %s%s, action = %s\n", 193 n, filter_Proto2Nam(fp->proto), 194 dbuff, filter_Action2Nam(fp->action)); 195 } 196 197 if (cproto == fp->proto) { 198 if ((fp->opt.srcop == OP_NONE || 199 PortMatch(fp->opt.srcop, sport, fp->opt.srcport)) && 200 (fp->opt.dstop == OP_NONE || 201 PortMatch(fp->opt.dstop, dport, fp->opt.dstport)) && 202 (fp->opt.estab == 0 || estab) && 203 (fp->opt.syn == 0 || syn) && 204 (fp->opt.finrst == 0 || finrst)) { 205 return (fp->action); 206 } 207 } 208 } else { 209 /* Address is mached. Make a decision. */ 210 log_Printf(LogDEBUG, " rule = %d: Address match, action = %s\n", n, 211 filter_Action2Nam(fp->action)); 212 return (fp->action); 213 } 214 } else 215 log_Printf(LogDEBUG, " rule = %d: Address mismatch\n", n); 216 } 217 fp++; 218 } 219 return (A_DENY); /* No rule is mached. Deny this packet */ 220 } 221 return (A_PERMIT); /* No rule is given. Permit this packet */ 222} 223 224#ifdef notdef 225static void 226IcmpError(struct ip * pip, int code) 227{ 228 struct mbuf *bp; 229 230 if (pip->ip_p != IPPROTO_ICMP) { 231 bp = mbuf_Alloc(cnt, MB_IPIN); 232 memcpy(MBUF_CTOP(bp), ptr, cnt); 233 vj_SendFrame(bp); 234 ipcp_AddOutOctets(cnt); 235 } 236} 237#endif 238 239/* 240 * For debugging aid. 241 */ 242int 243PacketCheck(struct bundle *bundle, char *cp, int nb, struct filter *filter) 244{ 245 struct ip *pip; 246 struct tcphdr *th; 247 struct udphdr *uh; 248 struct icmp *icmph; 249 char *ptop; 250 int mask, len, n; 251 int pri = PRI_NORMAL; 252 int logit, loglen; 253 static char logbuf[200]; 254 255 logit = log_IsKept(LogTCPIP) && filter->logok; 256 loglen = 0; 257 258 pip = (struct ip *) cp; 259 260 if (logit && loglen < sizeof logbuf) { 261 snprintf(logbuf + loglen, sizeof logbuf - loglen, "%s ", filter->name); 262 loglen += strlen(logbuf + loglen); 263 } 264 ptop = (cp + (pip->ip_hl << 2)); 265 266 switch (pip->ip_p) { 267 case IPPROTO_ICMP: 268 if (logit && loglen < sizeof logbuf) { 269 icmph = (struct icmp *) ptop; 270 snprintf(logbuf + loglen, sizeof logbuf - loglen, 271 "ICMP: %s:%d ---> ", inet_ntoa(pip->ip_src), icmph->icmp_type); 272 loglen += strlen(logbuf + loglen); 273 snprintf(logbuf + loglen, sizeof logbuf - loglen, 274 "%s:%d", inet_ntoa(pip->ip_dst), icmph->icmp_type); 275 loglen += strlen(logbuf + loglen); 276 } 277 break; 278 case IPPROTO_UDP: 279 if (logit && loglen < sizeof logbuf) { 280 uh = (struct udphdr *) ptop; 281 snprintf(logbuf + loglen, sizeof logbuf - loglen, 282 "UDP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(uh->uh_sport)); 283 loglen += strlen(logbuf + loglen); 284 snprintf(logbuf + loglen, sizeof logbuf - loglen, 285 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(uh->uh_dport)); 286 loglen += strlen(logbuf + loglen); 287 } 288 break; 289 case IPPROTO_TCP: 290 th = (struct tcphdr *) ptop; 291 if (pip->ip_tos == IPTOS_LOWDELAY) 292 pri = PRI_FAST; 293 else if ((ntohs(pip->ip_off) & IP_OFFMASK) == 0) { 294 if (INTERACTIVE(ntohs(th->th_sport)) || INTERACTIVE(ntohs(th->th_dport))) 295 pri = PRI_FAST; 296 } 297 if (logit && loglen < sizeof logbuf) { 298 len = ntohs(pip->ip_len) - (pip->ip_hl << 2) - (th->th_off << 2); 299 snprintf(logbuf + loglen, sizeof logbuf - loglen, 300 "TCP: %s:%d ---> ", inet_ntoa(pip->ip_src), ntohs(th->th_sport)); 301 loglen += strlen(logbuf + loglen); 302 snprintf(logbuf + loglen, sizeof logbuf - loglen, 303 "%s:%d", inet_ntoa(pip->ip_dst), ntohs(th->th_dport)); 304 loglen += strlen(logbuf + loglen); 305 n = 0; 306 for (mask = TH_FIN; mask != 0x40; mask <<= 1) { 307 if (th->th_flags & mask) { 308 snprintf(logbuf + loglen, sizeof logbuf - loglen, " %s", TcpFlags[n]); 309 loglen += strlen(logbuf + loglen); 310 } 311 n++; 312 } 313 snprintf(logbuf + loglen, sizeof logbuf - loglen, 314 " seq:%x ack:%x (%d/%d)", 315 ntohl(th->th_seq), ntohl(th->th_ack), len, nb); 316 loglen += strlen(logbuf + loglen); 317 if ((th->th_flags & TH_SYN) && nb > 40) { 318 u_short *sp; 319 320 ptop += 20; 321 sp = (u_short *) ptop; 322 if (ntohs(sp[0]) == 0x0204) { 323 snprintf(logbuf + loglen, sizeof logbuf - loglen, 324 " MSS = %d", ntohs(sp[1])); 325 loglen += strlen(logbuf + loglen); 326 } 327 } 328 } 329 break; 330 } 331 332 if ((FilterCheck(pip, filter) & A_DENY)) { 333 if (logit) 334 log_Printf(LogTCPIP, "%s - BLOCKED\n", logbuf); 335#ifdef notdef 336 if (direction == 0) 337 IcmpError(pip, pri); 338#endif 339 return (-1); 340 } else { 341 /* Check Keep Alive filter */ 342 if (logit) { 343 if (FilterCheck(pip, &bundle->filter.alive) & A_DENY) 344 log_Printf(LogTCPIP, "%s - NO KEEPALIVE\n", logbuf); 345 else 346 log_Printf(LogTCPIP, "%s\n", logbuf); 347 } 348 return (pri); 349 } 350} 351 352void 353ip_Input(struct bundle *bundle, struct mbuf * bp) 354{ 355 u_char *cp; 356 struct mbuf *wp; 357 int nb, nw; 358 struct tun_data tun; 359 struct ip *pip = (struct ip *)tun.data; 360 361 tun_fill_header(tun, AF_INET); 362 cp = tun.data; 363 nb = 0; 364 for (wp = bp; wp; wp = wp->next) { /* Copy to contiguous region */ 365 if (sizeof tun.data - (cp - tun.data) < wp->cnt) { 366 log_Printf(LogERROR, "ip_Input: Packet too large (%d) - dropped\n", 367 mbuf_Length(bp)); 368 mbuf_Free(bp); 369 return; 370 } 371 memcpy(cp, MBUF_CTOP(wp), wp->cnt); 372 cp += wp->cnt; 373 nb += wp->cnt; 374 } 375 376#ifndef NOALIAS 377 if (alias_IsEnabled()) { 378 struct tun_data *frag; 379 int iresult; 380 char *fptr; 381 382 iresult = (*PacketAlias.In)(tun.data, sizeof tun.data); 383 nb = ntohs(((struct ip *) tun.data)->ip_len); 384 385 if (nb > MAX_MRU) { 386 log_Printf(LogERROR, "ip_Input: Problem with IP header length\n"); 387 mbuf_Free(bp); 388 return; 389 } 390 if (iresult == PKT_ALIAS_OK 391 || iresult == PKT_ALIAS_FOUND_HEADER_FRAGMENT) { 392 if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) { 393 mbuf_Free(bp); 394 return; 395 } 396 397 if (!(FilterCheck(pip, &bundle->filter.alive) & A_DENY)) 398 bundle_StartIdleTimer(bundle); 399 400 ipcp_AddInOctets(&bundle->ncp.ipcp, nb); 401 402 nb = ntohs(((struct ip *) tun.data)->ip_len); 403 nb += sizeof tun - sizeof tun.data; 404 nw = write(bundle->dev.fd, &tun, nb); 405 if (nw != nb) { 406 if (nw == -1) 407 log_Printf(LogERROR, "ip_Input: wrote %d, got %s\n", nb, 408 strerror(errno)); 409 else 410 log_Printf(LogERROR, "ip_Input: wrote %d, got %d\n", nb, nw); 411 } 412 413 if (iresult == PKT_ALIAS_FOUND_HEADER_FRAGMENT) { 414 while ((fptr = (*PacketAlias.GetFragment)(tun.data)) != NULL) { 415 (*PacketAlias.FragmentIn)(tun.data, fptr); 416 nb = ntohs(((struct ip *) fptr)->ip_len); 417 frag = (struct tun_data *) 418 ((char *)fptr - sizeof tun + sizeof tun.data); 419 nb += sizeof tun - sizeof tun.data; 420 nw = write(bundle->dev.fd, frag, nb); 421 if (nw != nb) { 422 if (nw == -1) 423 log_Printf(LogERROR, "ip_Input: wrote %d, got %s\n", nb, 424 strerror(errno)); 425 else 426 log_Printf(LogERROR, "ip_Input: wrote %d, got %d\n", nb, nw); 427 } 428 free(frag); 429 } 430 } 431 } else if (iresult == PKT_ALIAS_UNRESOLVED_FRAGMENT) { 432 nb = ntohs(((struct ip *) tun.data)->ip_len); 433 nb += sizeof tun - sizeof tun.data; 434 frag = (struct tun_data *)malloc(nb); 435 if (frag == NULL) 436 log_Printf(LogALERT, "ip_Input: Cannot allocate memory for fragment\n"); 437 else { 438 tun_fill_header(*frag, AF_INET); 439 memcpy(frag->data, tun.data, nb - sizeof tun + sizeof tun.data); 440 (*PacketAlias.SaveFragment)(frag->data); 441 } 442 } 443 } else 444#endif /* #ifndef NOALIAS */ 445 { /* no aliasing */ 446 if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) { 447 mbuf_Free(bp); 448 return; 449 } 450 451 if (!(FilterCheck(pip, &bundle->filter.alive) & A_DENY)) 452 bundle_StartIdleTimer(bundle); 453 454 ipcp_AddInOctets(&bundle->ncp.ipcp, nb); 455 456 nb += sizeof tun - sizeof tun.data; 457 nw = write(bundle->dev.fd, &tun, nb); 458 if (nw != nb) { 459 if (nw == -1) 460 log_Printf(LogERROR, "ip_Input: wrote %d, got %s\n", nb, strerror(errno)); 461 else 462 log_Printf(LogERROR, "ip_Input: wrote %d, got %d\n", nb, nw); 463 } 464 } 465 mbuf_Free(bp); 466} 467 468static struct mqueue IpOutputQueues[PRI_FAST + 1]; 469 470void 471ip_Enqueue(int pri, char *ptr, int count) 472{ 473 struct mbuf *bp; 474 475 bp = mbuf_Alloc(count, MB_IPQ); 476 memcpy(MBUF_CTOP(bp), ptr, count); 477 mbuf_Enqueue(&IpOutputQueues[pri], bp); 478} 479 480int 481ip_QueueLen() 482{ 483 struct mqueue *queue; 484 int result = 0; 485 486 for (queue = &IpOutputQueues[PRI_MAX]; queue >= IpOutputQueues; queue--) 487 result += queue->qlen; 488 489 return result; 490} 491 492int 493ip_FlushPacket(struct link *l, struct bundle *bundle) 494{ 495 struct mqueue *queue; 496 struct mbuf *bp; 497 int cnt; 498 499 if (bundle->ncp.ipcp.fsm.state != ST_OPENED) 500 return 0; 501 502 for (queue = &IpOutputQueues[PRI_FAST]; queue >= IpOutputQueues; queue--) 503 if (queue->top) { 504 bp = mbuf_Dequeue(queue); 505 if (bp) { 506 struct ip *pip = (struct ip *)MBUF_CTOP(bp); 507 508 cnt = mbuf_Length(bp); 509 vj_SendFrame(l, bp, bundle); 510 if (!(FilterCheck(pip, &bundle->filter.alive) & A_DENY)) 511 bundle_StartIdleTimer(bundle); 512 ipcp_AddOutOctets(&bundle->ncp.ipcp, cnt); 513 return 1; 514 } 515 } 516 517 return 0; 518} 519