1
2/*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * $Id$
8 */
9
10#include <ctype.h>
11
12#include "ipf.h"
13#include "ipt.h"
14
15extern	int	opts;
16
17static	char	*tx_proto = "";
18
19static	int	text_open(char *), text_close(void);
20static	int	text_readip(mb_t *, char **, int *);
21static	int	parseline(char *, ip_t *, char **, int *);
22
23static	char	myflagset[] = "FSRPAUEC";
24static	u_char	myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH,
25				TH_ACK, TH_URG, TH_ECN, TH_CWR };
26
27struct	ipread	iptext = { text_open, text_close, text_readip, R_DO_CKSUM };
28static	FILE	*tfp = NULL;
29static	int	tfd = -1;
30
31static	u_32_t	tx_hostnum(char *, int *);
32static	u_short	tx_portnum(char *);
33
34#ifdef USE_INET6
35int parseipv6(char **, ip6_t *, char **, int *);
36#endif
37
38/*
39 * returns an ip address as a long var as a result of either a DNS lookup or
40 * straight inet_addr() call
41 */
42static u_32_t
43tx_hostnum(char *host, int *resolved)
44{
45	i6addr_t	ipa;
46
47	*resolved = 0;
48	if (!strcasecmp("any", host))
49		return (0L);
50	if (ISDIGIT(*host))
51		return (inet_addr(host));
52
53	if (gethost(AF_INET, host, &ipa) == -1) {
54		*resolved = -1;
55		fprintf(stderr, "can't resolve hostname: %s\n", host);
56		return (0);
57	}
58	return (ipa.in4.s_addr);
59}
60
61
62/*
63 * find the port number given by the name, either from getservbyname() or
64 * straight atoi()
65 */
66static u_short
67tx_portnum(char *name)
68{
69	struct	servent	*sp;
70
71	if (ISDIGIT(*name))
72		return (u_short)atoi(name);
73	sp = getservbyname(name, tx_proto);
74	if (sp)
75		return (ntohs(sp->s_port));
76	(void) fprintf(stderr, "unknown service \"%s\".\n", name);
77	return (0);
78}
79
80
81static int
82text_open(char *fname)
83{
84	if (tfp && tfd != -1) {
85		rewind(tfp);
86		return (tfd);
87	}
88
89	if (!strcmp(fname, "-")) {
90		tfd = 0;
91		tfp = stdin;
92	} else {
93		tfd = open(fname, O_RDONLY);
94		if (tfd != -1)
95			tfp = fdopen(tfd, "r");
96	}
97	return (tfd);
98}
99
100
101static int
102text_close(void)
103{
104	int	cfd = tfd;
105
106	tfd = -1;
107	return (close(cfd));
108}
109
110
111static int
112text_readip(mb_t *mb, char **ifn, int *dir)
113{
114	register char *s;
115	char	line[513];
116	ip_t	*ip;
117	char	*buf;
118
119	buf = (char *)mb->mb_buf;
120
121	*ifn = NULL;
122	while (fgets(line, sizeof(line)-1, tfp)) {
123		if ((s = strchr(line, '\n')))
124			*s = '\0';
125		if ((s = strchr(line, '\r')))
126			*s = '\0';
127		if ((s = strchr(line, '#')))
128			*s = '\0';
129		if (!*line)
130			continue;
131		if ((opts & OPT_DEBUG) != 0)
132			printf("input: %s\n", line);
133		*ifn = NULL;
134		*dir = 0;
135		if (!parseline(line, (ip_t *)buf, ifn, dir)) {
136			ip = (ip_t *)buf;
137			if (IP_V(ip) == 6) {
138#ifdef USE_INET6
139				mb->mb_len = ntohs(((ip6_t *)ip)->ip6_plen) +
140				       sizeof(ip6_t);
141#else
142				mb->mb_len = 0;
143#endif
144			} else {
145				mb->mb_len = ntohs(ip->ip_len);
146			}
147			return (mb->mb_len);
148		}
149	}
150	if (feof(tfp))
151		return (0);
152	return (-1);
153}
154
155static int
156parseline(char *line, ip_t *ip, char **ifn, int *out)
157{
158	tcphdr_t	th, *tcp = &th;
159	struct	icmp	icmp, *ic = &icmp;
160	char	*cps[20], **cpp, c, ipopts[68];
161	int	i, r;
162
163	if (*ifn)
164		free(*ifn);
165	bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip));
166	bzero((char *)tcp, sizeof(*tcp));
167	bzero((char *)ic, sizeof(*ic));
168	bzero(ipopts, sizeof(ipopts));
169	IP_HL_A(ip, sizeof(*ip) >> 2);
170	IP_V_A(ip, IPVERSION);
171	ip->ip_ttl = 63;
172	for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; )
173		cps[++i] = strtok(NULL, " \b\t\r\n");
174
175	cpp = cps;
176	if (!*cpp)
177		return (1);
178
179	c = **cpp;
180	if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) {
181		fprintf(stderr, "bad direction \"%s\"\n", *cpp);
182		return (1);
183	}
184
185#ifdef USE_INET6
186	if (!strcasecmp(*cpp, "out6") || !strcasecmp(*cpp, "in6")) {
187		return (parseipv6(cpp, (ip6_t *)ip, ifn, out));
188	}
189#endif
190
191	*out = (TOLOWER(c) == 'o') ? 1 : 0;
192	cpp++;
193	if (!*cpp)
194		return (1);
195
196	if (!strcasecmp(*cpp, "on")) {
197		cpp++;
198		if (!*cpp)
199			return (1);
200		*ifn = strdup(*cpp++);
201		if (!*cpp)
202			return (1);
203	}
204
205	c = **cpp;
206	ip->ip_len = sizeof(ip_t);
207	if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") ||
208	    !strcasecmp(*cpp, "icmp")) {
209		if (c == 't') {
210			ip->ip_p = IPPROTO_TCP;
211			ip->ip_len += sizeof(struct tcphdr);
212			tx_proto = "tcp";
213		} else if (c == 'u') {
214			ip->ip_p = IPPROTO_UDP;
215			ip->ip_len += sizeof(struct udphdr);
216			tx_proto = "udp";
217		} else {
218			ip->ip_p = IPPROTO_ICMP;
219			ip->ip_len += ICMPERR_IPICMPHLEN;
220			tx_proto = "icmp";
221		}
222		cpp++;
223	} else if (ISDIGIT(**cpp) && !index(*cpp, '.')) {
224		ip->ip_p = atoi(*cpp);
225		cpp++;
226	} else
227		ip->ip_p = IPPROTO_IP;
228
229	if (!*cpp)
230		return (1);
231	if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
232		char	*last;
233
234		last = strchr(*cpp, ',');
235		if (!last) {
236			fprintf(stderr, "tcp/udp with no source port\n");
237			return (1);
238		}
239		*last++ = '\0';
240		tcp->th_sport = htons(tx_portnum(last));
241		if (ip->ip_p == IPPROTO_TCP) {
242			tcp->th_win = htons(4096);
243			TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
244		}
245	}
246	ip->ip_src.s_addr = tx_hostnum(*cpp, &r);
247	cpp++;
248	if (!*cpp)
249		return (1);
250
251	if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
252		char	*last;
253
254		last = strchr(*cpp, ',');
255		if (!last) {
256			fprintf(stderr, "tcp/udp with no destination port\n");
257			return (1);
258		}
259		*last++ = '\0';
260		tcp->th_dport = htons(tx_portnum(last));
261	}
262	ip->ip_dst.s_addr = tx_hostnum(*cpp, &r);
263	cpp++;
264	if (ip->ip_p == IPPROTO_TCP) {
265		if (*cpp != NULL) {
266			char	*s, *t;
267
268			tcp->th_flags = 0;
269			for (s = *cpp; *s; s++)
270				if ((t  = strchr(myflagset, *s)))
271					tcp->th_flags |= myflags[t-myflagset];
272			if (tcp->th_flags)
273				cpp++;
274		}
275
276		if (tcp->th_flags & TH_URG)
277			tcp->th_urp = htons(1);
278
279		if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
280			tcp->th_seq = htonl(atoi(*cpp + 4));
281			cpp++;
282		}
283
284		if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
285			tcp->th_ack = htonl(atoi(*cpp + 4));
286			cpp++;
287		}
288	} else if (*cpp && ip->ip_p == IPPROTO_ICMP) {
289		char	*t;
290
291		t = strchr(*cpp, ',');
292		if (t != NULL)
293			*t = '\0';
294
295		ic->icmp_type = geticmptype(AF_INET, *cpp);
296		if (t != NULL)
297			ic->icmp_code = atoi(t + 1);
298		cpp++;
299
300		if (ic->icmp_type == ICMP_ECHO ||
301		    ic->icmp_type == ICMP_ECHOREPLY)
302			ic->icmp_id = htons(getpid());
303		if (t != NULL)
304			*t = ',';
305	}
306
307	if (*cpp && !strcasecmp(*cpp, "opt")) {
308		u_long	olen;
309
310		cpp++;
311		olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2);
312		if (olen) {
313			bcopy(ipopts, (char *)(ip + 1), olen);
314			IP_HL_A(ip, IP_HL(ip) + (olen >> 2));
315			ip->ip_len += olen;
316		}
317	}
318	if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP)
319		bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2),
320			sizeof(*tcp));
321	else if (ip->ip_p == IPPROTO_ICMP)
322		bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2),
323			sizeof(*ic));
324	ip->ip_len = htons(ip->ip_len);
325	return (0);
326}
327
328
329#ifdef USE_INET6
330int
331parseipv6(char **cpp, ip6_t *ip6, char **ifn, int *out)
332{
333	tcphdr_t th, *tcp = &th;
334	struct icmp6_hdr icmp, *ic6 = &icmp;
335
336	bzero((char *)ip6, MAX(sizeof(*tcp), sizeof(*ic6)) + sizeof(*ip6));
337	bzero((char *)tcp, sizeof(*tcp));
338	bzero((char *)ic6, sizeof(*ic6));
339	ip6->ip6_vfc = 0x60;
340
341	*out = (**cpp == 'o') ? 1 : 0;
342	cpp++;
343	if (!*cpp)
344		return (1);
345
346	if (!strcasecmp(*cpp, "on")) {
347		cpp++;
348		if (!*cpp)
349			return (1);
350		*ifn = strdup(*cpp++);
351		if (!*cpp)
352			return (1);
353	}
354
355	if (!strcasecmp(*cpp, "tcp")) {
356		ip6->ip6_nxt = IPPROTO_TCP;
357		tx_proto = "tcp";
358		cpp++;
359	} else if (!strcasecmp(*cpp, "udp")) {
360		ip6->ip6_nxt = IPPROTO_UDP;
361		tx_proto = "udp";
362		cpp++;
363	} else if (!strcasecmp(*cpp, "icmpv6")) {
364		ip6->ip6_nxt = IPPROTO_ICMPV6;
365		tx_proto = "icmpv6";
366		cpp++;
367	} else if (ISDIGIT(**cpp) && !index(*cpp, ':')) {
368		ip6->ip6_nxt = atoi(*cpp);
369		cpp++;
370	} else
371		ip6->ip6_nxt = IPPROTO_IPV6;
372
373	if (!*cpp)
374		return (1);
375
376	switch (ip6->ip6_nxt)
377	{
378	case IPPROTO_TCP :
379		ip6->ip6_plen = sizeof(struct tcphdr);
380		break;
381	case IPPROTO_UDP :
382		ip6->ip6_plen = sizeof(struct udphdr);
383		break;
384	case IPPROTO_ICMPV6 :
385		ip6->ip6_plen = ICMP6ERR_IPICMPHLEN;
386		break;
387	default :
388		break;
389	}
390
391	if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
392		char *last;
393
394		last = strchr(*cpp, ',');
395		if (!last) {
396			fprintf(stderr, "tcp/udp with no source port\n");
397			return (1);
398		}
399		*last++ = '\0';
400		tcp->th_sport = htons(tx_portnum(last));
401		if (ip6->ip6_nxt == IPPROTO_TCP) {
402			tcp->th_win = htons(4096);
403			TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
404		}
405	}
406
407	if (inet_pton(AF_INET6, *cpp, &ip6->ip6_src) != 1) {
408		fprintf(stderr, "cannot parse source address '%s'\n", *cpp);
409		return (1);
410	}
411
412	cpp++;
413	if (!*cpp)
414		return (1);
415
416	if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
417		char *last;
418
419		last = strchr(*cpp, ',');
420		if (!last) {
421			fprintf(stderr, "tcp/udp with no destination port\n");
422			return (1);
423		}
424		*last++ = '\0';
425		tcp->th_dport = htons(tx_portnum(last));
426	}
427
428	if (inet_pton(AF_INET6, *cpp, &ip6->ip6_dst) != 1) {
429		fprintf(stderr, "cannot parse destination address '%s'\n",
430			*cpp);
431		return (1);
432	}
433
434	cpp++;
435	if (ip6->ip6_nxt == IPPROTO_TCP) {
436		if (*cpp != NULL) {
437			char *s, *t;
438
439			tcp->th_flags = 0;
440			for (s = *cpp; *s; s++)
441				if ((t  = strchr(myflagset, *s)))
442					tcp->th_flags |= myflags[t-myflagset];
443			if (tcp->th_flags)
444				cpp++;
445		}
446
447		if (tcp->th_flags & TH_URG)
448			tcp->th_urp = htons(1);
449
450		if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
451			tcp->th_seq = htonl(atoi(*cpp + 4));
452			cpp++;
453		}
454
455		if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
456			tcp->th_ack = htonl(atoi(*cpp + 4));
457			cpp++;
458		}
459	} else if (*cpp && ip6->ip6_nxt == IPPROTO_ICMPV6) {
460		char *t;
461
462		t = strchr(*cpp, ',');
463		if (t != NULL)
464			*t = '\0';
465
466		ic6->icmp6_type = geticmptype(AF_INET6, *cpp);
467		if (t != NULL)
468			ic6->icmp6_code = atoi(t + 1);
469
470		if (ic6->icmp6_type == ICMP6_ECHO_REQUEST ||
471		    ic6->icmp6_type == ICMP6_ECHO_REPLY)
472			ic6->icmp6_id = htons(getpid());
473
474		if (t != NULL)
475			*t = ',';
476	}
477
478	if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
479		bcopy((char *)tcp, (char *)ip6 + sizeof(*ip6),
480			sizeof(*tcp));
481	} else if (ip6->ip6_nxt == IPPROTO_ICMPV6) {
482		bcopy((char *)ic6, (char *)ip6 + sizeof(*ip6),
483			sizeof(*ic6));
484	}
485
486	/*
487	 * Because a length of 0 == jumbo gram...
488	 */
489	if (ip6->ip6_plen == 0) {
490		ip6->ip6_plen++;
491	}
492	ip6->ip6_plen = htons(ip6->ip6_plen);
493	return (0);
494}
495#endif
496