filter.c revision 49372 
1/*
2 *		PPP Filter command Interface
3 *
4 *	    Written by Toshiharu OHNO (tony-o@iij.ad.jp)
5 *
6 *   Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd.
7 *
8 * Redistribution and use in source and binary forms are permitted
9 * provided that the above copyright notice and this paragraph are
10 * duplicated in all such forms and that any documentation,
11 * advertising materials, and other materials related to such
12 * distribution and use acknowledge that the software was developed
13 * by the Internet Initiative Japan.  The name of the
14 * IIJ may not be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19 *
20 * $Id: filter.c,v 1.33 1999/07/28 03:01:51 brian Exp $
21 *
22 *	TODO: Shoud send ICMP error message when we discard packets.
23 */
24
25#include <sys/param.h>
26#include <netinet/in.h>
27#include <arpa/inet.h>
28#include <netdb.h>
29#include <netinet/in_systm.h>
30#include <netinet/ip.h>
31#include <sys/un.h>
32
33#include <stdio.h>
34#include <stdlib.h>
35#include <strings.h>
36#include <termios.h>
37
38#include "layer.h"
39#include "defs.h"
40#include "command.h"
41#include "mbuf.h"
42#include "log.h"
43#include "iplist.h"
44#include "timer.h"
45#include "throughput.h"
46#include "lqr.h"
47#include "hdlc.h"
48#include "fsm.h"
49#include "lcp.h"
50#include "ccp.h"
51#include "link.h"
52#include "slcompress.h"
53#include "ipcp.h"
54#include "filter.h"
55#include "descriptor.h"
56#include "prompt.h"
57#include "mp.h"
58#ifndef NORADIUS
59#include "radius.h"
60#endif
61#include "bundle.h"
62
63static int filter_Nam2Proto(int, char const *const *);
64static int filter_Nam2Op(const char *);
65
66static const u_int32_t netmasks[33] = {
67  0x00000000,
68  0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
69  0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
70  0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000,
71  0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000,
72  0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000,
73  0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00,
74  0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0,
75  0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF,
76};
77
78struct in_addr
79bits2mask(int bits)
80{
81  struct in_addr result;
82
83  result.s_addr = htonl(netmasks[bits]);
84  return result;
85}
86
87int
88ParseAddr(struct ipcp *ipcp, const char *data,
89	  struct in_addr *paddr, struct in_addr *pmask, int *pwidth)
90{
91  int bits, len;
92  char *wp;
93  const char *cp;
94
95  if (pmask)
96    pmask->s_addr = INADDR_BROADCAST;	/* Assume 255.255.255.255 as default */
97
98  cp = pmask || pwidth ? strchr(data, '/') : NULL;
99  len = cp ? cp - data : strlen(data);
100
101  if (ipcp && strncasecmp(data, "HISADDR", len) == 0)
102    *paddr = ipcp->peer_ip;
103  else if (ipcp && strncasecmp(data, "MYADDR", len) == 0)
104    *paddr = ipcp->my_ip;
105  else if (len > 15)
106    log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data);
107  else {
108    char s[16];
109    strncpy(s, data, len);
110    s[len] = '\0';
111    if (inet_aton(s, paddr) == 0) {
112      log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s);
113      return 0;
114    }
115  }
116  if (cp && *++cp) {
117    bits = strtol(cp, &wp, 0);
118    if (cp == wp || bits < 0 || bits > 32) {
119      log_Printf(LogWARN, "ParseAddr: bad mask width.\n");
120      return 0;
121    }
122  } else if (paddr->s_addr == INADDR_ANY)
123    /* An IP of 0.0.0.0 without a width is anything */
124    bits = 0;
125  else
126    /* If a valid IP is given without a width, assume 32 bits */
127    bits = 32;
128
129  if (pwidth)
130    *pwidth = bits;
131
132  if (pmask) {
133    if (paddr->s_addr == INADDR_ANY)
134      pmask->s_addr = INADDR_ANY;
135    else
136      *pmask = bits2mask(bits);
137  }
138
139  return 1;
140}
141
142static int
143ParsePort(const char *service, int proto)
144{
145  const char *protocol_name;
146  char *cp;
147  struct servent *servent;
148  int port;
149
150  switch (proto) {
151  case P_UDP:
152    protocol_name = "udp";
153    break;
154  case P_TCP:
155    protocol_name = "tcp";
156    break;
157  default:
158    protocol_name = 0;
159  }
160
161  servent = getservbyname(service, protocol_name);
162  if (servent != 0)
163    return ntohs(servent->s_port);
164
165  port = strtol(service, &cp, 0);
166  if (cp == service) {
167    log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
168	      service);
169    return 0;
170  }
171  return port;
172}
173
174/*
175 *	ICMP Syntax:	src eq icmp_message_type
176 */
177static int
178ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
179{
180  int type;
181  char *cp;
182
183  switch (argc) {
184  case 0:
185    /* permit/deny all ICMP types */
186    tgt->f_srcop = OP_NONE;
187    break;
188
189  case 3:
190    if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
191      type = strtol(argv[2], &cp, 0);
192      if (cp == argv[2]) {
193	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
194	return 0;
195      }
196      tgt->f_srcop = OP_EQ;
197      tgt->f_srcport = type;
198    }
199    break;
200
201  default:
202    log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
203    return 0;
204  }
205  return 1;
206}
207
208/*
209 *	UDP Syntax: [src op port] [dst op port]
210 */
211static int
212ParseUdpOrTcp(int argc, char const *const *argv, int proto,
213              struct filterent *tgt)
214{
215  tgt->f_srcop = tgt->f_dstop = OP_NONE;
216  tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
217
218  if (argc >= 3 && !strcmp(*argv, "src")) {
219    tgt->f_srcop = filter_Nam2Op(argv[1]);
220    if (tgt->f_srcop == OP_NONE) {
221      log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
222      return 0;
223    }
224    tgt->f_srcport = ParsePort(argv[2], proto);
225    if (tgt->f_srcport == 0)
226      return 0;
227    argc -= 3;
228    argv += 3;
229  }
230
231  if (argc >= 3 && !strcmp(argv[0], "dst")) {
232    tgt->f_dstop = filter_Nam2Op(argv[1]);
233    if (tgt->f_dstop == OP_NONE) {
234      log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
235      return 0;
236    }
237    tgt->f_dstport = ParsePort(argv[2], proto);
238    if (tgt->f_dstport == 0)
239      return 0;
240    argc -= 3;
241    argv += 3;
242  }
243
244  if (proto == P_TCP) {
245    for (; argc > 0; argc--, argv++)
246      if (!strcmp(*argv, "estab"))
247        tgt->f_estab = 1;
248      else if (!strcmp(*argv, "syn"))
249        tgt->f_syn = 1;
250      else if (!strcmp(*argv, "finrst"))
251        tgt->f_finrst = 1;
252      else
253        break;
254  }
255
256  if (argc > 0) {
257    log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
258    return 0;
259  }
260
261  return 1;
262}
263
264static int
265ParseIgmp(int argc, char const * const *argv, struct filterent *tgt)
266{
267  /*
268   * Filter currently is a catch-all. Requests are either permitted or
269   * dropped.
270   */
271  if (argc != 0) {
272    log_Printf(LogWARN, "ParseIgmp: Too many parameters\n");
273    return 0;
274  } else
275    tgt->f_srcop = OP_NONE;
276
277  return 1;
278}
279
280static int
281ParseOspf(int argc, char const * const *argv, struct filterent *tgt)
282{
283  /*
284   * Filter currently is a catch-all. Requests are either permitted or
285   * dropped.
286   */
287  if (argc != 0) {
288    log_Printf(LogWARN, "ParseOspf: Too many parameters\n");
289    return 0;
290  } else
291    tgt->f_srcop = OP_NONE;
292
293  return 1;
294}
295
296static unsigned
297addrtype(const char *addr)
298{
299  if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
300    return T_MYADDR;
301  if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
302    return T_HISADDR;
303
304  return T_ADDR;
305}
306
307static const char *
308addrstr(struct in_addr addr, unsigned type)
309{
310  switch (type) {
311    case T_MYADDR:
312      return "MYADDR";
313    case T_HISADDR:
314      return "HISADDR";
315  }
316  return inet_ntoa(addr);
317}
318
319static const char *
320maskstr(int bits)
321{
322  static char str[4];
323
324  if (bits == 32)
325    *str = '\0';
326  else
327    snprintf(str, sizeof str, "/%d", bits);
328
329  return str;
330}
331
332static int
333Parse(struct ipcp *ipcp, int argc, char const *const *argv,
334      struct filterent *ofp)
335{
336  int action, proto;
337  int val, ruleno;
338  char *wp;
339  struct filterent filterdata;
340
341  ruleno = strtol(*argv, &wp, 0);
342  if (*argv == wp || ruleno >= MAXFILTERS) {
343    log_Printf(LogWARN, "Parse: invalid filter number.\n");
344    return 0;
345  }
346  if (ruleno < 0) {
347    for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
348      ofp->f_action = A_NONE;
349      ofp++;
350    }
351    log_Printf(LogWARN, "Parse: filter cleared.\n");
352    return 1;
353  }
354  ofp += ruleno;
355
356  if (--argc == 0) {
357    log_Printf(LogWARN, "Parse: missing action.\n");
358    return 0;
359  }
360  argv++;
361
362  proto = P_NONE;
363  memset(&filterdata, '\0', sizeof filterdata);
364
365  val = strtol(*argv, &wp, 0);
366  if (!*wp && val >= 0 && val < MAXFILTERS) {
367    if (val <= ruleno) {
368      log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
369                 ruleno);
370      return 0;
371    }
372    action = val;
373  } else if (!strcmp(*argv, "permit")) {
374    action = A_PERMIT;
375  } else if (!strcmp(*argv, "deny")) {
376    action = A_DENY;
377  } else if (!strcmp(*argv, "clear")) {
378    ofp->f_action = A_NONE;
379    return 1;
380  } else {
381    log_Printf(LogWARN, "Parse: bad action: %s\n", *argv);
382    return 0;
383  }
384  filterdata.f_action = action;
385
386  argc--;
387  argv++;
388
389  if (argc && argv[0][0] == '!' && !argv[0][1]) {
390    filterdata.f_invert = 1;
391    argc--;
392    argv++;
393  }
394
395  proto = filter_Nam2Proto(argc, argv);
396  if (proto == P_NONE) {
397    if (!argc)
398      log_Printf(LogWARN, "Parse: address/mask is expected.\n");
399    else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr,
400                       &filterdata.f_src.mask, &filterdata.f_src.width)) {
401      filterdata.f_srctype = addrtype(*argv);
402      argc--;
403      argv++;
404      proto = filter_Nam2Proto(argc, argv);
405      if (!argc)
406        log_Printf(LogWARN, "Parse: address/mask is expected.\n");
407      else if (proto == P_NONE) {
408	if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr,
409		      &filterdata.f_dst.mask, &filterdata.f_dst.width)) {
410          filterdata.f_dsttype = addrtype(*argv);
411	  argc--;
412	  argv++;
413	} else
414          filterdata.f_dsttype = T_ADDR;
415        if (argc) {
416	  proto = filter_Nam2Proto(argc, argv);
417	  if (proto == P_NONE) {
418            log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv);
419            return 0;
420          } else {
421	    argc--;
422	    argv++;
423	  }
424	}
425      } else {
426	argc--;
427	argv++;
428      }
429    } else {
430      log_Printf(LogWARN, "Parse: Address/protocol expected.\n");
431      return 0;
432    }
433  } else {
434    argc--;
435    argv++;
436  }
437
438  val = 1;
439  filterdata.f_proto = proto;
440
441  switch (proto) {
442  case P_TCP:
443    val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata);
444    break;
445  case P_UDP:
446    val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata);
447    break;
448  case P_ICMP:
449    val = ParseIcmp(argc, argv, &filterdata);
450    break;
451  case P_IGMP:
452    val = ParseIgmp(argc, argv, &filterdata);
453    break;
454  case P_OSPF:
455    val = ParseOspf(argc, argv, &filterdata);
456    break;
457  }
458
459  log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr));
460  log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask));
461  log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr));
462  log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask));
463  log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto);
464
465  log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
466            filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport);
467  log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
468            filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport);
469  log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab);
470  log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn);
471  log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst);
472
473  if (val)
474    *ofp = filterdata;
475
476  return val;
477}
478
479int
480filter_Set(struct cmdargs const *arg)
481{
482  struct filter *filter;
483
484  if (arg->argc < arg->argn+2)
485    return -1;
486
487  if (!strcmp(arg->argv[arg->argn], "in"))
488    filter = &arg->bundle->filter.in;
489  else if (!strcmp(arg->argv[arg->argn], "out"))
490    filter = &arg->bundle->filter.out;
491  else if (!strcmp(arg->argv[arg->argn], "dial"))
492    filter = &arg->bundle->filter.dial;
493  else if (!strcmp(arg->argv[arg->argn], "alive"))
494    filter = &arg->bundle->filter.alive;
495  else {
496    log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
497              arg->argv[arg->argn]);
498    return -1;
499  }
500
501  Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1,
502        arg->argv + arg->argn + 1, filter->rule);
503  return 0;
504}
505
506const char *
507filter_Action2Nam(int act)
508{
509  static const char *actname[] = { "  none ", "permit ", "  deny " };
510  static char	buf[8];
511
512  if (act >= 0 && act < MAXFILTERS) {
513    snprintf(buf, sizeof buf, "%6d ", act);
514    return buf;
515  } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
516    return actname[act - A_NONE];
517  else
518    return "?????? ";
519}
520
521static void
522doShowFilter(struct filterent *fp, struct prompt *prompt)
523{
524  int n;
525
526  for (n = 0; n < MAXFILTERS; n++, fp++) {
527    if (fp->f_action != A_NONE) {
528      prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->f_action));
529      prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
530      prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype),
531                    maskstr(fp->f_src.width));
532      prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype),
533                    maskstr(fp->f_dst.width));
534      if (fp->f_proto) {
535	prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto));
536
537	if (fp->f_srcop)
538	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
539		  fp->f_srcport);
540	if (fp->f_dstop)
541	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
542		  fp->f_dstport);
543	if (fp->f_estab)
544	  prompt_Printf(prompt, " estab");
545	if (fp->f_syn)
546	  prompt_Printf(prompt, " syn");
547	if (fp->f_finrst)
548	  prompt_Printf(prompt, " finrst");
549      }
550      prompt_Printf(prompt, "\n");
551    }
552  }
553}
554
555int
556filter_Show(struct cmdargs const *arg)
557{
558  if (arg->argc > arg->argn+1)
559    return -1;
560
561  if (arg->argc == arg->argn+1) {
562    struct filter *filter;
563
564    if (!strcmp(arg->argv[arg->argn], "in"))
565      filter = &arg->bundle->filter.in;
566    else if (!strcmp(arg->argv[arg->argn], "out"))
567      filter = &arg->bundle->filter.out;
568    else if (!strcmp(arg->argv[arg->argn], "dial"))
569      filter = &arg->bundle->filter.dial;
570    else if (!strcmp(arg->argv[arg->argn], "alive"))
571      filter = &arg->bundle->filter.alive;
572    else
573      return -1;
574    doShowFilter(filter->rule, arg->prompt);
575  } else {
576    struct filter *filter[4];
577    int f;
578
579    filter[0] = &arg->bundle->filter.in;
580    filter[1] = &arg->bundle->filter.out;
581    filter[2] = &arg->bundle->filter.dial;
582    filter[3] = &arg->bundle->filter.alive;
583    for (f = 0; f < 4; f++) {
584      if (f)
585        prompt_Printf(arg->prompt, "\n");
586      prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
587      doShowFilter(filter[f]->rule, arg->prompt);
588    }
589  }
590
591  return 0;
592}
593
594static const char *protoname[] = {
595  "none", "tcp", "udp", "icmp", "ospf", "igmp"
596};
597
598const char *
599filter_Proto2Nam(int proto)
600{
601  if (proto >= sizeof protoname / sizeof protoname[0])
602    return "unknown";
603  return protoname[proto];
604}
605
606static int
607filter_Nam2Proto(int argc, char const *const *argv)
608{
609  int proto;
610
611  if (argc == 0)
612    proto = 0;
613  else
614    for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--)
615      if (!strcasecmp(*argv, protoname[proto]))
616        break;
617
618  return proto;
619}
620
621static const char *opname[] = {"none", "eq", "gt", "unknown", "lt"};
622
623const char *
624filter_Op2Nam(int op)
625{
626  if (op >= sizeof opname / sizeof opname[0])
627    return "unknown";
628  return opname[op];
629
630}
631
632static int
633filter_Nam2Op(const char *cp)
634{
635  int op;
636
637  for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
638    if (!strcasecmp(cp, opname[op]))
639      break;
640
641  return op;
642}
643
644void
645filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip,
646                  struct in_addr *peer_ip)
647{
648  struct filterent *fp;
649  int n;
650
651  for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
652    if (fp->f_action != A_NONE) {
653      if (my_ip) {
654        if (fp->f_srctype == T_MYADDR)
655          fp->f_src.ipaddr = *my_ip;
656        if (fp->f_dsttype == T_MYADDR)
657          fp->f_dst.ipaddr = *my_ip;
658      }
659      if (peer_ip) {
660        if (fp->f_srctype == T_HISADDR)
661          fp->f_src.ipaddr = *peer_ip;
662        if (fp->f_dsttype == T_HISADDR)
663          fp->f_dst.ipaddr = *peer_ip;
664      }
665    }
666}
667