filter.c revision 58044
1/* 2 * PPP Filter command Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $FreeBSD: head/usr.sbin/ppp/filter.c 58044 2000-03-14 01:47:27Z brian $ 21 * 22 * TODO: Should send ICMP error message when we discard packets. 23 */ 24 25#include <sys/param.h> 26#include <netinet/in.h> 27#include <arpa/inet.h> 28#include <netdb.h> 29#include <netinet/in_systm.h> 30#include <netinet/ip.h> 31#include <sys/un.h> 32 33#include <stdio.h> 34#include <stdlib.h> 35#include <strings.h> 36#include <termios.h> 37 38#include "layer.h" 39#include "defs.h" 40#include "command.h" 41#include "mbuf.h" 42#include "log.h" 43#include "iplist.h" 44#include "timer.h" 45#include "throughput.h" 46#include "lqr.h" 47#include "hdlc.h" 48#include "fsm.h" 49#include "lcp.h" 50#include "ccp.h" 51#include "link.h" 52#include "slcompress.h" 53#include "ipcp.h" 54#include "filter.h" 55#include "descriptor.h" 56#include "prompt.h" 57#include "mp.h" 58#ifndef NORADIUS 59#include "radius.h" 60#endif 61#include "bundle.h" 62 63static int filter_Nam2Proto(int, char const *const *); 64static int filter_Nam2Op(const char *); 65 66static const u_int32_t netmasks[33] = { 67 0x00000000, 68 0x80000000, 0xC0000000, 0xE0000000, 0xF0000000, 69 0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000, 70 0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000, 71 0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000, 72 0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000, 73 0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00, 74 0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0, 75 0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF, 76}; 77 78struct in_addr 79bits2mask(int bits) 80{ 81 struct in_addr result; 82 83 result.s_addr = htonl(netmasks[bits]); 84 return result; 85} 86 87int 88ParseAddr(struct ipcp *ipcp, const char *data, 89 struct in_addr *paddr, struct in_addr *pmask, int *pwidth) 90{ 91 int bits, len; 92 char *wp; 93 const char *cp; 94 95 if (pmask) 96 pmask->s_addr = INADDR_BROADCAST; /* Assume 255.255.255.255 as default */ 97 98 cp = pmask || pwidth ? strchr(data, '/') : NULL; 99 len = cp ? cp - data : strlen(data); 100 101 if (ipcp && strncasecmp(data, "HISADDR", len) == 0) 102 *paddr = ipcp->peer_ip; 103 else if (ipcp && strncasecmp(data, "MYADDR", len) == 0) 104 *paddr = ipcp->my_ip; 105 else if (ipcp && strncasecmp(data, "DNS0", len) == 0) 106 *paddr = ipcp->ns.dns[0]; 107 else if (ipcp && strncasecmp(data, "DNS1", len) == 0) 108 *paddr = ipcp->ns.dns[1]; 109 else if (len > 15) 110 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data); 111 else { 112 char s[16]; 113 strncpy(s, data, len); 114 s[len] = '\0'; 115 if (inet_aton(s, paddr) == 0) { 116 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s); 117 return 0; 118 } 119 } 120 if (cp && *++cp) { 121 bits = strtol(cp, &wp, 0); 122 if (cp == wp || bits < 0 || bits > 32) { 123 log_Printf(LogWARN, "ParseAddr: bad mask width.\n"); 124 return 0; 125 } 126 } else if (paddr->s_addr == INADDR_ANY) 127 /* An IP of 0.0.0.0 without a width is anything */ 128 bits = 0; 129 else 130 /* If a valid IP is given without a width, assume 32 bits */ 131 bits = 32; 132 133 if (pwidth) 134 *pwidth = bits; 135 136 if (pmask) { 137 if (paddr->s_addr == INADDR_ANY) 138 pmask->s_addr = INADDR_ANY; 139 else 140 *pmask = bits2mask(bits); 141 } 142 143 return 1; 144} 145 146static int 147ParsePort(const char *service, int proto) 148{ 149 const char *protocol_name; 150 char *cp; 151 struct servent *servent; 152 int port; 153 154 switch (proto) { 155 case P_UDP: 156 protocol_name = "udp"; 157 break; 158 case P_TCP: 159 protocol_name = "tcp"; 160 break; 161 default: 162 protocol_name = 0; 163 } 164 165 servent = getservbyname(service, protocol_name); 166 if (servent != 0) 167 return ntohs(servent->s_port); 168 169 port = strtol(service, &cp, 0); 170 if (cp == service) { 171 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n", 172 service); 173 return 0; 174 } 175 return port; 176} 177 178/* 179 * ICMP Syntax: src eq icmp_message_type 180 */ 181static int 182ParseIcmp(int argc, char const *const *argv, struct filterent *tgt) 183{ 184 int type; 185 char *cp; 186 187 switch (argc) { 188 case 0: 189 /* permit/deny all ICMP types */ 190 tgt->f_srcop = OP_NONE; 191 break; 192 193 case 3: 194 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) { 195 type = strtol(argv[2], &cp, 0); 196 if (cp == argv[2]) { 197 log_Printf(LogWARN, "ParseIcmp: type is expected.\n"); 198 return 0; 199 } 200 tgt->f_srcop = OP_EQ; 201 tgt->f_srcport = type; 202 } 203 break; 204 205 default: 206 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n"); 207 return 0; 208 } 209 return 1; 210} 211 212/* 213 * UDP Syntax: [src op port] [dst op port] 214 */ 215static int 216ParseUdpOrTcp(int argc, char const *const *argv, int proto, 217 struct filterent *tgt) 218{ 219 tgt->f_srcop = tgt->f_dstop = OP_NONE; 220 tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0; 221 222 if (argc >= 3 && !strcmp(*argv, "src")) { 223 tgt->f_srcop = filter_Nam2Op(argv[1]); 224 if (tgt->f_srcop == OP_NONE) { 225 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 226 return 0; 227 } 228 tgt->f_srcport = ParsePort(argv[2], proto); 229 if (tgt->f_srcport == 0) 230 return 0; 231 argc -= 3; 232 argv += 3; 233 } 234 235 if (argc >= 3 && !strcmp(argv[0], "dst")) { 236 tgt->f_dstop = filter_Nam2Op(argv[1]); 237 if (tgt->f_dstop == OP_NONE) { 238 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 239 return 0; 240 } 241 tgt->f_dstport = ParsePort(argv[2], proto); 242 if (tgt->f_dstport == 0) 243 return 0; 244 argc -= 3; 245 argv += 3; 246 } 247 248 if (proto == P_TCP) { 249 for (; argc > 0; argc--, argv++) 250 if (!strcmp(*argv, "estab")) 251 tgt->f_estab = 1; 252 else if (!strcmp(*argv, "syn")) 253 tgt->f_syn = 1; 254 else if (!strcmp(*argv, "finrst")) 255 tgt->f_finrst = 1; 256 else 257 break; 258 } 259 260 if (argc > 0) { 261 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv); 262 return 0; 263 } 264 265 return 1; 266} 267 268static int 269ParseIgmp(int argc, char const * const *argv, struct filterent *tgt) 270{ 271 /* 272 * Filter currently is a catch-all. Requests are either permitted or 273 * dropped. 274 */ 275 if (argc != 0) { 276 log_Printf(LogWARN, "ParseIgmp: Too many parameters\n"); 277 return 0; 278 } else 279 tgt->f_srcop = OP_NONE; 280 281 return 1; 282} 283 284#ifdef P_GRE 285static int 286ParseGRE(int argc, char const * const *argv, struct filterent *tgt) 287{ 288 /* 289 * Filter currently is a catch-all. Requests are either permitted or 290 * dropped. 291 */ 292 if (argc != 0) { 293 log_Printf(LogWARN, "ParseGRE: Too many parameters\n"); 294 return 0; 295 } else 296 tgt->f_srcop = OP_NONE; 297 298 return 1; 299} 300#endif 301 302#ifdef P_OSPF 303static int 304ParseOspf(int argc, char const * const *argv, struct filterent *tgt) 305{ 306 /* 307 * Filter currently is a catch-all. Requests are either permitted or 308 * dropped. 309 */ 310 if (argc != 0) { 311 log_Printf(LogWARN, "ParseOspf: Too many parameters\n"); 312 return 0; 313 } else 314 tgt->f_srcop = OP_NONE; 315 316 return 1; 317} 318#endif 319 320static unsigned 321addrtype(const char *addr) 322{ 323 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/')) 324 return T_MYADDR; 325 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/')) 326 return T_HISADDR; 327 if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/')) 328 return T_DNS0; 329 if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/')) 330 return T_DNS1; 331 332 return T_ADDR; 333} 334 335static const char * 336addrstr(struct in_addr addr, unsigned type) 337{ 338 switch (type) { 339 case T_MYADDR: 340 return "MYADDR"; 341 case T_HISADDR: 342 return "HISADDR"; 343 case T_DNS0: 344 return "DNS0"; 345 case T_DNS1: 346 return "DNS1"; 347 } 348 return inet_ntoa(addr); 349} 350 351static const char * 352maskstr(int bits) 353{ 354 static char str[4]; 355 356 if (bits == 32) 357 *str = '\0'; 358 else 359 snprintf(str, sizeof str, "/%d", bits); 360 361 return str; 362} 363 364static int 365Parse(struct ipcp *ipcp, int argc, char const *const *argv, 366 struct filterent *ofp) 367{ 368 int action, proto; 369 int val, ruleno; 370 char *wp; 371 struct filterent filterdata; 372 373 ruleno = strtol(*argv, &wp, 0); 374 if (*argv == wp || ruleno >= MAXFILTERS) { 375 log_Printf(LogWARN, "Parse: invalid filter number.\n"); 376 return 0; 377 } 378 if (ruleno < 0) { 379 for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) { 380 ofp->f_action = A_NONE; 381 ofp++; 382 } 383 log_Printf(LogWARN, "Parse: filter cleared.\n"); 384 return 1; 385 } 386 ofp += ruleno; 387 388 if (--argc == 0) { 389 log_Printf(LogWARN, "Parse: missing action.\n"); 390 return 0; 391 } 392 argv++; 393 394 proto = P_NONE; 395 memset(&filterdata, '\0', sizeof filterdata); 396 397 val = strtol(*argv, &wp, 0); 398 if (!*wp && val >= 0 && val < MAXFILTERS) { 399 if (val <= ruleno) { 400 log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n", 401 ruleno); 402 return 0; 403 } 404 action = val; 405 } else if (!strcmp(*argv, "permit")) { 406 action = A_PERMIT; 407 } else if (!strcmp(*argv, "deny")) { 408 action = A_DENY; 409 } else if (!strcmp(*argv, "clear")) { 410 ofp->f_action = A_NONE; 411 return 1; 412 } else { 413 log_Printf(LogWARN, "Parse: bad action: %s\n", *argv); 414 return 0; 415 } 416 filterdata.f_action = action; 417 418 argc--; 419 argv++; 420 421 if (argc && argv[0][0] == '!' && !argv[0][1]) { 422 filterdata.f_invert = 1; 423 argc--; 424 argv++; 425 } 426 427 proto = filter_Nam2Proto(argc, argv); 428 if (proto == P_NONE) { 429 if (!argc) 430 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 431 else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr, 432 &filterdata.f_src.mask, &filterdata.f_src.width)) { 433 filterdata.f_srctype = addrtype(*argv); 434 argc--; 435 argv++; 436 proto = filter_Nam2Proto(argc, argv); 437 if (!argc) 438 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 439 else if (proto == P_NONE) { 440 if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr, 441 &filterdata.f_dst.mask, &filterdata.f_dst.width)) { 442 filterdata.f_dsttype = addrtype(*argv); 443 argc--; 444 argv++; 445 } else 446 filterdata.f_dsttype = T_ADDR; 447 if (argc) { 448 proto = filter_Nam2Proto(argc, argv); 449 if (proto == P_NONE) { 450 log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv); 451 return 0; 452 } else { 453 argc--; 454 argv++; 455 } 456 } 457 } else { 458 argc--; 459 argv++; 460 } 461 } else { 462 log_Printf(LogWARN, "Parse: Address/protocol expected.\n"); 463 return 0; 464 } 465 } else { 466 argc--; 467 argv++; 468 } 469 470 val = 1; 471 filterdata.f_proto = proto; 472 473 switch (proto) { 474 case P_TCP: 475 val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata); 476 break; 477 case P_UDP: 478 val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata); 479 break; 480 case P_ICMP: 481 val = ParseIcmp(argc, argv, &filterdata); 482 break; 483 case P_IGMP: 484 val = ParseIgmp(argc, argv, &filterdata); 485 break; 486#ifdef P_OSPF 487 case P_OSPF: 488 val = ParseOspf(argc, argv, &filterdata); 489 break; 490#endif 491#ifdef P_GRE 492 case P_GRE: 493 val = ParseGRE(argc, argv, &filterdata); 494 break; 495#endif 496 } 497 498 log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr)); 499 log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask)); 500 log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr)); 501 log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask)); 502 log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto); 503 504 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n", 505 filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport); 506 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n", 507 filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport); 508 log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab); 509 log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn); 510 log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst); 511 512 if (val) 513 *ofp = filterdata; 514 515 return val; 516} 517 518int 519filter_Set(struct cmdargs const *arg) 520{ 521 struct filter *filter; 522 523 if (arg->argc < arg->argn+2) 524 return -1; 525 526 if (!strcmp(arg->argv[arg->argn], "in")) 527 filter = &arg->bundle->filter.in; 528 else if (!strcmp(arg->argv[arg->argn], "out")) 529 filter = &arg->bundle->filter.out; 530 else if (!strcmp(arg->argv[arg->argn], "dial")) 531 filter = &arg->bundle->filter.dial; 532 else if (!strcmp(arg->argv[arg->argn], "alive")) 533 filter = &arg->bundle->filter.alive; 534 else { 535 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n", 536 arg->argv[arg->argn]); 537 return -1; 538 } 539 540 Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1, 541 arg->argv + arg->argn + 1, filter->rule); 542 return 0; 543} 544 545const char * 546filter_Action2Nam(int act) 547{ 548 static const char * const actname[] = { " none ", "permit ", " deny " }; 549 static char buf[8]; 550 551 if (act >= 0 && act < MAXFILTERS) { 552 snprintf(buf, sizeof buf, "%6d ", act); 553 return buf; 554 } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *)) 555 return actname[act - A_NONE]; 556 else 557 return "?????? "; 558} 559 560static void 561doShowFilter(struct filterent *fp, struct prompt *prompt) 562{ 563 int n; 564 565 for (n = 0; n < MAXFILTERS; n++, fp++) { 566 if (fp->f_action != A_NONE) { 567 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action)); 568 prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' '); 569 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype), 570 maskstr(fp->f_src.width)); 571 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype), 572 maskstr(fp->f_dst.width)); 573 if (fp->f_proto) { 574 prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto)); 575 576 if (fp->f_srcop) 577 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop), 578 fp->f_srcport); 579 if (fp->f_dstop) 580 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop), 581 fp->f_dstport); 582 if (fp->f_estab) 583 prompt_Printf(prompt, " estab"); 584 if (fp->f_syn) 585 prompt_Printf(prompt, " syn"); 586 if (fp->f_finrst) 587 prompt_Printf(prompt, " finrst"); 588 } 589 prompt_Printf(prompt, "\n"); 590 } 591 } 592} 593 594int 595filter_Show(struct cmdargs const *arg) 596{ 597 if (arg->argc > arg->argn+1) 598 return -1; 599 600 if (arg->argc == arg->argn+1) { 601 struct filter *filter; 602 603 if (!strcmp(arg->argv[arg->argn], "in")) 604 filter = &arg->bundle->filter.in; 605 else if (!strcmp(arg->argv[arg->argn], "out")) 606 filter = &arg->bundle->filter.out; 607 else if (!strcmp(arg->argv[arg->argn], "dial")) 608 filter = &arg->bundle->filter.dial; 609 else if (!strcmp(arg->argv[arg->argn], "alive")) 610 filter = &arg->bundle->filter.alive; 611 else 612 return -1; 613 doShowFilter(filter->rule, arg->prompt); 614 } else { 615 struct filter *filter[4]; 616 int f; 617 618 filter[0] = &arg->bundle->filter.in; 619 filter[1] = &arg->bundle->filter.out; 620 filter[2] = &arg->bundle->filter.dial; 621 filter[3] = &arg->bundle->filter.alive; 622 for (f = 0; f < 4; f++) { 623 if (f) 624 prompt_Printf(arg->prompt, "\n"); 625 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name); 626 doShowFilter(filter[f]->rule, arg->prompt); 627 } 628 } 629 630 return 0; 631} 632 633static const char * const protoname[] = { 634 "none", "tcp", "udp", "icmp", "ospf", "igmp", "gre" 635}; 636 637const char * 638filter_Proto2Nam(int proto) 639{ 640 if (proto >= sizeof protoname / sizeof protoname[0]) 641 return "unknown"; 642 return protoname[proto]; 643} 644 645static int 646filter_Nam2Proto(int argc, char const *const *argv) 647{ 648 int proto; 649 650 if (argc == 0) 651 proto = 0; 652 else 653 for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--) 654 if (!strcasecmp(*argv, protoname[proto])) 655 break; 656 657 return proto; 658} 659 660static const char * const opname[] = {"none", "eq", "gt", "lt"}; 661 662const char * 663filter_Op2Nam(int op) 664{ 665 if (op >= sizeof opname / sizeof opname[0]) 666 return "unknown"; 667 return opname[op]; 668 669} 670 671static int 672filter_Nam2Op(const char *cp) 673{ 674 int op; 675 676 for (op = sizeof opname / sizeof opname[0] - 1; op; op--) 677 if (!strcasecmp(cp, opname[op])) 678 break; 679 680 return op; 681} 682 683void 684filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip, 685 struct in_addr *peer_ip, struct in_addr dns[2]) 686{ 687 struct filterent *fp; 688 int n; 689 690 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++) 691 if (fp->f_action != A_NONE) { 692 if (my_ip) { 693 if (fp->f_srctype == T_MYADDR) 694 fp->f_src.ipaddr = *my_ip; 695 if (fp->f_dsttype == T_MYADDR) 696 fp->f_dst.ipaddr = *my_ip; 697 } 698 if (peer_ip) { 699 if (fp->f_srctype == T_HISADDR) 700 fp->f_src.ipaddr = *peer_ip; 701 if (fp->f_dsttype == T_HISADDR) 702 fp->f_dst.ipaddr = *peer_ip; 703 } 704 if (dns) { 705 if (fp->f_srctype == T_DNS0) 706 fp->f_src.ipaddr = dns[0]; 707 if (fp->f_dsttype == T_DNS0) 708 fp->f_dst.ipaddr = dns[0]; 709 if (fp->f_srctype == T_DNS1) 710 fp->f_src.ipaddr = dns[1]; 711 if (fp->f_dsttype == T_DNS1) 712 fp->f_dst.ipaddr = dns[1]; 713 } 714 } 715} 716