filter.c revision 330449 
1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org>
5 *          based on work by Toshiharu OHNO <tony-o@iij.ad.jp>
6 *                           Internet Initiative Japan, Inc (IIJ)
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * $FreeBSD: stable/11/usr.sbin/ppp/filter.c 330449 2018-03-05 07:26:05Z eadler $
31 */
32
33#include <sys/param.h>
34#include <netinet/in.h>
35#include <netdb.h>
36#include <netinet/in_systm.h>
37#include <netinet/ip.h>
38#include <sys/socket.h>
39#include <sys/un.h>
40
41#include <stdarg.h>
42#include <stdio.h>
43#include <stdlib.h>
44#include <string.h>
45#include <termios.h>
46
47#include "layer.h"
48#include "defs.h"
49#include "command.h"
50#include "mbuf.h"
51#include "log.h"
52#include "iplist.h"
53#include "timer.h"
54#include "throughput.h"
55#include "lqr.h"
56#include "hdlc.h"
57#include "fsm.h"
58#include "lcp.h"
59#include "ccp.h"
60#include "link.h"
61#include "slcompress.h"
62#include "ncpaddr.h"
63#include "ipcp.h"
64#include "filter.h"
65#include "descriptor.h"
66#include "prompt.h"
67#include "mp.h"
68#ifndef NORADIUS
69#include "radius.h"
70#endif
71#include "ipv6cp.h"
72#include "ncp.h"
73#include "bundle.h"
74
75static unsigned filter_Nam2Op(const char *);
76
77static int
78ParsePort(const char *service, const char *proto)
79{
80  struct servent *servent;
81  char *cp;
82  int port;
83
84  servent = getservbyname(service, proto);
85  if (servent != NULL)
86    return ntohs(servent->s_port);
87
88  port = strtol(service, &cp, 0);
89  if (cp == service) {
90    log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
91	      service);
92    return 0;
93  }
94  return port;
95}
96
97/*
98 *	ICMP Syntax:	src eq icmp_message_type
99 */
100static int
101ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
102{
103  int type;
104  char *cp;
105
106  switch (argc) {
107  case 0:
108    /* permit/deny all ICMP types */
109    tgt->f_srcop = tgt->f_dstop = OP_NONE;
110    break;
111
112  case 3:
113    if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
114      type = strtol(argv[2], &cp, 0);
115      if (cp == argv[2]) {
116	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
117	return 0;
118      }
119      tgt->f_srcop = OP_EQ;
120      tgt->f_srcport = type;
121      tgt->f_dstop = OP_NONE;
122    }
123    break;
124
125  default:
126    log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
127    return 0;
128  }
129  return 1;
130}
131
132/*
133 *	UDP Syntax: [src op port] [dst op port]
134 */
135static int
136ParseUdpOrTcp(int argc, char const *const *argv, const struct protoent *pe,
137              struct filterent *tgt)
138{
139  tgt->f_srcop = tgt->f_dstop = OP_NONE;
140  tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
141
142  if (argc >= 3 && !strcmp(*argv, "src")) {
143    tgt->f_srcop = filter_Nam2Op(argv[1]);
144    if (tgt->f_srcop == OP_NONE) {
145      log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
146      return 0;
147    }
148    if (pe == NULL)
149      return 0;
150    tgt->f_srcport = ParsePort(argv[2], pe->p_name);
151    if (tgt->f_srcport == 0)
152      return 0;
153    argc -= 3;
154    argv += 3;
155  }
156
157  if (argc >= 3 && !strcmp(argv[0], "dst")) {
158    tgt->f_dstop = filter_Nam2Op(argv[1]);
159    if (tgt->f_dstop == OP_NONE) {
160      log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
161      return 0;
162    }
163    if (pe == NULL)
164      return 0;
165    tgt->f_dstport = ParsePort(argv[2], pe->p_name);
166    if (tgt->f_dstport == 0)
167      return 0;
168    argc -= 3;
169    argv += 3;
170  }
171
172  if (pe && pe->p_proto == IPPROTO_TCP) {
173    for (; argc > 0; argc--, argv++)
174      if (!strcmp(*argv, "estab"))
175        tgt->f_estab = 1;
176      else if (!strcmp(*argv, "syn"))
177        tgt->f_syn = 1;
178      else if (!strcmp(*argv, "finrst"))
179        tgt->f_finrst = 1;
180      else
181        break;
182  }
183
184  if (argc > 0) {
185    log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
186    return 0;
187  }
188
189  return 1;
190}
191
192static int
193ParseGeneric(int argc, struct filterent *tgt)
194{
195  /*
196   * Filter currently is a catch-all. Requests are either permitted or
197   * dropped.
198   */
199  if (argc != 0) {
200    log_Printf(LogWARN, "ParseGeneric: Too many parameters\n");
201    return 0;
202  } else
203    tgt->f_srcop = tgt->f_dstop = OP_NONE;
204
205  return 1;
206}
207
208static unsigned
209addrtype(const char *addr)
210{
211  if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
212    return T_MYADDR;
213  if (!strncasecmp(addr, "MYADDR6", 7) && (addr[7] == '\0' || addr[7] == '/'))
214    return T_MYADDR6;
215  if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
216    return T_HISADDR;
217  if (!strncasecmp(addr, "HISADDR6", 8) && (addr[8] == '\0' || addr[8] == '/'))
218    return T_HISADDR6;
219  if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/'))
220    return T_DNS0;
221  if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/'))
222    return T_DNS1;
223
224  return T_ADDR;
225}
226
227static const char *
228addrstr(struct ncprange *addr, unsigned type)
229{
230  switch (type) {
231    case T_MYADDR:
232      return "MYADDR";
233    case T_HISADDR:
234      return "HISADDR";
235    case T_DNS0:
236      return "DNS0";
237    case T_DNS1:
238      return "DNS1";
239  }
240  return ncprange_ntoa(addr);
241}
242
243static int
244filter_Parse(struct ncp *ncp, int argc, char const *const *argv,
245             struct filterent *ofp)
246{
247  struct filterent fe;
248  struct protoent *pe;
249  char *wp;
250  int action, family, ruleno, val, width;
251
252  ruleno = strtol(*argv, &wp, 0);
253  if (*argv == wp || ruleno >= MAXFILTERS) {
254    log_Printf(LogWARN, "Parse: invalid filter number.\n");
255    return 0;
256  }
257  if (ruleno < 0) {
258    for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
259      ofp->f_action = A_NONE;
260      ofp++;
261    }
262    log_Printf(LogWARN, "Parse: filter cleared.\n");
263    return 1;
264  }
265  ofp += ruleno;
266
267  if (--argc == 0) {
268    log_Printf(LogWARN, "Parse: missing action.\n");
269    return 0;
270  }
271  argv++;
272
273  memset(&fe, '\0', sizeof fe);
274
275  val = strtol(*argv, &wp, 0);
276  if (!*wp && val >= 0 && val < MAXFILTERS) {
277    if (val <= ruleno) {
278      log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
279                 ruleno);
280      return 0;
281    }
282    action = val;
283  } else if (!strcmp(*argv, "permit")) {
284    action = A_PERMIT;
285  } else if (!strcmp(*argv, "deny")) {
286    action = A_DENY;
287  } else if (!strcmp(*argv, "clear")) {
288    ofp->f_action = A_NONE;
289    return 1;
290  } else {
291    log_Printf(LogWARN, "Parse: %s: bad action\n", *argv);
292    return 0;
293  }
294  fe.f_action = action;
295
296  argc--;
297  argv++;
298
299  if (argc && argv[0][0] == '!' && !argv[0][1]) {
300    fe.f_invert = 1;
301    argc--;
302    argv++;
303  }
304
305  ncprange_init(&fe.f_src);
306  ncprange_init(&fe.f_dst);
307
308  if (argc == 0)
309    pe = NULL;
310  else if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
311    if (argc < 2) {
312      log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
313      return 0;
314    } else if (strcasecmp(*argv, "any") == 0 ||
315               ncprange_aton(&fe.f_src, ncp, *argv)) {
316      family = ncprange_family(&fe.f_src);
317      if (!ncprange_getwidth(&fe.f_src, &width))
318        width = 0;
319      if (width == 0)
320        ncprange_init(&fe.f_src);
321      fe.f_srctype = addrtype(*argv);
322      argc--;
323      argv++;
324
325      if (strcasecmp(*argv, "any") == 0 ||
326          ncprange_aton(&fe.f_dst, ncp, *argv)) {
327        if (ncprange_family(&fe.f_dst) != AF_UNSPEC &&
328            ncprange_family(&fe.f_src) != AF_UNSPEC &&
329            family != ncprange_family(&fe.f_dst)) {
330          log_Printf(LogWARN, "Parse: src and dst address families differ\n");
331          return 0;
332        }
333        if (!ncprange_getwidth(&fe.f_dst, &width))
334          width = 0;
335        if (width == 0)
336          ncprange_init(&fe.f_dst);
337        fe.f_dsttype = addrtype(*argv);
338        argc--;
339        argv++;
340      } else {
341        log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
342        return 0;
343      }
344
345      if (argc) {
346        if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
347          log_Printf(LogWARN, "Parse: %s: Protocol expected\n", *argv);
348          return 0;
349        } else {
350          argc--;
351          argv++;
352        }
353      }
354    } else {
355      log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
356      return 0;
357    }
358  } else {
359    argc--;
360    argv++;
361  }
362
363  if (argc >= 2 && strcmp(*argv, "timeout") == 0) {
364    fe.timeout = strtoul(argv[1], NULL, 10);
365    argc -= 2;
366    argv += 2;
367  }
368
369  val = 1;
370  fe.f_proto = (pe == NULL) ? 0 : pe->p_proto;
371
372  switch (fe.f_proto) {
373  case IPPROTO_TCP:
374  case IPPROTO_UDP:
375  case IPPROTO_IPIP:
376#ifndef NOINET6
377  case IPPROTO_IPV6:
378#endif
379    val = ParseUdpOrTcp(argc, argv, pe, &fe);
380    break;
381  case IPPROTO_ICMP:
382#ifndef NOINET6
383  case IPPROTO_ICMPV6:
384#endif
385    val = ParseIcmp(argc, argv, &fe);
386    break;
387  default:
388    val = ParseGeneric(argc, &fe);
389    break;
390  }
391
392  log_Printf(LogDEBUG, "Parse: Src: %s\n", ncprange_ntoa(&fe.f_src));
393  log_Printf(LogDEBUG, "Parse: Dst: %s\n", ncprange_ntoa(&fe.f_dst));
394  log_Printf(LogDEBUG, "Parse: Proto: %d\n", fe.f_proto);
395
396  log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
397            filter_Op2Nam(fe.f_srcop), fe.f_srcport);
398  log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
399            filter_Op2Nam(fe.f_dstop), fe.f_dstport);
400  log_Printf(LogDEBUG, "Parse: estab: %u\n", fe.f_estab);
401  log_Printf(LogDEBUG, "Parse: syn: %u\n", fe.f_syn);
402  log_Printf(LogDEBUG, "Parse: finrst: %u\n", fe.f_finrst);
403
404  if (val)
405    *ofp = fe;
406
407  return val;
408}
409
410int
411filter_Set(struct cmdargs const *arg)
412{
413  struct filter *filter;
414
415  if (arg->argc < arg->argn+2)
416    return -1;
417
418  if (!strcmp(arg->argv[arg->argn], "in"))
419    filter = &arg->bundle->filter.in;
420  else if (!strcmp(arg->argv[arg->argn], "out"))
421    filter = &arg->bundle->filter.out;
422  else if (!strcmp(arg->argv[arg->argn], "dial"))
423    filter = &arg->bundle->filter.dial;
424  else if (!strcmp(arg->argv[arg->argn], "alive"))
425    filter = &arg->bundle->filter.alive;
426  else {
427    log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
428              arg->argv[arg->argn]);
429    return -1;
430  }
431
432  filter_Parse(&arg->bundle->ncp, arg->argc - arg->argn - 1,
433        arg->argv + arg->argn + 1, filter->rule);
434  return 0;
435}
436
437const char *
438filter_Action2Nam(unsigned act)
439{
440  static const char * const actname[] = { "  none ", "permit ", "  deny " };
441  static char buf[8];
442
443  if (act < MAXFILTERS) {
444    snprintf(buf, sizeof buf, "%6d ", act);
445    return buf;
446  } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
447    return actname[act - A_NONE];
448  else
449    return "?????? ";
450}
451
452static void
453doShowFilter(struct filterent *fp, struct prompt *prompt)
454{
455  struct protoent *pe;
456  int n;
457
458  for (n = 0; n < MAXFILTERS; n++, fp++) {
459    if (fp->f_action != A_NONE) {
460      prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->f_action));
461      prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
462
463      if (ncprange_isset(&fp->f_src))
464        prompt_Printf(prompt, "%s ", addrstr(&fp->f_src, fp->f_srctype));
465      else
466        prompt_Printf(prompt, "any ");
467
468      if (ncprange_isset(&fp->f_dst))
469        prompt_Printf(prompt, "%s ", addrstr(&fp->f_dst, fp->f_dsttype));
470      else
471        prompt_Printf(prompt, "any ");
472
473      if (fp->f_proto) {
474        if ((pe = getprotobynumber(fp->f_proto)) == NULL)
475	  prompt_Printf(prompt, "P:%d", fp->f_proto);
476        else
477	  prompt_Printf(prompt, "%s", pe->p_name);
478
479	if (fp->f_srcop)
480	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
481		  fp->f_srcport);
482	if (fp->f_dstop)
483	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
484		  fp->f_dstport);
485	if (fp->f_estab)
486	  prompt_Printf(prompt, " estab");
487	if (fp->f_syn)
488	  prompt_Printf(prompt, " syn");
489	if (fp->f_finrst)
490	  prompt_Printf(prompt, " finrst");
491      } else
492	prompt_Printf(prompt, "all");
493      if (fp->timeout != 0)
494	  prompt_Printf(prompt, " timeout %u", fp->timeout);
495      prompt_Printf(prompt, "\n");
496    }
497  }
498}
499
500int
501filter_Show(struct cmdargs const *arg)
502{
503  if (arg->argc > arg->argn+1)
504    return -1;
505
506  if (arg->argc == arg->argn+1) {
507    struct filter *filter;
508
509    if (!strcmp(arg->argv[arg->argn], "in"))
510      filter = &arg->bundle->filter.in;
511    else if (!strcmp(arg->argv[arg->argn], "out"))
512      filter = &arg->bundle->filter.out;
513    else if (!strcmp(arg->argv[arg->argn], "dial"))
514      filter = &arg->bundle->filter.dial;
515    else if (!strcmp(arg->argv[arg->argn], "alive"))
516      filter = &arg->bundle->filter.alive;
517    else
518      return -1;
519    doShowFilter(filter->rule, arg->prompt);
520  } else {
521    struct filter *filter[4];
522    int f;
523
524    filter[0] = &arg->bundle->filter.in;
525    filter[1] = &arg->bundle->filter.out;
526    filter[2] = &arg->bundle->filter.dial;
527    filter[3] = &arg->bundle->filter.alive;
528    for (f = 0; f < 4; f++) {
529      if (f)
530        prompt_Printf(arg->prompt, "\n");
531      prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
532      doShowFilter(filter[f]->rule, arg->prompt);
533    }
534  }
535
536  return 0;
537}
538
539static const char * const opname[] = {"none", "eq", "gt", "lt"};
540
541const char *
542filter_Op2Nam(unsigned op)
543{
544  if (op >= sizeof opname / sizeof opname[0])
545    return "unknown";
546  return opname[op];
547
548}
549
550static unsigned
551filter_Nam2Op(const char *cp)
552{
553  unsigned op;
554
555  for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
556    if (!strcasecmp(cp, opname[op]))
557      break;
558
559  return op;
560}
561
562void
563filter_AdjustAddr(struct filter *filter, struct ncpaddr *local,
564                  struct ncpaddr *remote, struct in_addr *dns)
565{
566  struct filterent *fp;
567  int n;
568
569  for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
570    if (fp->f_action != A_NONE) {
571      if (local) {
572        if (fp->f_srctype == T_MYADDR && ncpaddr_family(local) == AF_INET)
573          ncprange_sethost(&fp->f_src, local);
574        if (fp->f_dsttype == T_MYADDR && ncpaddr_family(local) == AF_INET)
575          ncprange_sethost(&fp->f_dst, local);
576#ifndef NOINET6
577        if (fp->f_srctype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
578          ncprange_sethost(&fp->f_src, local);
579        if (fp->f_dsttype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
580          ncprange_sethost(&fp->f_dst, local);
581#endif
582      }
583      if (remote) {
584        if (fp->f_srctype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
585          ncprange_sethost(&fp->f_src, remote);
586        if (fp->f_dsttype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
587          ncprange_sethost(&fp->f_dst, remote);
588#ifndef NOINET6
589        if (fp->f_srctype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
590          ncprange_sethost(&fp->f_src, remote);
591        if (fp->f_dsttype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
592          ncprange_sethost(&fp->f_dst, remote);
593#endif
594      }
595      if (dns) {
596        if (fp->f_srctype == T_DNS0)
597          ncprange_setip4host(&fp->f_src, dns[0]);
598        if (fp->f_dsttype == T_DNS0)
599          ncprange_setip4host(&fp->f_dst, dns[0]);
600        if (fp->f_srctype == T_DNS1)
601          ncprange_setip4host(&fp->f_src, dns[1]);
602        if (fp->f_dsttype == T_DNS1)
603          ncprange_setip4host(&fp->f_dst, dns[1]);
604      }
605    }
606}
607