1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 *
7 * $Id$
8 */
9
10 #include <ctype.h>
11
12 #include "ipf.h"
13 #include "ipt.h"
14
15 extern int opts;
16
17 static char *tx_proto = "";
18
19 static int text_open(char *), text_close(void);
20 static int text_readip(mb_t *, char **, int *);
21 static int parseline(char *, ip_t *, char **, int *);
22
23 static char myflagset[] = "FSRPAUEWe";
24 static uint16_t myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH,
25 TH_ACK, TH_URG, TH_ECN, TH_CWR, TH_AE };
26
27 struct ipread iptext = { text_open, text_close, text_readip, R_DO_CKSUM };
28 static FILE *tfp = NULL;
29 static int tfd = -1;
30
31 static u_32_t tx_hostnum(char *, int *);
32 static u_short tx_portnum(char *);
33
34 #ifdef USE_INET6
35 int parseipv6(char **, ip6_t *, char **, int *);
36 #endif
37
38 /*
39 * returns an ip address as a long var as a result of either a DNS lookup or
40 * straight inet_addr() call
41 */
42 static u_32_t
tx_hostnum(char * host,int * resolved)43 tx_hostnum(char *host, int *resolved)
44 {
45 i6addr_t ipa;
46
47 *resolved = 0;
48 if (!strcasecmp("any", host))
49 return (0L);
50 if (ISDIGIT(*host))
51 return (inet_addr(host));
52
53 if (gethost(AF_INET, host, &ipa) == -1) {
54 *resolved = -1;
55 fprintf(stderr, "can't resolve hostname: %s\n", host);
56 return (0);
57 }
58 return (ipa.in4.s_addr);
59 }
60
61
62 /*
63 * find the port number given by the name, either from getservbyname() or
64 * straight atoi()
65 */
66 static u_short
tx_portnum(char * name)67 tx_portnum(char *name)
68 {
69 struct servent *sp;
70
71 if (ISDIGIT(*name))
72 return (u_short)atoi(name);
73 sp = getservbyname(name, tx_proto);
74 if (sp)
75 return (ntohs(sp->s_port));
76 (void) fprintf(stderr, "unknown service \"%s\".\n", name);
77 return (0);
78 }
79
80
81 static int
text_open(char * fname)82 text_open(char *fname)
83 {
84 if (tfp && tfd != -1) {
85 rewind(tfp);
86 return (tfd);
87 }
88
89 if (!strcmp(fname, "-")) {
90 tfd = 0;
91 tfp = stdin;
92 } else {
93 tfd = open(fname, O_RDONLY);
94 if (tfd != -1)
95 tfp = fdopen(tfd, "r");
96 }
97 return (tfd);
98 }
99
100
101 static int
text_close(void)102 text_close(void)
103 {
104 int cfd = tfd;
105
106 tfd = -1;
107 return (close(cfd));
108 }
109
110
111 static int
text_readip(mb_t * mb,char ** ifn,int * dir)112 text_readip(mb_t *mb, char **ifn, int *dir)
113 {
114 register char *s;
115 char line[513];
116 ip_t *ip;
117 char *buf;
118
119 buf = (char *)mb->mb_buf;
120
121 *ifn = NULL;
122 while (fgets(line, sizeof(line)-1, tfp)) {
123 if ((s = strchr(line, '\n')))
124 *s = '\0';
125 if ((s = strchr(line, '\r')))
126 *s = '\0';
127 if ((s = strchr(line, '#')))
128 *s = '\0';
129 if (!*line)
130 continue;
131 if ((opts & OPT_DEBUG) != 0)
132 printf("input: %s\n", line);
133 *ifn = NULL;
134 *dir = 0;
135 if (!parseline(line, (ip_t *)buf, ifn, dir)) {
136 ip = (ip_t *)buf;
137 if (IP_V(ip) == 6) {
138 #ifdef USE_INET6
139 mb->mb_len = ntohs(((ip6_t *)ip)->ip6_plen) +
140 sizeof(ip6_t);
141 #else
142 mb->mb_len = 0;
143 #endif
144 } else {
145 mb->mb_len = ntohs(ip->ip_len);
146 }
147 return (mb->mb_len);
148 }
149 }
150 if (feof(tfp))
151 return (0);
152 return (-1);
153 }
154
155 static int
parseline(char * line,ip_t * ip,char ** ifn,int * out)156 parseline(char *line, ip_t *ip, char **ifn, int *out)
157 {
158 tcphdr_t th, *tcp = &th;
159 struct icmp icmp, *ic = &icmp;
160 char *cps[20], **cpp, c, ipopts[68];
161 int i, r;
162
163 if (*ifn)
164 free(*ifn);
165 bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip));
166 bzero((char *)tcp, sizeof(*tcp));
167 bzero((char *)ic, sizeof(*ic));
168 bzero(ipopts, sizeof(ipopts));
169 IP_HL_A(ip, sizeof(*ip) >> 2);
170 IP_V_A(ip, IPVERSION);
171 ip->ip_ttl = 63;
172 for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; )
173 cps[++i] = strtok(NULL, " \b\t\r\n");
174
175 cpp = cps;
176 if (!*cpp)
177 return (1);
178
179 c = **cpp;
180 if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) {
181 fprintf(stderr, "bad direction \"%s\"\n", *cpp);
182 return (1);
183 }
184
185 #ifdef USE_INET6
186 if (!strcasecmp(*cpp, "out6") || !strcasecmp(*cpp, "in6")) {
187 return (parseipv6(cpp, (ip6_t *)ip, ifn, out));
188 }
189 #endif
190
191 *out = (TOLOWER(c) == 'o') ? 1 : 0;
192 cpp++;
193 if (!*cpp)
194 return (1);
195
196 if (!strcasecmp(*cpp, "on")) {
197 cpp++;
198 if (!*cpp)
199 return (1);
200 *ifn = strdup(*cpp++);
201 if (!*cpp)
202 return (1);
203 }
204
205 c = **cpp;
206 ip->ip_len = sizeof(ip_t);
207 if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") ||
208 !strcasecmp(*cpp, "icmp")) {
209 if (c == 't') {
210 ip->ip_p = IPPROTO_TCP;
211 ip->ip_len += sizeof(struct tcphdr);
212 tx_proto = "tcp";
213 } else if (c == 'u') {
214 ip->ip_p = IPPROTO_UDP;
215 ip->ip_len += sizeof(struct udphdr);
216 tx_proto = "udp";
217 } else {
218 ip->ip_p = IPPROTO_ICMP;
219 ip->ip_len += ICMPERR_IPICMPHLEN;
220 tx_proto = "icmp";
221 }
222 cpp++;
223 } else if (ISDIGIT(**cpp) && !index(*cpp, '.')) {
224 ip->ip_p = atoi(*cpp);
225 cpp++;
226 } else
227 ip->ip_p = IPPROTO_IP;
228
229 if (!*cpp)
230 return (1);
231 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
232 char *last;
233
234 last = strchr(*cpp, ',');
235 if (!last) {
236 fprintf(stderr, "tcp/udp with no source port\n");
237 return (1);
238 }
239 *last++ = '\0';
240 tcp->th_sport = htons(tx_portnum(last));
241 if (ip->ip_p == IPPROTO_TCP) {
242 tcp->th_win = htons(4096);
243 TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
244 }
245 }
246 ip->ip_src.s_addr = tx_hostnum(*cpp, &r);
247 cpp++;
248 if (!*cpp)
249 return (1);
250
251 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
252 char *last;
253
254 last = strchr(*cpp, ',');
255 if (!last) {
256 fprintf(stderr, "tcp/udp with no destination port\n");
257 return (1);
258 }
259 *last++ = '\0';
260 tcp->th_dport = htons(tx_portnum(last));
261 }
262 ip->ip_dst.s_addr = tx_hostnum(*cpp, &r);
263 cpp++;
264 if (ip->ip_p == IPPROTO_TCP) {
265 if (*cpp != NULL) {
266 char *s, *t;
267
268 __tcp_set_flags(tcp, 0);
269 for (s = *cpp; *s; s++)
270 if ((t = strchr(myflagset, *s)))
271 __tcp_set_flags(tcp, __tcp_get_flags(tcp) |
272 myflags[t-myflagset]);
273 if (__tcp_get_flags(tcp))
274 cpp++;
275 }
276
277 if (__tcp_get_flags(tcp) & TH_URG)
278 tcp->th_urp = htons(1);
279
280 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
281 tcp->th_seq = htonl(atoi(*cpp + 4));
282 cpp++;
283 }
284
285 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
286 tcp->th_ack = htonl(atoi(*cpp + 4));
287 cpp++;
288 }
289 } else if (*cpp && ip->ip_p == IPPROTO_ICMP) {
290 char *t;
291
292 t = strchr(*cpp, ',');
293 if (t != NULL)
294 *t = '\0';
295
296 ic->icmp_type = geticmptype(AF_INET, *cpp);
297 if (t != NULL)
298 ic->icmp_code = atoi(t + 1);
299 cpp++;
300
301 if (ic->icmp_type == ICMP_ECHO ||
302 ic->icmp_type == ICMP_ECHOREPLY)
303 ic->icmp_id = htons(getpid());
304 if (t != NULL)
305 *t = ',';
306 }
307
308 if (*cpp && !strcasecmp(*cpp, "opt")) {
309 u_long olen;
310
311 cpp++;
312 olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2);
313 if (olen) {
314 bcopy(ipopts, (char *)(ip + 1), olen);
315 IP_HL_A(ip, IP_HL(ip) + (olen >> 2));
316 ip->ip_len += olen;
317 }
318 }
319 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP)
320 bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2),
321 sizeof(*tcp));
322 else if (ip->ip_p == IPPROTO_ICMP)
323 bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2),
324 sizeof(*ic));
325 ip->ip_len = htons(ip->ip_len);
326 return (0);
327 }
328
329
330 #ifdef USE_INET6
331 int
parseipv6(char ** cpp,ip6_t * ip6,char ** ifn,int * out)332 parseipv6(char **cpp, ip6_t *ip6, char **ifn, int *out)
333 {
334 tcphdr_t th, *tcp = &th;
335 struct icmp6_hdr icmp, *ic6 = &icmp;
336
337 bzero((char *)ip6, MAX(sizeof(*tcp), sizeof(*ic6)) + sizeof(*ip6));
338 bzero((char *)tcp, sizeof(*tcp));
339 bzero((char *)ic6, sizeof(*ic6));
340 ip6->ip6_vfc = 0x60;
341
342 *out = (**cpp == 'o') ? 1 : 0;
343 cpp++;
344 if (!*cpp)
345 return (1);
346
347 if (!strcasecmp(*cpp, "on")) {
348 cpp++;
349 if (!*cpp)
350 return (1);
351 *ifn = strdup(*cpp++);
352 if (!*cpp)
353 return (1);
354 }
355
356 if (!strcasecmp(*cpp, "tcp")) {
357 ip6->ip6_nxt = IPPROTO_TCP;
358 tx_proto = "tcp";
359 cpp++;
360 } else if (!strcasecmp(*cpp, "udp")) {
361 ip6->ip6_nxt = IPPROTO_UDP;
362 tx_proto = "udp";
363 cpp++;
364 } else if (!strcasecmp(*cpp, "icmpv6")) {
365 ip6->ip6_nxt = IPPROTO_ICMPV6;
366 tx_proto = "icmpv6";
367 cpp++;
368 } else if (ISDIGIT(**cpp) && !index(*cpp, ':')) {
369 ip6->ip6_nxt = atoi(*cpp);
370 cpp++;
371 } else
372 ip6->ip6_nxt = IPPROTO_IPV6;
373
374 if (!*cpp)
375 return (1);
376
377 switch (ip6->ip6_nxt)
378 {
379 case IPPROTO_TCP :
380 ip6->ip6_plen = sizeof(struct tcphdr);
381 break;
382 case IPPROTO_UDP :
383 ip6->ip6_plen = sizeof(struct udphdr);
384 break;
385 case IPPROTO_ICMPV6 :
386 ip6->ip6_plen = ICMP6ERR_IPICMPHLEN;
387 break;
388 default :
389 break;
390 }
391
392 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
393 char *last;
394
395 last = strchr(*cpp, ',');
396 if (!last) {
397 fprintf(stderr, "tcp/udp with no source port\n");
398 return (1);
399 }
400 *last++ = '\0';
401 tcp->th_sport = htons(tx_portnum(last));
402 if (ip6->ip6_nxt == IPPROTO_TCP) {
403 tcp->th_win = htons(4096);
404 TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
405 }
406 }
407
408 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_src) != 1) {
409 fprintf(stderr, "cannot parse source address '%s'\n", *cpp);
410 return (1);
411 }
412
413 cpp++;
414 if (!*cpp)
415 return (1);
416
417 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
418 char *last;
419
420 last = strchr(*cpp, ',');
421 if (!last) {
422 fprintf(stderr, "tcp/udp with no destination port\n");
423 return (1);
424 }
425 *last++ = '\0';
426 tcp->th_dport = htons(tx_portnum(last));
427 }
428
429 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_dst) != 1) {
430 fprintf(stderr, "cannot parse destination address '%s'\n",
431 *cpp);
432 return (1);
433 }
434
435 cpp++;
436 if (ip6->ip6_nxt == IPPROTO_TCP) {
437 if (*cpp != NULL) {
438 char *s, *t;
439
440 __tcp_set_flags(tcp, 0);
441 for (s = *cpp; *s; s++)
442 if ((t = strchr(myflagset, *s)))
443 __tcp_set_flags(tcp, __tcp_get_flags(tcp) |
444 myflags[t-myflagset]);
445 if (__tcp_get_flags(tcp))
446 cpp++;
447 }
448
449 if (__tcp_get_flags(tcp) & TH_URG)
450 tcp->th_urp = htons(1);
451
452 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
453 tcp->th_seq = htonl(atoi(*cpp + 4));
454 cpp++;
455 }
456
457 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
458 tcp->th_ack = htonl(atoi(*cpp + 4));
459 cpp++;
460 }
461 } else if (*cpp && ip6->ip6_nxt == IPPROTO_ICMPV6) {
462 char *t;
463
464 t = strchr(*cpp, ',');
465 if (t != NULL)
466 *t = '\0';
467
468 ic6->icmp6_type = geticmptype(AF_INET6, *cpp);
469 if (t != NULL)
470 ic6->icmp6_code = atoi(t + 1);
471
472 if (ic6->icmp6_type == ICMP6_ECHO_REQUEST ||
473 ic6->icmp6_type == ICMP6_ECHO_REPLY)
474 ic6->icmp6_id = htons(getpid());
475
476 if (t != NULL)
477 *t = ',';
478 }
479
480 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
481 bcopy((char *)tcp, (char *)ip6 + sizeof(*ip6),
482 sizeof(*tcp));
483 } else if (ip6->ip6_nxt == IPPROTO_ICMPV6) {
484 bcopy((char *)ic6, (char *)ip6 + sizeof(*ip6),
485 sizeof(*ic6));
486 }
487
488 /*
489 * Because a length of 0 == jumbo gram...
490 */
491 if (ip6->ip6_plen == 0) {
492 ip6->ip6_plen++;
493 }
494 ip6->ip6_plen = htons(ip6->ip6_plen);
495 return (0);
496 }
497 #endif
498