1 2 /* 3 * Copyright (C) 2012 by Darren Reed. 4 * 5 * See the IPFILTER.LICENCE file for details on licencing. 6 * 7 * $Id$ 8 */ 9 #if !defined(lint) 10 static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed"; 11 static const char rcsid[] = "@(#)$Id$"; 12 #endif 13 14 #include <ctype.h> 15 16 #include "ipf.h" 17 #include "ipt.h" 18 19 extern int opts; 20 21 static char *tx_proto = ""; 22 23 static int text_open(char *), text_close(void); 24 static int text_readip(mb_t *, char **, int *); 25 static int parseline(char *, ip_t *, char **, int *); 26 27 static char myflagset[] = "FSRPAUEC"; 28 static u_char myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, 29 TH_ACK, TH_URG, TH_ECN, TH_CWR }; 30 31 struct ipread iptext = { text_open, text_close, text_readip, R_DO_CKSUM }; 32 static FILE *tfp = NULL; 33 static int tfd = -1; 34 35 static u_32_t tx_hostnum(char *, int *); 36 static u_short tx_portnum(char *); 37 38 #ifdef USE_INET6 39 int parseipv6(char **, ip6_t *, char **, int *); 40 #endif 41 42 /* 43 * returns an ip address as a long var as a result of either a DNS lookup or 44 * straight inet_addr() call 45 */ 46 static u_32_t 47 tx_hostnum(char *host, int *resolved) 48 { 49 i6addr_t ipa; 50 51 *resolved = 0; 52 if (!strcasecmp("any", host)) 53 return (0L); 54 if (ISDIGIT(*host)) 55 return (inet_addr(host)); 56 57 if (gethost(AF_INET, host, &ipa) == -1) { 58 *resolved = -1; 59 fprintf(stderr, "can't resolve hostname: %s\n", host); 60 return (0); 61 } 62 return (ipa.in4.s_addr); 63 } 64 65 66 /* 67 * find the port number given by the name, either from getservbyname() or 68 * straight atoi() 69 */ 70 static u_short 71 tx_portnum(char *name) 72 { 73 struct servent *sp; 74 75 if (ISDIGIT(*name)) 76 return (u_short)atoi(name); 77 sp = getservbyname(name, tx_proto); 78 if (sp) 79 return (ntohs(sp->s_port)); 80 (void) fprintf(stderr, "unknown service \"%s\".\n", name); 81 return (0); 82 } 83 84 85 static int 86 text_open(char *fname) 87 { 88 if (tfp && tfd != -1) { 89 rewind(tfp); 90 return (tfd); 91 } 92 93 if (!strcmp(fname, "-")) { 94 tfd = 0; 95 tfp = stdin; 96 } else { 97 tfd = open(fname, O_RDONLY); 98 if (tfd != -1) 99 tfp = fdopen(tfd, "r"); 100 } 101 return (tfd); 102 } 103 104 105 static int 106 text_close(void) 107 { 108 int cfd = tfd; 109 110 tfd = -1; 111 return (close(cfd)); 112 } 113 114 115 static int 116 text_readip(mb_t *mb, char **ifn, int *dir) 117 { 118 register char *s; 119 char line[513]; 120 ip_t *ip; 121 char *buf; 122 123 buf = (char *)mb->mb_buf; 124 125 *ifn = NULL; 126 while (fgets(line, sizeof(line)-1, tfp)) { 127 if ((s = strchr(line, '\n'))) 128 *s = '\0'; 129 if ((s = strchr(line, '\r'))) 130 *s = '\0'; 131 if ((s = strchr(line, '#'))) 132 *s = '\0'; 133 if (!*line) 134 continue; 135 if ((opts & OPT_DEBUG) != 0) 136 printf("input: %s\n", line); 137 *ifn = NULL; 138 *dir = 0; 139 if (!parseline(line, (ip_t *)buf, ifn, dir)) { 140 ip = (ip_t *)buf; 141 if (IP_V(ip) == 6) { 142 #ifdef USE_INET6 143 mb->mb_len = ntohs(((ip6_t *)ip)->ip6_plen) + 144 sizeof(ip6_t); 145 #else 146 mb->mb_len = 0; 147 #endif 148 } else { 149 mb->mb_len = ntohs(ip->ip_len); 150 } 151 return (mb->mb_len); 152 } 153 } 154 if (feof(tfp)) 155 return (0); 156 return (-1); 157 } 158 159 static int 160 parseline(char *line, ip_t *ip, char **ifn, int *out) 161 { 162 tcphdr_t th, *tcp = &th; 163 struct icmp icmp, *ic = &icmp; 164 char *cps[20], **cpp, c, ipopts[68]; 165 int i, r; 166 167 if (*ifn) 168 free(*ifn); 169 bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip)); 170 bzero((char *)tcp, sizeof(*tcp)); 171 bzero((char *)ic, sizeof(*ic)); 172 bzero(ipopts, sizeof(ipopts)); 173 IP_HL_A(ip, sizeof(*ip) >> 2); 174 IP_V_A(ip, IPVERSION); 175 ip->ip_ttl = 63; 176 for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; ) 177 cps[++i] = strtok(NULL, " \b\t\r\n"); 178 179 cpp = cps; 180 if (!*cpp) 181 return (1); 182 183 c = **cpp; 184 if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) { 185 fprintf(stderr, "bad direction \"%s\"\n", *cpp); 186 return (1); 187 } 188 189 #ifdef USE_INET6 190 if (!strcasecmp(*cpp, "out6") || !strcasecmp(*cpp, "in6")) { 191 return (parseipv6(cpp, (ip6_t *)ip, ifn, out)); 192 } 193 #endif 194 195 *out = (TOLOWER(c) == 'o') ? 1 : 0; 196 cpp++; 197 if (!*cpp) 198 return (1); 199 200 if (!strcasecmp(*cpp, "on")) { 201 cpp++; 202 if (!*cpp) 203 return (1); 204 *ifn = strdup(*cpp++); 205 if (!*cpp) 206 return (1); 207 } 208 209 c = **cpp; 210 ip->ip_len = sizeof(ip_t); 211 if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") || 212 !strcasecmp(*cpp, "icmp")) { 213 if (c == 't') { 214 ip->ip_p = IPPROTO_TCP; 215 ip->ip_len += sizeof(struct tcphdr); 216 tx_proto = "tcp"; 217 } else if (c == 'u') { 218 ip->ip_p = IPPROTO_UDP; 219 ip->ip_len += sizeof(struct udphdr); 220 tx_proto = "udp"; 221 } else { 222 ip->ip_p = IPPROTO_ICMP; 223 ip->ip_len += ICMPERR_IPICMPHLEN; 224 tx_proto = "icmp"; 225 } 226 cpp++; 227 } else if (ISDIGIT(**cpp) && !index(*cpp, '.')) { 228 ip->ip_p = atoi(*cpp); 229 cpp++; 230 } else 231 ip->ip_p = IPPROTO_IP; 232 233 if (!*cpp) 234 return (1); 235 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { 236 char *last; 237 238 last = strchr(*cpp, ','); 239 if (!last) { 240 fprintf(stderr, "tcp/udp with no source port\n"); 241 return (1); 242 } 243 *last++ = '\0'; 244 tcp->th_sport = htons(tx_portnum(last)); 245 if (ip->ip_p == IPPROTO_TCP) { 246 tcp->th_win = htons(4096); 247 TCP_OFF_A(tcp, sizeof(*tcp) >> 2); 248 } 249 } 250 ip->ip_src.s_addr = tx_hostnum(*cpp, &r); 251 cpp++; 252 if (!*cpp) 253 return (1); 254 255 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { 256 char *last; 257 258 last = strchr(*cpp, ','); 259 if (!last) { 260 fprintf(stderr, "tcp/udp with no destination port\n"); 261 return (1); 262 } 263 *last++ = '\0'; 264 tcp->th_dport = htons(tx_portnum(last)); 265 } 266 ip->ip_dst.s_addr = tx_hostnum(*cpp, &r); 267 cpp++; 268 if (ip->ip_p == IPPROTO_TCP) { 269 if (*cpp != NULL) { 270 char *s, *t; 271 272 tcp->th_flags = 0; 273 for (s = *cpp; *s; s++) 274 if ((t = strchr(myflagset, *s))) 275 tcp->th_flags |= myflags[t-myflagset]; 276 if (tcp->th_flags) 277 cpp++; 278 } 279 280 if (tcp->th_flags & TH_URG) 281 tcp->th_urp = htons(1); 282 283 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) { 284 tcp->th_seq = htonl(atoi(*cpp + 4)); 285 cpp++; 286 } 287 288 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) { 289 tcp->th_ack = htonl(atoi(*cpp + 4)); 290 cpp++; 291 } 292 } else if (*cpp && ip->ip_p == IPPROTO_ICMP) { 293 char *t; 294 295 t = strchr(*cpp, ','); 296 if (t != NULL) 297 *t = '\0'; 298 299 ic->icmp_type = geticmptype(AF_INET, *cpp); 300 if (t != NULL) 301 ic->icmp_code = atoi(t + 1); 302 cpp++; 303 304 if (ic->icmp_type == ICMP_ECHO || 305 ic->icmp_type == ICMP_ECHOREPLY) 306 ic->icmp_id = htons(getpid()); 307 if (t != NULL) 308 *t = ','; 309 } 310 311 if (*cpp && !strcasecmp(*cpp, "opt")) { 312 u_long olen; 313 314 cpp++; 315 olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2); 316 if (olen) { 317 bcopy(ipopts, (char *)(ip + 1), olen); 318 IP_HL_A(ip, IP_HL(ip) + (olen >> 2)); 319 ip->ip_len += olen; 320 } 321 } 322 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) 323 bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2), 324 sizeof(*tcp)); 325 else if (ip->ip_p == IPPROTO_ICMP) 326 bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2), 327 sizeof(*ic)); 328 ip->ip_len = htons(ip->ip_len); 329 return (0); 330 } 331 332 333 #ifdef USE_INET6 334 int 335 parseipv6(char **cpp, ip6_t *ip6, char **ifn, int *out) 336 { 337 tcphdr_t th, *tcp = &th; 338 struct icmp6_hdr icmp, *ic6 = &icmp; 339 340 bzero((char *)ip6, MAX(sizeof(*tcp), sizeof(*ic6)) + sizeof(*ip6)); 341 bzero((char *)tcp, sizeof(*tcp)); 342 bzero((char *)ic6, sizeof(*ic6)); 343 ip6->ip6_vfc = 0x60; 344 345 *out = (**cpp == 'o') ? 1 : 0; 346 cpp++; 347 if (!*cpp) 348 return (1); 349 350 if (!strcasecmp(*cpp, "on")) { 351 cpp++; 352 if (!*cpp) 353 return (1); 354 *ifn = strdup(*cpp++); 355 if (!*cpp) 356 return (1); 357 } 358 359 if (!strcasecmp(*cpp, "tcp")) { 360 ip6->ip6_nxt = IPPROTO_TCP; 361 tx_proto = "tcp"; 362 cpp++; 363 } else if (!strcasecmp(*cpp, "udp")) { 364 ip6->ip6_nxt = IPPROTO_UDP; 365 tx_proto = "udp"; 366 cpp++; 367 } else if (!strcasecmp(*cpp, "icmpv6")) { 368 ip6->ip6_nxt = IPPROTO_ICMPV6; 369 tx_proto = "icmpv6"; 370 cpp++; 371 } else if (ISDIGIT(**cpp) && !index(*cpp, ':')) { 372 ip6->ip6_nxt = atoi(*cpp); 373 cpp++; 374 } else 375 ip6->ip6_nxt = IPPROTO_IPV6; 376 377 if (!*cpp) 378 return (1); 379 380 switch (ip6->ip6_nxt) 381 { 382 case IPPROTO_TCP : 383 ip6->ip6_plen = sizeof(struct tcphdr); 384 break; 385 case IPPROTO_UDP : 386 ip6->ip6_plen = sizeof(struct udphdr); 387 break; 388 case IPPROTO_ICMPV6 : 389 ip6->ip6_plen = ICMP6ERR_IPICMPHLEN; 390 break; 391 default : 392 break; 393 } 394 395 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 396 char *last; 397 398 last = strchr(*cpp, ','); 399 if (!last) { 400 fprintf(stderr, "tcp/udp with no source port\n"); 401 return (1); 402 } 403 *last++ = '\0'; 404 tcp->th_sport = htons(tx_portnum(last)); 405 if (ip6->ip6_nxt == IPPROTO_TCP) { 406 tcp->th_win = htons(4096); 407 TCP_OFF_A(tcp, sizeof(*tcp) >> 2); 408 } 409 } 410 411 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_src) != 1) { 412 fprintf(stderr, "cannot parse source address '%s'\n", *cpp); 413 return (1); 414 } 415 416 cpp++; 417 if (!*cpp) 418 return (1); 419 420 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 421 char *last; 422 423 last = strchr(*cpp, ','); 424 if (!last) { 425 fprintf(stderr, "tcp/udp with no destination port\n"); 426 return (1); 427 } 428 *last++ = '\0'; 429 tcp->th_dport = htons(tx_portnum(last)); 430 } 431 432 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_dst) != 1) { 433 fprintf(stderr, "cannot parse destination address '%s'\n", 434 *cpp); 435 return (1); 436 } 437 438 cpp++; 439 if (ip6->ip6_nxt == IPPROTO_TCP) { 440 if (*cpp != NULL) { 441 char *s, *t; 442 443 tcp->th_flags = 0; 444 for (s = *cpp; *s; s++) 445 if ((t = strchr(myflagset, *s))) 446 tcp->th_flags |= myflags[t-myflagset]; 447 if (tcp->th_flags) 448 cpp++; 449 } 450 451 if (tcp->th_flags & TH_URG) 452 tcp->th_urp = htons(1); 453 454 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) { 455 tcp->th_seq = htonl(atoi(*cpp + 4)); 456 cpp++; 457 } 458 459 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) { 460 tcp->th_ack = htonl(atoi(*cpp + 4)); 461 cpp++; 462 } 463 } else if (*cpp && ip6->ip6_nxt == IPPROTO_ICMPV6) { 464 char *t; 465 466 t = strchr(*cpp, ','); 467 if (t != NULL) 468 *t = '\0'; 469 470 ic6->icmp6_type = geticmptype(AF_INET6, *cpp); 471 if (t != NULL) 472 ic6->icmp6_code = atoi(t + 1); 473 474 if (ic6->icmp6_type == ICMP6_ECHO_REQUEST || 475 ic6->icmp6_type == ICMP6_ECHO_REPLY) 476 ic6->icmp6_id = htons(getpid()); 477 478 if (t != NULL) 479 *t = ','; 480 } 481 482 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 483 bcopy((char *)tcp, (char *)ip6 + sizeof(*ip6), 484 sizeof(*tcp)); 485 } else if (ip6->ip6_nxt == IPPROTO_ICMPV6) { 486 bcopy((char *)ic6, (char *)ip6 + sizeof(*ip6), 487 sizeof(*ic6)); 488 } 489 490 /* 491 * Because a length of 0 == jumbo gram... 492 */ 493 if (ip6->ip6_plen == 0) { 494 ip6->ip6_plen++; 495 } 496 ip6->ip6_plen = htons(ip6->ip6_plen); 497 return (0); 498 } 499 #endif 500