1 2 /* 3 * Copyright (C) 2012 by Darren Reed. 4 * 5 * See the IPFILTER.LICENCE file for details on licencing. 6 * 7 * $Id$ 8 */ 9 10 #include <ctype.h> 11 12 #include "ipf.h" 13 #include "ipt.h" 14 15 extern int opts; 16 17 static char *tx_proto = ""; 18 19 static int text_open(char *), text_close(void); 20 static int text_readip(mb_t *, char **, int *); 21 static int parseline(char *, ip_t *, char **, int *); 22 23 static char myflagset[] = "FSRPAUEWe"; 24 static uint16_t myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, 25 TH_ACK, TH_URG, TH_ECN, TH_CWR, TH_AE }; 26 27 struct ipread iptext = { text_open, text_close, text_readip, R_DO_CKSUM }; 28 static FILE *tfp = NULL; 29 static int tfd = -1; 30 31 static u_32_t tx_hostnum(char *, int *); 32 static u_short tx_portnum(char *); 33 34 #ifdef USE_INET6 35 int parseipv6(char **, ip6_t *, char **, int *); 36 #endif 37 38 /* 39 * returns an ip address as a long var as a result of either a DNS lookup or 40 * straight inet_addr() call 41 */ 42 static u_32_t 43 tx_hostnum(char *host, int *resolved) 44 { 45 i6addr_t ipa; 46 47 *resolved = 0; 48 if (!strcasecmp("any", host)) 49 return (0L); 50 if (ISDIGIT(*host)) 51 return (inet_addr(host)); 52 53 if (gethost(AF_INET, host, &ipa) == -1) { 54 *resolved = -1; 55 fprintf(stderr, "can't resolve hostname: %s\n", host); 56 return (0); 57 } 58 return (ipa.in4.s_addr); 59 } 60 61 62 /* 63 * find the port number given by the name, either from getservbyname() or 64 * straight atoi() 65 */ 66 static u_short 67 tx_portnum(char *name) 68 { 69 struct servent *sp; 70 71 if (ISDIGIT(*name)) 72 return (u_short)atoi(name); 73 sp = getservbyname(name, tx_proto); 74 if (sp) 75 return (ntohs(sp->s_port)); 76 (void) fprintf(stderr, "unknown service \"%s\".\n", name); 77 return (0); 78 } 79 80 81 static int 82 text_open(char *fname) 83 { 84 if (tfp && tfd != -1) { 85 rewind(tfp); 86 return (tfd); 87 } 88 89 if (!strcmp(fname, "-")) { 90 tfd = 0; 91 tfp = stdin; 92 } else { 93 tfd = open(fname, O_RDONLY); 94 if (tfd != -1) 95 tfp = fdopen(tfd, "r"); 96 } 97 return (tfd); 98 } 99 100 101 static int 102 text_close(void) 103 { 104 int cfd = tfd; 105 106 tfd = -1; 107 return (close(cfd)); 108 } 109 110 111 static int 112 text_readip(mb_t *mb, char **ifn, int *dir) 113 { 114 register char *s; 115 char line[513]; 116 ip_t *ip; 117 char *buf; 118 119 buf = (char *)mb->mb_buf; 120 121 *ifn = NULL; 122 while (fgets(line, sizeof(line)-1, tfp)) { 123 if ((s = strchr(line, '\n'))) 124 *s = '\0'; 125 if ((s = strchr(line, '\r'))) 126 *s = '\0'; 127 if ((s = strchr(line, '#'))) 128 *s = '\0'; 129 if (!*line) 130 continue; 131 if ((opts & OPT_DEBUG) != 0) 132 printf("input: %s\n", line); 133 *ifn = NULL; 134 *dir = 0; 135 if (!parseline(line, (ip_t *)buf, ifn, dir)) { 136 ip = (ip_t *)buf; 137 if (IP_V(ip) == 6) { 138 #ifdef USE_INET6 139 mb->mb_len = ntohs(((ip6_t *)ip)->ip6_plen) + 140 sizeof(ip6_t); 141 #else 142 mb->mb_len = 0; 143 #endif 144 } else { 145 mb->mb_len = ntohs(ip->ip_len); 146 } 147 return (mb->mb_len); 148 } 149 } 150 if (feof(tfp)) 151 return (0); 152 return (-1); 153 } 154 155 static int 156 parseline(char *line, ip_t *ip, char **ifn, int *out) 157 { 158 tcphdr_t th, *tcp = &th; 159 struct icmp icmp, *ic = &icmp; 160 char *cps[20], **cpp, c, ipopts[68]; 161 int i, r; 162 163 if (*ifn) 164 free(*ifn); 165 bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip)); 166 bzero((char *)tcp, sizeof(*tcp)); 167 bzero((char *)ic, sizeof(*ic)); 168 bzero(ipopts, sizeof(ipopts)); 169 IP_HL_A(ip, sizeof(*ip) >> 2); 170 IP_V_A(ip, IPVERSION); 171 ip->ip_ttl = 63; 172 for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; ) 173 cps[++i] = strtok(NULL, " \b\t\r\n"); 174 175 cpp = cps; 176 if (!*cpp) 177 return (1); 178 179 c = **cpp; 180 if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) { 181 fprintf(stderr, "bad direction \"%s\"\n", *cpp); 182 return (1); 183 } 184 185 #ifdef USE_INET6 186 if (!strcasecmp(*cpp, "out6") || !strcasecmp(*cpp, "in6")) { 187 return (parseipv6(cpp, (ip6_t *)ip, ifn, out)); 188 } 189 #endif 190 191 *out = (TOLOWER(c) == 'o') ? 1 : 0; 192 cpp++; 193 if (!*cpp) 194 return (1); 195 196 if (!strcasecmp(*cpp, "on")) { 197 cpp++; 198 if (!*cpp) 199 return (1); 200 *ifn = strdup(*cpp++); 201 if (!*cpp) 202 return (1); 203 } 204 205 c = **cpp; 206 ip->ip_len = sizeof(ip_t); 207 if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") || 208 !strcasecmp(*cpp, "icmp")) { 209 if (c == 't') { 210 ip->ip_p = IPPROTO_TCP; 211 ip->ip_len += sizeof(struct tcphdr); 212 tx_proto = "tcp"; 213 } else if (c == 'u') { 214 ip->ip_p = IPPROTO_UDP; 215 ip->ip_len += sizeof(struct udphdr); 216 tx_proto = "udp"; 217 } else { 218 ip->ip_p = IPPROTO_ICMP; 219 ip->ip_len += ICMPERR_IPICMPHLEN; 220 tx_proto = "icmp"; 221 } 222 cpp++; 223 } else if (ISDIGIT(**cpp) && !index(*cpp, '.')) { 224 ip->ip_p = atoi(*cpp); 225 cpp++; 226 } else 227 ip->ip_p = IPPROTO_IP; 228 229 if (!*cpp) 230 return (1); 231 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { 232 char *last; 233 234 last = strchr(*cpp, ','); 235 if (!last) { 236 fprintf(stderr, "tcp/udp with no source port\n"); 237 return (1); 238 } 239 *last++ = '\0'; 240 tcp->th_sport = htons(tx_portnum(last)); 241 if (ip->ip_p == IPPROTO_TCP) { 242 tcp->th_win = htons(4096); 243 TCP_OFF_A(tcp, sizeof(*tcp) >> 2); 244 } 245 } 246 ip->ip_src.s_addr = tx_hostnum(*cpp, &r); 247 cpp++; 248 if (!*cpp) 249 return (1); 250 251 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { 252 char *last; 253 254 last = strchr(*cpp, ','); 255 if (!last) { 256 fprintf(stderr, "tcp/udp with no destination port\n"); 257 return (1); 258 } 259 *last++ = '\0'; 260 tcp->th_dport = htons(tx_portnum(last)); 261 } 262 ip->ip_dst.s_addr = tx_hostnum(*cpp, &r); 263 cpp++; 264 if (ip->ip_p == IPPROTO_TCP) { 265 if (*cpp != NULL) { 266 char *s, *t; 267 268 __tcp_set_flags(tcp, 0); 269 for (s = *cpp; *s; s++) 270 if ((t = strchr(myflagset, *s))) 271 __tcp_set_flags(tcp, __tcp_get_flags(tcp) | 272 myflags[t-myflagset]); 273 if (__tcp_get_flags(tcp)) 274 cpp++; 275 } 276 277 if (__tcp_get_flags(tcp) & TH_URG) 278 tcp->th_urp = htons(1); 279 280 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) { 281 tcp->th_seq = htonl(atoi(*cpp + 4)); 282 cpp++; 283 } 284 285 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) { 286 tcp->th_ack = htonl(atoi(*cpp + 4)); 287 cpp++; 288 } 289 } else if (*cpp && ip->ip_p == IPPROTO_ICMP) { 290 char *t; 291 292 t = strchr(*cpp, ','); 293 if (t != NULL) 294 *t = '\0'; 295 296 ic->icmp_type = geticmptype(AF_INET, *cpp); 297 if (t != NULL) 298 ic->icmp_code = atoi(t + 1); 299 cpp++; 300 301 if (ic->icmp_type == ICMP_ECHO || 302 ic->icmp_type == ICMP_ECHOREPLY) 303 ic->icmp_id = htons(getpid()); 304 if (t != NULL) 305 *t = ','; 306 } 307 308 if (*cpp && !strcasecmp(*cpp, "opt")) { 309 u_long olen; 310 311 cpp++; 312 olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2); 313 if (olen) { 314 bcopy(ipopts, (char *)(ip + 1), olen); 315 IP_HL_A(ip, IP_HL(ip) + (olen >> 2)); 316 ip->ip_len += olen; 317 } 318 } 319 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) 320 bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2), 321 sizeof(*tcp)); 322 else if (ip->ip_p == IPPROTO_ICMP) 323 bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2), 324 sizeof(*ic)); 325 ip->ip_len = htons(ip->ip_len); 326 return (0); 327 } 328 329 330 #ifdef USE_INET6 331 int 332 parseipv6(char **cpp, ip6_t *ip6, char **ifn, int *out) 333 { 334 tcphdr_t th, *tcp = &th; 335 struct icmp6_hdr icmp, *ic6 = &icmp; 336 337 bzero((char *)ip6, MAX(sizeof(*tcp), sizeof(*ic6)) + sizeof(*ip6)); 338 bzero((char *)tcp, sizeof(*tcp)); 339 bzero((char *)ic6, sizeof(*ic6)); 340 ip6->ip6_vfc = 0x60; 341 342 *out = (**cpp == 'o') ? 1 : 0; 343 cpp++; 344 if (!*cpp) 345 return (1); 346 347 if (!strcasecmp(*cpp, "on")) { 348 cpp++; 349 if (!*cpp) 350 return (1); 351 *ifn = strdup(*cpp++); 352 if (!*cpp) 353 return (1); 354 } 355 356 if (!strcasecmp(*cpp, "tcp")) { 357 ip6->ip6_nxt = IPPROTO_TCP; 358 tx_proto = "tcp"; 359 cpp++; 360 } else if (!strcasecmp(*cpp, "udp")) { 361 ip6->ip6_nxt = IPPROTO_UDP; 362 tx_proto = "udp"; 363 cpp++; 364 } else if (!strcasecmp(*cpp, "icmpv6")) { 365 ip6->ip6_nxt = IPPROTO_ICMPV6; 366 tx_proto = "icmpv6"; 367 cpp++; 368 } else if (ISDIGIT(**cpp) && !index(*cpp, ':')) { 369 ip6->ip6_nxt = atoi(*cpp); 370 cpp++; 371 } else 372 ip6->ip6_nxt = IPPROTO_IPV6; 373 374 if (!*cpp) 375 return (1); 376 377 switch (ip6->ip6_nxt) 378 { 379 case IPPROTO_TCP : 380 ip6->ip6_plen = sizeof(struct tcphdr); 381 break; 382 case IPPROTO_UDP : 383 ip6->ip6_plen = sizeof(struct udphdr); 384 break; 385 case IPPROTO_ICMPV6 : 386 ip6->ip6_plen = ICMP6ERR_IPICMPHLEN; 387 break; 388 default : 389 break; 390 } 391 392 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 393 char *last; 394 395 last = strchr(*cpp, ','); 396 if (!last) { 397 fprintf(stderr, "tcp/udp with no source port\n"); 398 return (1); 399 } 400 *last++ = '\0'; 401 tcp->th_sport = htons(tx_portnum(last)); 402 if (ip6->ip6_nxt == IPPROTO_TCP) { 403 tcp->th_win = htons(4096); 404 TCP_OFF_A(tcp, sizeof(*tcp) >> 2); 405 } 406 } 407 408 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_src) != 1) { 409 fprintf(stderr, "cannot parse source address '%s'\n", *cpp); 410 return (1); 411 } 412 413 cpp++; 414 if (!*cpp) 415 return (1); 416 417 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 418 char *last; 419 420 last = strchr(*cpp, ','); 421 if (!last) { 422 fprintf(stderr, "tcp/udp with no destination port\n"); 423 return (1); 424 } 425 *last++ = '\0'; 426 tcp->th_dport = htons(tx_portnum(last)); 427 } 428 429 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_dst) != 1) { 430 fprintf(stderr, "cannot parse destination address '%s'\n", 431 *cpp); 432 return (1); 433 } 434 435 cpp++; 436 if (ip6->ip6_nxt == IPPROTO_TCP) { 437 if (*cpp != NULL) { 438 char *s, *t; 439 440 __tcp_set_flags(tcp, 0); 441 for (s = *cpp; *s; s++) 442 if ((t = strchr(myflagset, *s))) 443 __tcp_set_flags(tcp, __tcp_get_flags(tcp) | 444 myflags[t-myflagset]); 445 if (__tcp_get_flags(tcp)) 446 cpp++; 447 } 448 449 if (__tcp_get_flags(tcp) & TH_URG) 450 tcp->th_urp = htons(1); 451 452 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) { 453 tcp->th_seq = htonl(atoi(*cpp + 4)); 454 cpp++; 455 } 456 457 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) { 458 tcp->th_ack = htonl(atoi(*cpp + 4)); 459 cpp++; 460 } 461 } else if (*cpp && ip6->ip6_nxt == IPPROTO_ICMPV6) { 462 char *t; 463 464 t = strchr(*cpp, ','); 465 if (t != NULL) 466 *t = '\0'; 467 468 ic6->icmp6_type = geticmptype(AF_INET6, *cpp); 469 if (t != NULL) 470 ic6->icmp6_code = atoi(t + 1); 471 472 if (ic6->icmp6_type == ICMP6_ECHO_REQUEST || 473 ic6->icmp6_type == ICMP6_ECHO_REPLY) 474 ic6->icmp6_id = htons(getpid()); 475 476 if (t != NULL) 477 *t = ','; 478 } 479 480 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) { 481 bcopy((char *)tcp, (char *)ip6 + sizeof(*ip6), 482 sizeof(*tcp)); 483 } else if (ip6->ip6_nxt == IPPROTO_ICMPV6) { 484 bcopy((char *)ic6, (char *)ip6 + sizeof(*ip6), 485 sizeof(*ic6)); 486 } 487 488 /* 489 * Because a length of 0 == jumbo gram... 490 */ 491 if (ip6->ip6_plen == 0) { 492 ip6->ip6_plen++; 493 } 494 ip6->ip6_plen = htons(ip6->ip6_plen); 495 return (0); 496 } 497 #endif 498