1 /*- 2 * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org> 3 * based on work by Toshiharu OHNO <tony-o@iij.ad.jp> 4 * Internet Initiative Japan, Inc (IIJ) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 * $FreeBSD$ 29 */ 30 31 #include <sys/param.h> 32 #include <netinet/in.h> 33 #include <netdb.h> 34 #include <netinet/in_systm.h> 35 #include <netinet/ip.h> 36 #include <sys/socket.h> 37 #include <sys/un.h> 38 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <string.h> 42 #include <termios.h> 43 44 #include "layer.h" 45 #include "defs.h" 46 #include "command.h" 47 #include "mbuf.h" 48 #include "log.h" 49 #include "iplist.h" 50 #include "timer.h" 51 #include "throughput.h" 52 #include "lqr.h" 53 #include "hdlc.h" 54 #include "fsm.h" 55 #include "lcp.h" 56 #include "ccp.h" 57 #include "link.h" 58 #include "slcompress.h" 59 #include "ncpaddr.h" 60 #include "ipcp.h" 61 #include "filter.h" 62 #include "descriptor.h" 63 #include "prompt.h" 64 #include "mp.h" 65 #ifndef NORADIUS 66 #include "radius.h" 67 #endif 68 #include "ipv6cp.h" 69 #include "ncp.h" 70 #include "bundle.h" 71 72 static int filter_Nam2Op(const char *); 73 74 static int 75 ParsePort(const char *service, const char *proto) 76 { 77 struct servent *servent; 78 char *cp; 79 int port; 80 81 servent = getservbyname(service, proto); 82 if (servent != 0) 83 return ntohs(servent->s_port); 84 85 port = strtol(service, &cp, 0); 86 if (cp == service) { 87 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n", 88 service); 89 return 0; 90 } 91 return port; 92 } 93 94 /* 95 * ICMP Syntax: src eq icmp_message_type 96 */ 97 static int 98 ParseIcmp(int argc, char const *const *argv, const struct protoent *pe, 99 struct filterent *tgt) 100 { 101 int type; 102 char *cp; 103 104 switch (argc) { 105 case 0: 106 /* permit/deny all ICMP types */ 107 tgt->f_srcop = tgt->f_dstop = OP_NONE; 108 break; 109 110 case 3: 111 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) { 112 type = strtol(argv[2], &cp, 0); 113 if (cp == argv[2]) { 114 log_Printf(LogWARN, "ParseIcmp: type is expected.\n"); 115 return 0; 116 } 117 tgt->f_srcop = OP_EQ; 118 tgt->f_srcport = type; 119 tgt->f_dstop = OP_NONE; 120 } 121 break; 122 123 default: 124 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n"); 125 return 0; 126 } 127 return 1; 128 } 129 130 /* 131 * UDP Syntax: [src op port] [dst op port] 132 */ 133 static int 134 ParseUdpOrTcp(int argc, char const *const *argv, const struct protoent *pe, 135 struct filterent *tgt) 136 { 137 tgt->f_srcop = tgt->f_dstop = OP_NONE; 138 tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0; 139 140 if (argc >= 3 && !strcmp(*argv, "src")) { 141 tgt->f_srcop = filter_Nam2Op(argv[1]); 142 if (tgt->f_srcop == OP_NONE) { 143 log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n"); 144 return 0; 145 } 146 if (pe == NULL) 147 return 0; 148 tgt->f_srcport = ParsePort(argv[2], pe->p_name); 149 if (tgt->f_srcport == 0) 150 return 0; 151 argc -= 3; 152 argv += 3; 153 } 154 155 if (argc >= 3 && !strcmp(argv[0], "dst")) { 156 tgt->f_dstop = filter_Nam2Op(argv[1]); 157 if (tgt->f_dstop == OP_NONE) { 158 log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n"); 159 return 0; 160 } 161 if (pe == NULL) 162 return 0; 163 tgt->f_dstport = ParsePort(argv[2], pe->p_name); 164 if (tgt->f_dstport == 0) 165 return 0; 166 argc -= 3; 167 argv += 3; 168 } 169 170 if (pe && pe->p_proto == IPPROTO_TCP) { 171 for (; argc > 0; argc--, argv++) 172 if (!strcmp(*argv, "estab")) 173 tgt->f_estab = 1; 174 else if (!strcmp(*argv, "syn")) 175 tgt->f_syn = 1; 176 else if (!strcmp(*argv, "finrst")) 177 tgt->f_finrst = 1; 178 else 179 break; 180 } 181 182 if (argc > 0) { 183 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv); 184 return 0; 185 } 186 187 return 1; 188 } 189 190 static int 191 ParseGeneric(int argc, char const * const *argv, const struct protoent *pe, 192 struct filterent *tgt) 193 { 194 /* 195 * Filter currently is a catch-all. Requests are either permitted or 196 * dropped. 197 */ 198 if (argc != 0) { 199 log_Printf(LogWARN, "ParseGeneric: Too many parameters\n"); 200 return 0; 201 } else 202 tgt->f_srcop = tgt->f_dstop = OP_NONE; 203 204 return 1; 205 } 206 207 static unsigned 208 addrtype(const char *addr) 209 { 210 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/')) 211 return T_MYADDR; 212 if (!strncasecmp(addr, "MYADDR6", 7) && (addr[7] == '\0' || addr[7] == '/')) 213 return T_MYADDR6; 214 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/')) 215 return T_HISADDR; 216 if (!strncasecmp(addr, "HISADDR6", 8) && (addr[8] == '\0' || addr[8] == '/')) 217 return T_HISADDR6; 218 if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/')) 219 return T_DNS0; 220 if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/')) 221 return T_DNS1; 222 223 return T_ADDR; 224 } 225 226 static const char * 227 addrstr(struct ncprange *addr, unsigned type) 228 { 229 switch (type) { 230 case T_MYADDR: 231 return "MYADDR"; 232 case T_HISADDR: 233 return "HISADDR"; 234 case T_DNS0: 235 return "DNS0"; 236 case T_DNS1: 237 return "DNS1"; 238 } 239 return ncprange_ntoa(addr); 240 } 241 242 static int 243 filter_Parse(struct ncp *ncp, int argc, char const *const *argv, 244 struct filterent *ofp) 245 { 246 struct filterent fe; 247 struct protoent *pe; 248 char *wp; 249 int action, family, ruleno, val, width; 250 251 ruleno = strtol(*argv, &wp, 0); 252 if (*argv == wp || ruleno >= MAXFILTERS) { 253 log_Printf(LogWARN, "Parse: invalid filter number.\n"); 254 return 0; 255 } 256 if (ruleno < 0) { 257 for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) { 258 ofp->f_action = A_NONE; 259 ofp++; 260 } 261 log_Printf(LogWARN, "Parse: filter cleared.\n"); 262 return 1; 263 } 264 ofp += ruleno; 265 266 if (--argc == 0) { 267 log_Printf(LogWARN, "Parse: missing action.\n"); 268 return 0; 269 } 270 argv++; 271 272 memset(&fe, '\0', sizeof fe); 273 274 val = strtol(*argv, &wp, 0); 275 if (!*wp && val >= 0 && val < MAXFILTERS) { 276 if (val <= ruleno) { 277 log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n", 278 ruleno); 279 return 0; 280 } 281 action = val; 282 } else if (!strcmp(*argv, "permit")) { 283 action = A_PERMIT; 284 } else if (!strcmp(*argv, "deny")) { 285 action = A_DENY; 286 } else if (!strcmp(*argv, "clear")) { 287 ofp->f_action = A_NONE; 288 return 1; 289 } else { 290 log_Printf(LogWARN, "Parse: %s: bad action\n", *argv); 291 return 0; 292 } 293 fe.f_action = action; 294 295 argc--; 296 argv++; 297 298 if (argc && argv[0][0] == '!' && !argv[0][1]) { 299 fe.f_invert = 1; 300 argc--; 301 argv++; 302 } 303 304 ncprange_init(&fe.f_src); 305 ncprange_init(&fe.f_dst); 306 307 if (argc == 0) 308 pe = NULL; 309 else if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) { 310 if (argc < 2) { 311 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n"); 312 return 0; 313 } else if (strcasecmp(*argv, "any") == 0 || 314 ncprange_aton(&fe.f_src, ncp, *argv)) { 315 family = ncprange_family(&fe.f_src); 316 if (!ncprange_getwidth(&fe.f_src, &width)) 317 width = 0; 318 if (width == 0) 319 ncprange_init(&fe.f_src); 320 fe.f_srctype = addrtype(*argv); 321 argc--; 322 argv++; 323 324 if (strcasecmp(*argv, "any") == 0 || 325 ncprange_aton(&fe.f_dst, ncp, *argv)) { 326 if (ncprange_family(&fe.f_dst) != AF_UNSPEC && 327 ncprange_family(&fe.f_src) != AF_UNSPEC && 328 family != ncprange_family(&fe.f_dst)) { 329 log_Printf(LogWARN, "Parse: src and dst address families differ\n"); 330 return 0; 331 } 332 if (!ncprange_getwidth(&fe.f_dst, &width)) 333 width = 0; 334 if (width == 0) 335 ncprange_init(&fe.f_dst); 336 fe.f_dsttype = addrtype(*argv); 337 argc--; 338 argv++; 339 } else { 340 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n"); 341 return 0; 342 } 343 344 if (argc) { 345 if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) { 346 log_Printf(LogWARN, "Parse: %s: Protocol expected\n", *argv); 347 return 0; 348 } else { 349 argc--; 350 argv++; 351 } 352 } 353 } else { 354 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n"); 355 return 0; 356 } 357 } else { 358 argc--; 359 argv++; 360 } 361 362 if (argc >= 2 && strcmp(*argv, "timeout") == 0) { 363 fe.timeout = strtoul(argv[1], NULL, 10); 364 argc -= 2; 365 argv += 2; 366 } 367 368 val = 1; 369 fe.f_proto = (pe == NULL) ? 0 : pe->p_proto; 370 371 switch (fe.f_proto) { 372 case IPPROTO_TCP: 373 case IPPROTO_UDP: 374 case IPPROTO_IPIP: 375 #ifndef NOINET6 376 case IPPROTO_IPV6: 377 #endif 378 val = ParseUdpOrTcp(argc, argv, pe, &fe); 379 break; 380 case IPPROTO_ICMP: 381 #ifndef NOINET6 382 case IPPROTO_ICMPV6: 383 #endif 384 val = ParseIcmp(argc, argv, pe, &fe); 385 break; 386 default: 387 val = ParseGeneric(argc, argv, pe, &fe); 388 break; 389 } 390 391 log_Printf(LogDEBUG, "Parse: Src: %s\n", ncprange_ntoa(&fe.f_src)); 392 log_Printf(LogDEBUG, "Parse: Dst: %s\n", ncprange_ntoa(&fe.f_dst)); 393 log_Printf(LogDEBUG, "Parse: Proto: %d\n", fe.f_proto); 394 395 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n", 396 filter_Op2Nam(fe.f_srcop), fe.f_srcport); 397 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n", 398 filter_Op2Nam(fe.f_dstop), fe.f_dstport); 399 log_Printf(LogDEBUG, "Parse: estab: %u\n", fe.f_estab); 400 log_Printf(LogDEBUG, "Parse: syn: %u\n", fe.f_syn); 401 log_Printf(LogDEBUG, "Parse: finrst: %u\n", fe.f_finrst); 402 403 if (val) 404 *ofp = fe; 405 406 return val; 407 } 408 409 int 410 filter_Set(struct cmdargs const *arg) 411 { 412 struct filter *filter; 413 414 if (arg->argc < arg->argn+2) 415 return -1; 416 417 if (!strcmp(arg->argv[arg->argn], "in")) 418 filter = &arg->bundle->filter.in; 419 else if (!strcmp(arg->argv[arg->argn], "out")) 420 filter = &arg->bundle->filter.out; 421 else if (!strcmp(arg->argv[arg->argn], "dial")) 422 filter = &arg->bundle->filter.dial; 423 else if (!strcmp(arg->argv[arg->argn], "alive")) 424 filter = &arg->bundle->filter.alive; 425 else { 426 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n", 427 arg->argv[arg->argn]); 428 return -1; 429 } 430 431 filter_Parse(&arg->bundle->ncp, arg->argc - arg->argn - 1, 432 arg->argv + arg->argn + 1, filter->rule); 433 return 0; 434 } 435 436 const char * 437 filter_Action2Nam(int act) 438 { 439 static const char * const actname[] = { " none ", "permit ", " deny " }; 440 static char buf[8]; 441 442 if (act >= 0 && act < MAXFILTERS) { 443 snprintf(buf, sizeof buf, "%6d ", act); 444 return buf; 445 } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *)) 446 return actname[act - A_NONE]; 447 else 448 return "?????? "; 449 } 450 451 static void 452 doShowFilter(struct filterent *fp, struct prompt *prompt) 453 { 454 struct protoent *pe; 455 int n; 456 457 for (n = 0; n < MAXFILTERS; n++, fp++) { 458 if (fp->f_action != A_NONE) { 459 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action)); 460 prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' '); 461 462 if (ncprange_isset(&fp->f_src)) 463 prompt_Printf(prompt, "%s ", addrstr(&fp->f_src, fp->f_srctype)); 464 else 465 prompt_Printf(prompt, "any "); 466 467 if (ncprange_isset(&fp->f_dst)) 468 prompt_Printf(prompt, "%s ", addrstr(&fp->f_dst, fp->f_dsttype)); 469 else 470 prompt_Printf(prompt, "any "); 471 472 if (fp->f_proto) { 473 if ((pe = getprotobynumber(fp->f_proto)) == NULL) 474 prompt_Printf(prompt, "P:%d", fp->f_proto); 475 else 476 prompt_Printf(prompt, "%s", pe->p_name); 477 478 if (fp->f_srcop) 479 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop), 480 fp->f_srcport); 481 if (fp->f_dstop) 482 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop), 483 fp->f_dstport); 484 if (fp->f_estab) 485 prompt_Printf(prompt, " estab"); 486 if (fp->f_syn) 487 prompt_Printf(prompt, " syn"); 488 if (fp->f_finrst) 489 prompt_Printf(prompt, " finrst"); 490 } else 491 prompt_Printf(prompt, "all"); 492 if (fp->timeout != 0) 493 prompt_Printf(prompt, " timeout %u", fp->timeout); 494 prompt_Printf(prompt, "\n"); 495 } 496 } 497 } 498 499 int 500 filter_Show(struct cmdargs const *arg) 501 { 502 if (arg->argc > arg->argn+1) 503 return -1; 504 505 if (arg->argc == arg->argn+1) { 506 struct filter *filter; 507 508 if (!strcmp(arg->argv[arg->argn], "in")) 509 filter = &arg->bundle->filter.in; 510 else if (!strcmp(arg->argv[arg->argn], "out")) 511 filter = &arg->bundle->filter.out; 512 else if (!strcmp(arg->argv[arg->argn], "dial")) 513 filter = &arg->bundle->filter.dial; 514 else if (!strcmp(arg->argv[arg->argn], "alive")) 515 filter = &arg->bundle->filter.alive; 516 else 517 return -1; 518 doShowFilter(filter->rule, arg->prompt); 519 } else { 520 struct filter *filter[4]; 521 int f; 522 523 filter[0] = &arg->bundle->filter.in; 524 filter[1] = &arg->bundle->filter.out; 525 filter[2] = &arg->bundle->filter.dial; 526 filter[3] = &arg->bundle->filter.alive; 527 for (f = 0; f < 4; f++) { 528 if (f) 529 prompt_Printf(arg->prompt, "\n"); 530 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name); 531 doShowFilter(filter[f]->rule, arg->prompt); 532 } 533 } 534 535 return 0; 536 } 537 538 static const char * const opname[] = {"none", "eq", "gt", "lt"}; 539 540 const char * 541 filter_Op2Nam(int op) 542 { 543 if (op >= sizeof opname / sizeof opname[0]) 544 return "unknown"; 545 return opname[op]; 546 547 } 548 549 static int 550 filter_Nam2Op(const char *cp) 551 { 552 int op; 553 554 for (op = sizeof opname / sizeof opname[0] - 1; op; op--) 555 if (!strcasecmp(cp, opname[op])) 556 break; 557 558 return op; 559 } 560 561 void 562 filter_AdjustAddr(struct filter *filter, struct ncpaddr *local, 563 struct ncpaddr *remote, struct in_addr *dns) 564 { 565 struct filterent *fp; 566 int n; 567 568 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++) 569 if (fp->f_action != A_NONE) { 570 if (local) { 571 if (fp->f_srctype == T_MYADDR && ncpaddr_family(local) == AF_INET) 572 ncprange_sethost(&fp->f_src, local); 573 if (fp->f_dsttype == T_MYADDR && ncpaddr_family(local) == AF_INET) 574 ncprange_sethost(&fp->f_dst, local); 575 #ifndef NOINET6 576 if (fp->f_srctype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6) 577 ncprange_sethost(&fp->f_src, local); 578 if (fp->f_dsttype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6) 579 ncprange_sethost(&fp->f_dst, local); 580 #endif 581 } 582 if (remote) { 583 if (fp->f_srctype == T_HISADDR && ncpaddr_family(remote) == AF_INET) 584 ncprange_sethost(&fp->f_src, remote); 585 if (fp->f_dsttype == T_HISADDR && ncpaddr_family(remote) == AF_INET) 586 ncprange_sethost(&fp->f_dst, remote); 587 #ifndef NOINET6 588 if (fp->f_srctype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6) 589 ncprange_sethost(&fp->f_src, remote); 590 if (fp->f_dsttype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6) 591 ncprange_sethost(&fp->f_dst, remote); 592 #endif 593 } 594 if (dns) { 595 if (fp->f_srctype == T_DNS0) 596 ncprange_setip4host(&fp->f_src, dns[0]); 597 if (fp->f_dsttype == T_DNS0) 598 ncprange_setip4host(&fp->f_dst, dns[0]); 599 if (fp->f_srctype == T_DNS1) 600 ncprange_setip4host(&fp->f_src, dns[1]); 601 if (fp->f_dsttype == T_DNS1) 602 ncprange_setip4host(&fp->f_dst, dns[1]); 603 } 604 } 605 } 606