1 /* 2 * PPP Filter command Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $FreeBSD$ 21 * 22 * TODO: Should send ICMP error message when we discard packets. 23 */ 24 25 #include <sys/param.h> 26 #include <netinet/in.h> 27 #include <arpa/inet.h> 28 #include <netdb.h> 29 #include <netinet/in_systm.h> 30 #include <netinet/ip.h> 31 #include <sys/un.h> 32 33 #include <stdio.h> 34 #include <stdlib.h> 35 #include <strings.h> 36 #include <termios.h> 37 38 #include "layer.h" 39 #include "defs.h" 40 #include "command.h" 41 #include "mbuf.h" 42 #include "log.h" 43 #include "iplist.h" 44 #include "timer.h" 45 #include "throughput.h" 46 #include "lqr.h" 47 #include "hdlc.h" 48 #include "fsm.h" 49 #include "lcp.h" 50 #include "ccp.h" 51 #include "link.h" 52 #include "slcompress.h" 53 #include "ipcp.h" 54 #include "filter.h" 55 #include "descriptor.h" 56 #include "prompt.h" 57 #include "mp.h" 58 #ifndef NORADIUS 59 #include "radius.h" 60 #endif 61 #include "bundle.h" 62 63 static int filter_Nam2Proto(int, char const *const *); 64 static int filter_Nam2Op(const char *); 65 66 static const u_int32_t netmasks[33] = { 67 0x00000000, 68 0x80000000, 0xC0000000, 0xE0000000, 0xF0000000, 69 0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000, 70 0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000, 71 0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000, 72 0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000, 73 0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00, 74 0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0, 75 0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF, 76 }; 77 78 struct in_addr 79 bits2mask(int bits) 80 { 81 struct in_addr result; 82 83 result.s_addr = htonl(netmasks[bits]); 84 return result; 85 } 86 87 int 88 ParseAddr(struct ipcp *ipcp, const char *data, 89 struct in_addr *paddr, struct in_addr *pmask, int *pwidth) 90 { 91 int bits, len; 92 char *wp; 93 const char *cp; 94 95 if (pmask) 96 pmask->s_addr = INADDR_BROADCAST; /* Assume 255.255.255.255 as default */ 97 98 cp = pmask || pwidth ? strchr(data, '/') : NULL; 99 len = cp ? cp - data : strlen(data); 100 101 if (ipcp && strncasecmp(data, "HISADDR", len) == 0) 102 *paddr = ipcp->peer_ip; 103 else if (ipcp && strncasecmp(data, "MYADDR", len) == 0) 104 *paddr = ipcp->my_ip; 105 else if (ipcp && strncasecmp(data, "DNS0", len) == 0) 106 *paddr = ipcp->ns.dns[0]; 107 else if (ipcp && strncasecmp(data, "DNS1", len) == 0) 108 *paddr = ipcp->ns.dns[1]; 109 else { 110 char *s; 111 112 s = (char *)alloca(len + 1); 113 strncpy(s, data, len); 114 s[len] = '\0'; 115 *paddr = GetIpAddr(s); 116 if (paddr->s_addr == INADDR_NONE) { 117 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s); 118 return 0; 119 } 120 } 121 if (cp && *++cp) { 122 bits = strtol(cp, &wp, 0); 123 if (cp == wp || bits < 0 || bits > 32) { 124 log_Printf(LogWARN, "ParseAddr: bad mask width.\n"); 125 return 0; 126 } 127 } else if (paddr->s_addr == INADDR_ANY) 128 /* An IP of 0.0.0.0 without a width is anything */ 129 bits = 0; 130 else 131 /* If a valid IP is given without a width, assume 32 bits */ 132 bits = 32; 133 134 if (pwidth) 135 *pwidth = bits; 136 137 if (pmask) { 138 if (paddr->s_addr == INADDR_ANY) 139 pmask->s_addr = INADDR_ANY; 140 else 141 *pmask = bits2mask(bits); 142 } 143 144 return 1; 145 } 146 147 static int 148 ParsePort(const char *service, int proto) 149 { 150 const char *protocol_name; 151 char *cp; 152 struct servent *servent; 153 int port; 154 155 switch (proto) { 156 case P_UDP: 157 protocol_name = "udp"; 158 break; 159 case P_TCP: 160 protocol_name = "tcp"; 161 break; 162 default: 163 protocol_name = 0; 164 } 165 166 servent = getservbyname(service, protocol_name); 167 if (servent != 0) 168 return ntohs(servent->s_port); 169 170 port = strtol(service, &cp, 0); 171 if (cp == service) { 172 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n", 173 service); 174 return 0; 175 } 176 return port; 177 } 178 179 /* 180 * ICMP Syntax: src eq icmp_message_type 181 */ 182 static int 183 ParseIcmp(int argc, char const *const *argv, struct filterent *tgt) 184 { 185 int type; 186 char *cp; 187 188 switch (argc) { 189 case 0: 190 /* permit/deny all ICMP types */ 191 tgt->f_srcop = OP_NONE; 192 break; 193 194 case 3: 195 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) { 196 type = strtol(argv[2], &cp, 0); 197 if (cp == argv[2]) { 198 log_Printf(LogWARN, "ParseIcmp: type is expected.\n"); 199 return 0; 200 } 201 tgt->f_srcop = OP_EQ; 202 tgt->f_srcport = type; 203 } 204 break; 205 206 default: 207 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n"); 208 return 0; 209 } 210 return 1; 211 } 212 213 /* 214 * UDP Syntax: [src op port] [dst op port] 215 */ 216 static int 217 ParseUdpOrTcp(int argc, char const *const *argv, int proto, 218 struct filterent *tgt) 219 { 220 tgt->f_srcop = tgt->f_dstop = OP_NONE; 221 tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0; 222 223 if (argc >= 3 && !strcmp(*argv, "src")) { 224 tgt->f_srcop = filter_Nam2Op(argv[1]); 225 if (tgt->f_srcop == OP_NONE) { 226 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 227 return 0; 228 } 229 tgt->f_srcport = ParsePort(argv[2], proto); 230 if (tgt->f_srcport == 0) 231 return 0; 232 argc -= 3; 233 argv += 3; 234 } 235 236 if (argc >= 3 && !strcmp(argv[0], "dst")) { 237 tgt->f_dstop = filter_Nam2Op(argv[1]); 238 if (tgt->f_dstop == OP_NONE) { 239 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 240 return 0; 241 } 242 tgt->f_dstport = ParsePort(argv[2], proto); 243 if (tgt->f_dstport == 0) 244 return 0; 245 argc -= 3; 246 argv += 3; 247 } 248 249 if (proto == P_TCP) { 250 for (; argc > 0; argc--, argv++) 251 if (!strcmp(*argv, "estab")) 252 tgt->f_estab = 1; 253 else if (!strcmp(*argv, "syn")) 254 tgt->f_syn = 1; 255 else if (!strcmp(*argv, "finrst")) 256 tgt->f_finrst = 1; 257 else 258 break; 259 } 260 261 if (argc > 0) { 262 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv); 263 return 0; 264 } 265 266 return 1; 267 } 268 269 static int 270 ParseIgmp(int argc, char const * const *argv, struct filterent *tgt) 271 { 272 /* 273 * Filter currently is a catch-all. Requests are either permitted or 274 * dropped. 275 */ 276 if (argc != 0) { 277 log_Printf(LogWARN, "ParseIgmp: Too many parameters\n"); 278 return 0; 279 } else 280 tgt->f_srcop = OP_NONE; 281 282 return 1; 283 } 284 285 #ifdef P_GRE 286 static int 287 ParseGRE(int argc, char const * const *argv, struct filterent *tgt) 288 { 289 /* 290 * Filter currently is a catch-all. Requests are either permitted or 291 * dropped. 292 */ 293 if (argc != 0) { 294 log_Printf(LogWARN, "ParseGRE: Too many parameters\n"); 295 return 0; 296 } else 297 tgt->f_srcop = OP_NONE; 298 299 return 1; 300 } 301 #endif 302 303 #ifdef P_OSPF 304 static int 305 ParseOspf(int argc, char const * const *argv, struct filterent *tgt) 306 { 307 /* 308 * Filter currently is a catch-all. Requests are either permitted or 309 * dropped. 310 */ 311 if (argc != 0) { 312 log_Printf(LogWARN, "ParseOspf: Too many parameters\n"); 313 return 0; 314 } else 315 tgt->f_srcop = OP_NONE; 316 317 return 1; 318 } 319 #endif 320 321 static unsigned 322 addrtype(const char *addr) 323 { 324 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/')) 325 return T_MYADDR; 326 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/')) 327 return T_HISADDR; 328 if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/')) 329 return T_DNS0; 330 if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/')) 331 return T_DNS1; 332 333 return T_ADDR; 334 } 335 336 static const char * 337 addrstr(struct in_addr addr, unsigned type) 338 { 339 switch (type) { 340 case T_MYADDR: 341 return "MYADDR"; 342 case T_HISADDR: 343 return "HISADDR"; 344 case T_DNS0: 345 return "DNS0"; 346 case T_DNS1: 347 return "DNS1"; 348 } 349 return inet_ntoa(addr); 350 } 351 352 static const char * 353 maskstr(int bits) 354 { 355 static char str[4]; 356 357 if (bits == 32) 358 *str = '\0'; 359 else 360 snprintf(str, sizeof str, "/%d", bits); 361 362 return str; 363 } 364 365 static int 366 Parse(struct ipcp *ipcp, int argc, char const *const *argv, 367 struct filterent *ofp) 368 { 369 int action, proto; 370 int val, ruleno; 371 char *wp; 372 struct filterent filterdata; 373 374 ruleno = strtol(*argv, &wp, 0); 375 if (*argv == wp || ruleno >= MAXFILTERS) { 376 log_Printf(LogWARN, "Parse: invalid filter number.\n"); 377 return 0; 378 } 379 if (ruleno < 0) { 380 for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) { 381 ofp->f_action = A_NONE; 382 ofp++; 383 } 384 log_Printf(LogWARN, "Parse: filter cleared.\n"); 385 return 1; 386 } 387 ofp += ruleno; 388 389 if (--argc == 0) { 390 log_Printf(LogWARN, "Parse: missing action.\n"); 391 return 0; 392 } 393 argv++; 394 395 proto = P_NONE; 396 memset(&filterdata, '\0', sizeof filterdata); 397 398 val = strtol(*argv, &wp, 0); 399 if (!*wp && val >= 0 && val < MAXFILTERS) { 400 if (val <= ruleno) { 401 log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n", 402 ruleno); 403 return 0; 404 } 405 action = val; 406 } else if (!strcmp(*argv, "permit")) { 407 action = A_PERMIT; 408 } else if (!strcmp(*argv, "deny")) { 409 action = A_DENY; 410 } else if (!strcmp(*argv, "clear")) { 411 ofp->f_action = A_NONE; 412 return 1; 413 } else { 414 log_Printf(LogWARN, "Parse: bad action: %s\n", *argv); 415 return 0; 416 } 417 filterdata.f_action = action; 418 419 argc--; 420 argv++; 421 422 if (argc && argv[0][0] == '!' && !argv[0][1]) { 423 filterdata.f_invert = 1; 424 argc--; 425 argv++; 426 } 427 428 proto = filter_Nam2Proto(argc, argv); 429 if (proto == P_NONE) { 430 if (!argc) 431 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 432 else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr, 433 &filterdata.f_src.mask, &filterdata.f_src.width)) { 434 filterdata.f_srctype = addrtype(*argv); 435 argc--; 436 argv++; 437 proto = filter_Nam2Proto(argc, argv); 438 if (!argc) 439 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 440 else if (proto == P_NONE) { 441 if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr, 442 &filterdata.f_dst.mask, &filterdata.f_dst.width)) { 443 filterdata.f_dsttype = addrtype(*argv); 444 argc--; 445 argv++; 446 } else 447 filterdata.f_dsttype = T_ADDR; 448 if (argc) { 449 proto = filter_Nam2Proto(argc, argv); 450 if (proto == P_NONE) { 451 log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv); 452 return 0; 453 } else { 454 argc--; 455 argv++; 456 } 457 } 458 } else { 459 argc--; 460 argv++; 461 } 462 } else { 463 log_Printf(LogWARN, "Parse: Address/protocol expected.\n"); 464 return 0; 465 } 466 } else { 467 argc--; 468 argv++; 469 } 470 471 val = 1; 472 filterdata.f_proto = proto; 473 474 switch (proto) { 475 case P_TCP: 476 val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata); 477 break; 478 case P_UDP: 479 val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata); 480 break; 481 case P_ICMP: 482 val = ParseIcmp(argc, argv, &filterdata); 483 break; 484 case P_IGMP: 485 val = ParseIgmp(argc, argv, &filterdata); 486 break; 487 #ifdef P_OSPF 488 case P_OSPF: 489 val = ParseOspf(argc, argv, &filterdata); 490 break; 491 #endif 492 #ifdef P_GRE 493 case P_GRE: 494 val = ParseGRE(argc, argv, &filterdata); 495 break; 496 #endif 497 } 498 499 log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr)); 500 log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask)); 501 log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr)); 502 log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask)); 503 log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto); 504 505 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n", 506 filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport); 507 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n", 508 filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport); 509 log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab); 510 log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn); 511 log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst); 512 513 if (val) 514 *ofp = filterdata; 515 516 return val; 517 } 518 519 int 520 filter_Set(struct cmdargs const *arg) 521 { 522 struct filter *filter; 523 524 if (arg->argc < arg->argn+2) 525 return -1; 526 527 if (!strcmp(arg->argv[arg->argn], "in")) 528 filter = &arg->bundle->filter.in; 529 else if (!strcmp(arg->argv[arg->argn], "out")) 530 filter = &arg->bundle->filter.out; 531 else if (!strcmp(arg->argv[arg->argn], "dial")) 532 filter = &arg->bundle->filter.dial; 533 else if (!strcmp(arg->argv[arg->argn], "alive")) 534 filter = &arg->bundle->filter.alive; 535 else { 536 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n", 537 arg->argv[arg->argn]); 538 return -1; 539 } 540 541 Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1, 542 arg->argv + arg->argn + 1, filter->rule); 543 return 0; 544 } 545 546 const char * 547 filter_Action2Nam(int act) 548 { 549 static const char * const actname[] = { " none ", "permit ", " deny " }; 550 static char buf[8]; 551 552 if (act >= 0 && act < MAXFILTERS) { 553 snprintf(buf, sizeof buf, "%6d ", act); 554 return buf; 555 } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *)) 556 return actname[act - A_NONE]; 557 else 558 return "?????? "; 559 } 560 561 static void 562 doShowFilter(struct filterent *fp, struct prompt *prompt) 563 { 564 int n; 565 566 for (n = 0; n < MAXFILTERS; n++, fp++) { 567 if (fp->f_action != A_NONE) { 568 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action)); 569 prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' '); 570 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype), 571 maskstr(fp->f_src.width)); 572 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype), 573 maskstr(fp->f_dst.width)); 574 if (fp->f_proto) { 575 prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto)); 576 577 if (fp->f_srcop) 578 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop), 579 fp->f_srcport); 580 if (fp->f_dstop) 581 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop), 582 fp->f_dstport); 583 if (fp->f_estab) 584 prompt_Printf(prompt, " estab"); 585 if (fp->f_syn) 586 prompt_Printf(prompt, " syn"); 587 if (fp->f_finrst) 588 prompt_Printf(prompt, " finrst"); 589 } 590 prompt_Printf(prompt, "\n"); 591 } 592 } 593 } 594 595 int 596 filter_Show(struct cmdargs const *arg) 597 { 598 if (arg->argc > arg->argn+1) 599 return -1; 600 601 if (arg->argc == arg->argn+1) { 602 struct filter *filter; 603 604 if (!strcmp(arg->argv[arg->argn], "in")) 605 filter = &arg->bundle->filter.in; 606 else if (!strcmp(arg->argv[arg->argn], "out")) 607 filter = &arg->bundle->filter.out; 608 else if (!strcmp(arg->argv[arg->argn], "dial")) 609 filter = &arg->bundle->filter.dial; 610 else if (!strcmp(arg->argv[arg->argn], "alive")) 611 filter = &arg->bundle->filter.alive; 612 else 613 return -1; 614 doShowFilter(filter->rule, arg->prompt); 615 } else { 616 struct filter *filter[4]; 617 int f; 618 619 filter[0] = &arg->bundle->filter.in; 620 filter[1] = &arg->bundle->filter.out; 621 filter[2] = &arg->bundle->filter.dial; 622 filter[3] = &arg->bundle->filter.alive; 623 for (f = 0; f < 4; f++) { 624 if (f) 625 prompt_Printf(arg->prompt, "\n"); 626 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name); 627 doShowFilter(filter[f]->rule, arg->prompt); 628 } 629 } 630 631 return 0; 632 } 633 634 static const char * const protoname[] = { 635 "none", "tcp", "udp", "icmp", "ospf", "igmp", "gre" 636 }; 637 638 const char * 639 filter_Proto2Nam(int proto) 640 { 641 if (proto >= sizeof protoname / sizeof protoname[0]) 642 return "unknown"; 643 return protoname[proto]; 644 } 645 646 static int 647 filter_Nam2Proto(int argc, char const *const *argv) 648 { 649 int proto; 650 651 if (argc == 0) 652 proto = 0; 653 else 654 for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--) 655 if (!strcasecmp(*argv, protoname[proto])) 656 break; 657 658 return proto; 659 } 660 661 static const char * const opname[] = {"none", "eq", "gt", "lt"}; 662 663 const char * 664 filter_Op2Nam(int op) 665 { 666 if (op >= sizeof opname / sizeof opname[0]) 667 return "unknown"; 668 return opname[op]; 669 670 } 671 672 static int 673 filter_Nam2Op(const char *cp) 674 { 675 int op; 676 677 for (op = sizeof opname / sizeof opname[0] - 1; op; op--) 678 if (!strcasecmp(cp, opname[op])) 679 break; 680 681 return op; 682 } 683 684 void 685 filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip, 686 struct in_addr *peer_ip, struct in_addr dns[2]) 687 { 688 struct filterent *fp; 689 int n; 690 691 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++) 692 if (fp->f_action != A_NONE) { 693 if (my_ip) { 694 if (fp->f_srctype == T_MYADDR) 695 fp->f_src.ipaddr = *my_ip; 696 if (fp->f_dsttype == T_MYADDR) 697 fp->f_dst.ipaddr = *my_ip; 698 } 699 if (peer_ip) { 700 if (fp->f_srctype == T_HISADDR) 701 fp->f_src.ipaddr = *peer_ip; 702 if (fp->f_dsttype == T_HISADDR) 703 fp->f_dst.ipaddr = *peer_ip; 704 } 705 if (dns) { 706 if (fp->f_srctype == T_DNS0) 707 fp->f_src.ipaddr = dns[0]; 708 if (fp->f_dsttype == T_DNS0) 709 fp->f_dst.ipaddr = dns[0]; 710 if (fp->f_srctype == T_DNS1) 711 fp->f_src.ipaddr = dns[1]; 712 if (fp->f_dsttype == T_DNS1) 713 fp->f_dst.ipaddr = dns[1]; 714 } 715 } 716 } 717