xref: /freebsd/usr.sbin/ppp/filter.c (revision 6e8394b8baa7d5d9153ab90de6824bcd19b3b4e1) 
1 /*
2  *		PPP Filter command Interface
3  *
4  *	    Written by Toshiharu OHNO (tony-o@iij.ad.jp)
5  *
6  *   Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd.
7  *
8  * Redistribution and use in source and binary forms are permitted
9  * provided that the above copyright notice and this paragraph are
10  * duplicated in all such forms and that any documentation,
11  * advertising materials, and other materials related to such
12  * distribution and use acknowledge that the software was developed
13  * by the Internet Initiative Japan.  The name of the
14  * IIJ may not be used to endorse or promote products derived
15  * from this software without specific prior written permission.
16  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
18  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19  *
20  * $Id: filter.c,v 1.28 1999/05/08 11:06:33 brian Exp $
21  *
22  *	TODO: Shoud send ICMP error message when we discard packets.
23  */
24 
25 #include <sys/param.h>
26 #include <netinet/in.h>
27 #include <arpa/inet.h>
28 #include <netdb.h>
29 #include <netinet/in_systm.h>
30 #include <netinet/ip.h>
31 #include <sys/un.h>
32 
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <strings.h>
36 #include <termios.h>
37 
38 #include "layer.h"
39 #include "defs.h"
40 #include "command.h"
41 #include "mbuf.h"
42 #include "log.h"
43 #include "iplist.h"
44 #include "timer.h"
45 #include "throughput.h"
46 #include "lqr.h"
47 #include "hdlc.h"
48 #include "fsm.h"
49 #include "lcp.h"
50 #include "ccp.h"
51 #include "link.h"
52 #include "slcompress.h"
53 #include "ipcp.h"
54 #include "filter.h"
55 #include "descriptor.h"
56 #include "prompt.h"
57 #include "mp.h"
58 #ifndef NORADIUS
59 #include "radius.h"
60 #endif
61 #include "bundle.h"
62 
63 static int filter_Nam2Proto(int, char const *const *);
64 static int filter_Nam2Op(const char *);
65 
66 static const u_int32_t netmasks[33] = {
67   0x00000000,
68   0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
69   0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
70   0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000,
71   0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000,
72   0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000,
73   0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00,
74   0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0,
75   0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF,
76 };
77 
78 struct in_addr
79 bits2mask(int bits)
80 {
81   struct in_addr result;
82 
83   result.s_addr = htonl(netmasks[bits]);
84   return result;
85 }
86 
87 int
88 ParseAddr(struct ipcp *ipcp, const char *data,
89 	  struct in_addr *paddr, struct in_addr *pmask, int *pwidth)
90 {
91   int bits, len;
92   char *wp;
93   const char *cp;
94 
95   if (pmask)
96     pmask->s_addr = INADDR_BROADCAST;	/* Assume 255.255.255.255 as default */
97 
98   cp = pmask || pwidth ? strchr(data, '/') : NULL;
99   len = cp ? cp - data : strlen(data);
100 
101   if (ipcp && strncasecmp(data, "HISADDR", len) == 0)
102     *paddr = ipcp->peer_ip;
103   else if (ipcp && strncasecmp(data, "MYADDR", len) == 0)
104     *paddr = ipcp->my_ip;
105   else if (len > 15)
106     log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data);
107   else {
108     char s[16];
109     strncpy(s, data, len);
110     s[len] = '\0';
111     if (inet_aton(s, paddr) == 0) {
112       log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s);
113       return (0);
114     }
115   }
116   if (cp && *++cp) {
117     bits = strtol(cp, &wp, 0);
118     if (cp == wp || bits < 0 || bits > 32) {
119       log_Printf(LogWARN, "ParseAddr: bad mask width.\n");
120       return (0);
121     }
122   } else if (paddr->s_addr == INADDR_ANY)
123     /* An IP of 0.0.0.0 without a width is anything */
124     bits = 0;
125   else
126     /* If a valid IP is given without a width, assume 32 bits */
127     bits = 32;
128 
129   if (pwidth)
130     *pwidth = bits;
131 
132   if (pmask) {
133     if (paddr->s_addr == INADDR_ANY)
134       pmask->s_addr = INADDR_ANY;
135     else
136       *pmask = bits2mask(bits);
137   }
138 
139   return (1);
140 }
141 
142 static int
143 ParsePort(const char *service, int proto)
144 {
145   const char *protocol_name;
146   char *cp;
147   struct servent *servent;
148   int port;
149 
150   switch (proto) {
151   case P_UDP:
152     protocol_name = "udp";
153     break;
154   case P_TCP:
155     protocol_name = "tcp";
156     break;
157   default:
158     protocol_name = 0;
159   }
160 
161   servent = getservbyname(service, protocol_name);
162   if (servent != 0)
163     return (ntohs(servent->s_port));
164 
165   port = strtol(service, &cp, 0);
166   if (cp == service) {
167     log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
168 	      service);
169     return (0);
170   }
171   return (port);
172 }
173 
174 /*
175  *	ICMP Syntax:	src eq icmp_message_type
176  */
177 static int
178 ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
179 {
180   int type;
181   char *cp;
182 
183   switch (argc) {
184   case 0:
185     /* permit/deny all ICMP types */
186     tgt->opt.srcop = OP_NONE;
187     break;
188 
189   case 3:
190     if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
191       type = strtol(argv[2], &cp, 0);
192       if (cp == argv[2]) {
193 	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
194 	return (0);
195       }
196       tgt->opt.srcop = OP_EQ;
197       tgt->opt.srcport = type;
198     }
199     break;
200 
201   default:
202     log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
203     return (0);
204   }
205   return (1);
206 }
207 
208 /*
209  *	UDP Syntax: [src op port] [dst op port]
210  */
211 static int
212 ParseUdpOrTcp(int argc, char const *const *argv, int proto,
213               struct filterent *tgt)
214 {
215   tgt->opt.srcop = tgt->opt.dstop = OP_NONE;
216   tgt->opt.estab = tgt->opt.syn = tgt->opt.finrst = 0;
217 
218   if (argc >= 3 && !strcmp(*argv, "src")) {
219     tgt->opt.srcop = filter_Nam2Op(argv[1]);
220     if (tgt->opt.srcop == OP_NONE) {
221       log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
222       return (0);
223     }
224     tgt->opt.srcport = ParsePort(argv[2], proto);
225     if (tgt->opt.srcport == 0)
226       return (0);
227     argc -= 3;
228     argv += 3;
229   }
230 
231   if (argc >= 3 && !strcmp(argv[0], "dst")) {
232     tgt->opt.dstop = filter_Nam2Op(argv[1]);
233     if (tgt->opt.dstop == OP_NONE) {
234       log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
235       return (0);
236     }
237     tgt->opt.dstport = ParsePort(argv[2], proto);
238     if (tgt->opt.dstport == 0)
239       return (0);
240     argc -= 3;
241     argv += 3;
242   }
243 
244   if (proto == P_TCP) {
245     for (; argc > 0; argc--, argv++)
246       if (!strcmp(*argv, "estab"))
247         tgt->opt.estab = 1;
248       else if (!strcmp(*argv, "syn"))
249         tgt->opt.syn = 1;
250       else if (!strcmp(*argv, "finrst"))
251         tgt->opt.finrst = 1;
252       else
253         break;
254   }
255 
256   if (argc > 0) {
257     log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
258     return 0;
259   }
260 
261   return 1;
262 }
263 
264 static unsigned
265 addrtype(const char *addr)
266 {
267   if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
268     return T_MYADDR;
269   if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
270     return T_HISADDR;
271 
272   return T_ADDR;
273 }
274 
275 static const char *
276 addrstr(struct in_addr addr, unsigned type)
277 {
278   switch (type) {
279     case T_MYADDR:
280       return "MYADDR";
281     case T_HISADDR:
282       return "HISADDR";
283   }
284   return inet_ntoa(addr);
285 }
286 
287 static int
288 Parse(struct ipcp *ipcp, int argc, char const *const *argv,
289       struct filterent *ofp)
290 {
291   int action, proto;
292   int val;
293   char *wp;
294   struct filterent filterdata;
295 
296   val = strtol(*argv, &wp, 0);
297   if (*argv == wp || val > MAXFILTERS) {
298     log_Printf(LogWARN, "Parse: invalid filter number.\n");
299     return (0);
300   }
301   if (val < 0) {
302     for (val = 0; val < MAXFILTERS; val++) {
303       ofp->action = A_NONE;
304       ofp++;
305     }
306     log_Printf(LogWARN, "Parse: filter cleared.\n");
307     return (1);
308   }
309   ofp += val;
310 
311   if (--argc == 0) {
312     log_Printf(LogWARN, "Parse: missing action.\n");
313     return (0);
314   }
315   argv++;
316 
317   proto = P_NONE;
318   memset(&filterdata, '\0', sizeof filterdata);
319 
320   if (!strcmp(*argv, "permit")) {
321     action = A_PERMIT;
322   } else if (!strcmp(*argv, "deny")) {
323     action = A_DENY;
324   } else if (!strcmp(*argv, "clear")) {
325     ofp->action = A_NONE;
326     return (1);
327   } else {
328     log_Printf(LogWARN, "Parse: bad action: %s\n", *argv);
329     return (0);
330   }
331   filterdata.action = action;
332 
333   argc--;
334   argv++;
335 
336   if (argc && filterdata.action == A_DENY) {
337     if (!strcmp(*argv, "host")) {
338       filterdata.action |= A_UHOST;
339       argc--;
340       argv++;
341     } else if (!strcmp(*argv, "port")) {
342       filterdata.action |= A_UPORT;
343       argc--;
344       argv++;
345     }
346   }
347 
348   proto = filter_Nam2Proto(argc, argv);
349   if (proto == P_NONE) {
350     if (!argc)
351       log_Printf(LogWARN, "Parse: address/mask is expected.\n");
352     else if (ParseAddr(ipcp, *argv, &filterdata.src.ipaddr,
353                        &filterdata.src.mask, &filterdata.src.width)) {
354       filterdata.srctype = addrtype(*argv);
355       argc--;
356       argv++;
357       proto = filter_Nam2Proto(argc, argv);
358       if (!argc)
359         log_Printf(LogWARN, "Parse: address/mask is expected.\n");
360       else if (proto == P_NONE) {
361 	if (ParseAddr(ipcp, *argv, &filterdata.dst.ipaddr, &filterdata.dst.mask,
362                       &filterdata.dst.width)) {
363           filterdata.dsttype = addrtype(*argv);
364 	  argc--;
365 	  argv++;
366 	} else
367           filterdata.dsttype = T_ADDR;
368 	proto = filter_Nam2Proto(argc, argv);
369 	if (argc && proto != P_NONE) {
370 	  argc--;
371 	  argv++;
372 	}
373       } else {
374 	argc--;
375 	argv++;
376       }
377     } else {
378       log_Printf(LogWARN, "Parse: Address/protocol expected.\n");
379       return (0);
380     }
381   } else {
382     argc--;
383     argv++;
384   }
385 
386   val = 1;
387   filterdata.proto = proto;
388 
389   switch (proto) {
390   case P_TCP:
391     val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata);
392     break;
393   case P_UDP:
394     val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata);
395     break;
396   case P_ICMP:
397     val = ParseIcmp(argc, argv, &filterdata);
398     break;
399   }
400 
401   log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.src.ipaddr));
402   log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.src.mask));
403   log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.dst.ipaddr));
404   log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.dst.mask));
405   log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto);
406 
407   log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
408             filter_Op2Nam(filterdata.opt.srcop), filterdata.opt.srcport);
409   log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
410             filter_Op2Nam(filterdata.opt.dstop), filterdata.opt.dstport);
411   log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.opt.estab);
412   log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.opt.syn);
413   log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.opt.finrst);
414 
415   if (val)
416     *ofp = filterdata;
417   return (val);
418 }
419 
420 int
421 filter_Set(struct cmdargs const *arg)
422 {
423   struct filter *filter;
424 
425   if (arg->argc < arg->argn+2)
426     return -1;
427 
428   if (!strcmp(arg->argv[arg->argn], "in"))
429     filter = &arg->bundle->filter.in;
430   else if (!strcmp(arg->argv[arg->argn], "out"))
431     filter = &arg->bundle->filter.out;
432   else if (!strcmp(arg->argv[arg->argn], "dial"))
433     filter = &arg->bundle->filter.dial;
434   else if (!strcmp(arg->argv[arg->argn], "alive"))
435     filter = &arg->bundle->filter.alive;
436   else {
437     log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
438               arg->argv[arg->argn]);
439     return -1;
440   }
441 
442   Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1,
443         arg->argv + arg->argn + 1, filter->rule);
444   return 0;
445 }
446 
447 const char *
448 filter_Action2Nam(int act)
449 {
450   static const char *actname[] = { "none   ", "permit ", "deny   " };
451   return actname[act & (A_PERMIT|A_DENY)];
452 }
453 
454 static void
455 doShowFilter(struct filterent *fp, struct prompt *prompt)
456 {
457   int n;
458 
459   for (n = 0; n < MAXFILTERS; n++, fp++) {
460     if (fp->action != A_NONE) {
461       prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->action));
462       if (fp->action & A_UHOST)
463         prompt_Printf(prompt, "host ");
464       else if (fp->action & A_UPORT)
465         prompt_Printf(prompt, "port ");
466       else
467         prompt_Printf(prompt, "     ");
468       prompt_Printf(prompt, "%s/%d ", addrstr(fp->src.ipaddr, fp->srctype),
469                     fp->src.width);
470       prompt_Printf(prompt, "%s/%d ", addrstr(fp->dst.ipaddr, fp->dsttype),
471                     fp->dst.width);
472       if (fp->proto) {
473 	prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->proto));
474 
475 	if (fp->opt.srcop)
476 	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->opt.srcop),
477 		  fp->opt.srcport);
478 	if (fp->opt.dstop)
479 	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->opt.dstop),
480 		  fp->opt.dstport);
481 	if (fp->opt.estab)
482 	  prompt_Printf(prompt, " estab");
483 	if (fp->opt.syn)
484 	  prompt_Printf(prompt, " syn");
485 	if (fp->opt.finrst)
486 	  prompt_Printf(prompt, " finrst");
487       }
488       prompt_Printf(prompt, "\n");
489     }
490   }
491 }
492 
493 int
494 filter_Show(struct cmdargs const *arg)
495 {
496   if (arg->argc > arg->argn+1)
497     return -1;
498 
499   if (arg->argc == arg->argn+1) {
500     struct filter *filter;
501 
502     if (!strcmp(arg->argv[arg->argn], "in"))
503       filter = &arg->bundle->filter.in;
504     else if (!strcmp(arg->argv[arg->argn], "out"))
505       filter = &arg->bundle->filter.out;
506     else if (!strcmp(arg->argv[arg->argn], "dial"))
507       filter = &arg->bundle->filter.dial;
508     else if (!strcmp(arg->argv[arg->argn], "alive"))
509       filter = &arg->bundle->filter.alive;
510     else
511       return -1;
512     doShowFilter(filter->rule, arg->prompt);
513   } else {
514     struct filter *filter[4];
515     int f;
516 
517     filter[0] = &arg->bundle->filter.in;
518     filter[1] = &arg->bundle->filter.out;
519     filter[2] = &arg->bundle->filter.dial;
520     filter[3] = &arg->bundle->filter.alive;
521     for (f = 0; f < 4; f++) {
522       if (f)
523         prompt_Printf(arg->prompt, "\n");
524       prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
525       doShowFilter(filter[f]->rule, arg->prompt);
526     }
527   }
528 
529   return 0;
530 }
531 
532 static const char *protoname[] = { "none", "tcp", "udp", "icmp" };
533 
534 const char *
535 filter_Proto2Nam(int proto)
536 {
537   if (proto >= sizeof protoname / sizeof protoname[0])
538     return "unknown";
539   return protoname[proto];
540 }
541 
542 static int
543 filter_Nam2Proto(int argc, char const *const *argv)
544 {
545   int proto;
546 
547   if (argc == 0)
548     proto = 0;
549   else
550     for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--)
551       if (!strcasecmp(*argv, protoname[proto]))
552         break;
553 
554   return proto;
555 }
556 
557 static const char *opname[] = {"none", "eq", "gt", "unknown", "lt"};
558 
559 const char *
560 filter_Op2Nam(int op)
561 {
562   if (op >= sizeof opname / sizeof opname[0])
563     return "unknown";
564   return opname[op];
565 
566 }
567 
568 static int
569 filter_Nam2Op(const char *cp)
570 {
571   int op;
572 
573   for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
574     if (!strcasecmp(cp, opname[op]))
575       break;
576 
577   return op;
578 }
579 
580 void
581 filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip,
582                   struct in_addr *peer_ip)
583 {
584   struct filterent *fp;
585   int n;
586 
587   for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
588     if (fp->action != A_NONE) {
589       if (my_ip) {
590         if (fp->srctype == T_MYADDR)
591           fp->src.ipaddr = *my_ip;
592         if (fp->dsttype == T_MYADDR)
593           fp->dst.ipaddr = *my_ip;
594       }
595       if (peer_ip) {
596         if (fp->srctype == T_HISADDR)
597           fp->src.ipaddr = *peer_ip;
598         if (fp->dsttype == T_HISADDR)
599           fp->dst.ipaddr = *peer_ip;
600       }
601     }
602 }
603