1 /* 2 * PPP Filter command Interface 3 * 4 * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5 * 6 * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7 * 8 * Redistribution and use in source and binary forms are permitted 9 * provided that the above copyright notice and this paragraph are 10 * duplicated in all such forms and that any documentation, 11 * advertising materials, and other materials related to such 12 * distribution and use acknowledge that the software was developed 13 * by the Internet Initiative Japan. The name of the 14 * IIJ may not be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 * 20 * $FreeBSD$ 21 * 22 * TODO: Should send ICMP error message when we discard packets. 23 */ 24 25 #include <sys/param.h> 26 #include <netinet/in.h> 27 #include <arpa/inet.h> 28 #include <netdb.h> 29 #include <netinet/in_systm.h> 30 #include <netinet/ip.h> 31 #include <sys/un.h> 32 33 #include <stdio.h> 34 #include <stdlib.h> 35 #include <strings.h> 36 #include <termios.h> 37 38 #include "layer.h" 39 #include "defs.h" 40 #include "command.h" 41 #include "mbuf.h" 42 #include "log.h" 43 #include "iplist.h" 44 #include "timer.h" 45 #include "throughput.h" 46 #include "lqr.h" 47 #include "hdlc.h" 48 #include "fsm.h" 49 #include "lcp.h" 50 #include "ccp.h" 51 #include "link.h" 52 #include "slcompress.h" 53 #include "ipcp.h" 54 #include "filter.h" 55 #include "descriptor.h" 56 #include "prompt.h" 57 #include "mp.h" 58 #ifndef NORADIUS 59 #include "radius.h" 60 #endif 61 #include "bundle.h" 62 63 static int filter_Nam2Proto(int, char const *const *); 64 static int filter_Nam2Op(const char *); 65 66 static const u_int32_t netmasks[33] = { 67 0x00000000, 68 0x80000000, 0xC0000000, 0xE0000000, 0xF0000000, 69 0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000, 70 0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000, 71 0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000, 72 0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000, 73 0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00, 74 0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0, 75 0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF, 76 }; 77 78 struct in_addr 79 bits2mask(int bits) 80 { 81 struct in_addr result; 82 83 result.s_addr = htonl(netmasks[bits]); 84 return result; 85 } 86 87 int 88 ParseAddr(struct ipcp *ipcp, const char *data, 89 struct in_addr *paddr, struct in_addr *pmask, int *pwidth) 90 { 91 int bits, len; 92 char *wp; 93 const char *cp; 94 95 if (pmask) 96 pmask->s_addr = INADDR_BROADCAST; /* Assume 255.255.255.255 as default */ 97 98 cp = pmask || pwidth ? strchr(data, '/') : NULL; 99 len = cp ? cp - data : strlen(data); 100 101 if (ipcp && strncasecmp(data, "HISADDR", len) == 0) 102 *paddr = ipcp->peer_ip; 103 else if (ipcp && strncasecmp(data, "MYADDR", len) == 0) 104 *paddr = ipcp->my_ip; 105 else if (len > 15) 106 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data); 107 else { 108 char s[16]; 109 strncpy(s, data, len); 110 s[len] = '\0'; 111 if (inet_aton(s, paddr) == 0) { 112 log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s); 113 return 0; 114 } 115 } 116 if (cp && *++cp) { 117 bits = strtol(cp, &wp, 0); 118 if (cp == wp || bits < 0 || bits > 32) { 119 log_Printf(LogWARN, "ParseAddr: bad mask width.\n"); 120 return 0; 121 } 122 } else if (paddr->s_addr == INADDR_ANY) 123 /* An IP of 0.0.0.0 without a width is anything */ 124 bits = 0; 125 else 126 /* If a valid IP is given without a width, assume 32 bits */ 127 bits = 32; 128 129 if (pwidth) 130 *pwidth = bits; 131 132 if (pmask) { 133 if (paddr->s_addr == INADDR_ANY) 134 pmask->s_addr = INADDR_ANY; 135 else 136 *pmask = bits2mask(bits); 137 } 138 139 return 1; 140 } 141 142 static int 143 ParsePort(const char *service, int proto) 144 { 145 const char *protocol_name; 146 char *cp; 147 struct servent *servent; 148 int port; 149 150 switch (proto) { 151 case P_UDP: 152 protocol_name = "udp"; 153 break; 154 case P_TCP: 155 protocol_name = "tcp"; 156 break; 157 default: 158 protocol_name = 0; 159 } 160 161 servent = getservbyname(service, protocol_name); 162 if (servent != 0) 163 return ntohs(servent->s_port); 164 165 port = strtol(service, &cp, 0); 166 if (cp == service) { 167 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n", 168 service); 169 return 0; 170 } 171 return port; 172 } 173 174 /* 175 * ICMP Syntax: src eq icmp_message_type 176 */ 177 static int 178 ParseIcmp(int argc, char const *const *argv, struct filterent *tgt) 179 { 180 int type; 181 char *cp; 182 183 switch (argc) { 184 case 0: 185 /* permit/deny all ICMP types */ 186 tgt->f_srcop = OP_NONE; 187 break; 188 189 case 3: 190 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) { 191 type = strtol(argv[2], &cp, 0); 192 if (cp == argv[2]) { 193 log_Printf(LogWARN, "ParseIcmp: type is expected.\n"); 194 return 0; 195 } 196 tgt->f_srcop = OP_EQ; 197 tgt->f_srcport = type; 198 } 199 break; 200 201 default: 202 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n"); 203 return 0; 204 } 205 return 1; 206 } 207 208 /* 209 * UDP Syntax: [src op port] [dst op port] 210 */ 211 static int 212 ParseUdpOrTcp(int argc, char const *const *argv, int proto, 213 struct filterent *tgt) 214 { 215 tgt->f_srcop = tgt->f_dstop = OP_NONE; 216 tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0; 217 218 if (argc >= 3 && !strcmp(*argv, "src")) { 219 tgt->f_srcop = filter_Nam2Op(argv[1]); 220 if (tgt->f_srcop == OP_NONE) { 221 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 222 return 0; 223 } 224 tgt->f_srcport = ParsePort(argv[2], proto); 225 if (tgt->f_srcport == 0) 226 return 0; 227 argc -= 3; 228 argv += 3; 229 } 230 231 if (argc >= 3 && !strcmp(argv[0], "dst")) { 232 tgt->f_dstop = filter_Nam2Op(argv[1]); 233 if (tgt->f_dstop == OP_NONE) { 234 log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n"); 235 return 0; 236 } 237 tgt->f_dstport = ParsePort(argv[2], proto); 238 if (tgt->f_dstport == 0) 239 return 0; 240 argc -= 3; 241 argv += 3; 242 } 243 244 if (proto == P_TCP) { 245 for (; argc > 0; argc--, argv++) 246 if (!strcmp(*argv, "estab")) 247 tgt->f_estab = 1; 248 else if (!strcmp(*argv, "syn")) 249 tgt->f_syn = 1; 250 else if (!strcmp(*argv, "finrst")) 251 tgt->f_finrst = 1; 252 else 253 break; 254 } 255 256 if (argc > 0) { 257 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv); 258 return 0; 259 } 260 261 return 1; 262 } 263 264 static int 265 ParseIgmp(int argc, char const * const *argv, struct filterent *tgt) 266 { 267 /* 268 * Filter currently is a catch-all. Requests are either permitted or 269 * dropped. 270 */ 271 if (argc != 0) { 272 log_Printf(LogWARN, "ParseIgmp: Too many parameters\n"); 273 return 0; 274 } else 275 tgt->f_srcop = OP_NONE; 276 277 return 1; 278 } 279 280 #ifdef P_GRE 281 static int 282 ParseGRE(int argc, char const * const *argv, struct filterent *tgt) 283 { 284 /* 285 * Filter currently is a catch-all. Requests are either permitted or 286 * dropped. 287 */ 288 if (argc != 0) { 289 log_Printf(LogWARN, "ParseGRE: Too many parameters\n"); 290 return 0; 291 } else 292 tgt->f_srcop = OP_NONE; 293 294 return 1; 295 } 296 #endif 297 298 #ifdef P_OSPF 299 static int 300 ParseOspf(int argc, char const * const *argv, struct filterent *tgt) 301 { 302 /* 303 * Filter currently is a catch-all. Requests are either permitted or 304 * dropped. 305 */ 306 if (argc != 0) { 307 log_Printf(LogWARN, "ParseOspf: Too many parameters\n"); 308 return 0; 309 } else 310 tgt->f_srcop = OP_NONE; 311 312 return 1; 313 } 314 #endif 315 316 static unsigned 317 addrtype(const char *addr) 318 { 319 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/')) 320 return T_MYADDR; 321 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/')) 322 return T_HISADDR; 323 324 return T_ADDR; 325 } 326 327 static const char * 328 addrstr(struct in_addr addr, unsigned type) 329 { 330 switch (type) { 331 case T_MYADDR: 332 return "MYADDR"; 333 case T_HISADDR: 334 return "HISADDR"; 335 } 336 return inet_ntoa(addr); 337 } 338 339 static const char * 340 maskstr(int bits) 341 { 342 static char str[4]; 343 344 if (bits == 32) 345 *str = '\0'; 346 else 347 snprintf(str, sizeof str, "/%d", bits); 348 349 return str; 350 } 351 352 static int 353 Parse(struct ipcp *ipcp, int argc, char const *const *argv, 354 struct filterent *ofp) 355 { 356 int action, proto; 357 int val, ruleno; 358 char *wp; 359 struct filterent filterdata; 360 361 ruleno = strtol(*argv, &wp, 0); 362 if (*argv == wp || ruleno >= MAXFILTERS) { 363 log_Printf(LogWARN, "Parse: invalid filter number.\n"); 364 return 0; 365 } 366 if (ruleno < 0) { 367 for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) { 368 ofp->f_action = A_NONE; 369 ofp++; 370 } 371 log_Printf(LogWARN, "Parse: filter cleared.\n"); 372 return 1; 373 } 374 ofp += ruleno; 375 376 if (--argc == 0) { 377 log_Printf(LogWARN, "Parse: missing action.\n"); 378 return 0; 379 } 380 argv++; 381 382 proto = P_NONE; 383 memset(&filterdata, '\0', sizeof filterdata); 384 385 val = strtol(*argv, &wp, 0); 386 if (!*wp && val >= 0 && val < MAXFILTERS) { 387 if (val <= ruleno) { 388 log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n", 389 ruleno); 390 return 0; 391 } 392 action = val; 393 } else if (!strcmp(*argv, "permit")) { 394 action = A_PERMIT; 395 } else if (!strcmp(*argv, "deny")) { 396 action = A_DENY; 397 } else if (!strcmp(*argv, "clear")) { 398 ofp->f_action = A_NONE; 399 return 1; 400 } else { 401 log_Printf(LogWARN, "Parse: bad action: %s\n", *argv); 402 return 0; 403 } 404 filterdata.f_action = action; 405 406 argc--; 407 argv++; 408 409 if (argc && argv[0][0] == '!' && !argv[0][1]) { 410 filterdata.f_invert = 1; 411 argc--; 412 argv++; 413 } 414 415 proto = filter_Nam2Proto(argc, argv); 416 if (proto == P_NONE) { 417 if (!argc) 418 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 419 else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr, 420 &filterdata.f_src.mask, &filterdata.f_src.width)) { 421 filterdata.f_srctype = addrtype(*argv); 422 argc--; 423 argv++; 424 proto = filter_Nam2Proto(argc, argv); 425 if (!argc) 426 log_Printf(LogWARN, "Parse: address/mask is expected.\n"); 427 else if (proto == P_NONE) { 428 if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr, 429 &filterdata.f_dst.mask, &filterdata.f_dst.width)) { 430 filterdata.f_dsttype = addrtype(*argv); 431 argc--; 432 argv++; 433 } else 434 filterdata.f_dsttype = T_ADDR; 435 if (argc) { 436 proto = filter_Nam2Proto(argc, argv); 437 if (proto == P_NONE) { 438 log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv); 439 return 0; 440 } else { 441 argc--; 442 argv++; 443 } 444 } 445 } else { 446 argc--; 447 argv++; 448 } 449 } else { 450 log_Printf(LogWARN, "Parse: Address/protocol expected.\n"); 451 return 0; 452 } 453 } else { 454 argc--; 455 argv++; 456 } 457 458 val = 1; 459 filterdata.f_proto = proto; 460 461 switch (proto) { 462 case P_TCP: 463 val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata); 464 break; 465 case P_UDP: 466 val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata); 467 break; 468 case P_ICMP: 469 val = ParseIcmp(argc, argv, &filterdata); 470 break; 471 case P_IGMP: 472 val = ParseIgmp(argc, argv, &filterdata); 473 break; 474 #ifdef P_OSPF 475 case P_OSPF: 476 val = ParseOspf(argc, argv, &filterdata); 477 break; 478 #endif 479 #ifdef P_GRE 480 case P_GRE: 481 val = ParseGRE(argc, argv, &filterdata); 482 break; 483 #endif 484 } 485 486 log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr)); 487 log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask)); 488 log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr)); 489 log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask)); 490 log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto); 491 492 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n", 493 filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport); 494 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n", 495 filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport); 496 log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab); 497 log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn); 498 log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst); 499 500 if (val) 501 *ofp = filterdata; 502 503 return val; 504 } 505 506 int 507 filter_Set(struct cmdargs const *arg) 508 { 509 struct filter *filter; 510 511 if (arg->argc < arg->argn+2) 512 return -1; 513 514 if (!strcmp(arg->argv[arg->argn], "in")) 515 filter = &arg->bundle->filter.in; 516 else if (!strcmp(arg->argv[arg->argn], "out")) 517 filter = &arg->bundle->filter.out; 518 else if (!strcmp(arg->argv[arg->argn], "dial")) 519 filter = &arg->bundle->filter.dial; 520 else if (!strcmp(arg->argv[arg->argn], "alive")) 521 filter = &arg->bundle->filter.alive; 522 else { 523 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n", 524 arg->argv[arg->argn]); 525 return -1; 526 } 527 528 Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1, 529 arg->argv + arg->argn + 1, filter->rule); 530 return 0; 531 } 532 533 const char * 534 filter_Action2Nam(int act) 535 { 536 static const char * const actname[] = { " none ", "permit ", " deny " }; 537 static char buf[8]; 538 539 if (act >= 0 && act < MAXFILTERS) { 540 snprintf(buf, sizeof buf, "%6d ", act); 541 return buf; 542 } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *)) 543 return actname[act - A_NONE]; 544 else 545 return "?????? "; 546 } 547 548 static void 549 doShowFilter(struct filterent *fp, struct prompt *prompt) 550 { 551 int n; 552 553 for (n = 0; n < MAXFILTERS; n++, fp++) { 554 if (fp->f_action != A_NONE) { 555 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action)); 556 prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' '); 557 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype), 558 maskstr(fp->f_src.width)); 559 prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype), 560 maskstr(fp->f_dst.width)); 561 if (fp->f_proto) { 562 prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto)); 563 564 if (fp->f_srcop) 565 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop), 566 fp->f_srcport); 567 if (fp->f_dstop) 568 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop), 569 fp->f_dstport); 570 if (fp->f_estab) 571 prompt_Printf(prompt, " estab"); 572 if (fp->f_syn) 573 prompt_Printf(prompt, " syn"); 574 if (fp->f_finrst) 575 prompt_Printf(prompt, " finrst"); 576 } 577 prompt_Printf(prompt, "\n"); 578 } 579 } 580 } 581 582 int 583 filter_Show(struct cmdargs const *arg) 584 { 585 if (arg->argc > arg->argn+1) 586 return -1; 587 588 if (arg->argc == arg->argn+1) { 589 struct filter *filter; 590 591 if (!strcmp(arg->argv[arg->argn], "in")) 592 filter = &arg->bundle->filter.in; 593 else if (!strcmp(arg->argv[arg->argn], "out")) 594 filter = &arg->bundle->filter.out; 595 else if (!strcmp(arg->argv[arg->argn], "dial")) 596 filter = &arg->bundle->filter.dial; 597 else if (!strcmp(arg->argv[arg->argn], "alive")) 598 filter = &arg->bundle->filter.alive; 599 else 600 return -1; 601 doShowFilter(filter->rule, arg->prompt); 602 } else { 603 struct filter *filter[4]; 604 int f; 605 606 filter[0] = &arg->bundle->filter.in; 607 filter[1] = &arg->bundle->filter.out; 608 filter[2] = &arg->bundle->filter.dial; 609 filter[3] = &arg->bundle->filter.alive; 610 for (f = 0; f < 4; f++) { 611 if (f) 612 prompt_Printf(arg->prompt, "\n"); 613 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name); 614 doShowFilter(filter[f]->rule, arg->prompt); 615 } 616 } 617 618 return 0; 619 } 620 621 static const char * const protoname[] = { 622 "none", "tcp", "udp", "icmp", "ospf", "igmp", "gre" 623 }; 624 625 const char * 626 filter_Proto2Nam(int proto) 627 { 628 if (proto >= sizeof protoname / sizeof protoname[0]) 629 return "unknown"; 630 return protoname[proto]; 631 } 632 633 static int 634 filter_Nam2Proto(int argc, char const *const *argv) 635 { 636 int proto; 637 638 if (argc == 0) 639 proto = 0; 640 else 641 for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--) 642 if (!strcasecmp(*argv, protoname[proto])) 643 break; 644 645 return proto; 646 } 647 648 static const char * const opname[] = {"none", "eq", "gt", "lt"}; 649 650 const char * 651 filter_Op2Nam(int op) 652 { 653 if (op >= sizeof opname / sizeof opname[0]) 654 return "unknown"; 655 return opname[op]; 656 657 } 658 659 static int 660 filter_Nam2Op(const char *cp) 661 { 662 int op; 663 664 for (op = sizeof opname / sizeof opname[0] - 1; op; op--) 665 if (!strcasecmp(cp, opname[op])) 666 break; 667 668 return op; 669 } 670 671 void 672 filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip, 673 struct in_addr *peer_ip) 674 { 675 struct filterent *fp; 676 int n; 677 678 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++) 679 if (fp->f_action != A_NONE) { 680 if (my_ip) { 681 if (fp->f_srctype == T_MYADDR) 682 fp->f_src.ipaddr = *my_ip; 683 if (fp->f_dsttype == T_MYADDR) 684 fp->f_dst.ipaddr = *my_ip; 685 } 686 if (peer_ip) { 687 if (fp->f_srctype == T_HISADDR) 688 fp->f_src.ipaddr = *peer_ip; 689 if (fp->f_dsttype == T_HISADDR) 690 fp->f_dst.ipaddr = *peer_ip; 691 } 692 } 693 } 694