xref: /freebsd/usr.sbin/ppp/filter.c (revision daf1cffce2e07931f27c6c6998652e90df6ba87e)
1 /*
2  *		PPP Filter command Interface
3  *
4  *	    Written by Toshiharu OHNO (tony-o@iij.ad.jp)
5  *
6  *   Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd.
7  *
8  * Redistribution and use in source and binary forms are permitted
9  * provided that the above copyright notice and this paragraph are
10  * duplicated in all such forms and that any documentation,
11  * advertising materials, and other materials related to such
12  * distribution and use acknowledge that the software was developed
13  * by the Internet Initiative Japan.  The name of the
14  * IIJ may not be used to endorse or promote products derived
15  * from this software without specific prior written permission.
16  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
18  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19  *
20  * $FreeBSD$
21  *
22  *	TODO: Should send ICMP error message when we discard packets.
23  */
24 
25 #include <sys/param.h>
26 #include <netinet/in.h>
27 #include <arpa/inet.h>
28 #include <netdb.h>
29 #include <netinet/in_systm.h>
30 #include <netinet/ip.h>
31 #include <sys/un.h>
32 
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <strings.h>
36 #include <termios.h>
37 
38 #include "layer.h"
39 #include "defs.h"
40 #include "command.h"
41 #include "mbuf.h"
42 #include "log.h"
43 #include "iplist.h"
44 #include "timer.h"
45 #include "throughput.h"
46 #include "lqr.h"
47 #include "hdlc.h"
48 #include "fsm.h"
49 #include "lcp.h"
50 #include "ccp.h"
51 #include "link.h"
52 #include "slcompress.h"
53 #include "ipcp.h"
54 #include "filter.h"
55 #include "descriptor.h"
56 #include "prompt.h"
57 #include "mp.h"
58 #ifndef NORADIUS
59 #include "radius.h"
60 #endif
61 #include "bundle.h"
62 
63 static int filter_Nam2Proto(int, char const *const *);
64 static int filter_Nam2Op(const char *);
65 
66 static const u_int32_t netmasks[33] = {
67   0x00000000,
68   0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
69   0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
70   0xFF800000, 0xFFC00000, 0xFFE00000, 0xFFF00000,
71   0xFFF80000, 0xFFFC0000, 0xFFFE0000, 0xFFFF0000,
72   0xFFFF8000, 0xFFFFC000, 0xFFFFE000, 0xFFFFF000,
73   0xFFFFF800, 0xFFFFFC00, 0xFFFFFE00, 0xFFFFFF00,
74   0xFFFFFF80, 0xFFFFFFC0, 0xFFFFFFE0, 0xFFFFFFF0,
75   0xFFFFFFF8, 0xFFFFFFFC, 0xFFFFFFFE, 0xFFFFFFFF,
76 };
77 
78 struct in_addr
79 bits2mask(int bits)
80 {
81   struct in_addr result;
82 
83   result.s_addr = htonl(netmasks[bits]);
84   return result;
85 }
86 
87 int
88 ParseAddr(struct ipcp *ipcp, const char *data,
89 	  struct in_addr *paddr, struct in_addr *pmask, int *pwidth)
90 {
91   int bits, len;
92   char *wp;
93   const char *cp;
94 
95   if (pmask)
96     pmask->s_addr = INADDR_BROADCAST;	/* Assume 255.255.255.255 as default */
97 
98   cp = pmask || pwidth ? strchr(data, '/') : NULL;
99   len = cp ? cp - data : strlen(data);
100 
101   if (ipcp && strncasecmp(data, "HISADDR", len) == 0)
102     *paddr = ipcp->peer_ip;
103   else if (ipcp && strncasecmp(data, "MYADDR", len) == 0)
104     *paddr = ipcp->my_ip;
105   else if (len > 15)
106     log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", data);
107   else {
108     char s[16];
109     strncpy(s, data, len);
110     s[len] = '\0';
111     if (inet_aton(s, paddr) == 0) {
112       log_Printf(LogWARN, "ParseAddr: %s: Bad address\n", s);
113       return 0;
114     }
115   }
116   if (cp && *++cp) {
117     bits = strtol(cp, &wp, 0);
118     if (cp == wp || bits < 0 || bits > 32) {
119       log_Printf(LogWARN, "ParseAddr: bad mask width.\n");
120       return 0;
121     }
122   } else if (paddr->s_addr == INADDR_ANY)
123     /* An IP of 0.0.0.0 without a width is anything */
124     bits = 0;
125   else
126     /* If a valid IP is given without a width, assume 32 bits */
127     bits = 32;
128 
129   if (pwidth)
130     *pwidth = bits;
131 
132   if (pmask) {
133     if (paddr->s_addr == INADDR_ANY)
134       pmask->s_addr = INADDR_ANY;
135     else
136       *pmask = bits2mask(bits);
137   }
138 
139   return 1;
140 }
141 
142 static int
143 ParsePort(const char *service, int proto)
144 {
145   const char *protocol_name;
146   char *cp;
147   struct servent *servent;
148   int port;
149 
150   switch (proto) {
151   case P_UDP:
152     protocol_name = "udp";
153     break;
154   case P_TCP:
155     protocol_name = "tcp";
156     break;
157   default:
158     protocol_name = 0;
159   }
160 
161   servent = getservbyname(service, protocol_name);
162   if (servent != 0)
163     return ntohs(servent->s_port);
164 
165   port = strtol(service, &cp, 0);
166   if (cp == service) {
167     log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
168 	      service);
169     return 0;
170   }
171   return port;
172 }
173 
174 /*
175  *	ICMP Syntax:	src eq icmp_message_type
176  */
177 static int
178 ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
179 {
180   int type;
181   char *cp;
182 
183   switch (argc) {
184   case 0:
185     /* permit/deny all ICMP types */
186     tgt->f_srcop = OP_NONE;
187     break;
188 
189   case 3:
190     if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
191       type = strtol(argv[2], &cp, 0);
192       if (cp == argv[2]) {
193 	log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
194 	return 0;
195       }
196       tgt->f_srcop = OP_EQ;
197       tgt->f_srcport = type;
198     }
199     break;
200 
201   default:
202     log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
203     return 0;
204   }
205   return 1;
206 }
207 
208 /*
209  *	UDP Syntax: [src op port] [dst op port]
210  */
211 static int
212 ParseUdpOrTcp(int argc, char const *const *argv, int proto,
213               struct filterent *tgt)
214 {
215   tgt->f_srcop = tgt->f_dstop = OP_NONE;
216   tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
217 
218   if (argc >= 3 && !strcmp(*argv, "src")) {
219     tgt->f_srcop = filter_Nam2Op(argv[1]);
220     if (tgt->f_srcop == OP_NONE) {
221       log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
222       return 0;
223     }
224     tgt->f_srcport = ParsePort(argv[2], proto);
225     if (tgt->f_srcport == 0)
226       return 0;
227     argc -= 3;
228     argv += 3;
229   }
230 
231   if (argc >= 3 && !strcmp(argv[0], "dst")) {
232     tgt->f_dstop = filter_Nam2Op(argv[1]);
233     if (tgt->f_dstop == OP_NONE) {
234       log_Printf(LogWARN, "ParseUdpOrTcp: bad operation\n");
235       return 0;
236     }
237     tgt->f_dstport = ParsePort(argv[2], proto);
238     if (tgt->f_dstport == 0)
239       return 0;
240     argc -= 3;
241     argv += 3;
242   }
243 
244   if (proto == P_TCP) {
245     for (; argc > 0; argc--, argv++)
246       if (!strcmp(*argv, "estab"))
247         tgt->f_estab = 1;
248       else if (!strcmp(*argv, "syn"))
249         tgt->f_syn = 1;
250       else if (!strcmp(*argv, "finrst"))
251         tgt->f_finrst = 1;
252       else
253         break;
254   }
255 
256   if (argc > 0) {
257     log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
258     return 0;
259   }
260 
261   return 1;
262 }
263 
264 static int
265 ParseIgmp(int argc, char const * const *argv, struct filterent *tgt)
266 {
267   /*
268    * Filter currently is a catch-all. Requests are either permitted or
269    * dropped.
270    */
271   if (argc != 0) {
272     log_Printf(LogWARN, "ParseIgmp: Too many parameters\n");
273     return 0;
274   } else
275     tgt->f_srcop = OP_NONE;
276 
277   return 1;
278 }
279 
280 #ifdef P_GRE
281 static int
282 ParseGRE(int argc, char const * const *argv, struct filterent *tgt)
283 {
284   /*
285    * Filter currently is a catch-all. Requests are either permitted or
286    * dropped.
287    */
288   if (argc != 0) {
289     log_Printf(LogWARN, "ParseGRE: Too many parameters\n");
290     return 0;
291   } else
292     tgt->f_srcop = OP_NONE;
293 
294   return 1;
295 }
296 #endif
297 
298 #ifdef P_OSPF
299 static int
300 ParseOspf(int argc, char const * const *argv, struct filterent *tgt)
301 {
302   /*
303    * Filter currently is a catch-all. Requests are either permitted or
304    * dropped.
305    */
306   if (argc != 0) {
307     log_Printf(LogWARN, "ParseOspf: Too many parameters\n");
308     return 0;
309   } else
310     tgt->f_srcop = OP_NONE;
311 
312   return 1;
313 }
314 #endif
315 
316 static unsigned
317 addrtype(const char *addr)
318 {
319   if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
320     return T_MYADDR;
321   if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
322     return T_HISADDR;
323 
324   return T_ADDR;
325 }
326 
327 static const char *
328 addrstr(struct in_addr addr, unsigned type)
329 {
330   switch (type) {
331     case T_MYADDR:
332       return "MYADDR";
333     case T_HISADDR:
334       return "HISADDR";
335   }
336   return inet_ntoa(addr);
337 }
338 
339 static const char *
340 maskstr(int bits)
341 {
342   static char str[4];
343 
344   if (bits == 32)
345     *str = '\0';
346   else
347     snprintf(str, sizeof str, "/%d", bits);
348 
349   return str;
350 }
351 
352 static int
353 Parse(struct ipcp *ipcp, int argc, char const *const *argv,
354       struct filterent *ofp)
355 {
356   int action, proto;
357   int val, ruleno;
358   char *wp;
359   struct filterent filterdata;
360 
361   ruleno = strtol(*argv, &wp, 0);
362   if (*argv == wp || ruleno >= MAXFILTERS) {
363     log_Printf(LogWARN, "Parse: invalid filter number.\n");
364     return 0;
365   }
366   if (ruleno < 0) {
367     for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
368       ofp->f_action = A_NONE;
369       ofp++;
370     }
371     log_Printf(LogWARN, "Parse: filter cleared.\n");
372     return 1;
373   }
374   ofp += ruleno;
375 
376   if (--argc == 0) {
377     log_Printf(LogWARN, "Parse: missing action.\n");
378     return 0;
379   }
380   argv++;
381 
382   proto = P_NONE;
383   memset(&filterdata, '\0', sizeof filterdata);
384 
385   val = strtol(*argv, &wp, 0);
386   if (!*wp && val >= 0 && val < MAXFILTERS) {
387     if (val <= ruleno) {
388       log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
389                  ruleno);
390       return 0;
391     }
392     action = val;
393   } else if (!strcmp(*argv, "permit")) {
394     action = A_PERMIT;
395   } else if (!strcmp(*argv, "deny")) {
396     action = A_DENY;
397   } else if (!strcmp(*argv, "clear")) {
398     ofp->f_action = A_NONE;
399     return 1;
400   } else {
401     log_Printf(LogWARN, "Parse: bad action: %s\n", *argv);
402     return 0;
403   }
404   filterdata.f_action = action;
405 
406   argc--;
407   argv++;
408 
409   if (argc && argv[0][0] == '!' && !argv[0][1]) {
410     filterdata.f_invert = 1;
411     argc--;
412     argv++;
413   }
414 
415   proto = filter_Nam2Proto(argc, argv);
416   if (proto == P_NONE) {
417     if (!argc)
418       log_Printf(LogWARN, "Parse: address/mask is expected.\n");
419     else if (ParseAddr(ipcp, *argv, &filterdata.f_src.ipaddr,
420                        &filterdata.f_src.mask, &filterdata.f_src.width)) {
421       filterdata.f_srctype = addrtype(*argv);
422       argc--;
423       argv++;
424       proto = filter_Nam2Proto(argc, argv);
425       if (!argc)
426         log_Printf(LogWARN, "Parse: address/mask is expected.\n");
427       else if (proto == P_NONE) {
428 	if (ParseAddr(ipcp, *argv, &filterdata.f_dst.ipaddr,
429 		      &filterdata.f_dst.mask, &filterdata.f_dst.width)) {
430           filterdata.f_dsttype = addrtype(*argv);
431 	  argc--;
432 	  argv++;
433 	} else
434           filterdata.f_dsttype = T_ADDR;
435         if (argc) {
436 	  proto = filter_Nam2Proto(argc, argv);
437 	  if (proto == P_NONE) {
438             log_Printf(LogWARN, "Parse: %s: Invalid protocol\n", *argv);
439             return 0;
440           } else {
441 	    argc--;
442 	    argv++;
443 	  }
444 	}
445       } else {
446 	argc--;
447 	argv++;
448       }
449     } else {
450       log_Printf(LogWARN, "Parse: Address/protocol expected.\n");
451       return 0;
452     }
453   } else {
454     argc--;
455     argv++;
456   }
457 
458   val = 1;
459   filterdata.f_proto = proto;
460 
461   switch (proto) {
462   case P_TCP:
463     val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata);
464     break;
465   case P_UDP:
466     val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata);
467     break;
468   case P_ICMP:
469     val = ParseIcmp(argc, argv, &filterdata);
470     break;
471   case P_IGMP:
472     val = ParseIgmp(argc, argv, &filterdata);
473     break;
474 #ifdef P_OSPF
475   case P_OSPF:
476     val = ParseOspf(argc, argv, &filterdata);
477     break;
478 #endif
479 #ifdef P_GRE
480   case P_GRE:
481     val = ParseGRE(argc, argv, &filterdata);
482     break;
483 #endif
484   }
485 
486   log_Printf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.f_src.ipaddr));
487   log_Printf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.f_src.mask));
488   log_Printf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.f_dst.ipaddr));
489   log_Printf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.f_dst.mask));
490   log_Printf(LogDEBUG, "Parse: Proto = %d\n", proto);
491 
492   log_Printf(LogDEBUG, "Parse: src:  %s (%d)\n",
493             filter_Op2Nam(filterdata.f_srcop), filterdata.f_srcport);
494   log_Printf(LogDEBUG, "Parse: dst:  %s (%d)\n",
495             filter_Op2Nam(filterdata.f_dstop), filterdata.f_dstport);
496   log_Printf(LogDEBUG, "Parse: estab: %u\n", filterdata.f_estab);
497   log_Printf(LogDEBUG, "Parse: syn: %u\n", filterdata.f_syn);
498   log_Printf(LogDEBUG, "Parse: finrst: %u\n", filterdata.f_finrst);
499 
500   if (val)
501     *ofp = filterdata;
502 
503   return val;
504 }
505 
506 int
507 filter_Set(struct cmdargs const *arg)
508 {
509   struct filter *filter;
510 
511   if (arg->argc < arg->argn+2)
512     return -1;
513 
514   if (!strcmp(arg->argv[arg->argn], "in"))
515     filter = &arg->bundle->filter.in;
516   else if (!strcmp(arg->argv[arg->argn], "out"))
517     filter = &arg->bundle->filter.out;
518   else if (!strcmp(arg->argv[arg->argn], "dial"))
519     filter = &arg->bundle->filter.dial;
520   else if (!strcmp(arg->argv[arg->argn], "alive"))
521     filter = &arg->bundle->filter.alive;
522   else {
523     log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
524               arg->argv[arg->argn]);
525     return -1;
526   }
527 
528   Parse(&arg->bundle->ncp.ipcp, arg->argc - arg->argn - 1,
529         arg->argv + arg->argn + 1, filter->rule);
530   return 0;
531 }
532 
533 const char *
534 filter_Action2Nam(int act)
535 {
536   static const char * const actname[] = { "  none ", "permit ", "  deny " };
537   static char	buf[8];
538 
539   if (act >= 0 && act < MAXFILTERS) {
540     snprintf(buf, sizeof buf, "%6d ", act);
541     return buf;
542   } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
543     return actname[act - A_NONE];
544   else
545     return "?????? ";
546 }
547 
548 static void
549 doShowFilter(struct filterent *fp, struct prompt *prompt)
550 {
551   int n;
552 
553   for (n = 0; n < MAXFILTERS; n++, fp++) {
554     if (fp->f_action != A_NONE) {
555       prompt_Printf(prompt, "  %2d %s", n, filter_Action2Nam(fp->f_action));
556       prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
557       prompt_Printf(prompt, "%s%s ", addrstr(fp->f_src.ipaddr, fp->f_srctype),
558                     maskstr(fp->f_src.width));
559       prompt_Printf(prompt, "%s%s ", addrstr(fp->f_dst.ipaddr, fp->f_dsttype),
560                     maskstr(fp->f_dst.width));
561       if (fp->f_proto) {
562 	prompt_Printf(prompt, "%s", filter_Proto2Nam(fp->f_proto));
563 
564 	if (fp->f_srcop)
565 	  prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
566 		  fp->f_srcport);
567 	if (fp->f_dstop)
568 	  prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
569 		  fp->f_dstport);
570 	if (fp->f_estab)
571 	  prompt_Printf(prompt, " estab");
572 	if (fp->f_syn)
573 	  prompt_Printf(prompt, " syn");
574 	if (fp->f_finrst)
575 	  prompt_Printf(prompt, " finrst");
576       }
577       prompt_Printf(prompt, "\n");
578     }
579   }
580 }
581 
582 int
583 filter_Show(struct cmdargs const *arg)
584 {
585   if (arg->argc > arg->argn+1)
586     return -1;
587 
588   if (arg->argc == arg->argn+1) {
589     struct filter *filter;
590 
591     if (!strcmp(arg->argv[arg->argn], "in"))
592       filter = &arg->bundle->filter.in;
593     else if (!strcmp(arg->argv[arg->argn], "out"))
594       filter = &arg->bundle->filter.out;
595     else if (!strcmp(arg->argv[arg->argn], "dial"))
596       filter = &arg->bundle->filter.dial;
597     else if (!strcmp(arg->argv[arg->argn], "alive"))
598       filter = &arg->bundle->filter.alive;
599     else
600       return -1;
601     doShowFilter(filter->rule, arg->prompt);
602   } else {
603     struct filter *filter[4];
604     int f;
605 
606     filter[0] = &arg->bundle->filter.in;
607     filter[1] = &arg->bundle->filter.out;
608     filter[2] = &arg->bundle->filter.dial;
609     filter[3] = &arg->bundle->filter.alive;
610     for (f = 0; f < 4; f++) {
611       if (f)
612         prompt_Printf(arg->prompt, "\n");
613       prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
614       doShowFilter(filter[f]->rule, arg->prompt);
615     }
616   }
617 
618   return 0;
619 }
620 
621 static const char * const protoname[] = {
622   "none", "tcp", "udp", "icmp", "ospf", "igmp", "gre"
623 };
624 
625 const char *
626 filter_Proto2Nam(int proto)
627 {
628   if (proto >= sizeof protoname / sizeof protoname[0])
629     return "unknown";
630   return protoname[proto];
631 }
632 
633 static int
634 filter_Nam2Proto(int argc, char const *const *argv)
635 {
636   int proto;
637 
638   if (argc == 0)
639     proto = 0;
640   else
641     for (proto = sizeof protoname / sizeof protoname[0] - 1; proto; proto--)
642       if (!strcasecmp(*argv, protoname[proto]))
643         break;
644 
645   return proto;
646 }
647 
648 static const char * const opname[] = {"none", "eq", "gt", "lt"};
649 
650 const char *
651 filter_Op2Nam(int op)
652 {
653   if (op >= sizeof opname / sizeof opname[0])
654     return "unknown";
655   return opname[op];
656 
657 }
658 
659 static int
660 filter_Nam2Op(const char *cp)
661 {
662   int op;
663 
664   for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
665     if (!strcasecmp(cp, opname[op]))
666       break;
667 
668   return op;
669 }
670 
671 void
672 filter_AdjustAddr(struct filter *filter, struct in_addr *my_ip,
673                   struct in_addr *peer_ip)
674 {
675   struct filterent *fp;
676   int n;
677 
678   for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
679     if (fp->f_action != A_NONE) {
680       if (my_ip) {
681         if (fp->f_srctype == T_MYADDR)
682           fp->f_src.ipaddr = *my_ip;
683         if (fp->f_dsttype == T_MYADDR)
684           fp->f_dst.ipaddr = *my_ip;
685       }
686       if (peer_ip) {
687         if (fp->f_srctype == T_HISADDR)
688           fp->f_src.ipaddr = *peer_ip;
689         if (fp->f_dsttype == T_HISADDR)
690           fp->f_dst.ipaddr = *peer_ip;
691       }
692     }
693 }
694