1 /* 2 * Copyright (C) 1993-2005 by Darren Reed. 3 * See the IPFILTER.LICENCE file for details on licencing. 4 */ 5 6 %{ 7 #include "ipf.h" 8 #include <syslog.h> 9 #undef OPT_NAT 10 #undef OPT_VERBOSE 11 #include "ipmon_l.h" 12 #include "ipmon.h" 13 14 #define YYDEBUG 1 15 16 extern int yyerror __P((const char *)); 17 extern int yyparse __P((void)); 18 extern int yylex __P((void)); 19 extern int yydebug; 20 extern FILE *yyin; 21 extern int yylineNum; 22 23 typedef struct opt { 24 struct opt *o_next; 25 int o_line; 26 int o_type; 27 int o_num; 28 char *o_str; 29 struct in_addr o_ip; 30 } opt_t; 31 32 static void build_action __P((struct opt *)); 33 static opt_t *new_opt __P((int)); 34 static void free_action __P((ipmon_action_t *)); 35 36 static ipmon_action_t *alist = NULL; 37 %} 38 39 %union { 40 char *str; 41 u_32_t num; 42 struct in_addr addr; 43 struct opt *opt; 44 union i6addr ip6; 45 } 46 47 %token <num> YY_NUMBER YY_HEX 48 %token <str> YY_STR 49 %token <ip6> YY_IPV6 50 %token YY_COMMENT 51 %token YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT 52 %token YY_RANGE_OUT YY_RANGE_IN 53 54 %token IPM_MATCH IPM_BODY IPM_COMMENT IPM_DIRECTION IPM_DSTIP IPM_DSTPORT 55 %token IPM_EVERY IPM_EXECUTE IPM_GROUP IPM_INTERFACE IPM_IN IPM_NO IPM_OUT 56 %token IPM_PACKET IPM_PACKETS IPM_POOL IPM_PROTOCOL IPM_RESULT IPM_RULE 57 %token IPM_SECOND IPM_SECONDS IPM_SRCIP IPM_SRCPORT IPM_LOGTAG IPM_WITH 58 %token IPM_DO IPM_SAVE IPM_SYSLOG IPM_NOTHING IPM_RAW IPM_TYPE IPM_NAT 59 %token IPM_STATE IPM_NATTAG IPM_IPF 60 %type <addr> ipv4 61 %type <opt> direction dstip dstport every execute group interface 62 %type <opt> protocol result rule srcip srcport logtag matching 63 %type <opt> matchopt nattag type doopt doing save syslog nothing 64 %type <num> saveopts saveopt typeopt 65 66 %% 67 file: line 68 | assign 69 | file line 70 | file assign 71 ; 72 73 line: IPM_MATCH '{' matching '}' IPM_DO '{' doing '}' ';' 74 { build_action($3); resetlexer(); } 75 | IPM_COMMENT 76 | YY_COMMENT 77 ; 78 79 assign: YY_STR assigning YY_STR ';' { set_variable($1, $3); 80 resetlexer(); 81 free($1); 82 free($3); 83 } 84 ; 85 86 assigning: 87 '=' { yyvarnext = 1; } 88 ; 89 90 matching: 91 matchopt { $$ = $1; } 92 | matchopt ',' matching { $1->o_next = $3; $$ = $1; } 93 ; 94 95 matchopt: 96 direction { $$ = $1; } 97 | dstip { $$ = $1; } 98 | dstport { $$ = $1; } 99 | every { $$ = $1; } 100 | group { $$ = $1; } 101 | interface { $$ = $1; } 102 | protocol { $$ = $1; } 103 | result { $$ = $1; } 104 | rule { $$ = $1; } 105 | srcip { $$ = $1; } 106 | srcport { $$ = $1; } 107 | logtag { $$ = $1; } 108 | nattag { $$ = $1; } 109 | type { $$ = $1; } 110 ; 111 112 doing: 113 doopt { $$ = $1; } 114 | doopt ',' doing { $1->o_next = $3; $$ = $1; } 115 ; 116 117 doopt: 118 execute { $$ = $1; } 119 | save { $$ = $1; } 120 | syslog { $$ = $1; } 121 | nothing { $$ = $1; } 122 ; 123 124 direction: 125 IPM_DIRECTION '=' IPM_IN { $$ = new_opt(IPM_DIRECTION); 126 $$->o_num = IPM_IN; } 127 | IPM_DIRECTION '=' IPM_OUT { $$ = new_opt(IPM_DIRECTION); 128 $$->o_num = IPM_OUT; } 129 ; 130 131 dstip: IPM_DSTIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_DSTIP); 132 $$->o_ip = $3; 133 $$->o_num = $5; } 134 ; 135 136 dstport: 137 IPM_DSTPORT '=' YY_NUMBER { $$ = new_opt(IPM_DSTPORT); 138 $$->o_num = $3; } 139 | IPM_DSTPORT '=' YY_STR { $$ = new_opt(IPM_DSTPORT); 140 $$->o_str = $3; } 141 ; 142 143 every: IPM_EVERY IPM_SECOND { $$ = new_opt(IPM_SECOND); 144 $$->o_num = 1; } 145 | IPM_EVERY YY_NUMBER IPM_SECONDS { $$ = new_opt(IPM_SECOND); 146 $$->o_num = $2; } 147 | IPM_EVERY IPM_PACKET { $$ = new_opt(IPM_PACKET); 148 $$->o_num = 1; } 149 | IPM_EVERY YY_NUMBER IPM_PACKETS { $$ = new_opt(IPM_PACKET); 150 $$->o_num = $2; } 151 ; 152 153 group: IPM_GROUP '=' YY_NUMBER { $$ = new_opt(IPM_GROUP); 154 $$->o_num = $3; } 155 | IPM_GROUP '=' YY_STR { $$ = new_opt(IPM_GROUP); 156 $$->o_str = $3; } 157 ; 158 159 interface: 160 IPM_INTERFACE '=' YY_STR { $$ = new_opt(IPM_INTERFACE); 161 $$->o_str = $3; } 162 ; 163 164 logtag: IPM_LOGTAG '=' YY_NUMBER { $$ = new_opt(IPM_LOGTAG); 165 $$->o_num = $3; } 166 ; 167 168 nattag: IPM_NATTAG '=' YY_STR { $$ = new_opt(IPM_NATTAG); 169 $$->o_str = $3; } 170 ; 171 172 protocol: 173 IPM_PROTOCOL '=' YY_NUMBER { $$ = new_opt(IPM_PROTOCOL); 174 $$->o_num = $3; } 175 | IPM_PROTOCOL '=' YY_STR { $$ = new_opt(IPM_PROTOCOL); 176 $$->o_num = getproto($3); 177 free($3); 178 } 179 ; 180 181 result: IPM_RESULT '=' YY_STR { $$ = new_opt(IPM_RESULT); 182 $$->o_str = $3; } 183 ; 184 185 rule: IPM_RULE '=' YY_NUMBER { $$ = new_opt(IPM_RULE); 186 $$->o_num = YY_NUMBER; } 187 ; 188 189 srcip: IPM_SRCIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_SRCIP); 190 $$->o_ip = $3; 191 $$->o_num = $5; } 192 ; 193 194 srcport: 195 IPM_SRCPORT '=' YY_NUMBER { $$ = new_opt(IPM_SRCPORT); 196 $$->o_num = $3; } 197 | IPM_SRCPORT '=' YY_STR { $$ = new_opt(IPM_SRCPORT); 198 $$->o_str = $3; } 199 ; 200 201 type: IPM_TYPE '=' typeopt { $$ = new_opt(IPM_TYPE); 202 $$->o_num = $3; } 203 ; 204 205 typeopt: 206 IPM_IPF { $$ = IPL_MAGIC; } 207 | IPM_NAT { $$ = IPL_MAGIC_NAT; } 208 | IPM_STATE { $$ = IPL_MAGIC_STATE; } 209 ; 210 211 execute: 212 IPM_EXECUTE YY_STR { $$ = new_opt(IPM_EXECUTE); 213 $$->o_str = $2; } 214 ; 215 216 save: IPM_SAVE saveopts YY_STR { $$ = new_opt(IPM_SAVE); 217 $$->o_num = $2; 218 $$->o_str = $3; } 219 ; 220 221 saveopts: { $$ = 0; } 222 | saveopt { $$ = $1; } 223 | saveopt ',' saveopts { $$ = $1 | $3; } 224 ; 225 226 saveopt: 227 IPM_RAW { $$ = IPMDO_SAVERAW; } 228 ; 229 230 syslog: IPM_SYSLOG { $$ = new_opt(IPM_SYSLOG); } 231 ; 232 233 nothing: 234 IPM_NOTHING { $$ = 0; } 235 ; 236 237 ipv4: YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER 238 { if ($1 > 255 || $3 > 255 || $5 > 255 || $7 > 255) { 239 yyerror("Invalid octet string for IP address"); 240 return 0; 241 } 242 $$.s_addr = ($1 << 24) | ($3 << 16) | ($5 << 8) | $7; 243 $$.s_addr = htonl($$.s_addr); 244 } 245 %% 246 static struct wordtab yywords[] = { 247 { "body", IPM_BODY }, 248 { "direction", IPM_DIRECTION }, 249 { "do", IPM_DO }, 250 { "dstip", IPM_DSTIP }, 251 { "dstport", IPM_DSTPORT }, 252 { "every", IPM_EVERY }, 253 { "execute", IPM_EXECUTE }, 254 { "group", IPM_GROUP }, 255 { "in", IPM_IN }, 256 { "interface", IPM_INTERFACE }, 257 { "ipf", IPM_IPF }, 258 { "logtag", IPM_LOGTAG }, 259 { "match", IPM_MATCH }, 260 { "nat", IPM_NAT }, 261 { "nattag", IPM_NATTAG }, 262 { "no", IPM_NO }, 263 { "nothing", IPM_NOTHING }, 264 { "out", IPM_OUT }, 265 { "packet", IPM_PACKET }, 266 { "packets", IPM_PACKETS }, 267 { "protocol", IPM_PROTOCOL }, 268 { "result", IPM_RESULT }, 269 { "rule", IPM_RULE }, 270 { "save", IPM_SAVE }, 271 { "raw", IPM_RAW }, 272 { "second", IPM_SECOND }, 273 { "seconds", IPM_SECONDS }, 274 { "srcip", IPM_SRCIP }, 275 { "srcport", IPM_SRCPORT }, 276 { "state", IPM_STATE }, 277 { "syslog", IPM_SYSLOG }, 278 { "with", IPM_WITH }, 279 { NULL, 0 } 280 }; 281 282 static int macflags[17][2] = { 283 { IPM_DIRECTION, IPMAC_DIRECTION }, 284 { IPM_DSTIP, IPMAC_DSTIP }, 285 { IPM_DSTPORT, IPMAC_DSTPORT }, 286 { IPM_GROUP, IPMAC_GROUP }, 287 { IPM_INTERFACE, IPMAC_INTERFACE }, 288 { IPM_LOGTAG, IPMAC_LOGTAG }, 289 { IPM_NATTAG, IPMAC_NATTAG }, 290 { IPM_PACKET, IPMAC_EVERY }, 291 { IPM_PROTOCOL, IPMAC_PROTOCOL }, 292 { IPM_RESULT, IPMAC_RESULT }, 293 { IPM_RULE, IPMAC_RULE }, 294 { IPM_SECOND, IPMAC_EVERY }, 295 { IPM_SRCIP, IPMAC_SRCIP }, 296 { IPM_SRCPORT, IPMAC_SRCPORT }, 297 { IPM_TYPE, IPMAC_TYPE }, 298 { IPM_WITH, IPMAC_WITH }, 299 { 0, 0 } 300 }; 301 302 static opt_t *new_opt(type) 303 int type; 304 { 305 opt_t *o; 306 307 o = (opt_t *)malloc(sizeof(*o)); 308 if (o == NULL) 309 yyerror("sorry, out of memory"); 310 o->o_type = type; 311 o->o_line = yylineNum; 312 o->o_num = 0; 313 o->o_str = (char *)0; 314 o->o_next = NULL; 315 return o; 316 } 317 318 static void build_action(olist) 319 opt_t *olist; 320 { 321 ipmon_action_t *a; 322 opt_t *o; 323 char c; 324 int i; 325 326 a = (ipmon_action_t *)calloc(1, sizeof(*a)); 327 if (a == NULL) 328 return; 329 while ((o = olist) != NULL) { 330 /* 331 * Check to see if the same comparator is being used more than 332 * once per matching statement. 333 */ 334 for (i = 0; macflags[i][0]; i++) 335 if (macflags[i][0] == o->o_type) 336 break; 337 if (macflags[i][1] & a->ac_mflag) { 338 fprintf(stderr, "%s redfined on line %d\n", 339 yykeytostr(o->o_type), yylineNum); 340 if (o->o_str != NULL) 341 free(o->o_str); 342 olist = o->o_next; 343 free(o); 344 continue; 345 } 346 347 a->ac_mflag |= macflags[i][1]; 348 349 switch (o->o_type) 350 { 351 case IPM_DIRECTION : 352 a->ac_direction = o->o_num; 353 break; 354 case IPM_DSTIP : 355 a->ac_dip = o->o_ip.s_addr; 356 a->ac_dmsk = htonl(0xffffffff << (32 - o->o_num)); 357 break; 358 case IPM_DSTPORT : 359 a->ac_dport = htons(o->o_num); 360 break; 361 case IPM_EXECUTE : 362 a->ac_exec = o->o_str; 363 c = *o->o_str; 364 if (c== '"'|| c == '\'') { 365 if (o->o_str[strlen(o->o_str) - 1] == c) { 366 a->ac_run = strdup(o->o_str + 1); 367 a->ac_run[strlen(a->ac_run) - 1] ='\0'; 368 } else 369 a->ac_run = o->o_str; 370 } else 371 a->ac_run = o->o_str; 372 o->o_str = NULL; 373 break; 374 case IPM_INTERFACE : 375 a->ac_iface = o->o_str; 376 o->o_str = NULL; 377 break; 378 case IPM_GROUP : 379 if (o->o_str != NULL) 380 strncpy(a->ac_group, o->o_str, FR_GROUPLEN); 381 else 382 sprintf(a->ac_group, "%d", o->o_num); 383 break; 384 case IPM_LOGTAG : 385 a->ac_logtag = o->o_num; 386 break; 387 case IPM_NATTAG : 388 strncpy(a->ac_nattag, o->o_str, sizeof(a->ac_nattag)); 389 break; 390 case IPM_PACKET : 391 a->ac_packet = o->o_num; 392 break; 393 case IPM_PROTOCOL : 394 a->ac_proto = o->o_num; 395 break; 396 case IPM_RULE : 397 a->ac_rule = o->o_num; 398 break; 399 case IPM_RESULT : 400 if (!strcasecmp(o->o_str, "pass")) 401 a->ac_result = IPMR_PASS; 402 else if (!strcasecmp(o->o_str, "block")) 403 a->ac_result = IPMR_BLOCK; 404 else if (!strcasecmp(o->o_str, "nomatch")) 405 a->ac_result = IPMR_NOMATCH; 406 else if (!strcasecmp(o->o_str, "log")) 407 a->ac_result = IPMR_LOG; 408 break; 409 case IPM_SECOND : 410 a->ac_second = o->o_num; 411 break; 412 case IPM_SRCIP : 413 a->ac_sip = o->o_ip.s_addr; 414 a->ac_smsk = htonl(0xffffffff << (32 - o->o_num)); 415 break; 416 case IPM_SRCPORT : 417 a->ac_sport = htons(o->o_num); 418 break; 419 case IPM_SAVE : 420 if (a->ac_savefile != NULL) { 421 fprintf(stderr, "%s redfined on line %d\n", 422 yykeytostr(o->o_type), yylineNum); 423 break; 424 } 425 a->ac_savefile = strdup(o->o_str); 426 a->ac_savefp = fopen(o->o_str, "a"); 427 a->ac_dflag |= o->o_num & IPMDO_SAVERAW; 428 break; 429 case IPM_SYSLOG : 430 if (a->ac_syslog != 0) { 431 fprintf(stderr, "%s redfined on line %d\n", 432 yykeytostr(o->o_type), yylineNum); 433 break; 434 } 435 a->ac_syslog = 1; 436 break; 437 case IPM_TYPE : 438 a->ac_type = o->o_num; 439 break; 440 case IPM_WITH : 441 break; 442 default : 443 break; 444 } 445 446 olist = o->o_next; 447 if (o->o_str != NULL) 448 free(o->o_str); 449 free(o); 450 } 451 a->ac_next = alist; 452 alist = a; 453 } 454 455 456 int check_action(buf, log, opts, lvl) 457 char *buf, *log; 458 int opts, lvl; 459 { 460 ipmon_action_t *a; 461 struct timeval tv; 462 ipflog_t *ipf; 463 tcphdr_t *tcp; 464 iplog_t *ipl; 465 int matched; 466 u_long t1; 467 ip_t *ip; 468 469 matched = 0; 470 ipl = (iplog_t *)buf; 471 ipf = (ipflog_t *)(ipl +1); 472 ip = (ip_t *)(ipf + 1); 473 tcp = (tcphdr_t *)((char *)ip + (IP_HL(ip) << 2)); 474 475 for (a = alist; a != NULL; a = a->ac_next) { 476 if ((a->ac_mflag & IPMAC_DIRECTION) != 0) { 477 if (a->ac_direction == IPM_IN) { 478 if ((ipf->fl_flags & FR_INQUE) == 0) 479 continue; 480 } else if (a->ac_direction == IPM_OUT) { 481 if ((ipf->fl_flags & FR_OUTQUE) == 0) 482 continue; 483 } 484 } 485 486 if ((a->ac_type != 0) && (a->ac_type != ipl->ipl_magic)) 487 continue; 488 489 if ((a->ac_mflag & IPMAC_EVERY) != 0) { 490 gettimeofday(&tv, NULL); 491 t1 = tv.tv_sec - a->ac_lastsec; 492 if (tv.tv_usec <= a->ac_lastusec) 493 t1--; 494 if (a->ac_second != 0) { 495 if (t1 < a->ac_second) 496 continue; 497 a->ac_lastsec = tv.tv_sec; 498 a->ac_lastusec = tv.tv_usec; 499 } 500 501 if (a->ac_packet != 0) { 502 if (a->ac_pktcnt == 0) 503 a->ac_pktcnt++; 504 else if (a->ac_pktcnt == a->ac_packet) { 505 a->ac_pktcnt = 0; 506 continue; 507 } else { 508 a->ac_pktcnt++; 509 continue; 510 } 511 } 512 } 513 514 if ((a->ac_mflag & IPMAC_DSTIP) != 0) { 515 if ((ip->ip_dst.s_addr & a->ac_dmsk) != a->ac_dip) 516 continue; 517 } 518 519 if ((a->ac_mflag & IPMAC_DSTPORT) != 0) { 520 if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP) 521 continue; 522 if (tcp->th_dport != a->ac_dport) 523 continue; 524 } 525 526 if ((a->ac_mflag & IPMAC_GROUP) != 0) { 527 if (strncmp(a->ac_group, ipf->fl_group, 528 FR_GROUPLEN) != 0) 529 continue; 530 } 531 532 if ((a->ac_mflag & IPMAC_INTERFACE) != 0) { 533 if (strcmp(a->ac_iface, ipf->fl_ifname)) 534 continue; 535 } 536 537 if ((a->ac_mflag & IPMAC_PROTOCOL) != 0) { 538 if (a->ac_proto != ip->ip_p) 539 continue; 540 } 541 542 if ((a->ac_mflag & IPMAC_RESULT) != 0) { 543 if ((ipf->fl_flags & FF_LOGNOMATCH) != 0) { 544 if (a->ac_result != IPMR_NOMATCH) 545 continue; 546 } else if (FR_ISPASS(ipf->fl_flags)) { 547 if (a->ac_result != IPMR_PASS) 548 continue; 549 } else if (FR_ISBLOCK(ipf->fl_flags)) { 550 if (a->ac_result != IPMR_BLOCK) 551 continue; 552 } else { /* Log only */ 553 if (a->ac_result != IPMR_LOG) 554 continue; 555 } 556 } 557 558 if ((a->ac_mflag & IPMAC_RULE) != 0) { 559 if (a->ac_rule != ipf->fl_rule) 560 continue; 561 } 562 563 if ((a->ac_mflag & IPMAC_SRCIP) != 0) { 564 if ((ip->ip_src.s_addr & a->ac_smsk) != a->ac_sip) 565 continue; 566 } 567 568 if ((a->ac_mflag & IPMAC_SRCPORT) != 0) { 569 if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP) 570 continue; 571 if (tcp->th_sport != a->ac_sport) 572 continue; 573 } 574 575 if ((a->ac_mflag & IPMAC_LOGTAG) != 0) { 576 if (a->ac_logtag != ipf->fl_logtag) 577 continue; 578 } 579 580 if ((a->ac_mflag & IPMAC_NATTAG) != 0) { 581 if (strncmp(a->ac_nattag, ipf->fl_nattag.ipt_tag, 582 IPFTAG_LEN) != 0) 583 continue; 584 } 585 586 matched = 1; 587 588 /* 589 * It matched so now execute the command 590 */ 591 if (a->ac_syslog != 0) { 592 syslog(lvl, "%s", log); 593 } 594 595 if (a->ac_savefp != NULL) { 596 if (a->ac_dflag & IPMDO_SAVERAW) 597 fwrite(ipl, 1, ipl->ipl_dsize, a->ac_savefp); 598 else 599 fputs(log, a->ac_savefp); 600 } 601 602 if (a->ac_exec != NULL) { 603 switch (fork()) 604 { 605 case 0 : 606 { 607 FILE *pi; 608 609 pi = popen(a->ac_run, "w"); 610 if (pi != NULL) { 611 fprintf(pi, "%s\n", log); 612 if ((opts & OPT_HEXHDR) != 0) { 613 dumphex(pi, 0, buf, 614 sizeof(*ipl) + 615 sizeof(*ipf)); 616 } 617 if ((opts & OPT_HEXBODY) != 0) { 618 dumphex(pi, 0, (char *)ip, 619 ipf->fl_hlen + 620 ipf->fl_plen); 621 } 622 pclose(pi); 623 } 624 exit(1); 625 } 626 case -1 : 627 break; 628 default : 629 break; 630 } 631 } 632 } 633 634 return matched; 635 } 636 637 638 static void free_action(a) 639 ipmon_action_t *a; 640 { 641 if (a->ac_savefile != NULL) { 642 free(a->ac_savefile); 643 a->ac_savefile = NULL; 644 } 645 if (a->ac_savefp != NULL) { 646 fclose(a->ac_savefp); 647 a->ac_savefp = NULL; 648 } 649 if (a->ac_exec != NULL) { 650 free(a->ac_exec); 651 if (a->ac_run == a->ac_exec) 652 a->ac_run = NULL; 653 a->ac_exec = NULL; 654 } 655 if (a->ac_run != NULL) { 656 free(a->ac_run); 657 a->ac_run = NULL; 658 } 659 if (a->ac_iface != NULL) { 660 free(a->ac_iface); 661 a->ac_iface = NULL; 662 } 663 a->ac_next = NULL; 664 free(a); 665 } 666 667 668 int load_config(file) 669 char *file; 670 { 671 ipmon_action_t *a; 672 FILE *fp; 673 char *s; 674 675 s = getenv("YYDEBUG"); 676 if (s != NULL) 677 yydebug = atoi(s); 678 else 679 yydebug = 0; 680 681 while ((a = alist) != NULL) { 682 alist = a->ac_next; 683 free_action(a); 684 } 685 686 yylineNum = 1; 687 688 (void) yysettab(yywords); 689 690 fp = fopen(file, "r"); 691 if (!fp) { 692 perror("load_config:fopen:"); 693 return -1; 694 } 695 yyin = fp; 696 while (!feof(fp)) 697 yyparse(); 698 fclose(fp); 699 return 0; 700 } 701