contrib/ipfilter/ipt.c

   1 /*
   2  * Copyright (C) 1993-1998 by Darren Reed.
   3  *
   4  * Redistribution and use in source and binary forms are permitted
   5  * provided that this notice is preserved and due credit is given
   6  * to the original author and the contributors.
   7  */
   8 #ifdef  __FreeBSD__
   9 # include <osreldate.h>
  10 #endif
  11 #include <stdio.h>
  12 #include <assert.h>
  13 #include <string.h>
  14 #include <sys/types.h>
  15 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__sgi)
  16 #include <strings.h>
  17 #else
  18 #if !defined(__sgi)
  19 #include <sys/byteorder.h>
  20 #endif
  21 #include <sys/file.h>
  22 #endif
  23 #include <sys/param.h>
  24 #include <sys/time.h>
  25 #include <stdlib.h>
  26 #include <unistd.h>
  27 #include <stddef.h>
  28 #include <sys/socket.h>
  29 #include <sys/ioctl.h>
  30 #include <netinet/in.h>
  31 #include <netinet/in_systm.h>
  32 #ifndef linux
  33 #include <netinet/ip_var.h>
  34 #endif
  35 #include <netinet/ip.h>
  36 #include <netinet/udp.h>
  37 #include <netinet/tcp.h>
  38 #include <netinet/ip_icmp.h>
  39 #include <net/if.h>
  40 #if __FreeBSD_version >= 300000
  41 # include <net/if_var.h>
  42 #endif
  43 #include <netdb.h>
  44 #include <arpa/nameser.h>
  45 #include <arpa/inet.h>
  46 #include <resolv.h>
  47 #include <ctype.h>
  48 #include "ip_compat.h"
  49 #include <netinet/tcpip.h>
  50 #include "ip_fil.h"
  51 #include "ip_nat.h"
  52 #include "ip_state.h"
  53 #include "ipf.h"
  54 #include "ipt.h"
  55
  56 #if !defined(lint)
  57 static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-1996 Darren Reed";
  58 static const char rcsid[] = "@(#)$Id: ipt.c,v 2.1 1999/08/04 17:30:08 darrenr Exp $";
  59 #endif
  60
  61 extern  char    *optarg;
  62 extern  struct frentry  *ipfilter[2][2];
  63 extern  struct ipread   snoop, etherf, tcpd, pcap, iptext, iphex;
  64 extern  struct ifnet    *get_unit __P((char *));
  65 extern  void    init_ifp __P((void));
  66 extern  ipnat_t *natparse __P((char *, int));
  67
  68 int     opts = 0;
  69 int     main __P((int, char *[]));
  70
  71 int main(argc,argv)
  72 int argc;
  73 char *argv[];
  74 {
  75         struct  ipread  *r = &iptext;
  76         u_long  buf[2048];
  77         struct  ifnet   *ifp;
  78         char    *rules = NULL, *datain = NULL, *iface = NULL;
  79         ip_t    *ip;
  80         int     fd, i, dir = 0, c;
  81
  82         while ((c = getopt(argc, argv, "bdEHi:I:NoPr:STvX")) != -1)
  83                 switch (c)
  84                 {
  85                 case 'b' :
  86                         opts |= OPT_BRIEF;
  87                         break;
  88                 case 'd' :
  89                         opts |= OPT_DEBUG;
  90                         break;
  91                 case 'i' :
  92                         datain = optarg;
  93                         break;
  94                 case 'I' :
  95                         iface = optarg;
  96                         break;
  97                 case 'o' :
  98                         opts |= OPT_SAVEOUT;
  99                         break;
 100                 case 'r' :
 101                         rules = optarg;
 102                         break;
 103                 case 'v' :
 104                         opts |= OPT_VERBOSE;
 105                         break;
 106                 case 'E' :
 107                         r = &etherf;
 108                         break;
 109                 case 'H' :
 110                         r = &iphex;
 111                         break;
 112                 case 'N' :
 113                         opts |= OPT_NAT;
 114                         break;
 115                 case 'P' :
 116                         r = &pcap;
 117                         break;
 118                 case 'S' :
 119                         r = &snoop;
 120                         break;
 121                 case 'T' :
 122                         r = &tcpd;
 123                         break;
 124                 case 'X' :
 125                         r = &iptext;
 126                         break;
 127                 }
 128
 129         if (!rules) {
 130                 (void)fprintf(stderr,"no rule file present\n");
 131                 exit(-1);
 132         }
 133
 134         nat_init();
 135         fr_stateinit();
 136         initparse();
 137
 138         if (rules) {
 139                 char    line[513], *s;
 140                 void    *fr;
 141                 FILE    *fp;
 142                 int     linenum = 0;
 143
 144                 if (!strcmp(rules, "-"))
 145                         fp = stdin;
 146                 else if (!(fp = fopen(rules, "r"))) {
 147                         (void)fprintf(stderr, "couldn't open %s\n", rules);
 148                         exit(-1);
 149                 }
 150                 if (!(opts & OPT_BRIEF))
 151                         (void)printf("opening rule file \"%s\"\n", rules);
 152                 while (fgets(line, sizeof(line)-1, fp)) {
 153                         linenum++;
 154                         /*
 155                          * treat both CR and LF as EOL
 156                          */
 157                         if ((s = index(line, '\n')))
 158                                 *s = '\0';
 159                         if ((s = index(line, '\r')))
 160                                 *s = '\0';
 161                         /*
 162                          * # is comment marker, everything after is a ignored
 163                          */
 164                         if ((s = index(line, '#')))
 165                                 *s = '\0';
 166
 167                         if (!*line)
 168                                 continue;
 169
 170                         /* fake an `ioctl' call :) */
 171
 172                         if ((opts & OPT_NAT) != 0) {
 173                                 if (!(fr = natparse(line, linenum)))
 174                                         continue;
 175                                 i = IPL_EXTERN(ioctl)(IPL_LOGNAT, SIOCADNAT,
 176                                                       fr, FWRITE|FREAD);
 177                                 if (opts & OPT_DEBUG)
 178                                         fprintf(stderr,
 179                                                 "iplioctl(ADNAT,%p,1) = %d\n",
 180                                                 fr, i);
 181                         } else {
 182                                 if (!(fr = parse(line, linenum)))
 183                                         continue;
 184                                 i = IPL_EXTERN(ioctl)(0, SIOCADDFR, fr,
 185                                                       FWRITE|FREAD);
 186                                 if (opts & OPT_DEBUG)
 187                                         fprintf(stderr,
 188                                                 "iplioctl(ADDFR,%p,1) = %d\n",
 189                                                 fr, i);
 190                         }
 191                 }
 192                 (void)fclose(fp);
 193         }
 194
 195         if (opts & OPT_SAVEOUT)
 196                 init_ifp();
 197
 198         if (datain)
 199                 fd = (*r->r_open)(datain);
 200         else
 201                 fd = (*r->r_open)("-");
 202
 203         if (fd < 0)
 204                 exit(-1);
 205
 206         ip = (ip_t *)buf;
 207         while ((i = (*r->r_readip)((char *)buf, sizeof(buf),
 208                                     &iface, &dir)) > 0) {
 209                 ifp = iface ? get_unit(iface) : NULL;
 210                 ip->ip_off = ntohs(ip->ip_off);
 211                 ip->ip_len = ntohs(ip->ip_len);
 212                 i = fr_check(ip, ip->ip_hl << 2, ifp, dir, (mb_t **)&buf);
 213                 if ((opts & OPT_NAT) == 0)
 214                         switch (i)
 215                         {
 216                         case -2 :
 217                                 (void)printf("auth");
 218                                 break;
 219                         case -1 :
 220                                 (void)printf("block");
 221                                 break;
 222                         case 0 :
 223                                 (void)printf("pass");
 224                                 break;
 225                         case 1 :
 226                                 (void)printf("nomatch");
 227                                 break;
 228                         }
 229
 230                 if (!(opts & OPT_BRIEF)) {
 231                         putchar(' ');
 232                         printpacket((ip_t *)buf);
 233                         printf("--------------");
 234                 } else if ((opts & (OPT_BRIEF|OPT_NAT)) == (OPT_NAT|OPT_BRIEF))
 235                         printpacket((ip_t *)buf);
 236 #ifndef linux
 237                 if (dir && ifp && ip->ip_v)
 238 # ifdef __sgi
 239                         (*ifp->if_output)(ifp, (void *)buf, NULL);
 240 # else
 241                         (*ifp->if_output)(ifp, (void *)buf, NULL, 0);
 242 # endif
 243 #endif
 244                 if ((opts & (OPT_BRIEF|OPT_NAT)) != (OPT_NAT|OPT_BRIEF))
 245                         putchar('\n');
 246                 dir = 0;
 247         }
 248         (*r->r_close)();
 249         return 0;
 250 }