2 * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org>
3 * based on work by Toshiharu OHNO <tony-o@iij.ad.jp>
4 * Internet Initiative Japan, Inc (IIJ)
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 #include <sys/param.h>
32 #include <netinet/in.h>
33 #include <arpa/inet.h>
35 #include <netinet/in_systm.h>
36 #include <netinet/ip.h>
37 #include <sys/socket.h>
52 #include "throughput.h"
59 #include "slcompress.h"
64 #include "descriptor.h"
74 static int filter_Nam2Op(const char *);
77 ParsePort(const char *service, const char *proto)
79 struct servent *servent;
83 servent = getservbyname(service, proto);
85 return ntohs(servent->s_port);
87 port = strtol(service, &cp, 0);
89 log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
97 * ICMP Syntax: src eq icmp_message_type
100 ParseIcmp(int argc, char const *const *argv, const struct protoent *pe,
101 struct filterent *tgt)
108 /* permit/deny all ICMP types */
109 tgt->f_srcop = tgt->f_dstop = OP_NONE;
113 if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
114 type = strtol(argv[2], &cp, 0);
116 log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
119 tgt->f_srcop = OP_EQ;
120 tgt->f_srcport = type;
121 tgt->f_dstop = OP_NONE;
126 log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
133 * UDP Syntax: [src op port] [dst op port]
136 ParseUdpOrTcp(int argc, char const *const *argv, const struct protoent *pe,
137 struct filterent *tgt)
139 tgt->f_srcop = tgt->f_dstop = OP_NONE;
140 tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
142 if (argc >= 3 && !strcmp(*argv, "src")) {
143 tgt->f_srcop = filter_Nam2Op(argv[1]);
144 if (tgt->f_srcop == OP_NONE) {
145 log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
150 tgt->f_srcport = ParsePort(argv[2], pe->p_name);
151 if (tgt->f_srcport == 0)
157 if (argc >= 3 && !strcmp(argv[0], "dst")) {
158 tgt->f_dstop = filter_Nam2Op(argv[1]);
159 if (tgt->f_dstop == OP_NONE) {
160 log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
165 tgt->f_dstport = ParsePort(argv[2], pe->p_name);
166 if (tgt->f_dstport == 0)
172 if (pe && pe->p_proto == IPPROTO_TCP) {
173 for (; argc > 0; argc--, argv++)
174 if (!strcmp(*argv, "estab"))
176 else if (!strcmp(*argv, "syn"))
178 else if (!strcmp(*argv, "finrst"))
185 log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
193 ParseGeneric(int argc, char const * const *argv, const struct protoent *pe,
194 struct filterent *tgt)
197 * Filter currently is a catch-all. Requests are either permitted or
201 log_Printf(LogWARN, "ParseGeneric: Too many parameters\n");
204 tgt->f_srcop = tgt->f_dstop = OP_NONE;
210 addrtype(const char *addr)
212 if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
214 if (!strncasecmp(addr, "MYADDR6", 7) && (addr[7] == '\0' || addr[7] == '/'))
216 if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
218 if (!strncasecmp(addr, "HISADDR6", 8) && (addr[8] == '\0' || addr[8] == '/'))
220 if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/'))
222 if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/'))
229 addrstr(struct ncprange *addr, unsigned type)
241 return ncprange_ntoa(addr);
245 filter_Parse(struct ncp *ncp, int argc, char const *const *argv,
246 struct filterent *ofp)
251 int action, family, ruleno, val, width;
253 ruleno = strtol(*argv, &wp, 0);
254 if (*argv == wp || ruleno >= MAXFILTERS) {
255 log_Printf(LogWARN, "Parse: invalid filter number.\n");
259 for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
260 ofp->f_action = A_NONE;
263 log_Printf(LogWARN, "Parse: filter cleared.\n");
269 log_Printf(LogWARN, "Parse: missing action.\n");
274 memset(&fe, '\0', sizeof fe);
276 val = strtol(*argv, &wp, 0);
277 if (!*wp && val >= 0 && val < MAXFILTERS) {
279 log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
284 } else if (!strcmp(*argv, "permit")) {
286 } else if (!strcmp(*argv, "deny")) {
288 } else if (!strcmp(*argv, "clear")) {
289 ofp->f_action = A_NONE;
292 log_Printf(LogWARN, "Parse: %s: bad action\n", *argv);
295 fe.f_action = action;
300 if (argc && argv[0][0] == '!' && !argv[0][1]) {
306 ncprange_init(&fe.f_src);
307 ncprange_init(&fe.f_dst);
311 else if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
313 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
315 } else if (strcasecmp(*argv, "any") == 0 ||
316 ncprange_aton(&fe.f_src, ncp, *argv)) {
317 family = ncprange_family(&fe.f_src);
318 if (!ncprange_getwidth(&fe.f_src, &width))
321 ncprange_init(&fe.f_src);
322 fe.f_srctype = addrtype(*argv);
326 if (strcasecmp(*argv, "any") == 0 ||
327 ncprange_aton(&fe.f_dst, ncp, *argv)) {
328 if (ncprange_family(&fe.f_dst) != AF_UNSPEC &&
329 ncprange_family(&fe.f_src) != AF_UNSPEC &&
330 family != ncprange_family(&fe.f_dst)) {
331 log_Printf(LogWARN, "Parse: src and dst address families differ\n");
334 if (!ncprange_getwidth(&fe.f_dst, &width))
337 ncprange_init(&fe.f_dst);
338 fe.f_dsttype = addrtype(*argv);
342 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
347 if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
348 log_Printf(LogWARN, "Parse: %s: Protocol expected\n", *argv);
356 log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
364 if (argc >= 2 && strcmp(*argv, "timeout") == 0) {
365 fe.timeout = strtoul(argv[1], NULL, 10);
371 fe.f_proto = (pe == NULL) ? 0 : pe->p_proto;
373 switch (fe.f_proto) {
380 val = ParseUdpOrTcp(argc, argv, pe, &fe);
386 val = ParseIcmp(argc, argv, pe, &fe);
389 val = ParseGeneric(argc, argv, pe, &fe);
393 log_Printf(LogDEBUG, "Parse: Src: %s\n", ncprange_ntoa(&fe.f_src));
394 log_Printf(LogDEBUG, "Parse: Dst: %s\n", ncprange_ntoa(&fe.f_dst));
395 log_Printf(LogDEBUG, "Parse: Proto: %d\n", fe.f_proto);
397 log_Printf(LogDEBUG, "Parse: src: %s (%d)\n",
398 filter_Op2Nam(fe.f_srcop), fe.f_srcport);
399 log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n",
400 filter_Op2Nam(fe.f_dstop), fe.f_dstport);
401 log_Printf(LogDEBUG, "Parse: estab: %u\n", fe.f_estab);
402 log_Printf(LogDEBUG, "Parse: syn: %u\n", fe.f_syn);
403 log_Printf(LogDEBUG, "Parse: finrst: %u\n", fe.f_finrst);
412 filter_Set(struct cmdargs const *arg)
414 struct filter *filter;
416 if (arg->argc < arg->argn+2)
419 if (!strcmp(arg->argv[arg->argn], "in"))
420 filter = &arg->bundle->filter.in;
421 else if (!strcmp(arg->argv[arg->argn], "out"))
422 filter = &arg->bundle->filter.out;
423 else if (!strcmp(arg->argv[arg->argn], "dial"))
424 filter = &arg->bundle->filter.dial;
425 else if (!strcmp(arg->argv[arg->argn], "alive"))
426 filter = &arg->bundle->filter.alive;
428 log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
429 arg->argv[arg->argn]);
433 filter_Parse(&arg->bundle->ncp, arg->argc - arg->argn - 1,
434 arg->argv + arg->argn + 1, filter->rule);
439 filter_Action2Nam(int act)
441 static const char * const actname[] = { " none ", "permit ", " deny " };
444 if (act >= 0 && act < MAXFILTERS) {
445 snprintf(buf, sizeof buf, "%6d ", act);
447 } else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
448 return actname[act - A_NONE];
454 doShowFilter(struct filterent *fp, struct prompt *prompt)
459 for (n = 0; n < MAXFILTERS; n++, fp++) {
460 if (fp->f_action != A_NONE) {
461 prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action));
462 prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
464 if (ncprange_isset(&fp->f_src))
465 prompt_Printf(prompt, "%s ", addrstr(&fp->f_src, fp->f_srctype));
467 prompt_Printf(prompt, "any ");
469 if (ncprange_isset(&fp->f_dst))
470 prompt_Printf(prompt, "%s ", addrstr(&fp->f_dst, fp->f_dsttype));
472 prompt_Printf(prompt, "any ");
475 if ((pe = getprotobynumber(fp->f_proto)) == NULL)
476 prompt_Printf(prompt, "P:%d", fp->f_proto);
478 prompt_Printf(prompt, "%s", pe->p_name);
481 prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
484 prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
487 prompt_Printf(prompt, " estab");
489 prompt_Printf(prompt, " syn");
491 prompt_Printf(prompt, " finrst");
493 prompt_Printf(prompt, "all");
494 if (fp->timeout != 0)
495 prompt_Printf(prompt, " timeout %u", fp->timeout);
496 prompt_Printf(prompt, "\n");
502 filter_Show(struct cmdargs const *arg)
504 if (arg->argc > arg->argn+1)
507 if (arg->argc == arg->argn+1) {
508 struct filter *filter;
510 if (!strcmp(arg->argv[arg->argn], "in"))
511 filter = &arg->bundle->filter.in;
512 else if (!strcmp(arg->argv[arg->argn], "out"))
513 filter = &arg->bundle->filter.out;
514 else if (!strcmp(arg->argv[arg->argn], "dial"))
515 filter = &arg->bundle->filter.dial;
516 else if (!strcmp(arg->argv[arg->argn], "alive"))
517 filter = &arg->bundle->filter.alive;
520 doShowFilter(filter->rule, arg->prompt);
522 struct filter *filter[4];
525 filter[0] = &arg->bundle->filter.in;
526 filter[1] = &arg->bundle->filter.out;
527 filter[2] = &arg->bundle->filter.dial;
528 filter[3] = &arg->bundle->filter.alive;
529 for (f = 0; f < 4; f++) {
531 prompt_Printf(arg->prompt, "\n");
532 prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
533 doShowFilter(filter[f]->rule, arg->prompt);
540 static const char * const opname[] = {"none", "eq", "gt", "lt"};
543 filter_Op2Nam(int op)
545 if (op >= sizeof opname / sizeof opname[0])
552 filter_Nam2Op(const char *cp)
556 for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
557 if (!strcasecmp(cp, opname[op]))
564 filter_AdjustAddr(struct filter *filter, struct ncpaddr *local,
565 struct ncpaddr *remote, struct in_addr *dns)
567 struct filterent *fp;
570 for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
571 if (fp->f_action != A_NONE) {
573 if (fp->f_srctype == T_MYADDR && ncpaddr_family(local) == AF_INET)
574 ncprange_sethost(&fp->f_src, local);
575 if (fp->f_dsttype == T_MYADDR && ncpaddr_family(local) == AF_INET)
576 ncprange_sethost(&fp->f_dst, local);
578 if (fp->f_srctype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
579 ncprange_sethost(&fp->f_src, local);
580 if (fp->f_dsttype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
581 ncprange_sethost(&fp->f_dst, local);
585 if (fp->f_srctype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
586 ncprange_sethost(&fp->f_src, remote);
587 if (fp->f_dsttype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
588 ncprange_sethost(&fp->f_dst, remote);
590 if (fp->f_srctype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
591 ncprange_sethost(&fp->f_src, remote);
592 if (fp->f_dsttype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
593 ncprange_sethost(&fp->f_dst, remote);
597 if (fp->f_srctype == T_DNS0)
598 ncprange_setip4host(&fp->f_src, dns[0]);
599 if (fp->f_dsttype == T_DNS0)
600 ncprange_setip4host(&fp->f_dst, dns[0]);
601 if (fp->f_srctype == T_DNS1)
602 ncprange_setip4host(&fp->f_src, dns[1]);
603 if (fp->f_dsttype == T_DNS1)
604 ncprange_setip4host(&fp->f_dst, dns[1]);