1 /* $OpenBSD: tcpdrop.c,v 1.4 2004/05/22 23:55:22 deraadt Exp $ */
4 * Copyright (c) 2009 Juli Mallett <jmallett@FreeBSD.org>
5 * Copyright (c) 2004 Markus Friedl <markus@openbsd.org>
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
23 #include <sys/param.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
26 #include <sys/socketvar.h>
27 #include <sys/sysctl.h>
29 #include <netinet/in.h>
30 #include <netinet/in_pcb.h>
32 #include <netinet/tcp_fsm.h>
33 #include <netinet/tcp_var.h>
43 #define TCPDROP_FOREIGN 0
44 #define TCPDROP_LOCAL 1
47 char hs_host[NI_MAXHOST];
48 char hs_service[NI_MAXSERV];
51 static bool tcpdrop_list_commands = false;
53 static char *findport(const char *);
54 static struct xinpgen *getxpcblist(const char *);
55 static void sockinfo(const struct sockaddr *, struct host_service *);
56 static bool tcpdrop(const struct sockaddr *, const struct sockaddr *);
57 static bool tcpdropall(const char *, const char *, int);
58 static bool tcpdropbyname(const char *, const char *, const char *,
60 static bool tcpdropconn(const struct in_conninfo *);
61 static void usage(void);
64 * Drop a tcp connection.
67 main(int argc, char *argv[])
69 char stack[TCP_FUNCTION_NAME_LEN_MAX];
70 char ca_name[TCP_CA_NAME_MAX];
72 bool dropall, dropspecific;
81 while ((ch = getopt(argc, argv, "aC:lS:s:")) != -1) {
88 strlcpy(ca_name, optarg, sizeof(ca_name));
91 tcpdrop_list_commands = true;
95 strlcpy(stack, optarg, sizeof(stack));
99 for (state = 0; state < TCP_NSTATES; state++) {
100 if (strcmp(tcpstates[state], optarg) == 0)
111 if (state == TCP_NSTATES ||
112 state == TCPS_CLOSED ||
113 state == TCPS_LISTEN)
115 if (dropall && dropspecific)
117 if (dropall || dropspecific) {
120 if (!tcpdropall(ca_name, stack, state))
125 if ((argc != 2 && argc != 4) || tcpdrop_list_commands)
129 lport = findport(argv[0]);
130 fport = findport(argv[1]);
131 if (lport == NULL || lport[1] == '\0' || fport == NULL ||
136 if (!tcpdropbyname(argv[0], lport, argv[1], fport))
138 } else if (!tcpdropbyname(argv[0], argv[1], argv[2], argv[3]))
145 findport(const char *arg)
149 /* A strrspn() or strrpbrk() would be nice. */
150 dot = strrchr(arg, '.');
151 colon = strrchr(arg, ':');
162 static struct xinpgen *
163 getxpcblist(const char *name)
165 struct xinpgen *xinp;
170 rv = sysctlbyname(name, NULL, &len, NULL, 0);
172 err(1, "sysctlbyname %s", name);
175 errx(1, "%s is empty", name);
179 errx(1, "malloc failed");
181 rv = sysctlbyname(name, xinp, &len, NULL, 0);
183 err(1, "sysctlbyname %s", name);
189 sockinfo(const struct sockaddr *sa, struct host_service *hs)
191 static const int flags = NI_NUMERICHOST | NI_NUMERICSERV;
194 rv = getnameinfo(sa, sa->sa_len, hs->hs_host, sizeof hs->hs_host,
195 hs->hs_service, sizeof hs->hs_service, flags);
197 err(1, "getnameinfo");
201 tcpdrop(const struct sockaddr *lsa, const struct sockaddr *fsa)
203 struct host_service local, foreign;
204 struct sockaddr_storage addrs[2];
207 memcpy(&addrs[TCPDROP_FOREIGN], fsa, fsa->sa_len);
208 memcpy(&addrs[TCPDROP_LOCAL], lsa, lsa->sa_len);
210 sockinfo(lsa, &local);
211 sockinfo(fsa, &foreign);
213 if (tcpdrop_list_commands) {
214 printf("tcpdrop %s %s %s %s\n", local.hs_host, local.hs_service,
215 foreign.hs_host, foreign.hs_service);
219 rv = sysctlbyname("net.inet.tcp.drop", NULL, NULL, &addrs,
222 warn("%s %s %s %s", local.hs_host, local.hs_service,
223 foreign.hs_host, foreign.hs_service);
226 printf("%s %s %s %s: dropped\n", local.hs_host, local.hs_service,
227 foreign.hs_host, foreign.hs_service);
232 tcpdropall(const char *ca_name, const char *stack, int state)
234 struct xinpgen *head, *xinp;
241 head = getxpcblist("net.inet.tcp.pcblist");
243 #define XINP_NEXT(xinp) \
244 ((struct xinpgen *)(uintptr_t)((uintptr_t)(xinp) + (xinp)->xig_len))
246 for (xinp = XINP_NEXT(head); xinp->xig_len > sizeof *xinp;
247 xinp = XINP_NEXT(xinp)) {
248 xtp = (struct xtcpcb *)xinp;
253 * Check protocol, support just v4 or v6, etc.
256 /* Ignore PCBs which were freed during copyout. */
257 if (xip->inp_gencnt > head->xig_gen)
260 /* Skip listening sockets. */
261 if (xtp->t_state == TCPS_LISTEN)
264 /* If requested, skip sockets not having the requested state. */
265 if ((state != -1) && (xtp->t_state != state))
269 * If requested, skip sockets not having the requested
270 * congestion control algorithm.
272 if (ca_name[0] != '\0' &&
273 strncmp(xtp->xt_cc, ca_name, TCP_CA_NAME_MAX))
276 /* If requested, skip sockets not having the requested stack. */
277 if (stack[0] != '\0' &&
278 strncmp(xtp->xt_stack, stack, TCP_FUNCTION_NAME_LEN_MAX))
281 if (!tcpdropconn(&xip->inp_inc))
290 tcpdropbyname(const char *lhost, const char *lport, const char *fhost,
293 static const struct addrinfo hints = {
295 * Look for TCP streams in all domains.
297 .ai_family = AF_UNSPEC,
298 .ai_socktype = SOCK_STREAM,
299 .ai_protocol = IPPROTO_TCP,
301 struct addrinfo *ail, *local, *aif, *foreign;
305 error = getaddrinfo(lhost, lport, &hints, &local);
307 errx(1, "getaddrinfo: %s port %s: %s", lhost, lport,
308 gai_strerror(error));
310 error = getaddrinfo(fhost, fport, &hints, &foreign);
312 freeaddrinfo(local); /* XXX gratuitous */
313 errx(1, "getaddrinfo: %s port %s: %s", fhost, fport,
314 gai_strerror(error));
321 * Try every combination of local and foreign address pairs.
323 for (ail = local; ail != NULL; ail = ail->ai_next) {
324 for (aif = foreign; aif != NULL; aif = aif->ai_next) {
325 if (ail->ai_family != aif->ai_family)
328 if (!tcpdrop(ail->ai_addr, aif->ai_addr))
334 warnx("%s %s %s %s: different address families", lhost, lport,
340 freeaddrinfo(foreign);
346 tcpdropconn(const struct in_conninfo *inc)
348 struct sockaddr *local, *foreign;
349 struct sockaddr_in6 sin6[2];
350 struct sockaddr_in sin4[2];
352 if ((inc->inc_flags & INC_ISIPV6) != 0) {
353 memset(sin6, 0, sizeof sin6);
355 sin6[TCPDROP_LOCAL].sin6_len = sizeof sin6[TCPDROP_LOCAL];
356 sin6[TCPDROP_LOCAL].sin6_family = AF_INET6;
357 sin6[TCPDROP_LOCAL].sin6_port = inc->inc_lport;
358 memcpy(&sin6[TCPDROP_LOCAL].sin6_addr, &inc->inc6_laddr,
359 sizeof inc->inc6_laddr);
360 local = (struct sockaddr *)&sin6[TCPDROP_LOCAL];
362 sin6[TCPDROP_FOREIGN].sin6_len = sizeof sin6[TCPDROP_FOREIGN];
363 sin6[TCPDROP_FOREIGN].sin6_family = AF_INET6;
364 sin6[TCPDROP_FOREIGN].sin6_port = inc->inc_fport;
365 memcpy(&sin6[TCPDROP_FOREIGN].sin6_addr, &inc->inc6_faddr,
366 sizeof inc->inc6_faddr);
367 foreign = (struct sockaddr *)&sin6[TCPDROP_FOREIGN];
369 memset(sin4, 0, sizeof sin4);
371 sin4[TCPDROP_LOCAL].sin_len = sizeof sin4[TCPDROP_LOCAL];
372 sin4[TCPDROP_LOCAL].sin_family = AF_INET;
373 sin4[TCPDROP_LOCAL].sin_port = inc->inc_lport;
374 memcpy(&sin4[TCPDROP_LOCAL].sin_addr, &inc->inc_laddr,
375 sizeof inc->inc_laddr);
376 local = (struct sockaddr *)&sin4[TCPDROP_LOCAL];
378 sin4[TCPDROP_FOREIGN].sin_len = sizeof sin4[TCPDROP_FOREIGN];
379 sin4[TCPDROP_FOREIGN].sin_family = AF_INET;
380 sin4[TCPDROP_FOREIGN].sin_port = inc->inc_fport;
381 memcpy(&sin4[TCPDROP_FOREIGN].sin_addr, &inc->inc_faddr,
382 sizeof inc->inc_faddr);
383 foreign = (struct sockaddr *)&sin4[TCPDROP_FOREIGN];
386 return (tcpdrop(local, foreign));
393 "usage: tcpdrop local-address local-port foreign-address foreign-port\n"
394 " tcpdrop local-address:local-port foreign-address:foreign-port\n"
395 " tcpdrop local-address.local-port foreign-address.foreign-port\n"
397 " tcpdrop [-l] -C cc-algo [-S stack] [-s state]\n"
398 " tcpdrop [-l] [-C cc-algo] -S stack [-s state]\n"
399 " tcpdrop [-l] [-C cc-algo] [-S stack] -s state\n");