Move filter sets into struct bundle.
This commit is contained in:
Brian Somers
parent
e8e7be1aec
commit
5ca5389af4
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/cvs2svn/branches/MP/; revision=34631
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: arp.c,v 1.27.2.5 1998/02/27 01:22:15 brian Exp $
|
||||
* $Id: arp.c,v 1.27.2.6 1998/03/13 21:07:26 brian Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
@ -57,6 +57,7 @@
|
||||
#include "iplist.h"
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "arp.h"
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: auth.c,v 1.27.2.12 1998/03/13 00:43:51 brian Exp $
|
||||
* $Id: auth.c,v 1.27.2.13 1998/03/13 21:07:26 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Implement check against with registered IP addresses.
|
||||
@ -53,6 +53,7 @@
|
||||
#include "physical.h"
|
||||
#include "chat.h"
|
||||
#include "lcpproto.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
|
||||
const char *
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: bundle.c,v 1.1.2.24 1998/03/13 21:06:59 brian Exp $
|
||||
* $Id: bundle.c,v 1.1.2.25 1998/03/13 21:07:27 brian Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -56,6 +56,7 @@
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "link.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "loadalias.h"
|
||||
#include "vars.h"
|
||||
@ -411,6 +412,15 @@ bundle_Create(const char *prefix)
|
||||
ipcp_Init(&bundle.ncp.ipcp, &bundle, &bundle.links->physical->link,
|
||||
&bundle.fsm);
|
||||
|
||||
memset(&bundle.filter, '\0', sizeof bundle.filter);
|
||||
bundle.filter.in.fragok = bundle.filter.in.logok = 1;
|
||||
bundle.filter.in.name = "IN";
|
||||
bundle.filter.out.fragok = bundle.filter.out.logok = 1;
|
||||
bundle.filter.out.name = "OUT";
|
||||
bundle.filter.dial.name = "DIAL";
|
||||
bundle.filter.alive.name = "ALIVE";
|
||||
bundle.filter.alive.logok = 1;
|
||||
|
||||
/* Clean out any leftover crud */
|
||||
bundle_CleanInterface(&bundle);
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: bundle.h,v 1.1.2.15 1998/03/13 00:44:33 brian Exp $
|
||||
* $Id: bundle.h,v 1.1.2.16 1998/03/13 21:07:27 brian Exp $
|
||||
*/
|
||||
|
||||
#define PHASE_DEAD 0 /* Link is dead */
|
||||
@ -32,6 +32,7 @@
|
||||
#define PHASE_NETWORK 3 /* We're alive ! */
|
||||
#define PHASE_TERMINATE 4 /* Terminating link */
|
||||
|
||||
|
||||
struct datalink;
|
||||
struct physical;
|
||||
struct link;
|
||||
@ -56,6 +57,14 @@ struct bundle {
|
||||
struct ipcp ipcp; /* Our IPCP FSM */
|
||||
} ncp;
|
||||
|
||||
struct {
|
||||
struct filter in; /* incoming packet filter */
|
||||
struct filter out; /* outgoing packet filter */
|
||||
struct filter dial; /* dial-out packet filter */
|
||||
struct filter alive; /* keep-alive packet filter */
|
||||
} filter;
|
||||
|
||||
|
||||
struct pppTimer IdleTimer; /* timeout after cfg.idle_timeout */
|
||||
};
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: ccp.c,v 1.30.2.20 1998/03/13 21:07:28 brian Exp $
|
||||
* $Id: ccp.c,v 1.30.2.21 1998/03/13 21:07:57 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Support other compression protocols
|
||||
@ -45,6 +45,7 @@
|
||||
#include "throughput.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "descriptor.h"
|
||||
#include "prompt.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: chap.c,v 1.28.2.15 1998/03/13 21:07:00 brian Exp $
|
||||
* $Id: chap.c,v 1.28.2.16 1998/03/13 21:07:29 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -63,6 +63,7 @@
|
||||
#include "physical.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "ccp.h"
|
||||
#include "chat.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: command.c,v 1.131.2.37 1998/03/13 21:07:29 brian Exp $
|
||||
* $Id: command.c,v 1.131.2.38 1998/03/13 21:08:01 brian Exp $
|
||||
*
|
||||
*/
|
||||
#include <sys/param.h>
|
||||
@ -56,7 +56,6 @@
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "modem.h"
|
||||
#include "filter.h"
|
||||
#ifndef NOALIAS
|
||||
#include "alias_cmd.h"
|
||||
#endif
|
||||
@ -65,6 +64,7 @@
|
||||
#include "loadalias.h"
|
||||
#include "vars.h"
|
||||
#include "systems.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "main.h"
|
||||
#include "route.h"
|
||||
@ -558,22 +558,18 @@ ShowMSExt(struct cmdargs const *arg)
|
||||
#endif
|
||||
|
||||
static struct cmdtab const ShowCommands[] = {
|
||||
{"afilter", NULL, ShowAfilter, LOCAL_AUTH,
|
||||
"Show keep-alive filters", "show afilter option .."},
|
||||
{"auth", NULL, ShowAuthKey, LOCAL_AUTH,
|
||||
"Show auth details", "show auth"},
|
||||
{"ccp", NULL, ccp_ReportStatus, LOCAL_AUTH | LOCAL_CX_OPT,
|
||||
"Show CCP status", "show cpp"},
|
||||
{"compress", NULL, ReportCompress, LOCAL_AUTH,
|
||||
"Show compression stats", "show compress"},
|
||||
{"dfilter", NULL, ShowDfilter, LOCAL_AUTH,
|
||||
"Show Demand filters", "show dfilteroption .."},
|
||||
{"escape", NULL, ShowEscape, LOCAL_AUTH | LOCAL_CX,
|
||||
"Show escape characters", "show escape"},
|
||||
{"hdlc", NULL, hdlc_ReportStatus, LOCAL_AUTH | LOCAL_CX,
|
||||
"Show HDLC errors", "show hdlc"},
|
||||
{"ifilter", NULL, ShowIfilter, LOCAL_AUTH,
|
||||
"Show Input filters", "show ifilter option .."},
|
||||
{"filter", NULL, ShowFilter, LOCAL_AUTH,
|
||||
"Show packet filters", "show filter [in|out|dial|alive]"},
|
||||
{"ipcp", NULL, ReportIpcpStatus, LOCAL_AUTH,
|
||||
"Show IPCP status", "show ipcp"},
|
||||
{"lcp", NULL, lcp_ReportStatus, LOCAL_AUTH | LOCAL_CX,
|
||||
@ -596,8 +592,6 @@ static struct cmdtab const ShowCommands[] = {
|
||||
#endif
|
||||
{"mtu", NULL, ShowPreferredMTU, LOCAL_AUTH,
|
||||
"Show Preferred MTU", "show mtu"},
|
||||
{"ofilter", NULL, ShowOfilter, LOCAL_AUTH,
|
||||
"Show Output filters", "show ofilter option .."},
|
||||
{"proto", NULL, Physical_ReportProtocolStatus, LOCAL_AUTH,
|
||||
"Show protocol summary", "show proto"},
|
||||
{"reconnect", NULL, ShowReconnect, LOCAL_AUTH | LOCAL_CX,
|
||||
@ -1385,8 +1379,6 @@ SetOpenMode(struct cmdargs const *arg)
|
||||
static struct cmdtab const SetCommands[] = {
|
||||
{"accmap", NULL, SetVariable, LOCAL_AUTH | LOCAL_CX,
|
||||
"Set accmap value", "set accmap hex-value", (const void *) VAR_ACCMAP},
|
||||
{"afilter", NULL, SetAfilter, LOCAL_AUTH,
|
||||
"Set keep Alive filter", "set afilter ..."},
|
||||
{"authkey", "key", SetVariable, LOCAL_AUTH,
|
||||
"Set authentication key", "set authkey|key key", (const void *) VAR_AUTHKEY},
|
||||
{"authname", NULL, SetVariable, LOCAL_AUTH,
|
||||
@ -1396,8 +1388,6 @@ static struct cmdtab const SetCommands[] = {
|
||||
{"device", "line", SetVariable, LOCAL_AUTH | LOCAL_CX,
|
||||
"Set modem device name", "set device|line device-name[,device-name]",
|
||||
(const void *) VAR_DEVICE},
|
||||
{"dfilter", NULL, SetDfilter, LOCAL_AUTH,
|
||||
"Set demand filter", "set dfilter ..."},
|
||||
{"dial", NULL, SetVariable, LOCAL_AUTH | LOCAL_CX,
|
||||
"Set dialing script", "set dial chat-script", (const void *) VAR_DIAL},
|
||||
#ifdef HAVE_DES
|
||||
@ -1410,8 +1400,8 @@ static struct cmdtab const SetCommands[] = {
|
||||
"Set hangup script", "set hangup chat-script", (const void *) VAR_HANGUP},
|
||||
{"ifaddr", NULL, SetInterfaceAddr, LOCAL_AUTH, "Set destination address",
|
||||
"set ifaddr [src-addr [dst-addr [netmask [trg-addr]]]]"},
|
||||
{"ifilter", NULL, SetIfilter, LOCAL_AUTH,
|
||||
"Set input filter", "set ifilter ..."},
|
||||
{"filter", NULL, SetFilter, LOCAL_AUTH,
|
||||
"Set packet filters", "set filter in|out|dial|alive ..."},
|
||||
{"loopback", NULL, SetLoopback, LOCAL_AUTH,
|
||||
"Set loopback facility", "set loopback on|off"},
|
||||
{"log", NULL, SetLogLevel, LOCAL_AUTH,
|
||||
@ -1428,8 +1418,6 @@ static struct cmdtab const SetCommands[] = {
|
||||
{"ns", NULL, SetNS, LOCAL_AUTH,
|
||||
"Set NameServer", "set ns pri-addr [sec-addr]"},
|
||||
#endif
|
||||
{"ofilter", NULL, SetOfilter, LOCAL_AUTH,
|
||||
"Set output filter", "set ofilter ..."},
|
||||
{"openmode", NULL, SetOpenMode, LOCAL_AUTH | LOCAL_CX,
|
||||
"Set open mode", "set openmode [active|passive]"},
|
||||
{"parity", NULL, SetModemParity, LOCAL_AUTH | LOCAL_CX,
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: datalink.c,v 1.1.2.21 1998/03/13 21:07:03 brian Exp $
|
||||
* $Id: datalink.c,v 1.1.2.22 1998/03/13 21:07:30 brian Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -53,6 +53,7 @@
|
||||
#include "physical.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "chat.h"
|
||||
#include "ccp.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: filter.c,v 1.22.2.6 1998/03/13 00:44:01 brian Exp $
|
||||
* $Id: filter.c,v 1.22.2.7 1998/03/13 21:07:31 brian Exp $
|
||||
*
|
||||
* TODO: Shoud send ICMP error message when we discard packets.
|
||||
*/
|
||||
@ -51,14 +51,7 @@
|
||||
#include "prompt.h"
|
||||
#include "bundle.h"
|
||||
|
||||
struct filterent ifilters[MAXFILTERS]; /* incoming packet filter */
|
||||
struct filterent ofilters[MAXFILTERS]; /* outgoing packet filter */
|
||||
struct filterent dfilters[MAXFILTERS]; /* dial-out packet filter */
|
||||
struct filterent afilters[MAXFILTERS]; /* keep-alive packet filter */
|
||||
|
||||
static struct filterent filterdata;
|
||||
|
||||
static u_long netmasks[33] = {
|
||||
static const u_long netmasks[33] = {
|
||||
0x00000000,
|
||||
0x80000000, 0xC0000000, 0xE0000000, 0xF0000000,
|
||||
0xF8000000, 0xFC000000, 0xFE000000, 0xFF000000,
|
||||
@ -179,7 +172,7 @@ ParsePort(const char *service, int proto)
|
||||
* ICMP Syntax: src eq icmp_message_type
|
||||
*/
|
||||
static int
|
||||
ParseIcmp(int argc, char const *const *argv)
|
||||
ParseIcmp(int argc, char const *const *argv, struct filterent *tgt)
|
||||
{
|
||||
int type;
|
||||
char *cp;
|
||||
@ -187,7 +180,7 @@ ParseIcmp(int argc, char const *const *argv)
|
||||
switch (argc) {
|
||||
case 0:
|
||||
/* permit/deny all ICMP types */
|
||||
filterdata.opt.srcop = OP_NONE;
|
||||
tgt->opt.srcop = OP_NONE;
|
||||
break;
|
||||
default:
|
||||
LogPrintf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
|
||||
@ -199,8 +192,8 @@ ParseIcmp(int argc, char const *const *argv)
|
||||
LogPrintf(LogWARN, "ParseIcmp: type is expected.\n");
|
||||
return (0);
|
||||
}
|
||||
filterdata.opt.srcop = OP_EQ;
|
||||
filterdata.opt.srcport = type;
|
||||
tgt->opt.srcop = OP_EQ;
|
||||
tgt->opt.srcport = type;
|
||||
}
|
||||
break;
|
||||
}
|
||||
@ -225,10 +218,11 @@ ParseOp(const char *cp)
|
||||
* UDP Syntax: [src op port] [dst op port]
|
||||
*/
|
||||
static int
|
||||
ParseUdpOrTcp(int argc, char const *const *argv, int proto)
|
||||
ParseUdpOrTcp(int argc, char const *const *argv, int proto,
|
||||
struct filterent *tgt)
|
||||
{
|
||||
filterdata.opt.srcop = filterdata.opt.dstop = OP_NONE;
|
||||
filterdata.opt.estab = 0;
|
||||
tgt->opt.srcop = tgt->opt.dstop = OP_NONE;
|
||||
tgt->opt.estab = 0;
|
||||
|
||||
if (argc == 0) {
|
||||
/* permit/deny all tcp traffic */
|
||||
@ -236,13 +230,13 @@ ParseUdpOrTcp(int argc, char const *const *argv, int proto)
|
||||
}
|
||||
|
||||
if (argc >= 3 && !strcmp(*argv, "src")) {
|
||||
filterdata.opt.srcop = ParseOp(argv[1]);
|
||||
if (filterdata.opt.srcop == OP_NONE) {
|
||||
tgt->opt.srcop = ParseOp(argv[1]);
|
||||
if (tgt->opt.srcop == OP_NONE) {
|
||||
LogPrintf(LogWARN, "ParseUdpOrTcp: bad operation\n");
|
||||
return (0);
|
||||
}
|
||||
filterdata.opt.srcport = ParsePort(argv[2], proto);
|
||||
if (filterdata.opt.srcport == 0)
|
||||
tgt->opt.srcport = ParsePort(argv[2], proto);
|
||||
if (tgt->opt.srcport == 0)
|
||||
return (0);
|
||||
argc -= 3;
|
||||
argv += 3;
|
||||
@ -250,13 +244,13 @@ ParseUdpOrTcp(int argc, char const *const *argv, int proto)
|
||||
return (1);
|
||||
}
|
||||
if (argc >= 3 && !strcmp(argv[0], "dst")) {
|
||||
filterdata.opt.dstop = ParseOp(argv[1]);
|
||||
if (filterdata.opt.dstop == OP_NONE) {
|
||||
tgt->opt.dstop = ParseOp(argv[1]);
|
||||
if (tgt->opt.dstop == OP_NONE) {
|
||||
LogPrintf(LogWARN, "ParseUdpOrTcp: bad operation\n");
|
||||
return (0);
|
||||
}
|
||||
filterdata.opt.dstport = ParsePort(argv[2], proto);
|
||||
if (filterdata.opt.dstport == 0)
|
||||
tgt->opt.dstport = ParsePort(argv[2], proto);
|
||||
if (tgt->opt.dstport == 0)
|
||||
return (0);
|
||||
argc -= 3;
|
||||
argv += 3;
|
||||
@ -265,7 +259,7 @@ ParseUdpOrTcp(int argc, char const *const *argv, int proto)
|
||||
}
|
||||
if (argc == 1 && proto == P_TCP) {
|
||||
if (!strcmp(*argv, "estab")) {
|
||||
filterdata.opt.estab = 1;
|
||||
tgt->opt.estab = 1;
|
||||
return (1);
|
||||
}
|
||||
LogPrintf(LogWARN, "ParseUdpOrTcp: estab is expected: %s\n", *argv);
|
||||
@ -280,12 +274,12 @@ static const char *opname[] = {"none", "eq", "gt", NULL, "lt"};
|
||||
|
||||
static int
|
||||
Parse(struct ipcp *ipcp, int argc, char const *const *argv,
|
||||
struct filterent * ofp)
|
||||
struct filterent *ofp)
|
||||
{
|
||||
int action, proto;
|
||||
int val;
|
||||
char *wp;
|
||||
struct filterent *fp = &filterdata;
|
||||
struct filterent filterdata;
|
||||
|
||||
val = strtol(*argv, &wp, 0);
|
||||
if (*argv == wp || val > MAXFILTERS) {
|
||||
@ -322,30 +316,32 @@ Parse(struct ipcp *ipcp, int argc, char const *const *argv,
|
||||
LogPrintf(LogWARN, "Parse: bad action: %s\n", *argv);
|
||||
return (0);
|
||||
}
|
||||
fp->action = action;
|
||||
filterdata.action = action;
|
||||
|
||||
argc--;
|
||||
argv++;
|
||||
|
||||
if (fp->action == A_DENY) {
|
||||
if (filterdata.action == A_DENY) {
|
||||
if (!strcmp(*argv, "host")) {
|
||||
fp->action |= A_UHOST;
|
||||
filterdata.action |= A_UHOST;
|
||||
argc--;
|
||||
argv++;
|
||||
} else if (!strcmp(*argv, "port")) {
|
||||
fp->action |= A_UPORT;
|
||||
filterdata.action |= A_UPORT;
|
||||
argc--;
|
||||
argv++;
|
||||
}
|
||||
}
|
||||
proto = ParseProto(argc, argv);
|
||||
if (proto == P_NONE) {
|
||||
if (ParseAddr(ipcp, argc, argv, &fp->saddr, &fp->smask, &fp->swidth)) {
|
||||
if (ParseAddr(ipcp, argc, argv, &filterdata.saddr, &filterdata.smask,
|
||||
&filterdata.swidth)) {
|
||||
argc--;
|
||||
argv++;
|
||||
proto = ParseProto(argc, argv);
|
||||
if (proto == P_NONE) {
|
||||
if (ParseAddr(ipcp, argc, argv, &fp->daddr, &fp->dmask, &fp->dwidth)) {
|
||||
if (ParseAddr(ipcp, argc, argv, &filterdata.daddr, &filterdata.dmask,
|
||||
&filterdata.dwidth)) {
|
||||
argc--;
|
||||
argv++;
|
||||
}
|
||||
@ -368,88 +364,71 @@ Parse(struct ipcp *ipcp, int argc, char const *const *argv,
|
||||
}
|
||||
|
||||
val = 1;
|
||||
fp->proto = proto;
|
||||
filterdata.proto = proto;
|
||||
|
||||
switch (proto) {
|
||||
case P_TCP:
|
||||
val = ParseUdpOrTcp(argc, argv, P_TCP);
|
||||
val = ParseUdpOrTcp(argc, argv, P_TCP, &filterdata);
|
||||
break;
|
||||
case P_UDP:
|
||||
val = ParseUdpOrTcp(argc, argv, P_UDP);
|
||||
val = ParseUdpOrTcp(argc, argv, P_UDP, &filterdata);
|
||||
break;
|
||||
case P_ICMP:
|
||||
val = ParseIcmp(argc, argv);
|
||||
val = ParseIcmp(argc, argv, &filterdata);
|
||||
break;
|
||||
}
|
||||
|
||||
LogPrintf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(fp->saddr));
|
||||
LogPrintf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(fp->smask));
|
||||
LogPrintf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(fp->daddr));
|
||||
LogPrintf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(fp->dmask));
|
||||
LogPrintf(LogDEBUG, "Parse: Src: %s\n", inet_ntoa(filterdata.saddr));
|
||||
LogPrintf(LogDEBUG, "Parse: Src mask: %s\n", inet_ntoa(filterdata.smask));
|
||||
LogPrintf(LogDEBUG, "Parse: Dst: %s\n", inet_ntoa(filterdata.daddr));
|
||||
LogPrintf(LogDEBUG, "Parse: Dst mask: %s\n", inet_ntoa(filterdata.dmask));
|
||||
LogPrintf(LogDEBUG, "Parse: Proto = %d\n", proto);
|
||||
|
||||
LogPrintf(LogDEBUG, "Parse: src: %s (%d)\n", opname[fp->opt.srcop],
|
||||
fp->opt.srcport);
|
||||
LogPrintf(LogDEBUG, "Parse: dst: %s (%d)\n", opname[fp->opt.dstop],
|
||||
fp->opt.dstport);
|
||||
LogPrintf(LogDEBUG, "Parse: estab: %d\n", fp->opt.estab);
|
||||
LogPrintf(LogDEBUG, "Parse: src: %s (%d)\n", opname[filterdata.opt.srcop],
|
||||
filterdata.opt.srcport);
|
||||
LogPrintf(LogDEBUG, "Parse: dst: %s (%d)\n", opname[filterdata.opt.dstop],
|
||||
filterdata.opt.dstport);
|
||||
LogPrintf(LogDEBUG, "Parse: estab: %d\n", filterdata.opt.estab);
|
||||
|
||||
if (val)
|
||||
*ofp = *fp;
|
||||
*ofp = filterdata;
|
||||
return (val);
|
||||
}
|
||||
|
||||
int
|
||||
SetIfilter(struct cmdargs const *arg)
|
||||
SetFilter(struct cmdargs const *arg)
|
||||
{
|
||||
if (arg->argc > 0) {
|
||||
Parse(&arg->bundle->ncp.ipcp, arg->argc, arg->argv, ifilters);
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
struct filter *filter;
|
||||
|
||||
int
|
||||
SetOfilter(struct cmdargs const *arg)
|
||||
{
|
||||
if (arg->argc > 0) {
|
||||
Parse(&arg->bundle->ncp.ipcp, arg->argc, arg->argv, ofilters);
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
if (arg->argc < 2)
|
||||
return -1;
|
||||
|
||||
int
|
||||
SetDfilter(struct cmdargs const *arg)
|
||||
{
|
||||
if (arg->argc > 0) {
|
||||
Parse(&arg->bundle->ncp.ipcp, arg->argc, arg->argv, dfilters);
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
if (!strcmp(arg->argv[0], "in"))
|
||||
filter = &arg->bundle->filter.in;
|
||||
else if (!strcmp(arg->argv[0], "out"))
|
||||
filter = &arg->bundle->filter.out;
|
||||
else if (!strcmp(arg->argv[0], "dial"))
|
||||
filter = &arg->bundle->filter.dial;
|
||||
else if (!strcmp(arg->argv[0], "alive"))
|
||||
filter = &arg->bundle->filter.alive;
|
||||
else
|
||||
return -1;
|
||||
|
||||
int
|
||||
SetAfilter(struct cmdargs const *arg)
|
||||
{
|
||||
if (arg->argc > 0) {
|
||||
Parse(&arg->bundle->ncp.ipcp, arg->argc, arg->argv, afilters);
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
Parse(&arg->bundle->ncp.ipcp, arg->argc - 1, arg->argv + 1, filter->rule);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static const char *protoname[] = { "none", "tcp", "udp", "icmp" };
|
||||
static const char *actname[] = { "none ", "permit ", "deny " };
|
||||
|
||||
static void
|
||||
ShowFilter(struct filterent * fp)
|
||||
doShowFilter(struct filterent *fp)
|
||||
{
|
||||
int n;
|
||||
|
||||
for (n = 0; n < MAXFILTERS; n++, fp++) {
|
||||
if (fp->action != A_NONE) {
|
||||
prompt_Printf(&prompt, "%2d %s", n,
|
||||
prompt_Printf(&prompt, " %2d %s", n,
|
||||
actname[fp->action & (A_PERMIT|A_DENY)]);
|
||||
if (fp->action & A_UHOST)
|
||||
prompt_Printf(&prompt, "host ");
|
||||
@ -478,29 +457,40 @@ ShowFilter(struct filterent * fp)
|
||||
}
|
||||
|
||||
int
|
||||
ShowIfilter(struct cmdargs const *arg)
|
||||
ShowFilter(struct cmdargs const *arg)
|
||||
{
|
||||
ShowFilter(ifilters);
|
||||
return 0;
|
||||
}
|
||||
if (arg->argc > 1)
|
||||
return -1;
|
||||
|
||||
int
|
||||
ShowOfilter(struct cmdargs const *arg)
|
||||
{
|
||||
ShowFilter(ofilters);
|
||||
return 0;
|
||||
}
|
||||
if (arg->argc == 1) {
|
||||
struct filter *filter;
|
||||
|
||||
int
|
||||
ShowDfilter(struct cmdargs const *arg)
|
||||
{
|
||||
ShowFilter(dfilters);
|
||||
return 0;
|
||||
}
|
||||
if (!strcmp(arg->argv[0], "in"))
|
||||
filter = &arg->bundle->filter.in;
|
||||
else if (!strcmp(arg->argv[0], "out"))
|
||||
filter = &arg->bundle->filter.out;
|
||||
else if (!strcmp(arg->argv[0], "dial"))
|
||||
filter = &arg->bundle->filter.dial;
|
||||
else if (!strcmp(arg->argv[0], "alive"))
|
||||
filter = &arg->bundle->filter.alive;
|
||||
else
|
||||
return -1;
|
||||
doShowFilter(filter->rule);
|
||||
} else {
|
||||
struct filter *filter[4];
|
||||
int f;
|
||||
|
||||
filter[0] = &arg->bundle->filter.in;
|
||||
filter[1] = &arg->bundle->filter.out;
|
||||
filter[2] = &arg->bundle->filter.dial;
|
||||
filter[3] = &arg->bundle->filter.alive;
|
||||
for (f = 0; f < 4; f++) {
|
||||
if (f)
|
||||
prompt_Printf(&prompt, "\n");
|
||||
prompt_Printf(&prompt, "%s:\n", filter[f]->name);
|
||||
doShowFilter(filter[f]->rule);
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
ShowAfilter(struct cmdargs const *arg)
|
||||
{
|
||||
ShowFilter(afilters);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -15,7 +15,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: filter.h,v 1.11 1997/11/22 03:37:30 brian Exp $
|
||||
* $Id: filter.h,v 1.11.2.1 1998/03/13 21:07:32 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -64,25 +64,21 @@ struct filterent {
|
||||
} opt;
|
||||
};
|
||||
|
||||
#define MAXFILTERS 20
|
||||
#define MAXFILTERS 20 /* in each filter set */
|
||||
|
||||
struct filter {
|
||||
struct filterent rule[MAXFILTERS]; /* incoming packet filter */
|
||||
char *name;
|
||||
unsigned fragok : 1;
|
||||
unsigned logok : 1;
|
||||
};
|
||||
|
||||
#define FL_IN 0
|
||||
#define FL_OUT 1
|
||||
#define FL_DIAL 2
|
||||
#define FL_KEEP 3
|
||||
|
||||
extern struct filterent ifilters[MAXFILTERS]; /* incoming packet filter */
|
||||
extern struct filterent ofilters[MAXFILTERS]; /* outgoing packet filter */
|
||||
extern struct filterent dfilters[MAXFILTERS]; /* dial-out packet filter */
|
||||
extern struct filterent afilters[MAXFILTERS]; /* keep-alive packet filter */
|
||||
|
||||
extern int ParseAddr(struct ipcp *, int, char const *const *, struct in_addr *,
|
||||
struct in_addr *, int *);
|
||||
extern int ShowIfilter(struct cmdargs const *);
|
||||
extern int ShowOfilter(struct cmdargs const *);
|
||||
extern int ShowDfilter(struct cmdargs const *);
|
||||
extern int ShowAfilter(struct cmdargs const *);
|
||||
extern int SetIfilter(struct cmdargs const *);
|
||||
extern int SetOfilter(struct cmdargs const *);
|
||||
extern int SetDfilter(struct cmdargs const *);
|
||||
extern int SetAfilter(struct cmdargs const *);
|
||||
extern int ShowFilter(struct cmdargs const *);
|
||||
extern int SetFilter(struct cmdargs const *);
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: fsm.c,v 1.27.2.19 1998/03/13 21:07:32 brian Exp $
|
||||
* $Id: fsm.c,v 1.27.2.20 1998/03/13 21:08:01 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Refer loglevel for log output
|
||||
@ -51,6 +51,7 @@
|
||||
#include "physical.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "auth.h"
|
||||
#include "chat.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: hdlc.c,v 1.28.2.18 1998/03/13 21:07:04 brian Exp $
|
||||
* $Id: hdlc.c,v 1.28.2.19 1998/03/13 21:07:33 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -57,6 +57,7 @@
|
||||
#include "prompt.h"
|
||||
#include "chat.h"
|
||||
#include "datalink.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
|
||||
static u_short const fcstab[256] = {
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: ip.c,v 1.38.2.11 1998/03/13 00:44:04 brian Exp $
|
||||
* $Id: ip.c,v 1.38.2.12 1998/03/13 21:07:34 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Return ICMP message for filterd packet
|
||||
@ -77,9 +77,6 @@ static const u_short interactive_ports[32] = {
|
||||
|
||||
static const char *TcpFlags[] = { "FIN", "SYN", "RST", "PSH", "ACK", "URG" };
|
||||
|
||||
static const char *Direction[] = {"INP", "OUT", "OUT", "IN/OUT"};
|
||||
static struct filterent *Filters[] = {ifilters, ofilters, dfilters, afilters};
|
||||
|
||||
static int
|
||||
PortMatch(int op, u_short pport, u_short rport)
|
||||
{
|
||||
@ -99,15 +96,15 @@ PortMatch(int op, u_short pport, u_short rport)
|
||||
* Check a packet against with defined filters
|
||||
*/
|
||||
static int
|
||||
FilterCheck(struct ip * pip, int direction)
|
||||
FilterCheck(struct ip *pip, struct filter *filter)
|
||||
{
|
||||
struct filterent *fp = Filters[direction];
|
||||
int gotinfo, cproto, estab, n;
|
||||
struct tcphdr *th;
|
||||
struct udphdr *uh;
|
||||
struct icmp *ih;
|
||||
char *ptop;
|
||||
u_short sport, dport;
|
||||
struct filterent *fp = filter->rule;
|
||||
|
||||
if (fp->action) {
|
||||
cproto = gotinfo = estab = 0;
|
||||
@ -115,10 +112,9 @@ FilterCheck(struct ip * pip, int direction)
|
||||
for (n = 0; n < MAXFILTERS; n++) {
|
||||
if (fp->action) {
|
||||
/* permit fragments on in and out filter */
|
||||
if ((direction == FL_IN || direction == FL_OUT) &&
|
||||
(ntohs(pip->ip_off) & IP_OFFMASK) != 0) {
|
||||
if (filter->fragok && (ntohs(pip->ip_off) & IP_OFFMASK) != 0)
|
||||
return (A_PERMIT);
|
||||
}
|
||||
|
||||
LogPrintf(LogDEBUG, "rule = %d\n", n);
|
||||
if ((pip->ip_src.s_addr & fp->smask.s_addr) ==
|
||||
(fp->saddr.s_addr & fp->smask.s_addr) &&
|
||||
@ -156,8 +152,8 @@ FilterCheck(struct ip * pip, int direction)
|
||||
return (A_DENY);/* We'll block unknown type of packet */
|
||||
}
|
||||
gotinfo = 1;
|
||||
LogPrintf(LogDEBUG, "dir = %d, proto = %d, srcop = %d,"
|
||||
" dstop = %d, estab = %d\n", direction, cproto,
|
||||
LogPrintf(LogDEBUG, "dir = %p, proto = %d, srcop = %d,"
|
||||
" dstop = %d, estab = %d\n", fp, cproto,
|
||||
fp->opt.srcop, fp->opt.dstop, estab);
|
||||
}
|
||||
LogPrintf(LogDEBUG, "check0: rule = %d, proto = %d, sport = %d,"
|
||||
@ -189,10 +185,10 @@ FilterCheck(struct ip * pip, int direction)
|
||||
return (A_PERMIT); /* No rule is given. Permit this packet */
|
||||
}
|
||||
|
||||
#ifdef notdef
|
||||
static void
|
||||
IcmpError(struct ip * pip, int code)
|
||||
{
|
||||
#ifdef notdef
|
||||
struct mbuf *bp;
|
||||
|
||||
if (pip->ip_p != IPPROTO_ICMP) {
|
||||
@ -203,14 +199,14 @@ IcmpError(struct ip * pip, int code)
|
||||
bundle_StartIdleTimer(bundle);
|
||||
ipcp_AddOutOctets(cnt);
|
||||
}
|
||||
#endif
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* For debugging aid.
|
||||
*/
|
||||
int
|
||||
PacketCheck(char *cp, int nb, int direction)
|
||||
PacketCheck(struct bundle *bundle, char *cp, int nb, struct filter *filter)
|
||||
{
|
||||
struct ip *pip;
|
||||
struct tcphdr *th;
|
||||
@ -222,14 +218,13 @@ PacketCheck(char *cp, int nb, int direction)
|
||||
int logit, loglen;
|
||||
static char logbuf[200];
|
||||
|
||||
logit = LogIsKept(LogTCPIP) && direction != FL_DIAL;
|
||||
logit = LogIsKept(LogTCPIP) && filter->logok;
|
||||
loglen = 0;
|
||||
|
||||
pip = (struct ip *) cp;
|
||||
|
||||
if (logit && loglen < sizeof logbuf) {
|
||||
snprintf(logbuf + loglen, sizeof logbuf - loglen, "%s ",
|
||||
Direction[direction]);
|
||||
snprintf(logbuf + loglen, sizeof logbuf - loglen, "%s ", filter->name);
|
||||
loglen += strlen(logbuf + loglen);
|
||||
}
|
||||
ptop = (cp + (pip->ip_hl << 2));
|
||||
@ -300,14 +295,17 @@ PacketCheck(char *cp, int nb, int direction)
|
||||
break;
|
||||
}
|
||||
|
||||
if ((FilterCheck(pip, direction) & A_DENY)) {
|
||||
if ((FilterCheck(pip, filter) & A_DENY)) {
|
||||
if (logit)
|
||||
LogPrintf(LogTCPIP, "%s - BLOCKED\n", logbuf);
|
||||
#ifdef notdef
|
||||
if (direction == 0)
|
||||
IcmpError(pip, pri);
|
||||
#endif
|
||||
return (-1);
|
||||
} else {
|
||||
if (FilterCheck(pip, FL_KEEP) & A_DENY) { /* Check Keep Alive filter */
|
||||
/* Check Keep Alive filter */
|
||||
if (FilterCheck(pip, &bundle->filter.alive) & A_DENY) {
|
||||
if (logit)
|
||||
LogPrintf(LogTCPIP, "%s - NO KEEPALIVE\n", logbuf);
|
||||
ipKeepAlive = 0;
|
||||
@ -359,7 +357,7 @@ IpInput(struct bundle *bundle, struct mbuf * bp)
|
||||
}
|
||||
if (iresult == PKT_ALIAS_OK
|
||||
|| iresult == PKT_ALIAS_FOUND_HEADER_FRAGMENT) {
|
||||
if (PacketCheck(tun.data, nb, FL_IN) < 0) {
|
||||
if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) {
|
||||
pfree(bp);
|
||||
return;
|
||||
}
|
||||
@ -407,7 +405,7 @@ IpInput(struct bundle *bundle, struct mbuf * bp)
|
||||
} else
|
||||
#endif /* #ifndef NOALIAS */
|
||||
{ /* no aliasing */
|
||||
if (PacketCheck(tun.data, nb, FL_IN) < 0) {
|
||||
if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) {
|
||||
pfree(bp);
|
||||
return;
|
||||
}
|
||||
|
||||
@ -17,12 +17,14 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: ip.h,v 1.8.2.4 1998/02/23 00:38:33 brian Exp $
|
||||
* $Id: ip.h,v 1.8.2.5 1998/03/09 19:26:38 brian Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
struct filter;
|
||||
|
||||
extern void IpStartOutput(struct link *, struct bundle *);
|
||||
extern int PacketCheck(char *, int, int);
|
||||
extern int PacketCheck(struct bundle *, char *, int, struct filter *);
|
||||
extern void IpEnqueue(int, char *, int);
|
||||
extern void IpInput(struct bundle *, struct mbuf *);
|
||||
extern int ip_QueueLen(void);
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: ipcp.c,v 1.50.2.21 1998/03/13 21:07:36 brian Exp $
|
||||
* $Id: ipcp.c,v 1.50.2.22 1998/03/13 21:08:03 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o More RFC1772 backwoard compatibility
|
||||
@ -52,13 +52,13 @@
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "slcompress.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "loadalias.h"
|
||||
#include "vars.h"
|
||||
#include "vjcomp.h"
|
||||
#include "ip.h"
|
||||
#include "route.h"
|
||||
#include "filter.h"
|
||||
#include "lqr.h"
|
||||
#include "hdlc.h"
|
||||
#include "async.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: lcp.c,v 1.55.2.27 1998/03/13 21:07:06 brian Exp $
|
||||
* $Id: lcp.c,v 1.55.2.28 1998/03/13 21:08:05 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Limit data field length by MRU
|
||||
@ -51,6 +51,7 @@
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "lcpproto.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "lqr.h"
|
||||
#include "hdlc.h"
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: link.c,v 1.1.2.10 1998/03/13 00:44:09 brian Exp $
|
||||
* $Id: link.c,v 1.1.2.11 1998/03/13 21:07:38 brian Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
@ -48,6 +48,7 @@
|
||||
#include "fsm.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "descriptor.h"
|
||||
#include "prompt.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: lqr.c,v 1.22.2.11 1998/03/13 21:07:08 brian Exp $
|
||||
* $Id: lqr.c,v 1.22.2.12 1998/03/13 21:07:39 brian Exp $
|
||||
*
|
||||
* o LQR based on RFC1333
|
||||
*
|
||||
@ -50,6 +50,7 @@
|
||||
#include "physical.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "loadalias.h"
|
||||
#include "vars.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: main.c,v 1.121.2.31 1998/03/13 21:07:09 brian Exp $
|
||||
* $Id: main.c,v 1.121.2.32 1998/03/13 21:07:39 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
* o Add commands for traffic summary, version display, etc.
|
||||
@ -61,11 +61,11 @@
|
||||
#include "iplist.h"
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "loadalias.h"
|
||||
#include "vars.h"
|
||||
#include "auth.h"
|
||||
#include "filter.h"
|
||||
#include "systems.h"
|
||||
#include "ip.h"
|
||||
#include "sig.h"
|
||||
@ -587,7 +587,7 @@ DoLoop(struct bundle *bundle)
|
||||
bundle->ncp.ipcp.my_ip.s_addr) {
|
||||
/* we've been asked to send something addressed *to* us :( */
|
||||
if (VarLoopback) {
|
||||
pri = PacketCheck(tun.data, n, FL_IN);
|
||||
pri = PacketCheck(bundle, tun.data, n, &bundle->filter.in);
|
||||
if (pri >= 0) {
|
||||
struct mbuf *bp;
|
||||
|
||||
@ -612,10 +612,10 @@ DoLoop(struct bundle *bundle)
|
||||
* device until IPCP is opened.
|
||||
*/
|
||||
if (bundle->phase == PHASE_DEAD && (mode & MODE_AUTO) &&
|
||||
(pri = PacketCheck(tun.data, n, FL_DIAL)) >= 0)
|
||||
(pri = PacketCheck(bundle, tun.data, n, &bundle->filter.dial)) >= 0)
|
||||
bundle_Open(bundle, NULL);
|
||||
|
||||
pri = PacketCheck(tun.data, n, FL_OUT);
|
||||
pri = PacketCheck(bundle, tun.data, n, &bundle->filter.out);
|
||||
if (pri >= 0) {
|
||||
#ifndef NOALIAS
|
||||
if (mode & MODE_ALIAS) {
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: modem.c,v 1.77.2.34 1998/03/13 21:07:11 brian Exp $
|
||||
* $Id: modem.c,v 1.77.2.35 1998/03/13 21:07:41 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -61,6 +61,7 @@
|
||||
#include "async.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "link.h"
|
||||
#include "descriptor.h"
|
||||
|
||||
@ -18,7 +18,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: pap.c,v 1.20.2.16 1998/03/13 21:07:14 brian Exp $
|
||||
* $Id: pap.c,v 1.20.2.17 1998/03/13 21:07:42 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -58,6 +58,7 @@
|
||||
#include "physical.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "chat.h"
|
||||
#include "ccp.h"
|
||||
|
||||
@ -16,7 +16,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: physical.c,v 1.1.2.15 1998/03/13 00:44:20 brian Exp $
|
||||
* $Id: physical.c,v 1.1.2.16 1998/03/13 21:07:43 brian Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
@ -59,6 +59,7 @@
|
||||
#include "vars.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "log.h"
|
||||
#include "id.h"
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
.\" $Id: ppp.8,v 1.97.2.3 1998/03/13 00:44:21 brian Exp $
|
||||
.\" $Id: ppp.8,v 1.97.2.4 1998/03/16 07:37:56 brian Exp $
|
||||
.Dd 20 September 1995
|
||||
.Os FreeBSD
|
||||
.Dt PPP 8
|
||||
@ -107,15 +107,15 @@ When
|
||||
is set up as server, you can also configure it to do proxy arp for your
|
||||
connection.
|
||||
.It Supports packet filtering.
|
||||
User can define four kinds of filters:
|
||||
.Em ifilter
|
||||
for incoming packets,
|
||||
.Em ofilter
|
||||
for outgoing packets,
|
||||
.Em dfilter
|
||||
to define a dialing trigger packet and
|
||||
.Em afilter
|
||||
for keeping a connection alive with the trigger packet.
|
||||
User can define four kinds of filters: the
|
||||
.Em in
|
||||
filter for incoming packets, the
|
||||
.Em out
|
||||
filter for outgoing packets, the
|
||||
.Em dial
|
||||
filter to define a dialing trigger packet and the
|
||||
.Em alive
|
||||
filter for keeping a connection alive with the trigger packet.
|
||||
.It Tunnel driver supports bpf.
|
||||
The user can use
|
||||
.Xr tcpdump 1
|
||||
@ -919,16 +919,29 @@ and that other machines have designated the
|
||||
host as the gateway for the LAN.
|
||||
.Sh PACKET FILTERING
|
||||
This implementation supports packet filtering. There are four kinds of
|
||||
filters; ifilter, ofilter, dfilter and afilter. Here are the basics:
|
||||
filters; the
|
||||
.Em in
|
||||
filter, the
|
||||
.Em out
|
||||
filter, the
|
||||
.Em dial
|
||||
filter and the
|
||||
.Em alive
|
||||
filter. Here are the basics:
|
||||
.Bl -bullet -compact
|
||||
.It
|
||||
A filter definition has the following syntax:
|
||||
set filter-name rule-no action [src_addr/src_width] [dst_addr/dst_width]
|
||||
set filter name rule-no action [src_addr/src_width] [dst_addr/dst_width]
|
||||
[proto [src [lt|eq|gt] port ]] [dst [lt|eq|gt] port] [estab]
|
||||
.Bl -enum
|
||||
.It
|
||||
.Sq filter-name
|
||||
should be one of ifilter, ofilter, dfilter or afilter.
|
||||
.Sq name
|
||||
should be one of
|
||||
.Em in ,
|
||||
.Em out ,
|
||||
.Em dial
|
||||
or
|
||||
.Em alive .
|
||||
.It
|
||||
There are two actions:
|
||||
.Sq permit
|
||||
@ -959,12 +972,12 @@ If no rule is matched to a packet, that packet will be discarded
|
||||
(blocked).
|
||||
.It
|
||||
Use
|
||||
.Dq set filter-name -1
|
||||
.Dq set filter name -1
|
||||
to flush all rules.
|
||||
.El
|
||||
.Pp
|
||||
See
|
||||
.Pa /etc/ppp/ppp.conf.filter.example .
|
||||
.Pa /etc/ppp/ppp.conf.example .
|
||||
.Sh SETTING IDLE, LINE QUALITY REQUEST, RETRY TIMER
|
||||
To check/set idle timer, use the
|
||||
.Dq show timeout
|
||||
@ -1934,30 +1947,41 @@ ACCMap stands for Asyncronous Control Character Map. This is always
|
||||
negotiated with the peer, and defaults to a value of 0x00000000.
|
||||
This protocol is required to defeat hardware that depends on passing
|
||||
certain characters from end to end (such as XON/XOFF etc).
|
||||
.It set filter-name rule-no action [src_addr/src_width]
|
||||
.It set filter name rule-no action [src_addr/src_width]
|
||||
[dst_addr/dst_width] [proto [src [lt|eq|gt] port ]]
|
||||
[dst [lt|eq|gt] port] [estab]
|
||||
.Pp
|
||||
.Nm Ppp
|
||||
supports four filter sets. The afilter specifies packets that keep
|
||||
the connection alive - reseting the idle timer. The dfilter specifies
|
||||
supports four filter sets. The
|
||||
.Em alive
|
||||
filter specifies packets that keep the connection alive - reseting the
|
||||
idle timer. The dial filter specifies
|
||||
packets that cause
|
||||
.Nm
|
||||
to dial when in
|
||||
.Fl auto
|
||||
mode. The ifilter specifies packets that are allowed to travel
|
||||
into the machine and the ofilter specifies packets that are allowed
|
||||
out of the machine. By default all filter sets allow all packets
|
||||
to pass.
|
||||
Rules are processed in order according to
|
||||
mode. The
|
||||
.Em in
|
||||
filter specifies packets that are allowed to travel
|
||||
into the machine and the
|
||||
.Em out
|
||||
filter specifies packets that are allowed out of the machine. Filtering
|
||||
is done prior to any IP alterations that might be done by the alias
|
||||
engine. By default all filter sets allow all packets to pass. Rules are
|
||||
processed in order according to
|
||||
.Dq n .
|
||||
Up to 20 rules may be given for each set. If a packet doesn't match
|
||||
any of the rules in a given set, it is discarded. In the case of
|
||||
ifilters and ofilters, this means that the packet is dropped. In
|
||||
the case of afilters it means that the packet will not reset the
|
||||
idle timer and in the case of dfilters it means that the packet will
|
||||
not trigger a dial.
|
||||
Refer to the section on PACKET FILTERING above for further details.
|
||||
.Em in
|
||||
and
|
||||
.Em out
|
||||
filters, this means that the packet is dropped. In the case of
|
||||
.Em alive
|
||||
filters it means that the packet will not reset the idle timer and in
|
||||
the case of
|
||||
.Em dial
|
||||
filters it means that the packet will not trigger a dial. Refer to the
|
||||
section on PACKET FILTERING above for further details.
|
||||
.It set authkey|key value
|
||||
This sets the authentication key (or password) used in client mode
|
||||
PAP or CHAP negotiation to the given value. It can also be used to
|
||||
@ -2445,8 +2469,10 @@ command if you wish processing to happen in the background.
|
||||
.It show var
|
||||
This command allows the user to examine the following:
|
||||
.Bl -tag -width 20
|
||||
.It show [adio]filter
|
||||
List the current rules for the given filter.
|
||||
.It show filter [name]
|
||||
List the current rules for the given filter. If
|
||||
.Ar name
|
||||
isn't specified, all filters are shown.
|
||||
.It show auth
|
||||
Show the current authname and encryption values. If you have built
|
||||
.Nm
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: prompt.c,v 1.1.2.11 1998/03/13 00:44:23 brian Exp $
|
||||
* $Id: prompt.c,v 1.1.2.12 1998/03/13 21:07:43 brian Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -51,6 +51,7 @@
|
||||
#include "iplist.h"
|
||||
#include "throughput.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "lqr.h"
|
||||
#include "hdlc.h"
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: route.c,v 1.42.2.9 1998/03/13 00:44:23 brian Exp $
|
||||
* $Id: route.c,v 1.42.2.10 1998/03/13 21:07:44 brian Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
@ -56,6 +56,7 @@
|
||||
#include "link.h"
|
||||
#include "fsm.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "route.h"
|
||||
#include "descriptor.h"
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: tun.c,v 1.6.4.5 1998/03/13 00:44:24 brian Exp $
|
||||
* $Id: tun.c,v 1.6.4.6 1998/03/13 21:07:45 brian Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -52,6 +52,7 @@
|
||||
#include "throughput.h"
|
||||
#include "iplist.h"
|
||||
#include "ipcp.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "tun.h"
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
||||
*
|
||||
* $Id: vjcomp.c,v 1.16.2.6 1998/03/13 00:44:26 brian Exp $
|
||||
* $Id: vjcomp.c,v 1.16.2.7 1998/03/13 21:07:46 brian Exp $
|
||||
*
|
||||
* TODO:
|
||||
*/
|
||||
@ -45,6 +45,7 @@
|
||||
#include "lcp.h"
|
||||
#include "ccp.h"
|
||||
#include "link.h"
|
||||
#include "filter.h"
|
||||
#include "bundle.h"
|
||||
#include "vjcomp.h"
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user