1997-02-09 22:50:16 +00:00
|
|
|
/*
|
1999-11-08 20:51:23 +00:00
|
|
|
* Copyright (C) 1993-1998 by Darren Reed.
|
1997-02-09 22:50:16 +00:00
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms are permitted
|
|
|
|
* provided that this notice is preserved and due credit is given
|
|
|
|
* to the original author and the contributors.
|
|
|
|
*/
|
1997-05-25 15:45:04 +00:00
|
|
|
#ifdef __FreeBSD__
|
|
|
|
# include <osreldate.h>
|
|
|
|
#endif
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <assert.h>
|
|
|
|
#include <string.h>
|
1997-11-16 04:52:19 +00:00
|
|
|
#include <sys/types.h>
|
|
|
|
#if !defined(__SVR4) && !defined(__svr4__) && !defined(__sgi)
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <strings.h>
|
|
|
|
#else
|
1997-11-16 04:52:19 +00:00
|
|
|
#if !defined(__sgi)
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <sys/byteorder.h>
|
1997-11-16 04:52:19 +00:00
|
|
|
#endif
|
1997-04-03 10:22:02 +00:00
|
|
|
#include <sys/file.h>
|
1997-02-09 22:50:16 +00:00
|
|
|
#endif
|
|
|
|
#include <sys/param.h>
|
1997-05-25 15:45:04 +00:00
|
|
|
#include <sys/time.h>
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <stdlib.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <stddef.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/ioctl.h>
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_systm.h>
|
1997-11-16 04:52:19 +00:00
|
|
|
#ifndef linux
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <netinet/ip_var.h>
|
1997-11-16 04:52:19 +00:00
|
|
|
#endif
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <netinet/ip.h>
|
|
|
|
#include <netinet/udp.h>
|
|
|
|
#include <netinet/tcp.h>
|
|
|
|
#include <netinet/ip_icmp.h>
|
|
|
|
#include <net/if.h>
|
1997-05-25 15:45:04 +00:00
|
|
|
#if __FreeBSD_version >= 300000
|
|
|
|
# include <net/if_var.h>
|
|
|
|
#endif
|
1997-02-09 22:50:16 +00:00
|
|
|
#include <netdb.h>
|
|
|
|
#include <arpa/nameser.h>
|
|
|
|
#include <arpa/inet.h>
|
|
|
|
#include <resolv.h>
|
1997-04-03 10:22:02 +00:00
|
|
|
#include <ctype.h>
|
|
|
|
#include "ip_compat.h"
|
1997-11-16 04:52:19 +00:00
|
|
|
#include <netinet/tcpip.h>
|
1997-04-03 10:22:02 +00:00
|
|
|
#include "ip_fil.h"
|
1999-11-08 20:51:23 +00:00
|
|
|
#include "ip_nat.h"
|
|
|
|
#include "ip_state.h"
|
1997-02-09 22:50:16 +00:00
|
|
|
#include "ipf.h"
|
|
|
|
#include "ipt.h"
|
|
|
|
|
1997-11-16 04:52:19 +00:00
|
|
|
#if !defined(lint)
|
|
|
|
static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-1996 Darren Reed";
|
1999-11-08 20:51:23 +00:00
|
|
|
static const char rcsid[] = "@(#)$Id: ipt.c,v 2.1 1999/08/04 17:30:08 darrenr Exp $";
|
1997-02-09 22:50:16 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
extern char *optarg;
|
1997-04-03 10:22:02 +00:00
|
|
|
extern struct frentry *ipfilter[2][2];
|
|
|
|
extern struct ipread snoop, etherf, tcpd, pcap, iptext, iphex;
|
|
|
|
extern struct ifnet *get_unit __P((char *));
|
|
|
|
extern void init_ifp __P((void));
|
1999-11-08 20:51:23 +00:00
|
|
|
extern ipnat_t *natparse __P((char *, int));
|
1997-02-09 22:50:16 +00:00
|
|
|
|
|
|
|
int opts = 0;
|
1997-04-03 10:22:02 +00:00
|
|
|
int main __P((int, char *[]));
|
1997-02-09 22:50:16 +00:00
|
|
|
|
|
|
|
int main(argc,argv)
|
|
|
|
int argc;
|
|
|
|
char *argv[];
|
|
|
|
{
|
|
|
|
struct ipread *r = &iptext;
|
1999-11-08 20:51:23 +00:00
|
|
|
u_long buf[2048];
|
1997-04-03 10:22:02 +00:00
|
|
|
struct ifnet *ifp;
|
1997-02-09 22:50:16 +00:00
|
|
|
char *rules = NULL, *datain = NULL, *iface = NULL;
|
1997-11-16 04:52:19 +00:00
|
|
|
ip_t *ip;
|
|
|
|
int fd, i, dir = 0, c;
|
1997-02-09 22:50:16 +00:00
|
|
|
|
1999-11-08 20:51:23 +00:00
|
|
|
while ((c = getopt(argc, argv, "bdEHi:I:NoPr:STvX")) != -1)
|
1997-02-09 22:50:16 +00:00
|
|
|
switch (c)
|
|
|
|
{
|
|
|
|
case 'b' :
|
|
|
|
opts |= OPT_BRIEF;
|
|
|
|
break;
|
|
|
|
case 'd' :
|
|
|
|
opts |= OPT_DEBUG;
|
|
|
|
break;
|
|
|
|
case 'i' :
|
|
|
|
datain = optarg;
|
|
|
|
break;
|
|
|
|
case 'I' :
|
|
|
|
iface = optarg;
|
|
|
|
break;
|
1997-04-03 10:22:02 +00:00
|
|
|
case 'o' :
|
|
|
|
opts |= OPT_SAVEOUT;
|
|
|
|
break;
|
1997-02-09 22:50:16 +00:00
|
|
|
case 'r' :
|
|
|
|
rules = optarg;
|
|
|
|
break;
|
|
|
|
case 'v' :
|
|
|
|
opts |= OPT_VERBOSE;
|
|
|
|
break;
|
|
|
|
case 'E' :
|
|
|
|
r = ðerf;
|
|
|
|
break;
|
|
|
|
case 'H' :
|
|
|
|
r = &iphex;
|
|
|
|
break;
|
1999-11-08 20:51:23 +00:00
|
|
|
case 'N' :
|
|
|
|
opts |= OPT_NAT;
|
|
|
|
break;
|
1997-02-09 22:50:16 +00:00
|
|
|
case 'P' :
|
|
|
|
r = &pcap;
|
|
|
|
break;
|
|
|
|
case 'S' :
|
|
|
|
r = &snoop;
|
|
|
|
break;
|
|
|
|
case 'T' :
|
|
|
|
r = &tcpd;
|
|
|
|
break;
|
|
|
|
case 'X' :
|
|
|
|
r = &iptext;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!rules) {
|
|
|
|
(void)fprintf(stderr,"no rule file present\n");
|
|
|
|
exit(-1);
|
|
|
|
}
|
|
|
|
|
1999-11-08 20:51:23 +00:00
|
|
|
nat_init();
|
|
|
|
fr_stateinit();
|
1997-02-09 22:50:16 +00:00
|
|
|
initparse();
|
|
|
|
|
|
|
|
if (rules) {
|
|
|
|
char line[513], *s;
|
1999-11-08 20:51:23 +00:00
|
|
|
void *fr;
|
1997-02-09 22:50:16 +00:00
|
|
|
FILE *fp;
|
1999-11-08 20:51:23 +00:00
|
|
|
int linenum = 0;
|
1997-02-09 22:50:16 +00:00
|
|
|
|
|
|
|
if (!strcmp(rules, "-"))
|
|
|
|
fp = stdin;
|
|
|
|
else if (!(fp = fopen(rules, "r"))) {
|
|
|
|
(void)fprintf(stderr, "couldn't open %s\n", rules);
|
|
|
|
exit(-1);
|
|
|
|
}
|
|
|
|
if (!(opts & OPT_BRIEF))
|
|
|
|
(void)printf("opening rule file \"%s\"\n", rules);
|
|
|
|
while (fgets(line, sizeof(line)-1, fp)) {
|
1999-11-08 20:51:23 +00:00
|
|
|
linenum++;
|
1997-02-09 22:50:16 +00:00
|
|
|
/*
|
|
|
|
* treat both CR and LF as EOL
|
|
|
|
*/
|
|
|
|
if ((s = index(line, '\n')))
|
|
|
|
*s = '\0';
|
|
|
|
if ((s = index(line, '\r')))
|
|
|
|
*s = '\0';
|
|
|
|
/*
|
|
|
|
* # is comment marker, everything after is a ignored
|
|
|
|
*/
|
|
|
|
if ((s = index(line, '#')))
|
|
|
|
*s = '\0';
|
|
|
|
|
|
|
|
if (!*line)
|
|
|
|
continue;
|
|
|
|
|
1997-04-03 10:22:02 +00:00
|
|
|
/* fake an `ioctl' call :) */
|
1999-11-08 20:51:23 +00:00
|
|
|
|
|
|
|
if ((opts & OPT_NAT) != 0) {
|
|
|
|
if (!(fr = natparse(line, linenum)))
|
|
|
|
continue;
|
|
|
|
i = IPL_EXTERN(ioctl)(IPL_LOGNAT, SIOCADNAT,
|
|
|
|
fr, FWRITE|FREAD);
|
|
|
|
if (opts & OPT_DEBUG)
|
|
|
|
fprintf(stderr,
|
|
|
|
"iplioctl(ADNAT,%p,1) = %d\n",
|
|
|
|
fr, i);
|
|
|
|
} else {
|
|
|
|
if (!(fr = parse(line, linenum)))
|
|
|
|
continue;
|
|
|
|
i = IPL_EXTERN(ioctl)(0, SIOCADDFR, fr,
|
|
|
|
FWRITE|FREAD);
|
|
|
|
if (opts & OPT_DEBUG)
|
|
|
|
fprintf(stderr,
|
|
|
|
"iplioctl(ADDFR,%p,1) = %d\n",
|
|
|
|
fr, i);
|
|
|
|
}
|
1997-02-09 22:50:16 +00:00
|
|
|
}
|
|
|
|
(void)fclose(fp);
|
|
|
|
}
|
|
|
|
|
1997-04-03 10:22:02 +00:00
|
|
|
if (opts & OPT_SAVEOUT)
|
|
|
|
init_ifp();
|
|
|
|
|
1997-02-09 22:50:16 +00:00
|
|
|
if (datain)
|
|
|
|
fd = (*r->r_open)(datain);
|
|
|
|
else
|
|
|
|
fd = (*r->r_open)("-");
|
|
|
|
|
|
|
|
if (fd < 0)
|
|
|
|
exit(-1);
|
|
|
|
|
1997-11-16 04:52:19 +00:00
|
|
|
ip = (ip_t *)buf;
|
1997-04-03 10:22:02 +00:00
|
|
|
while ((i = (*r->r_readip)((char *)buf, sizeof(buf),
|
|
|
|
&iface, &dir)) > 0) {
|
|
|
|
ifp = iface ? get_unit(iface) : NULL;
|
1997-02-09 22:50:16 +00:00
|
|
|
ip->ip_off = ntohs(ip->ip_off);
|
|
|
|
ip->ip_len = ntohs(ip->ip_len);
|
1999-11-08 20:51:23 +00:00
|
|
|
i = fr_check(ip, ip->ip_hl << 2, ifp, dir, (mb_t **)&buf);
|
|
|
|
if ((opts & OPT_NAT) == 0)
|
|
|
|
switch (i)
|
|
|
|
{
|
|
|
|
case -2 :
|
|
|
|
(void)printf("auth");
|
|
|
|
break;
|
|
|
|
case -1 :
|
|
|
|
(void)printf("block");
|
|
|
|
break;
|
|
|
|
case 0 :
|
|
|
|
(void)printf("pass");
|
|
|
|
break;
|
|
|
|
case 1 :
|
|
|
|
(void)printf("nomatch");
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
1997-02-09 22:50:16 +00:00
|
|
|
if (!(opts & OPT_BRIEF)) {
|
|
|
|
putchar(' ');
|
1997-11-16 04:52:19 +00:00
|
|
|
printpacket((ip_t *)buf);
|
1997-02-09 22:50:16 +00:00
|
|
|
printf("--------------");
|
1999-11-08 20:51:23 +00:00
|
|
|
} else if ((opts & (OPT_BRIEF|OPT_NAT)) == (OPT_NAT|OPT_BRIEF))
|
|
|
|
printpacket((ip_t *)buf);
|
1997-11-16 04:52:19 +00:00
|
|
|
#ifndef linux
|
1997-04-03 10:22:02 +00:00
|
|
|
if (dir && ifp && ip->ip_v)
|
1997-11-16 04:52:19 +00:00
|
|
|
# ifdef __sgi
|
|
|
|
(*ifp->if_output)(ifp, (void *)buf, NULL);
|
|
|
|
# else
|
1997-04-03 10:22:02 +00:00
|
|
|
(*ifp->if_output)(ifp, (void *)buf, NULL, 0);
|
1997-11-16 04:52:19 +00:00
|
|
|
# endif
|
|
|
|
#endif
|
1999-11-08 20:51:23 +00:00
|
|
|
if ((opts & (OPT_BRIEF|OPT_NAT)) != (OPT_NAT|OPT_BRIEF))
|
|
|
|
putchar('\n');
|
1997-02-09 22:50:16 +00:00
|
|
|
dir = 0;
|
|
|
|
}
|
|
|
|
(*r->r_close)();
|
|
|
|
return 0;
|
|
|
|
}
|