2001-06-13 21:52:19 +00:00
|
|
|
/*-
|
|
|
|
* Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org>
|
|
|
|
* based on work by Toshiharu OHNO <tony-o@iij.ad.jp>
|
|
|
|
* Internet Initiative Japan, Inc (IIJ)
|
|
|
|
* All rights reserved.
|
1995-01-31 06:29:58 +00:00
|
|
|
*
|
2001-06-13 21:52:19 +00:00
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
1995-01-31 06:29:58 +00:00
|
|
|
*
|
2001-06-13 21:52:19 +00:00
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
1995-05-30 03:57:47 +00:00
|
|
|
*
|
1999-08-28 01:35:59 +00:00
|
|
|
* $FreeBSD$
|
1995-01-31 06:29:58 +00:00
|
|
|
*/
|
|
|
|
|
1999-01-28 01:56:34 +00:00
|
|
|
#include <sys/param.h>
|
1995-01-31 06:29:58 +00:00
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <arpa/inet.h>
|
1995-09-17 16:14:49 +00:00
|
|
|
#include <netdb.h>
|
1998-05-21 21:49:08 +00:00
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/ip.h>
|
2001-08-14 16:05:52 +00:00
|
|
|
#include <sys/socket.h>
|
1998-05-21 21:49:08 +00:00
|
|
|
#include <sys/un.h>
|
1997-10-26 01:04:02 +00:00
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <strings.h>
|
1998-05-21 21:49:08 +00:00
|
|
|
#include <termios.h>
|
1997-10-26 01:04:02 +00:00
|
|
|
|
1999-05-08 11:07:56 +00:00
|
|
|
#include "layer.h"
|
1998-06-15 19:06:25 +00:00
|
|
|
#include "defs.h"
|
1995-01-31 06:29:58 +00:00
|
|
|
#include "command.h"
|
1997-06-09 03:27:43 +00:00
|
|
|
#include "mbuf.h"
|
|
|
|
#include "log.h"
|
1998-05-21 21:49:08 +00:00
|
|
|
#include "iplist.h"
|
|
|
|
#include "timer.h"
|
|
|
|
#include "throughput.h"
|
|
|
|
#include "lqr.h"
|
|
|
|
#include "hdlc.h"
|
|
|
|
#include "fsm.h"
|
|
|
|
#include "lcp.h"
|
|
|
|
#include "ccp.h"
|
|
|
|
#include "link.h"
|
|
|
|
#include "slcompress.h"
|
2001-08-14 16:05:52 +00:00
|
|
|
#include "ncpaddr.h"
|
|
|
|
#include "ip.h"
|
1997-06-28 01:34:03 +00:00
|
|
|
#include "ipcp.h"
|
1997-10-26 01:04:02 +00:00
|
|
|
#include "filter.h"
|
1998-05-21 21:49:08 +00:00
|
|
|
#include "descriptor.h"
|
|
|
|
#include "prompt.h"
|
|
|
|
#include "mp.h"
|
1999-01-28 01:56:34 +00:00
|
|
|
#ifndef NORADIUS
|
|
|
|
#include "radius.h"
|
|
|
|
#endif
|
2001-08-14 16:05:52 +00:00
|
|
|
#include "ipv6cp.h"
|
|
|
|
#include "ncp.h"
|
1998-05-21 21:49:08 +00:00
|
|
|
#include "bundle.h"
|
1997-10-26 01:04:02 +00:00
|
|
|
|
1998-05-21 21:49:08 +00:00
|
|
|
static int filter_Nam2Op(const char *);
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1995-09-17 16:14:49 +00:00
|
|
|
static int
|
2001-08-14 16:05:52 +00:00
|
|
|
ParsePort(const char *service, const char *proto)
|
1995-09-17 16:14:49 +00:00
|
|
|
{
|
|
|
|
struct servent *servent;
|
2001-08-14 16:05:52 +00:00
|
|
|
char *cp;
|
1995-09-17 16:14:49 +00:00
|
|
|
int port;
|
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
servent = getservbyname(service, proto);
|
1995-09-17 16:14:49 +00:00
|
|
|
if (servent != 0)
|
1999-07-27 23:44:00 +00:00
|
|
|
return ntohs(servent->s_port);
|
1995-09-17 16:14:49 +00:00
|
|
|
|
|
|
|
port = strtol(service, &cp, 0);
|
|
|
|
if (cp == service) {
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogWARN, "ParsePort: %s is not a port name or number.\n",
|
1997-08-25 00:29:32 +00:00
|
|
|
service);
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-09-17 16:14:49 +00:00
|
|
|
}
|
1999-07-27 23:44:00 +00:00
|
|
|
return port;
|
1995-09-17 16:14:49 +00:00
|
|
|
}
|
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
/*
|
|
|
|
* ICMP Syntax: src eq icmp_message_type
|
|
|
|
*/
|
|
|
|
static int
|
2001-08-14 16:05:52 +00:00
|
|
|
ParseIcmp(int argc, char const *const *argv, const struct protoent *pe,
|
|
|
|
struct filterent *tgt)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
|
|
|
int type;
|
|
|
|
char *cp;
|
|
|
|
|
|
|
|
switch (argc) {
|
|
|
|
case 0:
|
|
|
|
/* permit/deny all ICMP types */
|
2001-08-14 16:05:52 +00:00
|
|
|
tgt->f_srcop = tgt->f_dstop = OP_NONE;
|
1995-01-31 06:29:58 +00:00
|
|
|
break;
|
1998-05-21 21:49:08 +00:00
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
case 3:
|
1997-10-26 01:04:02 +00:00
|
|
|
if (!strcmp(*argv, "src") && !strcmp(argv[1], "eq")) {
|
1995-01-31 06:29:58 +00:00
|
|
|
type = strtol(argv[2], &cp, 0);
|
|
|
|
if (cp == argv[2]) {
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogWARN, "ParseIcmp: type is expected.\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_srcop = OP_EQ;
|
|
|
|
tgt->f_srcport = type;
|
2001-08-14 16:05:52 +00:00
|
|
|
tgt->f_dstop = OP_NONE;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
break;
|
1998-05-21 21:49:08 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
log_Printf(LogWARN, "ParseIcmp: bad icmp syntax.\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1999-07-27 23:44:00 +00:00
|
|
|
return 1;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* UDP Syntax: [src op port] [dst op port]
|
|
|
|
*/
|
|
|
|
static int
|
2001-08-14 16:05:52 +00:00
|
|
|
ParseUdpOrTcp(int argc, char const *const *argv, const struct protoent *pe,
|
1998-05-21 21:49:08 +00:00
|
|
|
struct filterent *tgt)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_srcop = tgt->f_dstop = OP_NONE;
|
|
|
|
tgt->f_estab = tgt->f_syn = tgt->f_finrst = 0;
|
1997-10-23 10:09:35 +00:00
|
|
|
|
1997-10-26 01:04:02 +00:00
|
|
|
if (argc >= 3 && !strcmp(*argv, "src")) {
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_srcop = filter_Nam2Op(argv[1]);
|
|
|
|
if (tgt->f_srcop == OP_NONE) {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
2001-08-14 16:05:52 +00:00
|
|
|
if (pe == NULL)
|
|
|
|
return 0;
|
|
|
|
tgt->f_srcport = ParsePort(argv[2], pe->p_name);
|
1999-07-27 23:44:00 +00:00
|
|
|
if (tgt->f_srcport == 0)
|
|
|
|
return 0;
|
1997-08-25 00:29:32 +00:00
|
|
|
argc -= 3;
|
|
|
|
argv += 3;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1998-05-21 21:49:08 +00:00
|
|
|
|
1997-10-26 01:04:02 +00:00
|
|
|
if (argc >= 3 && !strcmp(argv[0], "dst")) {
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_dstop = filter_Nam2Op(argv[1]);
|
|
|
|
if (tgt->f_dstop == OP_NONE) {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "ParseUdpOrTcp: bad operator\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
2001-08-14 16:05:52 +00:00
|
|
|
if (pe == NULL)
|
|
|
|
return 0;
|
|
|
|
tgt->f_dstport = ParsePort(argv[2], pe->p_name);
|
1999-07-27 23:44:00 +00:00
|
|
|
if (tgt->f_dstport == 0)
|
|
|
|
return 0;
|
1997-08-25 00:29:32 +00:00
|
|
|
argc -= 3;
|
|
|
|
argv += 3;
|
1995-09-17 16:14:49 +00:00
|
|
|
}
|
1998-05-21 21:49:08 +00:00
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
if (pe && pe->p_proto == IPPROTO_TCP) {
|
1998-05-21 21:49:08 +00:00
|
|
|
for (; argc > 0; argc--, argv++)
|
|
|
|
if (!strcmp(*argv, "estab"))
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_estab = 1;
|
1998-05-21 21:49:08 +00:00
|
|
|
else if (!strcmp(*argv, "syn"))
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_syn = 1;
|
1998-05-21 21:49:08 +00:00
|
|
|
else if (!strcmp(*argv, "finrst"))
|
1999-07-27 23:44:00 +00:00
|
|
|
tgt->f_finrst = 1;
|
1998-05-21 21:49:08 +00:00
|
|
|
else
|
|
|
|
break;
|
1995-09-17 16:14:49 +00:00
|
|
|
}
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1998-05-21 21:49:08 +00:00
|
|
|
if (argc > 0) {
|
|
|
|
log_Printf(LogWARN, "ParseUdpOrTcp: bad src/dst port syntax: %s\n", *argv);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1999-08-02 11:53:16 +00:00
|
|
|
static int
|
2001-08-14 16:05:52 +00:00
|
|
|
ParseGeneric(int argc, char const * const *argv, const struct protoent *pe,
|
|
|
|
struct filterent *tgt)
|
1999-08-02 11:53:16 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Filter currently is a catch-all. Requests are either permitted or
|
|
|
|
* dropped.
|
|
|
|
*/
|
|
|
|
if (argc != 0) {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "ParseGeneric: Too many parameters\n");
|
1999-08-02 11:53:16 +00:00
|
|
|
return 0;
|
|
|
|
} else
|
2001-08-14 16:05:52 +00:00
|
|
|
tgt->f_srcop = tgt->f_dstop = OP_NONE;
|
1999-08-02 11:53:16 +00:00
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
1999-05-31 23:57:40 +00:00
|
|
|
static unsigned
|
|
|
|
addrtype(const char *addr)
|
|
|
|
{
|
|
|
|
if (!strncasecmp(addr, "MYADDR", 6) && (addr[6] == '\0' || addr[6] == '/'))
|
|
|
|
return T_MYADDR;
|
2001-08-14 16:05:52 +00:00
|
|
|
if (!strncasecmp(addr, "MYADDR6", 7) && (addr[7] == '\0' || addr[7] == '/'))
|
|
|
|
return T_MYADDR6;
|
1999-05-31 23:57:40 +00:00
|
|
|
if (!strncasecmp(addr, "HISADDR", 7) && (addr[7] == '\0' || addr[7] == '/'))
|
|
|
|
return T_HISADDR;
|
2001-08-14 16:05:52 +00:00
|
|
|
if (!strncasecmp(addr, "HISADDR6", 8) && (addr[8] == '\0' || addr[8] == '/'))
|
|
|
|
return T_HISADDR6;
|
2000-03-14 01:47:27 +00:00
|
|
|
if (!strncasecmp(addr, "DNS0", 4) && (addr[4] == '\0' || addr[4] == '/'))
|
|
|
|
return T_DNS0;
|
|
|
|
if (!strncasecmp(addr, "DNS1", 4) && (addr[4] == '\0' || addr[4] == '/'))
|
|
|
|
return T_DNS1;
|
1999-05-31 23:57:40 +00:00
|
|
|
|
|
|
|
return T_ADDR;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const char *
|
2001-08-14 16:05:52 +00:00
|
|
|
addrstr(struct ncprange *addr, unsigned type)
|
1999-05-31 23:57:40 +00:00
|
|
|
{
|
|
|
|
switch (type) {
|
|
|
|
case T_MYADDR:
|
|
|
|
return "MYADDR";
|
|
|
|
case T_HISADDR:
|
|
|
|
return "HISADDR";
|
2000-03-14 01:47:27 +00:00
|
|
|
case T_DNS0:
|
|
|
|
return "DNS0";
|
|
|
|
case T_DNS1:
|
|
|
|
return "DNS1";
|
1999-05-31 23:57:40 +00:00
|
|
|
}
|
2001-08-14 16:05:52 +00:00
|
|
|
return ncprange_ntoa(addr);
|
1999-07-27 23:44:00 +00:00
|
|
|
}
|
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
static int
|
2001-08-14 16:05:52 +00:00
|
|
|
filter_Parse(struct ncp *ncp, int argc, char const *const *argv,
|
|
|
|
struct filterent *ofp)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
2001-08-14 16:05:52 +00:00
|
|
|
struct filterent fe;
|
|
|
|
struct protoent *pe;
|
1995-01-31 06:29:58 +00:00
|
|
|
char *wp;
|
2001-08-14 16:05:52 +00:00
|
|
|
int action, family, ruleno, val, width;
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1999-07-27 23:44:00 +00:00
|
|
|
ruleno = strtol(*argv, &wp, 0);
|
|
|
|
if (*argv == wp || ruleno >= MAXFILTERS) {
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogWARN, "Parse: invalid filter number.\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1999-07-27 23:44:00 +00:00
|
|
|
if (ruleno < 0) {
|
|
|
|
for (ruleno = 0; ruleno < MAXFILTERS; ruleno++) {
|
|
|
|
ofp->f_action = A_NONE;
|
1995-01-31 06:29:58 +00:00
|
|
|
ofp++;
|
|
|
|
}
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogWARN, "Parse: filter cleared.\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 1;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1999-07-27 23:44:00 +00:00
|
|
|
ofp += ruleno;
|
1995-01-31 06:29:58 +00:00
|
|
|
|
|
|
|
if (--argc == 0) {
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogWARN, "Parse: missing action.\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
argv++;
|
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
memset(&fe, '\0', sizeof fe);
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1999-07-27 23:44:00 +00:00
|
|
|
val = strtol(*argv, &wp, 0);
|
|
|
|
if (!*wp && val >= 0 && val < MAXFILTERS) {
|
|
|
|
if (val <= ruleno) {
|
|
|
|
log_Printf(LogWARN, "Parse: Can only jump forward from rule %d\n",
|
|
|
|
ruleno);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
action = val;
|
|
|
|
} else if (!strcmp(*argv, "permit")) {
|
1995-01-31 06:29:58 +00:00
|
|
|
action = A_PERMIT;
|
1997-10-26 01:04:02 +00:00
|
|
|
} else if (!strcmp(*argv, "deny")) {
|
1995-01-31 06:29:58 +00:00
|
|
|
action = A_DENY;
|
1997-10-26 01:04:02 +00:00
|
|
|
} else if (!strcmp(*argv, "clear")) {
|
1999-07-27 23:44:00 +00:00
|
|
|
ofp->f_action = A_NONE;
|
|
|
|
return 1;
|
1995-01-31 06:29:58 +00:00
|
|
|
} else {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "Parse: %s: bad action\n", *argv);
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
2001-08-14 16:05:52 +00:00
|
|
|
fe.f_action = action;
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1997-08-25 00:29:32 +00:00
|
|
|
argc--;
|
|
|
|
argv++;
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1999-07-27 23:44:00 +00:00
|
|
|
if (argc && argv[0][0] == '!' && !argv[0][1]) {
|
2001-08-14 16:05:52 +00:00
|
|
|
fe.f_invert = 1;
|
1999-07-27 23:44:00 +00:00
|
|
|
argc--;
|
|
|
|
argv++;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
1999-01-28 01:56:34 +00:00
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
ncprange_init(&fe.f_src);
|
|
|
|
ncprange_init(&fe.f_dst);
|
|
|
|
|
|
|
|
if (argc == 0)
|
|
|
|
pe = NULL;
|
|
|
|
else if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
|
|
|
|
if (argc < 2) {
|
|
|
|
log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
|
|
|
|
return 0;
|
|
|
|
} else if (strcasecmp(*argv, "any") == 0 ||
|
|
|
|
ncprange_aton(&fe.f_src, ncp, *argv)) {
|
|
|
|
family = ncprange_family(&fe.f_src);
|
|
|
|
if (!ncprange_getwidth(&fe.f_src, &width))
|
|
|
|
width = 0;
|
|
|
|
if (width == 0)
|
|
|
|
ncprange_init(&fe.f_src);
|
|
|
|
fe.f_srctype = addrtype(*argv);
|
1997-08-25 00:29:32 +00:00
|
|
|
argc--;
|
|
|
|
argv++;
|
2001-08-14 16:05:52 +00:00
|
|
|
|
|
|
|
if (strcasecmp(*argv, "any") == 0 ||
|
|
|
|
ncprange_aton(&fe.f_dst, ncp, *argv)) {
|
|
|
|
if (ncprange_family(&fe.f_dst) != AF_UNSPEC &&
|
|
|
|
ncprange_family(&fe.f_src) != AF_UNSPEC &&
|
|
|
|
family != ncprange_family(&fe.f_dst)) {
|
|
|
|
log_Printf(LogWARN, "Parse: src and dst address families differ\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!ncprange_getwidth(&fe.f_dst, &width))
|
|
|
|
width = 0;
|
|
|
|
if (width == 0)
|
|
|
|
ncprange_init(&fe.f_dst);
|
|
|
|
fe.f_dsttype = addrtype(*argv);
|
|
|
|
argc--;
|
|
|
|
argv++;
|
1997-07-27 23:26:23 +00:00
|
|
|
} else {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (argc) {
|
|
|
|
if ((pe = getprotobyname(*argv)) == NULL && strcmp(*argv, "all") != 0) {
|
|
|
|
log_Printf(LogWARN, "Parse: %s: Protocol expected\n", *argv);
|
|
|
|
return 0;
|
|
|
|
} else {
|
|
|
|
argc--;
|
|
|
|
argv++;
|
|
|
|
}
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
} else {
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogWARN, "Parse: Protocol or address pair expected\n");
|
1999-07-27 23:44:00 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
} else {
|
1997-08-25 00:29:32 +00:00
|
|
|
argc--;
|
|
|
|
argv++;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
if (argc >= 2 && strcmp(*argv, "timeout") == 0) {
|
|
|
|
fe.timeout = strtoul(argv[1], NULL, 10);
|
2000-07-11 22:11:36 +00:00
|
|
|
argc -= 2;
|
2001-08-14 16:05:52 +00:00
|
|
|
argv += 2;
|
2000-07-11 22:11:36 +00:00
|
|
|
}
|
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
val = 1;
|
2001-08-14 16:05:52 +00:00
|
|
|
fe.f_proto = (pe == NULL) ? 0 : pe->p_proto;
|
|
|
|
|
|
|
|
switch (fe.f_proto) {
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
case IPPROTO_IPIP:
|
|
|
|
#ifndef NOINET6
|
|
|
|
case IPPROTO_IPV6:
|
1999-09-30 07:23:13 +00:00
|
|
|
#endif
|
2001-08-14 16:05:52 +00:00
|
|
|
val = ParseUdpOrTcp(argc, argv, pe, &fe);
|
1999-09-30 07:23:13 +00:00
|
|
|
break;
|
2001-08-14 16:05:52 +00:00
|
|
|
case IPPROTO_ICMP:
|
|
|
|
#ifndef NOINET6
|
|
|
|
case IPPROTO_ICMPV6:
|
1999-08-02 15:29:19 +00:00
|
|
|
#endif
|
2001-08-14 16:05:52 +00:00
|
|
|
val = ParseIcmp(argc, argv, pe, &fe);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
val = ParseGeneric(argc, argv, pe, &fe);
|
|
|
|
break;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
log_Printf(LogDEBUG, "Parse: Src: %s\n", ncprange_ntoa(&fe.f_src));
|
|
|
|
log_Printf(LogDEBUG, "Parse: Dst: %s\n", ncprange_ntoa(&fe.f_dst));
|
|
|
|
log_Printf(LogDEBUG, "Parse: Proto: %d\n", fe.f_proto);
|
1995-01-31 06:29:58 +00:00
|
|
|
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogDEBUG, "Parse: src: %s (%d)\n",
|
2001-08-14 16:05:52 +00:00
|
|
|
filter_Op2Nam(fe.f_srcop), fe.f_srcport);
|
1998-05-21 21:49:08 +00:00
|
|
|
log_Printf(LogDEBUG, "Parse: dst: %s (%d)\n",
|
2001-08-14 16:05:52 +00:00
|
|
|
filter_Op2Nam(fe.f_dstop), fe.f_dstport);
|
|
|
|
log_Printf(LogDEBUG, "Parse: estab: %u\n", fe.f_estab);
|
|
|
|
log_Printf(LogDEBUG, "Parse: syn: %u\n", fe.f_syn);
|
|
|
|
log_Printf(LogDEBUG, "Parse: finrst: %u\n", fe.f_finrst);
|
1995-01-31 06:29:58 +00:00
|
|
|
|
|
|
|
if (val)
|
2001-08-14 16:05:52 +00:00
|
|
|
*ofp = fe;
|
1999-07-27 23:44:00 +00:00
|
|
|
|
|
|
|
return val;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
1998-05-21 21:49:08 +00:00
|
|
|
filter_Set(struct cmdargs const *arg)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
1998-05-21 21:49:08 +00:00
|
|
|
struct filter *filter;
|
|
|
|
|
|
|
|
if (arg->argc < arg->argn+2)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
if (!strcmp(arg->argv[arg->argn], "in"))
|
|
|
|
filter = &arg->bundle->filter.in;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "out"))
|
|
|
|
filter = &arg->bundle->filter.out;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "dial"))
|
|
|
|
filter = &arg->bundle->filter.dial;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "alive"))
|
|
|
|
filter = &arg->bundle->filter.alive;
|
|
|
|
else {
|
|
|
|
log_Printf(LogWARN, "filter_Set: %s: Invalid filter name.\n",
|
|
|
|
arg->argv[arg->argn]);
|
|
|
|
return -1;
|
1997-06-09 03:27:43 +00:00
|
|
|
}
|
1995-01-31 06:29:58 +00:00
|
|
|
|
2001-08-14 16:05:52 +00:00
|
|
|
filter_Parse(&arg->bundle->ncp, arg->argc - arg->argn - 1,
|
1998-05-21 21:49:08 +00:00
|
|
|
arg->argv + arg->argn + 1, filter->rule);
|
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
1998-05-21 21:49:08 +00:00
|
|
|
const char *
|
|
|
|
filter_Action2Nam(int act)
|
1995-02-26 12:18:08 +00:00
|
|
|
{
|
1999-12-27 11:54:57 +00:00
|
|
|
static const char * const actname[] = { " none ", "permit ", " deny " };
|
1999-07-27 23:44:00 +00:00
|
|
|
static char buf[8];
|
|
|
|
|
|
|
|
if (act >= 0 && act < MAXFILTERS) {
|
1999-07-28 03:01:52 +00:00
|
|
|
snprintf(buf, sizeof buf, "%6d ", act);
|
1999-07-27 23:44:00 +00:00
|
|
|
return buf;
|
|
|
|
} else if (act >= A_NONE && act < A_NONE + sizeof(actname)/sizeof(char *))
|
|
|
|
return actname[act - A_NONE];
|
|
|
|
else
|
|
|
|
return "?????? ";
|
1995-02-26 12:18:08 +00:00
|
|
|
}
|
|
|
|
|
1995-01-31 06:29:58 +00:00
|
|
|
static void
|
1998-05-21 21:49:08 +00:00
|
|
|
doShowFilter(struct filterent *fp, struct prompt *prompt)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
2001-08-14 16:05:52 +00:00
|
|
|
struct protoent *pe;
|
1995-01-31 06:29:58 +00:00
|
|
|
int n;
|
|
|
|
|
|
|
|
for (n = 0; n < MAXFILTERS; n++, fp++) {
|
1999-07-27 23:44:00 +00:00
|
|
|
if (fp->f_action != A_NONE) {
|
|
|
|
prompt_Printf(prompt, " %2d %s", n, filter_Action2Nam(fp->f_action));
|
|
|
|
prompt_Printf(prompt, "%c ", fp->f_invert ? '!' : ' ');
|
2001-08-14 16:05:52 +00:00
|
|
|
|
|
|
|
if (ncprange_isset(&fp->f_src))
|
|
|
|
prompt_Printf(prompt, "%s ", addrstr(&fp->f_src, fp->f_srctype));
|
|
|
|
else
|
|
|
|
prompt_Printf(prompt, "any ");
|
|
|
|
|
|
|
|
if (ncprange_isset(&fp->f_dst))
|
|
|
|
prompt_Printf(prompt, "%s ", addrstr(&fp->f_dst, fp->f_dsttype));
|
|
|
|
else
|
|
|
|
prompt_Printf(prompt, "any ");
|
|
|
|
|
1999-07-27 23:44:00 +00:00
|
|
|
if (fp->f_proto) {
|
2001-08-14 16:05:52 +00:00
|
|
|
if ((pe = getprotobynumber(fp->f_proto)) == NULL)
|
|
|
|
prompt_Printf(prompt, "P:%d", fp->f_proto);
|
|
|
|
else
|
|
|
|
prompt_Printf(prompt, "%s", pe->p_name);
|
1999-07-27 23:44:00 +00:00
|
|
|
|
|
|
|
if (fp->f_srcop)
|
|
|
|
prompt_Printf(prompt, " src %s %d", filter_Op2Nam(fp->f_srcop),
|
|
|
|
fp->f_srcport);
|
|
|
|
if (fp->f_dstop)
|
|
|
|
prompt_Printf(prompt, " dst %s %d", filter_Op2Nam(fp->f_dstop),
|
|
|
|
fp->f_dstport);
|
|
|
|
if (fp->f_estab)
|
1998-05-21 21:49:08 +00:00
|
|
|
prompt_Printf(prompt, " estab");
|
1999-07-27 23:44:00 +00:00
|
|
|
if (fp->f_syn)
|
1998-05-21 21:49:08 +00:00
|
|
|
prompt_Printf(prompt, " syn");
|
1999-07-27 23:44:00 +00:00
|
|
|
if (fp->f_finrst)
|
1998-05-21 21:49:08 +00:00
|
|
|
prompt_Printf(prompt, " finrst");
|
2001-08-14 16:05:52 +00:00
|
|
|
} else
|
|
|
|
prompt_Printf(prompt, "all");
|
2000-07-11 22:11:36 +00:00
|
|
|
if (fp->timeout != 0)
|
|
|
|
prompt_Printf(prompt, " timeout %u", fp->timeout);
|
1998-05-21 21:49:08 +00:00
|
|
|
prompt_Printf(prompt, "\n");
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int
|
1998-05-21 21:49:08 +00:00
|
|
|
filter_Show(struct cmdargs const *arg)
|
1995-01-31 06:29:58 +00:00
|
|
|
{
|
1998-05-21 21:49:08 +00:00
|
|
|
if (arg->argc > arg->argn+1)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
if (arg->argc == arg->argn+1) {
|
|
|
|
struct filter *filter;
|
|
|
|
|
|
|
|
if (!strcmp(arg->argv[arg->argn], "in"))
|
|
|
|
filter = &arg->bundle->filter.in;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "out"))
|
|
|
|
filter = &arg->bundle->filter.out;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "dial"))
|
|
|
|
filter = &arg->bundle->filter.dial;
|
|
|
|
else if (!strcmp(arg->argv[arg->argn], "alive"))
|
|
|
|
filter = &arg->bundle->filter.alive;
|
|
|
|
else
|
|
|
|
return -1;
|
|
|
|
doShowFilter(filter->rule, arg->prompt);
|
|
|
|
} else {
|
|
|
|
struct filter *filter[4];
|
|
|
|
int f;
|
|
|
|
|
|
|
|
filter[0] = &arg->bundle->filter.in;
|
|
|
|
filter[1] = &arg->bundle->filter.out;
|
|
|
|
filter[2] = &arg->bundle->filter.dial;
|
|
|
|
filter[3] = &arg->bundle->filter.alive;
|
|
|
|
for (f = 0; f < 4; f++) {
|
|
|
|
if (f)
|
|
|
|
prompt_Printf(arg->prompt, "\n");
|
|
|
|
prompt_Printf(arg->prompt, "%s:\n", filter[f]->name);
|
|
|
|
doShowFilter(filter[f]->rule, arg->prompt);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1997-06-09 03:27:43 +00:00
|
|
|
return 0;
|
1995-01-31 06:29:58 +00:00
|
|
|
}
|
|
|
|
|
1999-12-27 11:54:57 +00:00
|
|
|
static const char * const opname[] = {"none", "eq", "gt", "lt"};
|
1998-05-21 21:49:08 +00:00
|
|
|
|
|
|
|
const char *
|
|
|
|
filter_Op2Nam(int op)
|
1995-02-26 12:18:08 +00:00
|
|
|
{
|
1998-05-21 21:49:08 +00:00
|
|
|
if (op >= sizeof opname / sizeof opname[0])
|
|
|
|
return "unknown";
|
|
|
|
return opname[op];
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
filter_Nam2Op(const char *cp)
|
|
|
|
{
|
|
|
|
int op;
|
|
|
|
|
|
|
|
for (op = sizeof opname / sizeof opname[0] - 1; op; op--)
|
|
|
|
if (!strcasecmp(cp, opname[op]))
|
|
|
|
break;
|
|
|
|
|
|
|
|
return op;
|
1995-02-26 12:18:08 +00:00
|
|
|
}
|
1999-05-31 23:57:40 +00:00
|
|
|
|
|
|
|
void
|
2001-08-14 16:05:52 +00:00
|
|
|
filter_AdjustAddr(struct filter *filter, struct ncpaddr *local,
|
|
|
|
struct ncpaddr *remote, struct in_addr *dns)
|
1999-05-31 23:57:40 +00:00
|
|
|
{
|
|
|
|
struct filterent *fp;
|
|
|
|
int n;
|
|
|
|
|
|
|
|
for (fp = filter->rule, n = 0; n < MAXFILTERS; fp++, n++)
|
1999-07-27 23:44:00 +00:00
|
|
|
if (fp->f_action != A_NONE) {
|
2001-08-14 16:05:52 +00:00
|
|
|
if (local) {
|
|
|
|
if (fp->f_srctype == T_MYADDR && ncpaddr_family(local) == AF_INET)
|
|
|
|
ncprange_sethost(&fp->f_src, local);
|
|
|
|
if (fp->f_dsttype == T_MYADDR && ncpaddr_family(local) == AF_INET)
|
|
|
|
ncprange_sethost(&fp->f_dst, local);
|
|
|
|
#ifndef NOINET6
|
|
|
|
if (fp->f_srctype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
|
|
|
|
ncprange_sethost(&fp->f_src, local);
|
|
|
|
if (fp->f_dsttype == T_MYADDR6 && ncpaddr_family(local) == AF_INET6)
|
|
|
|
ncprange_sethost(&fp->f_dst, local);
|
|
|
|
#endif
|
1999-05-31 23:57:40 +00:00
|
|
|
}
|
2001-08-14 16:05:52 +00:00
|
|
|
if (remote) {
|
|
|
|
if (fp->f_srctype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
|
|
|
|
ncprange_sethost(&fp->f_src, remote);
|
|
|
|
if (fp->f_dsttype == T_HISADDR && ncpaddr_family(remote) == AF_INET)
|
|
|
|
ncprange_sethost(&fp->f_dst, remote);
|
|
|
|
#ifndef NOINET6
|
|
|
|
if (fp->f_srctype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
|
|
|
|
ncprange_sethost(&fp->f_src, remote);
|
|
|
|
if (fp->f_dsttype == T_HISADDR6 && ncpaddr_family(remote) == AF_INET6)
|
|
|
|
ncprange_sethost(&fp->f_dst, remote);
|
|
|
|
#endif
|
1999-05-31 23:57:40 +00:00
|
|
|
}
|
2000-03-14 01:47:27 +00:00
|
|
|
if (dns) {
|
|
|
|
if (fp->f_srctype == T_DNS0)
|
2001-08-14 16:05:52 +00:00
|
|
|
ncprange_setip4host(&fp->f_src, dns[0]);
|
2000-03-14 01:47:27 +00:00
|
|
|
if (fp->f_dsttype == T_DNS0)
|
2001-08-14 16:05:52 +00:00
|
|
|
ncprange_setip4host(&fp->f_dst, dns[0]);
|
2000-03-14 01:47:27 +00:00
|
|
|
if (fp->f_srctype == T_DNS1)
|
2001-08-14 16:05:52 +00:00
|
|
|
ncprange_setip4host(&fp->f_src, dns[1]);
|
2000-03-14 01:47:27 +00:00
|
|
|
if (fp->f_dsttype == T_DNS1)
|
2001-08-14 16:05:52 +00:00
|
|
|
ncprange_setip4host(&fp->f_dst, dns[1]);
|
2000-03-14 01:47:27 +00:00
|
|
|
}
|
1999-05-31 23:57:40 +00:00
|
|
|
}
|
|
|
|
}
|