1 /* $FreeBSD$ */
2
3 /*
4 * Copyright (C) 2012 by Darren Reed.
5 *
6 * See the IPFILTER.LICENCE file for details on licencing.
7 *
8 * $Id$
9 */
10 #if !defined(lint)
11 static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed";
12 static const char rcsid[] = "@(#)$Id$";
13 #endif
14
15 #include <ctype.h>
16
17 #include "ipf.h"
18 #include "ipt.h"
19
20 extern int opts;
21
22 static char *tx_proto = "";
23
24 static int text_open __P((char *)), text_close __P((void));
25 static int text_readip __P((mb_t *, char **, int *));
26 static int parseline __P((char *, ip_t *, char **, int *));
27
28 static char myflagset[] = "FSRPAUEC";
29 static u_char myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH,
30 TH_ACK, TH_URG, TH_ECN, TH_CWR };
31
32 struct ipread iptext = { text_open, text_close, text_readip, R_DO_CKSUM };
33 static FILE *tfp = NULL;
34 static int tfd = -1;
35
36 static u_32_t tx_hostnum __P((char *, int *));
37 static u_short tx_portnum __P((char *));
38
39 #ifdef USE_INET6
40 int parseipv6 __P((char **, ip6_t *, char **, int *));
41 #endif
42
43 /*
44 * returns an ip address as a long var as a result of either a DNS lookup or
45 * straight inet_addr() call
46 */
tx_hostnum(host,resolved)47 static u_32_t tx_hostnum(host, resolved)
48 char *host;
49 int *resolved;
50 {
51 i6addr_t ipa;
52
53 *resolved = 0;
54 if (!strcasecmp("any", host))
55 return 0L;
56 if (ISDIGIT(*host))
57 return inet_addr(host);
58
59 if (gethost(AF_INET, host, &ipa) == -1) {
60 *resolved = -1;
61 fprintf(stderr, "can't resolve hostname: %s\n", host);
62 return 0;
63 }
64 return ipa.in4.s_addr;
65 }
66
67
68 /*
69 * find the port number given by the name, either from getservbyname() or
70 * straight atoi()
71 */
tx_portnum(name)72 static u_short tx_portnum(name)
73 char *name;
74 {
75 struct servent *sp;
76
77 if (ISDIGIT(*name))
78 return (u_short)atoi(name);
79 sp = getservbyname(name, tx_proto);
80 if (sp)
81 return ntohs(sp->s_port);
82 (void) fprintf(stderr, "unknown service \"%s\".\n", name);
83 return 0;
84 }
85
86
text_open(fname)87 static int text_open(fname)
88 char *fname;
89 {
90 if (tfp && tfd != -1) {
91 rewind(tfp);
92 return tfd;
93 }
94
95 if (!strcmp(fname, "-")) {
96 tfd = 0;
97 tfp = stdin;
98 } else {
99 tfd = open(fname, O_RDONLY);
100 if (tfd != -1)
101 tfp = fdopen(tfd, "r");
102 }
103 return tfd;
104 }
105
106
text_close()107 static int text_close()
108 {
109 int cfd = tfd;
110
111 tfd = -1;
112 return close(cfd);
113 }
114
115
text_readip(mb,ifn,dir)116 static int text_readip(mb, ifn, dir)
117 mb_t *mb;
118 char **ifn;
119 int *dir;
120 {
121 register char *s;
122 char line[513];
123 ip_t *ip;
124 char *buf;
125 int cnt;
126
127 buf = (char *)mb->mb_buf;
128 cnt = sizeof(mb->mb_buf);
129
130 *ifn = NULL;
131 while (fgets(line, sizeof(line)-1, tfp)) {
132 if ((s = strchr(line, '\n')))
133 *s = '\0';
134 if ((s = strchr(line, '\r')))
135 *s = '\0';
136 if ((s = strchr(line, '#')))
137 *s = '\0';
138 if (!*line)
139 continue;
140 if ((opts & OPT_DEBUG) != 0)
141 printf("input: %s\n", line);
142 *ifn = NULL;
143 *dir = 0;
144 if (!parseline(line, (ip_t *)buf, ifn, dir)) {
145 ip = (ip_t *)buf;
146 if (IP_V(ip) == 6) {
147 #ifdef USE_INET6
148 mb->mb_len = ntohs(((ip6_t *)ip)->ip6_plen) +
149 sizeof(ip6_t);
150 #else
151 mb->mb_len = 0;
152 #endif
153 } else {
154 mb->mb_len = ntohs(ip->ip_len);
155 }
156 return mb->mb_len;
157 }
158 }
159 if (feof(tfp))
160 return 0;
161 return -1;
162 }
163
parseline(line,ip,ifn,out)164 static int parseline(line, ip, ifn, out)
165 char *line;
166 ip_t *ip;
167 char **ifn;
168 int *out;
169 {
170 tcphdr_t th, *tcp = &th;
171 struct icmp icmp, *ic = &icmp;
172 char *cps[20], **cpp, c, ipopts[68];
173 int i, r;
174
175 if (*ifn)
176 free(*ifn);
177 bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip));
178 bzero((char *)tcp, sizeof(*tcp));
179 bzero((char *)ic, sizeof(*ic));
180 bzero(ipopts, sizeof(ipopts));
181 IP_HL_A(ip, sizeof(*ip) >> 2);
182 IP_V_A(ip, IPVERSION);
183 ip->ip_ttl = 63;
184 for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; )
185 cps[++i] = strtok(NULL, " \b\t\r\n");
186
187 cpp = cps;
188 if (!*cpp)
189 return 1;
190
191 c = **cpp;
192 if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) {
193 fprintf(stderr, "bad direction \"%s\"\n", *cpp);
194 return 1;
195 }
196
197 #ifdef USE_INET6
198 if (!strcasecmp(*cpp, "out6") || !strcasecmp(*cpp, "in6")) {
199 return parseipv6(cpp, (ip6_t *)ip, ifn, out);
200 }
201 #endif
202
203 *out = (TOLOWER(c) == 'o') ? 1 : 0;
204 cpp++;
205 if (!*cpp)
206 return 1;
207
208 if (!strcasecmp(*cpp, "on")) {
209 cpp++;
210 if (!*cpp)
211 return 1;
212 *ifn = strdup(*cpp++);
213 if (!*cpp)
214 return 1;
215 }
216
217 c = **cpp;
218 ip->ip_len = sizeof(ip_t);
219 if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") ||
220 !strcasecmp(*cpp, "icmp")) {
221 if (c == 't') {
222 ip->ip_p = IPPROTO_TCP;
223 ip->ip_len += sizeof(struct tcphdr);
224 tx_proto = "tcp";
225 } else if (c == 'u') {
226 ip->ip_p = IPPROTO_UDP;
227 ip->ip_len += sizeof(struct udphdr);
228 tx_proto = "udp";
229 } else {
230 ip->ip_p = IPPROTO_ICMP;
231 ip->ip_len += ICMPERR_IPICMPHLEN;
232 tx_proto = "icmp";
233 }
234 cpp++;
235 } else if (ISDIGIT(**cpp) && !index(*cpp, '.')) {
236 ip->ip_p = atoi(*cpp);
237 cpp++;
238 } else
239 ip->ip_p = IPPROTO_IP;
240
241 if (!*cpp)
242 return 1;
243 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
244 char *last;
245
246 last = strchr(*cpp, ',');
247 if (!last) {
248 fprintf(stderr, "tcp/udp with no source port\n");
249 return 1;
250 }
251 *last++ = '\0';
252 tcp->th_sport = htons(tx_portnum(last));
253 if (ip->ip_p == IPPROTO_TCP) {
254 tcp->th_win = htons(4096);
255 TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
256 }
257 }
258 ip->ip_src.s_addr = tx_hostnum(*cpp, &r);
259 cpp++;
260 if (!*cpp)
261 return 1;
262
263 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) {
264 char *last;
265
266 last = strchr(*cpp, ',');
267 if (!last) {
268 fprintf(stderr, "tcp/udp with no destination port\n");
269 return 1;
270 }
271 *last++ = '\0';
272 tcp->th_dport = htons(tx_portnum(last));
273 }
274 ip->ip_dst.s_addr = tx_hostnum(*cpp, &r);
275 cpp++;
276 if (ip->ip_p == IPPROTO_TCP) {
277 if (*cpp != NULL) {
278 char *s, *t;
279
280 tcp->th_flags = 0;
281 for (s = *cpp; *s; s++)
282 if ((t = strchr(myflagset, *s)))
283 tcp->th_flags |= myflags[t-myflagset];
284 if (tcp->th_flags)
285 cpp++;
286 }
287
288 if (tcp->th_flags & TH_URG)
289 tcp->th_urp = htons(1);
290
291 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
292 tcp->th_seq = htonl(atoi(*cpp + 4));
293 cpp++;
294 }
295
296 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
297 tcp->th_ack = htonl(atoi(*cpp + 4));
298 cpp++;
299 }
300 } else if (*cpp && ip->ip_p == IPPROTO_ICMP) {
301 char *t;
302
303 t = strchr(*cpp, ',');
304 if (t != NULL)
305 *t = '\0';
306
307 ic->icmp_type = geticmptype(AF_INET, *cpp);
308 if (t != NULL)
309 ic->icmp_code = atoi(t + 1);
310 cpp++;
311
312 if (ic->icmp_type == ICMP_ECHO ||
313 ic->icmp_type == ICMP_ECHOREPLY)
314 ic->icmp_id = htons(getpid());
315 if (t != NULL)
316 *t = ',';
317 }
318
319 if (*cpp && !strcasecmp(*cpp, "opt")) {
320 u_long olen;
321
322 cpp++;
323 olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2);
324 if (olen) {
325 bcopy(ipopts, (char *)(ip + 1), olen);
326 IP_HL_A(ip, IP_HL(ip) + (olen >> 2));
327 ip->ip_len += olen;
328 }
329 }
330 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP)
331 bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2),
332 sizeof(*tcp));
333 else if (ip->ip_p == IPPROTO_ICMP)
334 bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2),
335 sizeof(*ic));
336 ip->ip_len = htons(ip->ip_len);
337 return 0;
338 }
339
340
341 #ifdef USE_INET6
parseipv6(cpp,ip6,ifn,out)342 int parseipv6(cpp, ip6, ifn, out)
343 char **cpp;
344 ip6_t *ip6;
345 char **ifn;
346 int *out;
347 {
348 tcphdr_t th, *tcp = &th;
349 struct icmp6_hdr icmp, *ic6 = &icmp;
350
351 bzero((char *)ip6, MAX(sizeof(*tcp), sizeof(*ic6)) + sizeof(*ip6));
352 bzero((char *)tcp, sizeof(*tcp));
353 bzero((char *)ic6, sizeof(*ic6));
354 ip6->ip6_vfc = 0x60;
355
356 *out = (**cpp == 'o') ? 1 : 0;
357 cpp++;
358 if (!*cpp)
359 return 1;
360
361 if (!strcasecmp(*cpp, "on")) {
362 cpp++;
363 if (!*cpp)
364 return 1;
365 *ifn = strdup(*cpp++);
366 if (!*cpp)
367 return 1;
368 }
369
370 if (!strcasecmp(*cpp, "tcp")) {
371 ip6->ip6_nxt = IPPROTO_TCP;
372 tx_proto = "tcp";
373 cpp++;
374 } else if (!strcasecmp(*cpp, "udp")) {
375 ip6->ip6_nxt = IPPROTO_UDP;
376 tx_proto = "udp";
377 cpp++;
378 } else if (!strcasecmp(*cpp, "icmpv6")) {
379 ip6->ip6_nxt = IPPROTO_ICMPV6;
380 tx_proto = "icmpv6";
381 cpp++;
382 } else if (ISDIGIT(**cpp) && !index(*cpp, ':')) {
383 ip6->ip6_nxt = atoi(*cpp);
384 cpp++;
385 } else
386 ip6->ip6_nxt = IPPROTO_IPV6;
387
388 if (!*cpp)
389 return 1;
390
391 switch (ip6->ip6_nxt)
392 {
393 case IPPROTO_TCP :
394 ip6->ip6_plen = sizeof(struct tcphdr);
395 break;
396 case IPPROTO_UDP :
397 ip6->ip6_plen = sizeof(struct udphdr);
398 break;
399 case IPPROTO_ICMPV6 :
400 ip6->ip6_plen = ICMP6ERR_IPICMPHLEN;
401 break;
402 default :
403 break;
404 }
405
406 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
407 char *last;
408
409 last = strchr(*cpp, ',');
410 if (!last) {
411 fprintf(stderr, "tcp/udp with no source port\n");
412 return 1;
413 }
414 *last++ = '\0';
415 tcp->th_sport = htons(tx_portnum(last));
416 if (ip6->ip6_nxt == IPPROTO_TCP) {
417 tcp->th_win = htons(4096);
418 TCP_OFF_A(tcp, sizeof(*tcp) >> 2);
419 }
420 }
421
422 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_src) != 1) {
423 fprintf(stderr, "cannot parse source address '%s'\n", *cpp);
424 return 1;
425 }
426
427 cpp++;
428 if (!*cpp)
429 return 1;
430
431 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
432 char *last;
433
434 last = strchr(*cpp, ',');
435 if (!last) {
436 fprintf(stderr, "tcp/udp with no destination port\n");
437 return 1;
438 }
439 *last++ = '\0';
440 tcp->th_dport = htons(tx_portnum(last));
441 }
442
443 if (inet_pton(AF_INET6, *cpp, &ip6->ip6_dst) != 1) {
444 fprintf(stderr, "cannot parse destination address '%s'\n",
445 *cpp);
446 return 1;
447 }
448
449 cpp++;
450 if (ip6->ip6_nxt == IPPROTO_TCP) {
451 if (*cpp != NULL) {
452 char *s, *t;
453
454 tcp->th_flags = 0;
455 for (s = *cpp; *s; s++)
456 if ((t = strchr(myflagset, *s)))
457 tcp->th_flags |= myflags[t-myflagset];
458 if (tcp->th_flags)
459 cpp++;
460 }
461
462 if (tcp->th_flags & TH_URG)
463 tcp->th_urp = htons(1);
464
465 if (*cpp && !strncasecmp(*cpp, "seq=", 4)) {
466 tcp->th_seq = htonl(atoi(*cpp + 4));
467 cpp++;
468 }
469
470 if (*cpp && !strncasecmp(*cpp, "ack=", 4)) {
471 tcp->th_ack = htonl(atoi(*cpp + 4));
472 cpp++;
473 }
474 } else if (*cpp && ip6->ip6_nxt == IPPROTO_ICMPV6) {
475 char *t;
476
477 t = strchr(*cpp, ',');
478 if (t != NULL)
479 *t = '\0';
480
481 ic6->icmp6_type = geticmptype(AF_INET6, *cpp);
482 if (t != NULL)
483 ic6->icmp6_code = atoi(t + 1);
484
485 if (ic6->icmp6_type == ICMP6_ECHO_REQUEST ||
486 ic6->icmp6_type == ICMP6_ECHO_REPLY)
487 ic6->icmp6_id = htons(getpid());
488
489 if (t != NULL)
490 *t = ',';
491 }
492
493 if (ip6->ip6_nxt == IPPROTO_TCP || ip6->ip6_nxt == IPPROTO_UDP) {
494 bcopy((char *)tcp, (char *)ip6 + sizeof(*ip6),
495 sizeof(*tcp));
496 } else if (ip6->ip6_nxt == IPPROTO_ICMPV6) {
497 bcopy((char *)ic6, (char *)ip6 + sizeof(*ip6),
498 sizeof(*ic6));
499 }
500
501 /*
502 * Because a length of 0 == jumbo gram...
503 */
504 if (ip6->ip6_plen == 0) {
505 ip6->ip6_plen++;
506 }
507 ip6->ip6_plen = htons(ip6->ip6_plen);
508 return 0;
509 }
510 #endif
511