1 /* $OpenBSD: tcpdrop.c,v 1.4 2004/05/22 23:55:22 deraadt Exp $ */
2
3 /*-
4 * Copyright (c) 2009 Juli Mallett <jmallett@FreeBSD.org>
5 * Copyright (c) 2004 Markus Friedl <markus@openbsd.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
22
23 #include <sys/param.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
26 #include <sys/socketvar.h>
27 #include <sys/sysctl.h>
28
29 #include <netinet/in.h>
30 #include <netinet/in_pcb.h>
31 #define TCPSTATES
32 #include <netinet/tcp_fsm.h>
33 #include <netinet/tcp_var.h>
34
35 #include <err.h>
36 #include <netdb.h>
37 #include <stdbool.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <unistd.h>
42
43 #define TCPDROP_FOREIGN 0
44 #define TCPDROP_LOCAL 1
45
46 struct host_service {
47 char hs_host[NI_MAXHOST];
48 char hs_service[NI_MAXSERV];
49 };
50
51 static bool tcpdrop_list_commands = false;
52
53 static char *findport(const char *);
54 static struct xtcpcb *tcpcblist(const char *, size_t *);
55 static void sockinfo(const struct sockaddr *, struct host_service *);
56 static bool tcpdrop(const struct sockaddr *, const struct sockaddr *);
57 static bool tcpdropall(void);
58 static bool tcpdropbyname(const char *, const char *, const char *,
59 const char *);
60 static bool tcpdropconn(const struct in_conninfo *);
61 static void usage(void);
62
63 /*
64 * Drop a tcp connection.
65 */
66 int
main(int argc,char * argv[])67 main(int argc, char *argv[])
68 {
69 char *lport, *fport;
70 bool dropall;
71 int ch;
72
73 dropall = false;
74
75 while ((ch = getopt(argc, argv, "al")) != -1) {
76 switch (ch) {
77 case 'a':
78 dropall = true;
79 break;
80 case 'l':
81 tcpdrop_list_commands = true;
82 break;
83 default:
84 usage();
85 }
86 }
87 argc -= optind;
88 argv += optind;
89
90 if (dropall) {
91 if (argc != 0)
92 usage();
93 if (!tcpdropall())
94 exit(1);
95 exit(0);
96 }
97
98 if ((argc != 2 && argc != 4) || tcpdrop_list_commands)
99 usage();
100
101 if (argc == 2) {
102 lport = findport(argv[0]);
103 fport = findport(argv[1]);
104 if (lport == NULL || lport[1] == '\0' || fport == NULL ||
105 fport[1] == '\0')
106 usage();
107 *lport++ = '\0';
108 *fport++ = '\0';
109 if (!tcpdropbyname(argv[0], lport, argv[1], fport))
110 exit(1);
111 } else if (!tcpdropbyname(argv[0], argv[1], argv[2], argv[3]))
112 exit(1);
113
114 exit(0);
115 }
116
117 static char *
findport(const char * arg)118 findport(const char *arg)
119 {
120 char *dot, *colon;
121
122 /* A strrspn() or strrpbrk() would be nice. */
123 dot = strrchr(arg, '.');
124 colon = strrchr(arg, ':');
125 if (dot == NULL)
126 return (colon);
127 if (colon == NULL)
128 return (dot);
129 if (dot < colon)
130 return (colon);
131 else
132 return (dot);
133 }
134
135 static struct xtcpcb *
tcpcblist(const char * name,size_t * len0)136 tcpcblist(const char *name, size_t *len0)
137 {
138 struct xtcpcb *tcp;
139 size_t len;
140 int rv;
141
142 len = 0;
143 rv = sysctlbyname(name, NULL, &len, NULL, 0);
144 if (rv == -1)
145 err(1, "sysctlbyname %s", name);
146
147 if (len == 0)
148 errx(1, "%s is empty", name);
149
150 tcp = malloc(len);
151 if (tcp == NULL)
152 errx(1, "malloc failed");
153
154 rv = sysctlbyname(name, tcp, &len, NULL, 0);
155 if (rv == -1)
156 err(1, "sysctlbyname %s", name);
157
158 *len0 = len;
159 return (tcp);
160 }
161
162 static void
sockinfo(const struct sockaddr * sa,struct host_service * hs)163 sockinfo(const struct sockaddr *sa, struct host_service *hs)
164 {
165 static const int flags = NI_NUMERICHOST | NI_NUMERICSERV;
166 int rv;
167
168 rv = getnameinfo(sa, sa->sa_len, hs->hs_host, sizeof hs->hs_host,
169 hs->hs_service, sizeof hs->hs_service, flags);
170 if (rv == -1)
171 err(1, "getnameinfo");
172 }
173
174 static bool
tcpdrop(const struct sockaddr * lsa,const struct sockaddr * fsa)175 tcpdrop(const struct sockaddr *lsa, const struct sockaddr *fsa)
176 {
177 struct host_service local, foreign;
178 struct sockaddr_storage addrs[2];
179 int rv;
180
181 memcpy(&addrs[TCPDROP_FOREIGN], fsa, fsa->sa_len);
182 memcpy(&addrs[TCPDROP_LOCAL], lsa, lsa->sa_len);
183
184 sockinfo(lsa, &local);
185 sockinfo(fsa, &foreign);
186
187 if (tcpdrop_list_commands) {
188 printf("tcpdrop %s %s %s %s\n", local.hs_host, local.hs_service,
189 foreign.hs_host, foreign.hs_service);
190 return (true);
191 }
192
193 rv = sysctlbyname("net.inet.tcp.drop", NULL, NULL, &addrs,
194 sizeof addrs);
195 if (rv == -1) {
196 warn("%s %s %s %s", local.hs_host, local.hs_service,
197 foreign.hs_host, foreign.hs_service);
198 return (false);
199 }
200 printf("%s %s %s %s: dropped\n", local.hs_host, local.hs_service,
201 foreign.hs_host, foreign.hs_service);
202 return (true);
203 }
204
205 static bool
tcpdropall(void)206 tcpdropall(void)
207 {
208 struct xtcpcb *tcp;
209 size_t len;
210 bool ok;
211 int cnt, i;
212
213 ok = true;
214
215 tcp = tcpcblist("net.inet.tcp.pcblist", &len);
216 cnt = len / sizeof(*tcp);
217
218 for (i = 0; i < cnt; ++i) {
219 struct xtcpcb *xpcb;
220 struct tcpcb *tp;
221 struct inpcb *inp;
222
223 xpcb = &tcp[i];
224 if (xpcb->xt_len != sizeof(*xpcb))
225 break;
226
227 tp = &xpcb->xt_tp;
228 inp = &xpcb->xt_inp;
229
230 /*
231 * XXX
232 * Check protocol, support just v4 or v6, etc.
233 */
234
235 /* Skip listening sockets. */
236 if (tp->t_state == TCPS_LISTEN)
237 continue;
238
239 if (!tcpdropconn(&inp->inp_inc))
240 ok = false;
241 }
242 free(tcp);
243
244 return (ok);
245 }
246
247 static bool
tcpdropbyname(const char * lhost,const char * lport,const char * fhost,const char * fport)248 tcpdropbyname(const char *lhost, const char *lport, const char *fhost,
249 const char *fport)
250 {
251 static const struct addrinfo hints = {
252 /*
253 * Look for streams in all domains.
254 */
255 .ai_family = AF_UNSPEC,
256 .ai_socktype = SOCK_STREAM,
257 };
258 struct addrinfo *ail, *local, *aif, *foreign;
259 int error;
260 bool ok, infamily;
261
262 error = getaddrinfo(lhost, lport, &hints, &local);
263 if (error != 0)
264 errx(1, "getaddrinfo: %s port %s: %s", lhost, lport,
265 gai_strerror(error));
266
267 error = getaddrinfo(fhost, fport, &hints, &foreign);
268 if (error != 0) {
269 freeaddrinfo(local); /* XXX gratuitous */
270 errx(1, "getaddrinfo: %s port %s: %s", fhost, fport,
271 gai_strerror(error));
272 }
273
274 ok = true;
275 infamily = false;
276
277 /*
278 * Try every combination of local and foreign address pairs.
279 */
280 for (ail = local; ail != NULL; ail = ail->ai_next) {
281 for (aif = foreign; aif != NULL; aif = aif->ai_next) {
282 if (ail->ai_family != aif->ai_family)
283 continue;
284 infamily = true;
285 if (!tcpdrop(ail->ai_addr, aif->ai_addr))
286 ok = false;
287 }
288 }
289
290 if (!infamily) {
291 warnx("%s %s %s %s: different address families", lhost, lport,
292 fhost, fport);
293 ok = false;
294 }
295
296 freeaddrinfo(local);
297 freeaddrinfo(foreign);
298
299 return (ok);
300 }
301
302 static bool
tcpdropconn(const struct in_conninfo * inc)303 tcpdropconn(const struct in_conninfo *inc)
304 {
305 struct sockaddr *local, *foreign;
306 struct sockaddr_in6 sin6[2];
307 struct sockaddr_in sin4[2];
308
309 if (inc->inc_isipv6) {
310 memset(sin6, 0, sizeof sin6);
311
312 sin6[TCPDROP_LOCAL].sin6_len = sizeof sin6[TCPDROP_LOCAL];
313 sin6[TCPDROP_LOCAL].sin6_family = AF_INET6;
314 sin6[TCPDROP_LOCAL].sin6_port = inc->inc_lport;
315 memcpy(&sin6[TCPDROP_LOCAL].sin6_addr, &inc->inc6_laddr,
316 sizeof inc->inc6_laddr);
317 local = (struct sockaddr *)&sin6[TCPDROP_LOCAL];
318
319 sin6[TCPDROP_FOREIGN].sin6_len = sizeof sin6[TCPDROP_FOREIGN];
320 sin6[TCPDROP_FOREIGN].sin6_family = AF_INET6;
321 sin6[TCPDROP_FOREIGN].sin6_port = inc->inc_fport;
322 memcpy(&sin6[TCPDROP_FOREIGN].sin6_addr, &inc->inc6_faddr,
323 sizeof inc->inc6_faddr);
324 foreign = (struct sockaddr *)&sin6[TCPDROP_FOREIGN];
325 } else {
326 memset(&sin4[TCPDROP_LOCAL], 0, sizeof sin4[TCPDROP_LOCAL]);
327
328 sin4[TCPDROP_LOCAL].sin_len = sizeof sin4[TCPDROP_LOCAL];
329 sin4[TCPDROP_LOCAL].sin_family = AF_INET;
330 sin4[TCPDROP_LOCAL].sin_port = inc->inc_lport;
331 memcpy(&sin4[TCPDROP_LOCAL].sin_addr, &inc->inc_laddr,
332 sizeof inc->inc_laddr);
333 local = (struct sockaddr *)&sin4[TCPDROP_LOCAL];
334
335 sin4[TCPDROP_FOREIGN].sin_len = sizeof sin4[TCPDROP_FOREIGN];
336 sin4[TCPDROP_FOREIGN].sin_family = AF_INET;
337 sin4[TCPDROP_FOREIGN].sin_port = inc->inc_fport;
338 memcpy(&sin4[TCPDROP_FOREIGN].sin_addr, &inc->inc_faddr,
339 sizeof inc->inc_faddr);
340 foreign = (struct sockaddr *)&sin4[TCPDROP_FOREIGN];
341 }
342
343 return (tcpdrop(local, foreign));
344 }
345
346 static void
usage(void)347 usage(void)
348 {
349 fprintf(stderr,
350 "usage: tcpdrop local-address local-port foreign-address foreign-port\n"
351 " tcpdrop local-address:local-port foreign-address:foreign-port\n"
352 " tcpdrop local-address.local-port foreign-address.foreign-port\n"
353 " tcpdrop [-l] -a\n");
354 exit(1);
355 }
356