/*
* Copyright (C) 1993-2001 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include "ipf.h"
#include "ipt.h"
#include <sys/ioctl.h>
#include <sys/file.h>
#if !defined(lint)
static const char sccsid[] = "@(#)ipt.c 1.19 6/3/96 (C) 1993-2000 Darren Reed";
static const char rcsid[] = "@(#)$Id: ipftest.c,v 1.44.2.4 2005/07/16 06:05:28 darrenr Exp $";
#endif
extern char *optarg;
extern struct frentry *ipfilter[2][2];
extern struct ipread snoop, etherf, tcpd, pcap, iptext, iphex;
extern struct ifnet *get_unit __P((char *, int, ipf_stack_t *));
extern void init_ifp __P((void));
int opts = OPT_DONOTHING;
int use_inet6 = 0;
int pfil_delayed_copy = 0;
int main __P((int, char *[]));
int loadrules __P((char *, int));
int kmemcpy __P((char *, long, int));
int kstrncpy __P((char *, long, int n));
void dumpnat __P((ipf_stack_t *ifs));
void dumpstate __P((ipf_stack_t *ifs));
void dumplookups __P((ipf_stack_t *ifs));
void dumpgroups __P((ipf_stack_t *ifs));
void drain_log __P((char *, ipf_stack_t *ifs));
void fixv4sums __P((mb_t *, ip_t *));
ipf_stack_t *get_ifs __P((void));
ipf_stack_t *create_ifs __P((void));
#if defined(__NetBSD__) || defined(__OpenBSD__) || SOLARIS || \
(_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000) || \
defined(__osf__) || defined(linux)
int ipftestioctl __P((int, ioctlcmd_t, ...));
int ipnattestioctl __P((int, ioctlcmd_t, ...));
int ipstatetestioctl __P((int, ioctlcmd_t, ...));
int ipauthtestioctl __P((int, ioctlcmd_t, ...));
int ipscantestioctl __P((int, ioctlcmd_t, ...));
int ipsynctestioctl __P((int, ioctlcmd_t, ...));
int ipooltestioctl __P((int, ioctlcmd_t, ...));
#else
int ipftestioctl __P((dev_t, ioctlcmd_t, void *));
int ipnattestioctl __P((dev_t, ioctlcmd_t, void *));
int ipstatetestioctl __P((dev_t, ioctlcmd_t, void *));
int ipauthtestioctl __P((dev_t, ioctlcmd_t, void *));
int ipsynctestioctl __P((dev_t, ioctlcmd_t, void *));
int ipscantestioctl __P((dev_t, ioctlcmd_t, void *));
int ipooltestioctl __P((dev_t, ioctlcmd_t, void *));
#endif
static ioctlfunc_t iocfunctions[IPL_LOGSIZE] = { ipftestioctl,
ipnattestioctl,
ipstatetestioctl,
ipauthtestioctl,
ipsynctestioctl,
ipscantestioctl,
ipooltestioctl,
NULL };
int main(argc,argv)
int argc;
char *argv[];
{
char *datain, *iface, *ifname, *logout;
int fd, i, dir, c, loaded, dump, hlen;
struct ifnet *ifp;
struct ipread *r;
mb_t mb, *m;
ip_t *ip;
ipf_stack_t *ifs;
m = &mb;
dir = 0;
dump = 0;
hlen = 0;
loaded = 0;
r = &iptext;
iface = NULL;
logout = NULL;
ifname = "anon0";
datain = NULL;
initparse();
ifs = create_ifs();
#if defined(IPFILTER_DEFAULT_BLOCK)
ifs->ifs_fr_pass = FR_BLOCK|FR_NOMATCH;
#else
ifs->ifs_fr_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH;
#endif
ipftuneable_alloc(ifs);
MUTEX_INIT(&ifs->ifs_ipf_rw, "ipf rw mutex");
MUTEX_INIT(&ifs->ifs_ipf_timeoutlock, "ipf timeout lock");
RWLOCK_INIT(&ifs->ifs_ipf_global, "ipf filter load/unload mutex");
RWLOCK_INIT(&ifs->ifs_ipf_mutex, "ipf filter rwlock");
RWLOCK_INIT(&ifs->ifs_ipf_ipidfrag, "ipf IP NAT-Frag rwlock");
RWLOCK_INIT(&ifs->ifs_ipf_frcache, "ipf rule cache rwlock");
fr_loginit(ifs);
fr_authinit(ifs);
fr_fraginit(ifs);
fr_stateinit(ifs);
fr_natinit(ifs);
appr_init(ifs);
ip_lookup_init(ifs);
ifs->ifs_fr_running = 1;
while ((c = getopt(argc, argv, "6bdDF:i:I:l:N:P:or:RT:vxX")) != -1)
switch (c)
{
case '6' :
#ifdef USE_INET6
use_inet6 = 1;
#else
fprintf(stderr, "IPv6 not supported\n");
exit(1);
#endif
break;
case 'b' :
opts |= OPT_BRIEF;
break;
case 'd' :
opts |= OPT_DEBUG;
break;
case 'D' :
dump = 1;
break;
case 'F' :
if (strcasecmp(optarg, "pcap") == 0)
r = &pcap;
else if (strcasecmp(optarg, "etherfind") == 0)
r = &etherf;
else if (strcasecmp(optarg, "snoop") == 0)
r = &snoop;
else if (strcasecmp(optarg, "tcpdump") == 0)
r = &tcpd;
else if (strcasecmp(optarg, "hex") == 0)
r = &iphex;
else if (strcasecmp(optarg, "text") == 0)
r = &iptext;
break;
case 'i' :
datain = optarg;
break;
case 'I' :
ifname = optarg;
break;
case 'l' :
logout = optarg;
break;
case 'o' :
opts |= OPT_SAVEOUT;
break;
case 'r' :
if (ipf_parsefile(-1, ipf_addrule, iocfunctions,
optarg) == -1)
return -1;
loaded = 1;
break;
case 'R' :
opts |= OPT_NORESOLVE;
break;
case 'v' :
opts |= OPT_VERBOSE;
break;
case 'N' :
if (ipnat_parsefile(-1, ipnat_addrule, ipnattestioctl,
optarg) == -1)
return -1;
loaded = 1;
opts |= OPT_NAT;
break;
case 'P' :
if (ippool_parsefile(-1, optarg, ipooltestioctl) == -1)
return -1;
loaded = 1;
break;
case 'T' :
ipf_dotuning(-1, optarg, ipftestioctl);
break;
case 'x' :
opts |= OPT_HEX;
break;
}
if (loaded == 0) {
(void)fprintf(stderr,"no rules loaded\n");
exit(-1);
}
if (opts & OPT_SAVEOUT)
init_ifp();
if (datain)
fd = (*r->r_open)(datain);
else
fd = (*r->r_open)("-");
if (fd < 0)
exit(-1);
ip = MTOD(m, ip_t *);
while ((i = (*r->r_readip)(MTOD(m, char *), sizeof(m->mb_buf),
&iface, &dir)) > 0) {
if (iface == NULL || *iface == '\0')
iface = ifname;
ifp = get_unit(iface, IP_V(ip), ifs);
if (ifp == NULL) {
fprintf(stderr, "out of memory\n");
exit(1);
}
if (!use_inet6) {
ip->ip_off = ntohs(ip->ip_off);
ip->ip_len = ntohs(ip->ip_len);
if (r->r_flags & R_DO_CKSUM)
fixv4sums(m, ip);
hlen = IP_HL(ip) << 2;
}
#ifdef USE_INET6
else
hlen = sizeof(ip6_t);
#endif
/* ipfr_slowtimer(); */
m = &mb;
m->mb_len = i;
i = fr_check(ip, hlen, ifp, dir, &m, ifs);
if ((opts & OPT_NAT) == 0)
switch (i)
{
case -4 :
(void)printf("preauth");
break;
case -3 :
(void)printf("account");
break;
case -2 :
(void)printf("auth");
break;
case -1 :
(void)printf("block");
break;
case 0 :
(void)printf("pass");
break;
case 1 :
(void)printf("nomatch");
break;
case 3 :
(void)printf("block return-rst");
break;
case 4 :
(void)printf("block return-icmp");
break;
case 5 :
(void)printf("block return-icmp-as-dest");
break;
default :
(void)printf("recognised return %#x\n", i);
break;
}
if (!use_inet6) {
ip->ip_off = htons(ip->ip_off);
ip->ip_len = htons(ip->ip_len);
}
if (!(opts & OPT_BRIEF)) {
putchar(' ');
printpacket(ip);
printf("--------------");
} else if ((opts & (OPT_BRIEF|OPT_NAT)) == (OPT_NAT|OPT_BRIEF))
printpacket(ip);
if (dir && (ifp != NULL) && IP_V(ip) && (m != NULL))
#if defined(__sgi) && (IRIX < 60500)
(*ifp->if_output)(ifp, (void *)m, NULL);
#else
# if TRU64 >= 1885
(*ifp->if_output)(ifp, (void *)m, NULL, 0, 0);
# else
(*ifp->if_output)(ifp, (void *)m, NULL, 0);
# endif
#endif
if ((opts & (OPT_BRIEF|OPT_NAT)) != (OPT_NAT|OPT_BRIEF))
putchar('\n');
dir = 0;
if (iface != ifname) {
free(iface);
iface = ifname;
}
m = &mb;
}
(*r->r_close)();
if (logout != NULL) {
drain_log(logout, ifs);
}
if (dump == 1) {
dumpnat(ifs);
dumpstate(ifs);
dumplookups(ifs);
dumpgroups(ifs);
}
fr_deinitialise(ifs);
return 0;
}
#if defined(__NetBSD__) || defined(__OpenBSD__) || SOLARIS || \
(_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000) || \
defined(__osf__) || defined(linux)
int ipftestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGIPF, cmd, data, FWRITE|FREAD);
if (opts & OPT_DEBUG)
fprintf(stderr, "iplioctl(IPF,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipnattestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGNAT, cmd, data, FWRITE|FREAD);
if (opts & OPT_DEBUG)
fprintf(stderr, "iplioctl(NAT,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipstatetestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGSTATE, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(STATE,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipauthtestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGAUTH, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(AUTH,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipscantestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGSCAN, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(SCAN,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipsynctestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGSYNC, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(SYNC,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipooltestioctl(int dev, ioctlcmd_t cmd, ...)
{
caddr_t data;
va_list ap;
int i;
va_start(ap, cmd);
data = va_arg(ap, caddr_t);
va_end(ap);
i = iplioctl(IPL_LOGLOOKUP, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(POOL,%#x,%p) = %d\n",
(u_int)cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
#else
int ipftestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGIPF, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(IPF,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipnattestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGNAT, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(NAT,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipstatetestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGSTATE, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(STATE,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipauthtestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGAUTH, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(AUTH,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipsynctestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGSYNC, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(SYNC,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipscantestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGSCAN, cmd, data, FWRITE|FREAD);
if ((opts & OPT_DEBUG) || (i != 0))
fprintf(stderr, "iplioctl(SCAN,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
int ipooltestioctl(dev, cmd, data)
dev_t dev;
ioctlcmd_t cmd;
void *data;
{
int i;
i = iplioctl(IPL_LOGLOOKUP, cmd, data, FWRITE|FREAD);
if (opts & OPT_DEBUG)
fprintf(stderr, "iplioctl(POOL,%#x,%p) = %d\n", cmd, data, i);
if (i != 0) {
errno = i;
return -1;
}
return 0;
}
#endif
int kmemcpy(addr, offset, size)
char *addr;
long offset;
int size;
{
bcopy((char *)offset, addr, size);
return 0;
}
int kstrncpy(buf, pos, n)
char *buf;
long pos;
int n;
{
char *ptr;
ptr = (char *)pos;
while ((n-- > 0) && (*buf++ = *ptr++))
;
return 0;
}
/*
* Display the built up NAT table rules and mapping entries.
*/
void dumpnat(ifs)
ipf_stack_t *ifs;
{
ipnat_t *ipn;
nat_t *nat;
printf("List of active MAP/Redirect filters:\n");
for (ipn = ifs->ifs_nat_list; ipn != NULL; ipn = ipn->in_next)
printnat(ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
printf("\nList of active sessions:\n");
for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
printactivenat(nat, opts, 0);
if (nat->nat_aps)
printaps(nat->nat_aps, opts);
}
}
/*
* Display the built up state table rules and mapping entries.
*/
void dumpstate(ifs)
ipf_stack_t *ifs;
{
ipstate_t *ips;
printf("List of active state sessions:\n");
for (ips = ifs->ifs_ips_list; ips != NULL; )
ips = printstate(ips, opts & (OPT_DEBUG|OPT_VERBOSE),
ifs->ifs_fr_ticks);
}
void dumplookups(ifs)
ipf_stack_t *ifs;
{
iphtable_t *iph;
ip_pool_t *ipl;
int i;
printf("List of configured pools\n");
for (i = 0; i < IPL_LOGSIZE; i++)
for (ipl = ifs->ifs_ip_pool_list[i]; ipl != NULL;
ipl = ipl->ipo_next)
printpool(ipl, bcopywrap, NULL, opts);
printf("List of configured hash tables\n");
for (i = 0; i < IPL_LOGSIZE; i++)
for (iph = ifs->ifs_ipf_htables[i]; iph != NULL;
iph = iph->iph_next)
printhash(iph, bcopywrap, NULL, opts);
}
void dumpgroups(ifs)
ipf_stack_t *ifs;
{
frgroup_t *fg;
frentry_t *fr;
int i;
printf("List of groups configured (set 0)\n");
for (i = 0; i < IPL_LOGSIZE; i++)
for (fg = ifs->ifs_ipfgroups[i][0]; fg != NULL;
fg = fg->fg_next) {
printf("Dev.%d. Group %s Ref %d Flags %#x\n",
i, fg->fg_name, fg->fg_ref, fg->fg_flags);
for (fr = fg->fg_start; fr != NULL; fr = fr->fr_next) {
#ifdef USE_QUAD_T
printf("%qu ",(unsigned long long)fr->fr_hits);
#else
printf("%ld ", fr->fr_hits);
#endif
printfr(fr, ipftestioctl);
}
}
printf("List of groups configured (set 1)\n");
for (i = 0; i < IPL_LOGSIZE; i++)
for (fg = ifs->ifs_ipfgroups[i][1]; fg != NULL;
fg = fg->fg_next) {
printf("Dev.%d. Group %s Ref %d Flags %#x\n",
i, fg->fg_name, fg->fg_ref, fg->fg_flags);
for (fr = fg->fg_start; fr != NULL; fr = fr->fr_next) {
#ifdef USE_QUAD_T
printf("%qu ",(unsigned long long)fr->fr_hits);
#else
printf("%ld ", fr->fr_hits);
#endif
printfr(fr, ipftestioctl);
}
}
}
void drain_log(filename, ifs)
char *filename;
ipf_stack_t *ifs;
{
char buffer[DEFAULT_IPFLOGSIZE];
struct iovec iov;
struct uio uio;
size_t resid;
int fd, i;
fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, 0644);
if (fd == -1) {
perror("drain_log:open");
return;
}
for (i = 0; i <= IPL_LOGMAX; i++)
while (1) {
bzero((char *)&iov, sizeof(iov));
iov.iov_base = buffer;
iov.iov_len = sizeof(buffer);
bzero((char *)&uio, sizeof(uio));
uio.uio_iov = &iov;
uio.uio_iovcnt = 1;
uio.uio_resid = iov.iov_len;
resid = uio.uio_resid;
if (ipflog_read(i, &uio, ifs) == 0) {
/*
* If nothing was read then break out.
*/
if (uio.uio_resid == resid)
break;
write(fd, buffer, resid - uio.uio_resid);
} else
break;
}
close(fd);
}
void fixv4sums(m, ip)
mb_t *m;
ip_t *ip;
{
u_char *csump, *hdr;
ip->ip_sum = 0;
ip->ip_sum = ipf_cksum((u_short *)ip, IP_HL(ip) << 2);
csump = (u_char *)ip;
csump += IP_HL(ip) << 2;
switch (ip->ip_p)
{
case IPPROTO_TCP :
hdr = csump;
csump += offsetof(tcphdr_t, th_sum);
break;
case IPPROTO_UDP :
hdr = csump;
csump += offsetof(udphdr_t, uh_sum);
break;
default :
csump = NULL;
hdr = NULL;
break;
}
if (hdr != NULL) {
*csump = 0;
*(u_short *)csump = fr_cksum(m, ip, ip->ip_p, hdr);
}
}
ipf_stack_t *gifs;
/*
* Allocate and keep pointer for get_ifs()
*/
ipf_stack_t *
create_ifs()
{
ipf_stack_t *ifs;
KMALLOCS(ifs, ipf_stack_t *, sizeof (*ifs));
bzero(ifs, sizeof (*ifs));
gifs = ifs;
return (ifs);
}
ipf_stack_t *
get_ifs()
{
return (gifs);
}