%{

#include "ipf.h"

#include <syslog.h>

#undef OPT_NAT

#undef OPT_VERBOSE

#include "ipmon_l.h"

#include "ipmon.h"

#define YYDEBUG 1

extern void yyerror __P((char *));

extern int yyparse __P((void));

extern int yylex __P((void));

extern int yydebug;

extern FILE *yyin;

extern int yylineNum;

typedef struct opt {

struct opt *o_next;

int o_line;

int o_type;

int o_num;

char *o_str;

struct in_addr o_ip;

} opt_t;

static void build_action __P((struct opt *));

static opt_t *new_opt __P((int));

static void free_action __P((ipmon_action_t *));

static ipmon_action_t *alist = NULL;

%}

%union {

char *str;

u_32_t num;

struct in_addr addr;

struct opt *opt;

union i6addr ip6;

}

%token <num> YY_NUMBER YY_HEX

%token <str> YY_STR

%token <ip6> YY_IPV6

%token YY_COMMENT

%token YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT

%token YY_RANGE_OUT YY_RANGE_IN

%token IPM_MATCH IPM_BODY IPM_COMMENT IPM_DIRECTION IPM_DSTIP IPM_DSTPORT

%token IPM_EVERY IPM_EXECUTE IPM_GROUP IPM_INTERFACE IPM_IN IPM_NO IPM_OUT

%token IPM_PACKET IPM_PACKETS IPM_POOL IPM_PROTOCOL IPM_RESULT IPM_RULE

%token IPM_SECOND IPM_SECONDS IPM_SRCIP IPM_SRCPORT IPM_LOGTAG IPM_WITH

%token IPM_DO IPM_SAVE IPM_SYSLOG IPM_NOTHING IPM_RAW IPM_TYPE IPM_NAT

%token IPM_STATE IPM_NATTAG IPM_IPF

%type <addr> ipv4

%type <opt> direction dstip dstport every execute group interface

%type <opt> protocol result rule srcip srcport logtag matching

%type <opt> matchopt nattag type doopt doing save syslog nothing

%type <num> saveopts saveopt typeopt

%%

file: line

| assign

| file line

| file assign

;

line: IPM_MATCH '{' matching '}' IPM_DO '{' doing '}' ';'

{ build_action($3); resetlexer(); }

| IPM_COMMENT

| YY_COMMENT

;

assign: YY_STR assigning YY_STR ';' { set_variable($1, $3);

resetlexer();

free($1);

free($3);

}

;

assigning:

'=' { yyvarnext = 1; }

;

matching:

matchopt { $$ = $1; }

| matchopt ',' matching { $1->o_next = $3; $$ = $1; }

;

matchopt:

direction { $$ = $1; }

| dstip { $$ = $1; }

| dstport { $$ = $1; }

| every { $$ = $1; }

| group { $$ = $1; }

| interface { $$ = $1; }

| protocol { $$ = $1; }

| result { $$ = $1; }

| rule { $$ = $1; }

| srcip { $$ = $1; }

| srcport { $$ = $1; }

| logtag { $$ = $1; }

| nattag { $$ = $1; }

| type { $$ = $1; }

;

doing:

doopt { $$ = $1; }

| doopt ',' doing { $1->o_next = $3; $$ = $1; }

;

doopt:

execute { $$ = $1; }

| save { $$ = $1; }

| syslog { $$ = $1; }

| nothing { $$ = $1; }

;

direction:

IPM_DIRECTION '=' IPM_IN { $$ = new_opt(IPM_DIRECTION);

$$->o_num = IPM_IN; }

| IPM_DIRECTION '=' IPM_OUT { $$ = new_opt(IPM_DIRECTION);

$$->o_num = IPM_OUT; }

;

dstip: IPM_DSTIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_DSTIP);

$$->o_ip = $3;

$$->o_num = $5; }

;

dstport:

IPM_DSTPORT '=' YY_NUMBER { $$ = new_opt(IPM_DSTPORT);

$$->o_num = $3; }

| IPM_DSTPORT '=' YY_STR { $$ = new_opt(IPM_DSTPORT);

$$->o_str = $3; }

;

every: IPM_EVERY IPM_SECOND { $$ = new_opt(IPM_SECOND);

$$->o_num = 1; }

| IPM_EVERY YY_NUMBER IPM_SECONDS { $$ = new_opt(IPM_SECOND);

$$->o_num = $2; }

| IPM_EVERY IPM_PACKET { $$ = new_opt(IPM_PACKET);

$$->o_num = 1; }

| IPM_EVERY YY_NUMBER IPM_PACKETS { $$ = new_opt(IPM_PACKET);

$$->o_num = $2; }

;

group: IPM_GROUP '=' YY_NUMBER { $$ = new_opt(IPM_GROUP);

$$->o_num = $3; }

| IPM_GROUP '=' YY_STR { $$ = new_opt(IPM_GROUP);

$$->o_str = $3; }

;

interface:

IPM_INTERFACE '=' YY_STR { $$ = new_opt(IPM_INTERFACE);

$$->o_str = $3; }

;

logtag: IPM_LOGTAG '=' YY_NUMBER { $$ = new_opt(IPM_LOGTAG);

$$->o_num = $3; }

;

nattag: IPM_NATTAG '=' YY_STR { $$ = new_opt(IPM_NATTAG);

$$->o_str = $3; }

;

protocol:

IPM_PROTOCOL '=' YY_NUMBER { $$ = new_opt(IPM_PROTOCOL);

$$->o_num = $3; }

| IPM_PROTOCOL '=' YY_STR { $$ = new_opt(IPM_PROTOCOL);

$$->o_num = getproto($3);

free($3);

}

;

result: IPM_RESULT '=' YY_STR { $$ = new_opt(IPM_RESULT);

$$->o_str = $3; }

;

rule: IPM_RULE '=' YY_NUMBER { $$ = new_opt(IPM_RULE);

$$->o_num = YY_NUMBER; }

;

srcip: IPM_SRCIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_SRCIP);

$$->o_ip = $3;

$$->o_num = $5; }

;

srcport:

IPM_SRCPORT '=' YY_NUMBER { $$ = new_opt(IPM_SRCPORT);

$$->o_num = $3; }

| IPM_SRCPORT '=' YY_STR { $$ = new_opt(IPM_SRCPORT);

$$->o_str = $3; }

;

type: IPM_TYPE '=' typeopt { $$ = new_opt(IPM_TYPE);

$$->o_num = $3; }

;

typeopt:

IPM_IPF { $$ = IPL_MAGIC; }

| IPM_NAT { $$ = IPL_MAGIC_NAT; }

| IPM_STATE { $$ = IPL_MAGIC_STATE; }

;

execute:

IPM_EXECUTE YY_STR { $$ = new_opt(IPM_EXECUTE);

$$->o_str = $2; }

;

save: IPM_SAVE saveopts YY_STR { $$ = new_opt(IPM_SAVE);

$$->o_num = $2;

$$->o_str = $3; }

;

saveopts: { $$ = 0; }

| saveopt { $$ = $1; }

| saveopt ',' saveopts { $$ = $1 | $3; }

;

saveopt:

IPM_RAW { $$ = IPMDO_SAVERAW; }

;

syslog: IPM_SYSLOG { $$ = new_opt(IPM_SYSLOG); }

;

nothing:

IPM_NOTHING { $$ = 0; }

;

ipv4: YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER

{ if ($1 > 255 || $3 > 255 || $5 > 255 || $7 > 255) {

yyerror("Invalid octet string for IP address");

return 0;

}

$$.s_addr = ($1 << 24) | ($3 << 16) | ($5 << 8) | $7;

$$.s_addr = htonl($$.s_addr);

}

%%

static struct wordtab yywords[] = {

{ "body", IPM_BODY },

{ "direction", IPM_DIRECTION },

{ "do", IPM_DO },

{ "dstip", IPM_DSTIP },

{ "dstport", IPM_DSTPORT },

{ "every", IPM_EVERY },

{ "execute", IPM_EXECUTE },

{ "group", IPM_GROUP },

{ "in", IPM_IN },

{ "interface", IPM_INTERFACE },

{ "ipf", IPM_IPF },

{ "logtag", IPM_LOGTAG },

{ "match", IPM_MATCH },

{ "nat", IPM_NAT },

{ "nattag", IPM_NATTAG },

{ "no", IPM_NO },

{ "nothing", IPM_NOTHING },

{ "out", IPM_OUT },

{ "packet", IPM_PACKET },

{ "packets", IPM_PACKETS },

{ "protocol", IPM_PROTOCOL },

{ "result", IPM_RESULT },

{ "rule", IPM_RULE },

{ "save", IPM_SAVE },

{ "raw", IPM_RAW },

{ "second", IPM_SECOND },

{ "seconds", IPM_SECONDS },

{ "srcip", IPM_SRCIP },

{ "srcport", IPM_SRCPORT },

{ "state", IPM_STATE },

{ "syslog", IPM_SYSLOG },

{ "with", IPM_WITH },

{ NULL, 0 }

};

static int macflags[17][2] = {

{ IPM_DIRECTION, IPMAC_DIRECTION },

{ IPM_DSTIP, IPMAC_DSTIP },

{ IPM_DSTPORT, IPMAC_DSTPORT },

{ IPM_GROUP, IPMAC_GROUP },

{ IPM_INTERFACE, IPMAC_INTERFACE },

{ IPM_LOGTAG, IPMAC_LOGTAG },

{ IPM_NATTAG, IPMAC_NATTAG },

{ IPM_PACKET, IPMAC_EVERY },

{ IPM_PROTOCOL, IPMAC_PROTOCOL },

{ IPM_RESULT, IPMAC_RESULT },

{ IPM_RULE, IPMAC_RULE },

{ IPM_SECOND, IPMAC_EVERY },

{ IPM_SRCIP, IPMAC_SRCIP },

{ IPM_SRCPORT, IPMAC_SRCPORT },

{ IPM_TYPE, IPMAC_TYPE },

{ IPM_WITH, IPMAC_WITH },

{ 0, 0 }

};

static opt_t *new_opt(type)

int type;

{

opt_t *o;

o = (opt_t *)malloc(sizeof(*o));

if (o == NULL)

yyerror("sorry, out of memory");

o->o_type = type;

o->o_line = yylineNum;

o->o_num = 0;

o->o_str = (char *)0;

o->o_next = NULL;

return o;

}

static void build_action(olist)

opt_t *olist;

{

ipmon_action_t *a;

opt_t *o;

char c;

int i;

a = (ipmon_action_t *)calloc(1, sizeof(*a));

if (a == NULL)

return;

while ((o = olist) != NULL) {

/*

for (i = 0; macflags[i][0]; i++)

if (macflags[i][0] == o->o_type)

break;

if (macflags[i][1] & a->ac_mflag) {

fprintf(stderr, "%s redfined on line %d\n",

yykeytostr(o->o_type), yylineNum);

if (o->o_str != NULL)

free(o->o_str);

olist = o->o_next;

free(o);

continue;

}

a->ac_mflag |= macflags[i][1];

switch (o->o_type)

{

case IPM_DIRECTION :

a->ac_direction = o->o_num;

break;

case IPM_DSTIP :

a->ac_dip = o->o_ip.s_addr;

a->ac_dmsk = htonl(0xffffffff << (32 - o->o_num));

break;

case IPM_DSTPORT :

a->ac_dport = htons(o->o_num);

break;

case IPM_EXECUTE :

a->ac_exec = o->o_str;

c = *o->o_str;

if (c== '"'|| c == '\'') {

if (o->o_str[strlen(o->o_str) - 1] == c) {

a->ac_run = strdup(o->o_str + 1);

a->ac_run[strlen(a->ac_run) - 1] ='\0';

} else

a->ac_run = o->o_str;

} else

a->ac_run = o->o_str;

o->o_str = NULL;

break;

case IPM_INTERFACE :

a->ac_iface = o->o_str;

o->o_str = NULL;

break;

case IPM_GROUP :

if (o->o_str != NULL)

strncpy(a->ac_group, o->o_str, FR_GROUPLEN);

else

sprintf(a->ac_group, "%d", o->o_num);

break;

case IPM_LOGTAG :

a->ac_logtag = o->o_num;

break;

case IPM_NATTAG :

strncpy(a->ac_nattag, o->o_str, sizeof(a->ac_nattag));

break;

case IPM_PACKET :

a->ac_packet = o->o_num;

break;

case IPM_PROTOCOL :

a->ac_proto = o->o_num;

break;

case IPM_RULE :

a->ac_rule = o->o_num;

break;

case IPM_RESULT :

if (!strcasecmp(o->o_str, "pass"))

a->ac_result = IPMR_PASS;

else if (!strcasecmp(o->o_str, "block"))

a->ac_result = IPMR_BLOCK;

else if (!strcasecmp(o->o_str, "nomatch"))

a->ac_result = IPMR_NOMATCH;

else if (!strcasecmp(o->o_str, "log"))

a->ac_result = IPMR_LOG;

break;

case IPM_SECOND :

a->ac_second = o->o_num;

break;

case IPM_SRCIP :

a->ac_sip = o->o_ip.s_addr;

a->ac_smsk = htonl(0xffffffff << (32 - o->o_num));

break;

case IPM_SRCPORT :

a->ac_sport = htons(o->o_num);

break;

case IPM_SAVE :

if (a->ac_savefile != NULL) {

fprintf(stderr, "%s redfined on line %d\n",

yykeytostr(o->o_type), yylineNum);

break;

}

a->ac_savefile = strdup(o->o_str);

a->ac_savefp = fopen(o->o_str, "a");

a->ac_dflag |= o->o_num & IPMDO_SAVERAW;

break;

case IPM_SYSLOG :

if (a->ac_syslog != 0) {

fprintf(stderr, "%s redfined on line %d\n",

yykeytostr(o->o_type), yylineNum);

break;

}

a->ac_syslog = 1;

break;

case IPM_TYPE :

a->ac_type = o->o_num;

break;

case IPM_WITH :

break;

default :

break;

}

olist = o->o_next;

if (o->o_str != NULL)

free(o->o_str);

free(o);

}

a->ac_next = alist;

alist = a;

}

int check_action(buf, log, opts, lvl)

char *buf, *log;

int opts, lvl;

{

ipmon_action_t *a;

struct timeval tv;

ipflog_t *ipf;

tcphdr_t *tcp;

iplog_t *ipl;

int matched;

u_long t1;

ip_t *ip;

matched = 0;

ipl = (iplog_t *)buf;

ipf = (ipflog_t *)(ipl +1);

ip = (ip_t *)(ipf + 1);

tcp = (tcphdr_t *)((char *)ip + (IP_HL(ip) << 2));

for (a = alist; a != NULL; a = a->ac_next) {

if ((a->ac_mflag & IPMAC_DIRECTION) != 0) {

if (a->ac_direction == IPM_IN) {

if ((ipf->fl_flags & FR_INQUE) == 0)

continue;

} else if (a->ac_direction == IPM_OUT) {

if ((ipf->fl_flags & FR_OUTQUE) == 0)

continue;

}

}

if ((a->ac_type != 0) && (a->ac_type != ipl->ipl_magic))

continue;

if ((a->ac_mflag & IPMAC_EVERY) != 0) {

gettimeofday(&tv, NULL);

t1 = tv.tv_sec - a->ac_lastsec;

if (tv.tv_usec <= a->ac_lastusec)

t1--;

if (a->ac_second != 0) {

if (t1 < a->ac_second)

continue;

a->ac_lastsec = tv.tv_sec;

a->ac_lastusec = tv.tv_usec;

}

if (a->ac_packet != 0) {

if (a->ac_pktcnt == 0)

a->ac_pktcnt++;

else if (a->ac_pktcnt == a->ac_packet) {

a->ac_pktcnt = 0;

continue;

} else {

a->ac_pktcnt++;

continue;

}

}

}

if ((a->ac_mflag & IPMAC_DSTIP) != 0) {

if ((ip->ip_dst.s_addr & a->ac_dmsk) != a->ac_dip)

continue;

}

if ((a->ac_mflag & IPMAC_DSTPORT) != 0) {

if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP)

continue;

if (tcp->th_dport != a->ac_dport)

continue;

}

if ((a->ac_mflag & IPMAC_GROUP) != 0) {

if (strncmp(a->ac_group, ipf->fl_group,

FR_GROUPLEN) != 0)

continue;

}

if ((a->ac_mflag & IPMAC_INTERFACE) != 0) {

if (strcmp(a->ac_iface, ipf->fl_ifname))

continue;

}

if ((a->ac_mflag & IPMAC_PROTOCOL) != 0) {

if (a->ac_proto != ip->ip_p)

continue;

}

if ((a->ac_mflag & IPMAC_RESULT) != 0) {

if ((ipf->fl_flags & FF_LOGNOMATCH) != 0) {

if (a->ac_result != IPMR_NOMATCH)

continue;

} else if (FR_ISPASS(ipf->fl_flags)) {

if (a->ac_result != IPMR_PASS)

continue;

} else if (FR_ISBLOCK(ipf->fl_flags)) {

if (a->ac_result != IPMR_BLOCK)

continue;

} else { /* Log only */

if (a->ac_result != IPMR_LOG)

continue;

}

}

if ((a->ac_mflag & IPMAC_RULE) != 0) {

if (a->ac_rule != ipf->fl_rule)

continue;

}

if ((a->ac_mflag & IPMAC_SRCIP) != 0) {

if ((ip->ip_src.s_addr & a->ac_smsk) != a->ac_sip)

continue;

}

if ((a->ac_mflag & IPMAC_SRCPORT) != 0) {

if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP)

continue;

if (tcp->th_sport != a->ac_sport)

continue;

}

if ((a->ac_mflag & IPMAC_LOGTAG) != 0) {

if (a->ac_logtag != ipf->fl_logtag)

continue;

}

if ((a->ac_mflag & IPMAC_NATTAG) != 0) {

if (strncmp(a->ac_nattag, ipf->fl_nattag.ipt_tag,

IPFTAG_LEN) != 0)

continue;

}

matched = 1;

/*

if (a->ac_syslog != 0) {

syslog(lvl, "%s", log);

}

if (a->ac_savefp != NULL) {

if (a->ac_dflag & IPMDO_SAVERAW)

fwrite(ipl, 1, ipl->ipl_dsize, a->ac_savefp);

else

fputs(log, a->ac_savefp);

}

if (a->ac_exec != NULL) {

switch (fork())

{

case 0 :

{

FILE *pi;

pi = popen(a->ac_run, "w");

if (pi != NULL) {

fprintf(pi, "%s\n", log);

if ((opts & OPT_HEXHDR) != 0) {

dumphex(pi, 0, buf,

sizeof(*ipl) +

sizeof(*ipf));

}

if ((opts & OPT_HEXBODY) != 0) {

dumphex(pi, 0, (char *)ip,

ipf->fl_hlen +

ipf->fl_plen);

}

pclose(pi);

}

exit(1);

}

case -1 :

break;

default :

break;

}

}

}

return matched;

}

static void free_action(a)

ipmon_action_t *a;

{

if (a->ac_savefile != NULL) {

free(a->ac_savefile);

a->ac_savefile = NULL;

}

if (a->ac_savefp != NULL) {

fclose(a->ac_savefp);

a->ac_savefp = NULL;

}

if (a->ac_exec != NULL) {

free(a->ac_exec);

if (a->ac_run == a->ac_exec)

a->ac_run = NULL;

a->ac_exec = NULL;

}

if (a->ac_run != NULL) {

free(a->ac_run);

a->ac_run = NULL;

}

if (a->ac_iface != NULL) {

free(a->ac_iface);

a->ac_iface = NULL;

}

a->ac_next = NULL;

free(a);

}

int load_config(file)

char *file;

{

ipmon_action_t *a;

FILE *fp;

char *s;

s = getenv("YYDEBUG");

if (s != NULL)

yydebug = atoi(s);

else

yydebug = 0;

while ((a = alist) != NULL) {

alist = a->ac_next;

free_action(a);

}

yylineNum = 1;

(void) yysettab(yywords);

fp = fopen(file, "r");

if (!fp) {

perror("load_config:fopen:");

return -1;

}

yyin = fp;

while (!feof(fp))

yyparse();

fclose(fp);

return 0;

}