# # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright 2009 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # LIBRARY= libipf.a VERS= .1 OBJECTS= addicmp.o addipopt.o bcopywrap.o \ binprint.o buildopts.o checkrev.o count6bits.o \ count4bits.o debug.o extras.o facpri.o flags.o \ fill6bits.o genmask.o gethost.o getifname.o \ getline.o getnattype.o getport.o getportproto.o \ getproto.o getsumd.o hostname.o \ icmpcode.o inet_addr.o initparse.o \ ionames.o v6ionames.o ipoptsec.o ipf_dotuning.o \ ipft_ef.o ipft_hx.o ipft_pc.o ipft_sn.o ipft_td.o \ ipft_tx.o kmem.o kmemcpywrap.o kvatoname.o \ load_hash.o load_pool.o load_hashnode.o \ load_poolnode.o loglevel.o mutex_emul.o nametokva.o \ nat_setgroupmap.o ntomask.o optname.o optprint.o \ optprintv6.o optvalue.o \ portname.o portnum.o ports.o print_toif.o \ printactivenat.o printaps.o printbuf.o printhash.o \ printhashnode.o printip.o printpool.o \ printpoolnode.o printfr.o printfraginfo.o \ printhostmap.o printifname.o printhostmask.o \ printlog.o printlookup.o printmask.o printnat.o printpacket.o \ printpacket6.o printportcmp.o printproto.o \ printsbuf.o printstate.o printtunable.o ratoi.o \ remove_pool.o remove_poolnode.o remove_hash.o \ remove_hashnode.o resetlexer.o rwlock_emul.o \ tcpflags.o var.o verbose.o \ v6ionames.o v6optvalue.o printpool_live.o \ printpooldata.o printhash_live.o printhashdata.o \ printactiveaddr.o printactivenat.o printaddr.o include $(SRC)/lib/Makefile.lib include $(SRC)/lib/Makefile.lib.64 include ../Makefile.ipf LIBS= $(LIBRARY) CPPFLAGS += -I../tools .KEEP_STATE: all: $(LIBS) install: all include $(SRC)/lib/Makefile.targ /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: addicmp.c,v 1.10.2.1 2004/12/09 19:41:16 darrenr Exp $ */ #include #include "ipf.h" char *icmptypes[MAX_ICMPTYPE + 1] = { "echorep", (char *)NULL, (char *)NULL, "unreach", "squench", "redir", (char *)NULL, (char *)NULL, "echo", "routerad", "routersol", "timex", "paramprob", "timest", "timestrep", "inforeq", "inforep", "maskreq", "maskrep", "END" }; /* * set the icmp field to the correct type if "icmp" word is found */ int addicmp(cp, fp, linenum) char ***cp; struct frentry *fp; int linenum; { char **t; int i; (*cp)++; if (!**cp) return -1; if (!fp->fr_proto) /* to catch lusers */ fp->fr_proto = IPPROTO_ICMP; if (ISDIGIT(***cp)) { if (!ratoi(**cp, &i, 0, 255)) { fprintf(stderr, "%d: Invalid icmp-type (%s) specified\n", linenum, **cp); return -1; } } else { for (t = icmptypes, i = 0; ; t++, i++) { if (!*t) continue; if (!strcasecmp("END", *t)) { i = -1; break; } if (!strcasecmp(*t, **cp)) break; } if (i == -1) { fprintf(stderr, "%d: Unknown icmp-type (%s) specified\n", linenum, **cp); return -1; } } fp->fr_icmp = (u_short)(i << 8); fp->fr_icmpm = (u_short)0xff00; (*cp)++; if (!**cp) return 0; if (**cp && strcasecmp("code", **cp)) return 0; (*cp)++; if (ISDIGIT(***cp)) { if (!ratoi(**cp, &i, 0, 255)) { fprintf(stderr, "%d: Invalid icmp code (%s) specified\n", linenum, **cp); return -1; } } else { i = icmpcode(**cp); if (i == -1) { fprintf(stderr, "%d: Unknown icmp code (%s) specified\n", linenum, **cp); return -1; } } i &= 0xff; fp->fr_icmp |= (u_short)i; fp->fr_icmpm = (u_short)0xffff; (*cp)++; return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: addipopt.c,v 1.7 2002/01/28 06:50:45 darrenr Exp $ */ #include "ipf.h" int addipopt(op, io, len, class) char *op; struct ipopt_names *io; int len; char *class; { int olen = len; struct in_addr ipadr; u_short val; u_char lvl; char *s; if ((len + io->on_siz) > 48) { fprintf(stderr, "options too long\n"); return 0; } len += io->on_siz; *op++ = io->on_value; if (io->on_siz > 1) { s = op; *op++ = io->on_siz; *op++ = IPOPT_MINOFF; if (class) { switch (io->on_value) { case IPOPT_SECURITY : lvl = seclevel(class); *(op - 1) = lvl; break; case IPOPT_LSRR : case IPOPT_SSRR : ipadr.s_addr = inet_addr(class); s[IPOPT_OLEN] = IPOPT_MINOFF - 1 + 4; bcopy((char *)&ipadr, op, sizeof(ipadr)); break; case IPOPT_SATID : val = atoi(class); bcopy((char *)&val, op, 2); break; } } op += io->on_siz - 3; if (len & 3) { *op++ = IPOPT_NOP; len++; } } if (opts & OPT_DEBUG) fprintf(stderr, "bo: %s %d %#x: %d\n", io->on_name, io->on_value, io->on_bit, len); return len - olen; } # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright 2009 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # include ../Makefile.com include $(SRC)/lib/Makefile.lib.64 # # XX64 # work around the problem that gcc currently produces # buggy gcc -mcmodel=small code # CFLAGS64 += $(C_PICFLAGS64) install: all #include "ipf.h" int bcopywrap(from, to, size) void *from, *to; size_t size; { bcopy((caddr_t)from, (caddr_t)to, size); return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: binprint.c,v 1.8 2002/05/14 15:18:56 darrenr Exp $ */ #include "ipf.h" void binprint(ptr, size) void *ptr; size_t size; { u_char *s; int i, j; for (i = size, j = 0, s = (u_char *)ptr; i; i--, s++) { j++; printf("%02x ", *s); if (j == 16) { printf("\n"); j = 0; } } putchar('\n'); (void)fflush(stdout); } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: buildopts.c,v 1.6 2002/01/28 06:50:45 darrenr Exp $ */ #include "ipf.h" u_32_t buildopts(cp, op, len) char *cp, *op; int len; { struct ipopt_names *io; u_32_t msk = 0; char *s, *t; int inc; for (s = strtok(cp, ","); s; s = strtok(NULL, ",")) { if ((t = strchr(s, '='))) *t++ = '\0'; for (io = ionames; io->on_name; io++) { if (strcasecmp(s, io->on_name) || (msk & io->on_bit)) continue; if ((inc = addipopt(op, io, len, t))) { op += inc; len += inc; } msk |= io->on_bit; break; } if (!io->on_name) { fprintf(stderr, "unknown IP option name %s\n", s); return 0; } } *op++ = IPOPT_EOL; len++; return len; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: checkrev.c,v 1.12.2.1 2004/03/09 14:44:39 darrenr Exp $ */ #include #include #include "ipf.h" #include "netinet/ipl.h" int checkrev(ipfname) char *ipfname; { static int vfd = -1; struct friostat fio, *fiop = &fio; ipfobj_t ipfo; bzero((caddr_t)&ipfo, sizeof(ipfo)); ipfo.ipfo_rev = IPFILTER_VERSION; ipfo.ipfo_size = sizeof(*fiop); ipfo.ipfo_ptr = (void *)fiop; ipfo.ipfo_type = IPFOBJ_IPFSTAT; if ((vfd == -1) && ((vfd = open(ipfname, O_RDONLY)) == -1)) { perror("open device"); return -1; } if (ioctl(vfd, SIOCGETFS, &ipfo)) { perror("ioctl(SIOCGETFS)"); close(vfd); vfd = -1; return -1; } if (strncmp(IPL_VERSION, fio.f_version, sizeof(fio.f_version))) { return -1; } return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: count4bits.c,v 1.1 2002/06/15 04:46:39 darrenr Exp $ */ #include "ipf.h" /* * count consecutive 1's in bit mask. If the mask generated by counting * consecutive 1's is different to that passed, return -1, else return # * of bits. */ int count4bits(ip) u_int ip; { int cnt = 0, i, j; u_int ipn; ip = ipn = ntohl(ip); for (i = 32; i; i--, ipn *= 2) if (ipn & 0x80000000) cnt++; else break; ipn = 0; for (i = 32, j = cnt; i; i--, j--) { ipn *= 2; if (j > 0) ipn++; } if (ipn == ip) return cnt; return -1; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: count6bits.c,v 1.4 2001/06/09 17:09:23 darrenr Exp $ */ #include "ipf.h" int count6bits(msk) u_32_t *msk; { int i = 0, k; u_32_t j; for (k = 3; k >= 0; k--) if (msk[k] == 0xffffffff) i += 32; else { for (j = msk[k]; j; j <<= 1) if (j & 0x80000000) i++; } return i; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: debug.c,v 1.6 2001/06/09 17:09:24 darrenr Exp $ */ #if defined(__STDC__) # include #else # include #endif #include #include "ipt.h" #include "opts.h" #ifdef __STDC__ void debug(char *fmt, ...) #else void debug(fmt, va_alist) char *fmt; va_dcl #endif { va_list pvar; va_start(pvar, fmt); if (opts & OPT_DEBUG) vprintf(fmt, pvar); va_end(pvar); } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: extras.c,v 1.12 2002/07/13 12:06:49 darrenr Exp $ */ #include "ipf.h" /* * deal with extra bits on end of the line */ int extras(cp, fr, linenum) char ***cp; struct frentry *fr; int linenum; { u_short secmsk; u_long opts; int notopt; opts = 0; secmsk = 0; notopt = 0; (*cp)++; if (!**cp) return -1; while (**cp) { if (!strcasecmp(**cp, "not") || !strcasecmp(**cp, "no")) { notopt = 1; (*cp)++; continue; } else if (!strncasecmp(**cp, "ipopt", 5)) { if (!notopt) fr->fr_flx |= FI_OPTIONS; fr->fr_mflx |= FI_OPTIONS; goto nextopt; } else if (!strcasecmp(**cp, "lowttl")) { if (!notopt) fr->fr_flx |= FI_LOWTTL; fr->fr_mflx |= FI_LOWTTL; goto nextopt; } else if (!strcasecmp(**cp, "bad-src")) { if (!notopt) fr->fr_flx |= FI_BADSRC; fr->fr_mflx |= FI_BADSRC; goto nextopt; } else if (!strncasecmp(**cp, "mbcast", 6)) { if (!notopt) fr->fr_flx |= FI_MBCAST; fr->fr_mflx |= FI_MBCAST; goto nextopt; } else if (!strncasecmp(**cp, "nat", 3)) { if (!notopt) fr->fr_flx |= FI_NATED; fr->fr_mflx |= FI_NATED; goto nextopt; } else if (!strncasecmp(**cp, "frag", 4)) { if (!notopt) fr->fr_flx |= FI_FRAG; fr->fr_mflx |= FI_FRAG; goto nextopt; } else if (!strncasecmp(**cp, "opt", 3)) { if (!*(*cp + 1)) { fprintf(stderr, "%d: opt missing arguements\n", linenum); return -1; } (*cp)++; if (!(opts = optname(cp, &secmsk, linenum))) return -1; if (notopt) { if (!secmsk) { fr->fr_optmask |= opts; } else { fr->fr_optmask |= (opts & ~0x0100); fr->fr_secmask |= secmsk; } fr->fr_secbits &= ~secmsk; fr->fr_optbits &= ~opts; } else { fr->fr_optmask |= opts; fr->fr_secmask |= secmsk; fr->fr_optbits |= opts; fr->fr_secbits |= secmsk; } } else if (!strncasecmp(**cp, "short", 5)) { if (fr->fr_tcpf) { fprintf(stderr, "%d: short cannot be used with TCP flags\n", linenum); return -1; } if (!notopt) fr->fr_flx |= FI_SHORT; fr->fr_mflx |= FI_SHORT; goto nextopt; } else return -1; nextopt: notopt = 0; opts = 0; secmsk = 0; (*cp)++; } return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: facpri.c,v 1.6 2003/12/01 01:59:43 darrenr Exp $ */ #include #include #include #include #if !defined(__SVR4) && !defined(__svr4__) #include #endif #include #include #include #include #include "facpri.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: facpri.c,v 1.6 2003/12/01 01:59:43 darrenr Exp $"; #endif typedef struct table { char *name; int value; } table_t; table_t facs[] = { { "kern", LOG_KERN }, { "user", LOG_USER }, { "mail", LOG_MAIL }, { "daemon", LOG_DAEMON }, { "auth", LOG_AUTH }, { "syslog", LOG_SYSLOG }, { "lpr", LOG_LPR }, { "news", LOG_NEWS }, { "uucp", LOG_UUCP }, #if LOG_CRON == LOG_CRON2 { "cron2", LOG_CRON1 }, #else { "cron", LOG_CRON1 }, #endif #ifdef LOG_FTP { "ftp", LOG_FTP }, #endif #ifdef LOG_AUTHPRIV { "authpriv", LOG_AUTHPRIV }, #endif #ifdef LOG_AUDIT { "audit", LOG_AUDIT }, #endif #ifdef LOG_LFMT { "logalert", LOG_LFMT }, #endif #if LOG_CRON == LOG_CRON1 { "cron", LOG_CRON2 }, #else { "cron2", LOG_CRON2 }, #endif #ifdef LOG_SECURITY { "security", LOG_SECURITY }, #endif { "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 }, { "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 }, { "local4", LOG_LOCAL4 }, { "local5", LOG_LOCAL5 }, { "local6", LOG_LOCAL6 }, { "local7", LOG_LOCAL7 }, { NULL, 0 } }; /* * map a facility number to its name */ char * fac_toname(facpri) int facpri; { int i, j, fac; fac = facpri & LOG_FACMASK; j = fac >> 3; if (j < 24) { if (facs[j].value == fac) return facs[j].name; for (i = 0; facs[i].name; i++) if (fac == facs[i].value) return facs[i].name; } return NULL; } /* * map a facility name to its number */ int fac_findname(name) char *name; { int i; for (i = 0; facs[i].name; i++) if (!strcmp(facs[i].name, name)) return facs[i].value; return -1; } table_t pris[] = { { "emerg", LOG_EMERG }, { "alert", LOG_ALERT }, { "crit", LOG_CRIT }, { "err", LOG_ERR }, { "warn", LOG_WARNING }, { "notice", LOG_NOTICE }, { "info", LOG_INFO }, { "debug", LOG_DEBUG }, { NULL, 0 } }; /* * map a priority name to its number */ int pri_findname(name) char *name; { int i; for (i = 0; pris[i].name; i++) if (!strcmp(pris[i].name, name)) return pris[i].value; return -1; } /* * map a priority number to its name */ char * pri_toname(facpri) int facpri; { int i, pri; pri = facpri & LOG_PRIMASK; if (pris[pri].value == pri) return pris[pri].name; for (i = 0; pris[i].name; i++) if (pri == pris[i].value) return pris[i].name; return NULL; } /* * Copyright (C) 1999-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: facpri.h,v 1.3 2001/06/09 17:19:50 darrenr Exp $ */ #ifndef __FACPRI_H__ #define __FACPRI_H__ #ifndef __P # define P_DEF # ifdef __STDC__ # define __P(x) x # else # define __P(x) () # endif #endif extern char *fac_toname __P((int)); extern int fac_findname __P((char *)); extern char *pri_toname __P((int)); extern int pri_findname __P((char *)); #ifdef P_DEF # undef __P # undef P_DEF #endif #if LOG_CRON == (9<<3) # define LOG_CRON1 LOG_CRON # define LOG_CRON2 (15<<3) #endif #if LOG_CRON == (15<<3) # define LOG_CRON1 (9<<3) # define LOG_CRON2 LOG_CRON #endif #endif /* __FACPRI_H__ */ /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: fill6bits.c,v 1.5 2002/03/27 15:09:57 darrenr Exp $ */ #include "ipf.h" void fill6bits(bits, msk) int bits; u_int *msk; { if (bits == 0) { msk[0] = 0; msk[1] = 0; msk[2] = 0; msk[3] = 0; return; } msk[0] = 0xffffffff; msk[1] = 0xffffffff; msk[2] = 0xffffffff; msk[3] = 0xffffffff; if (bits == 128) return; if (bits > 96) { msk[3] = htonl(msk[3] << (128 - bits)); } else if (bits > 64) { msk[3] = 0; msk[2] = htonl(msk[2] << (96 - bits)); } else if (bits > 32) { msk[3] = 0; msk[2] = 0; msk[1] = htonl(msk[1] << (64 - bits)); } else { msk[3] = 0; msk[2] = 0; msk[1] = 0; msk[0] = htonl(msk[0] << (32 - bits)); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: flags.c,v 1.4 2002/11/02 07:16:36 darrenr Exp $ */ #include "ipf.h" /* * ECN is a new addition to TCP - RFC 2481 */ #ifndef TH_ECN # define TH_ECN 0x40 #endif #ifndef TH_CWR # define TH_CWR 0x80 #endif char flagset[] = "FSRPAUEC"; u_char flags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, TH_ACK, TH_URG, TH_ECN, TH_CWR }; /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: genmask.c,v 1.7 2003/11/11 13:40:15 darrenr Exp $ */ #include "ipf.h" int genmask(msk, mskp) char *msk; u_32_t *mskp; { char *endptr = 0L; int bits; if (strchr(msk, '.') || strchr(msk, 'x') || strchr(msk, ':')) { /* possibly of the form xxx.xxx.xxx.xxx * or 0xYYYYYYYY */ #ifdef USE_INET6 if (use_inet6) { if (inet_pton(AF_INET6, msk, mskp) != 1) return -1; } else #endif if (inet_aton(msk, (struct in_addr *)mskp) == 0) return -1; } else { /* * set x most significant bits */ bits = (int)strtol(msk, &endptr, 0); #ifdef USE_INET6 if ((*endptr != '\0') || ((bits > 32) && !use_inet6) || (bits < 0) || ((bits > 128) && use_inet6)) #else if (*endptr != '\0' || bits > 32 || bits < 0) #endif return -1; #ifdef USE_INET6 if (use_inet6) fill6bits(bits, mskp); else #endif if (bits == 0) *mskp = 0; else *mskp = htonl(0xffffffff << (32 - bits)); } return 0; } /* * Copyright (C) 1993-2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" int gethost(name, hostp, use_inet6) char *name; i6addr_t *hostp; int use_inet6; { struct addrinfo hints, *ai; struct netent *n; int error; if (!strcmp(name, "test.host.dots")) { hostp->in4.s_addr = htonl(0xfedcba98); return 0; } if (!strcmp(name, "")) name = thishost; bzero(&hints, sizeof (hints)); if (use_inet6 == 0) hints.ai_family = AF_INET; else hints.ai_family = AF_INET6; error = getaddrinfo(name, NULL, &hints, &ai); if ((error == 0) && (ai != NULL) && (ai->ai_addr != NULL)) { switch (ai->ai_family) { case AF_INET: hostp->in4 = ((struct sockaddr_in *) ai->ai_addr)->sin_addr; break; case AF_INET6: hostp->in6 = ((struct sockaddr_in6 *) ai->ai_addr)->sin6_addr; break; default: break; } freeaddrinfo(ai); return 0; } if (ai != NULL) freeaddrinfo(ai); if (use_inet6 == 0) { n = getnetbyname(name); if (n != NULL) { hostp->in4.s_addr = htonl(n->n_net); return 0; } } return -1; } /* * Copyright (C) 2003 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #include "kmem.h" /* * Given a pointer to an interface in the kernel, return a pointer to a * string which is the interface name. * * The same code is used to run in two different environments: in ipfstat * and in ipftest. In ipftest, kmemcpy is wrapper for bcopy but in ipfstat, * it is used as an interface to libkvm. */ char *getifname(ptr) struct ifnet *ptr; { # ifdef SOLARIS # include # include # endif # ifdef __hpux # include "compat.h" # endif # if defined(NetBSD) && (NetBSD >= 199905) && (NetBSD < 1991011) || \ defined(__OpenBSD__) || \ (defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) #else char buf[32]; int len; # endif struct ifnet netif; #define SOLARIS_PFHOOKS 1 # ifdef SOLARIS_PFHOOKS if ((opts & OPT_DONOTHING) == 0) return "@"; # endif if ((void *)ptr == (void *)-1) return "!"; if (ptr == NULL) return "-"; if (kmemcpy((char *)&netif, (u_long)ptr, sizeof(netif)) == -1) return "X"; # if defined(NetBSD) && (NetBSD >= 199905) && (NetBSD < 1991011) || \ defined(__OpenBSD__) || defined(linux) || \ (defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) return strdup(netif.if_xname); # else if (kstrncpy(buf, (u_long)netif.if_name, sizeof(buf)) == -1) return "X"; if (netif.if_unit < 10) len = 2; else if (netif.if_unit < 1000) len = 3; else if (netif.if_unit < 10000) len = 4; else len = 5; buf[sizeof(buf) - len] = '\0'; sprintf(buf + strlen(buf), "%d", netif.if_unit % 10000); return strdup(buf); # endif } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: getline.c,v 1.3 2001/06/09 17:09:24 darrenr Exp $ */ #include #if !defined(__SVR4) && !defined(__GNUC__) #include #endif #include #include "ipf.h" /* * Similar to fgets(3) but can handle '\\' and NL is converted to NUL. * Returns NULL if error occured, EOF encounterd or input line is too long. */ char * getaline(char *str, size_t size, FILE *file, int *linenum) { char *p; int s, len; do { for (p = str, s = size; ; p += (len - 1), s -= (len - 1)) { /* * if an error occured, EOF was encounterd, or there * was no room to put NUL, return NULL. */ if (fgets(p, s, file) == NULL) return (NULL); len = strlen(p); if (p[len - 1] != '\n') { p[len] = '\0'; break; } (*linenum)++; p[len - 1] = '\0'; if (len < 2 || p[len - 2] != '\\') break; else /* * Convert '\\' to a space so words don't * run together */ p[len - 2] = ' '; } } while (*str == '\0'); return (str); } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #include "kmem.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: getnattype.c,v 1.3 2004/01/17 17:26:07 darrenr Exp $"; #endif /* * Get a nat filter type given its kernel address. */ char *getnattype(nat, alive) nat_t *nat; int alive; { static char unknownbuf[20]; ipnat_t *ipn, ipnatbuff; char *which; int type; if (!nat) return "???"; if (alive) { type = nat->nat_redir; } else { ipn = nat->nat_ptr; if (kmemcpy((char *)&ipnatbuff, (long)ipn, sizeof(ipnatbuff))) return "!!!"; type = ipnatbuff.in_redir; } switch (type) { case NAT_MAP : which = "MAP"; break; case NAT_MAPBLK : which = "MAP-BLOCK"; break; case NAT_REDIRECT : which = "RDR"; break; case NAT_BIMAP : which = "BIMAP"; break; default : sprintf(unknownbuf, "unknown(%04x)", type & 0xffffffff); which = unknownbuf; break; } return which; } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" int getport(fr, name, port) frentry_t *fr; char *name; u_short *port; { struct protoent *p; struct servent *s; u_short p1; if (fr == NULL || fr->fr_type != FR_T_IPF) { s = getservbyname(name, NULL); if (s != NULL) { *port = s->s_port; return 0; } return -1; } if ((fr->fr_flx & FI_TCPUDP) != 0) { /* * If a rule is "tcp/udp" then check that both TCP and UDP * mappings for this protocol name match ports. */ s = getservbyname(name, "tcp"); if (s == NULL) return -1; p1 = s->s_port; s = getservbyname(name, "udp"); if (s == NULL || s->s_port != p1) return -1; *port = p1; return 0; } p = getprotobynumber(fr->fr_proto); s = getservbyname(name, p ? p->p_name : NULL); if (s != NULL) { *port = s->s_port; return 0; } return -1; } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include #include "ipf.h" int getportproto(name, proto) char *name; int proto; { struct servent *s; struct protoent *p; if (ISDIGIT(*name)) { int number; char *s; for (s = name; *s != '\0'; s++) if (!ISDIGIT(*s)) return -1; number = atoi(name); if (number < 0 || number > 65535) return -1; return htons(number); } p = getprotobynumber(proto); s = getservbyname(name, p ? p->p_name : NULL); if (s != NULL) return s->s_port; return -1; } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" int getproto(name) char *name; { struct protoent *p; char *s; for (s = name; *s != '\0'; s++) if (!ISDIGIT(*s)) break; if (*s == '\0') return atoi(name); #ifdef _AIX51 /* * For some bogus reason, "ip" is 252 in /etc/protocols on AIX 5 */ if (!strcasecmp(name, "ip")) return 0; #endif p = getprotobyname(name); if (p != NULL) return p->p_proto; return -1; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ /* * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" char *getsumd(sum) u_32_t sum; { static char sumdbuf[17]; sprintf(sumdbuf, "%#0x", sum); return sumdbuf; } /* * Copyright (C) 2003 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" char *hostname(v, ip) int v; void *ip; { static char hostbuf[MAXHOSTNAMELEN+1]; struct hostent *hp; struct in_addr ipa; struct netent *np; if (v == 4) { ipa.s_addr = *(u_32_t *)ip; if (ipa.s_addr == htonl(0xfedcba98)) return "test.host.dots"; } if ((opts & OPT_NORESOLVE) == 0) { if (v == 4) { hp = gethostbyaddr(ip, 4, AF_INET); if (hp != NULL && hp->h_name != NULL && *hp->h_name != '\0') { strncpy(hostbuf, hp->h_name, sizeof(hostbuf)); hostbuf[sizeof(hostbuf) - 1] = '\0'; return hostbuf; } np = getnetbyaddr(ipa.s_addr, AF_INET); if (np != NULL && np->n_name != NULL && *np->n_name != '\0') { strncpy(hostbuf, np->n_name, sizeof(hostbuf)); hostbuf[sizeof(hostbuf) - 1] = '\0'; return hostbuf; } } } if (v == 4) { return inet_ntoa(ipa); } #ifdef USE_INET6 (void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1); hostbuf[MAXHOSTNAMELEN] = '\0'; return hostbuf; #else return "IPv6"; #endif } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: icmpcode.c,v 1.7.2.1 2004/12/09 19:41:20 darrenr Exp $ */ #include #include "ipf.h" #ifndef MIN # define MIN(a,b) ((a) > (b) ? (b) : (a)) #endif char *icmpcodes[MAX_ICMPCODE + 1] = { "net-unr", "host-unr", "proto-unr", "port-unr", "needfrag", "srcfail", "net-unk", "host-unk", "isolate", "net-prohib", "host-prohib", "net-tos", "host-tos", "filter-prohib", "host-preced", "preced-cutoff", NULL }; /* * Return the number for the associated ICMP unreachable code. */ int icmpcode(str) char *str; { char *s; int i, len; if ((s = strrchr(str, ')'))) *s = '\0'; if (ISDIGIT(*str)) { if (!ratoi(str, &i, 0, 255)) return -1; else return i; } len = strlen(str); for (i = 0; icmpcodes[i]; i++) if (!strncasecmp(str, icmpcodes[i], MIN(len, strlen(icmpcodes[i])) )) return i; return -1; } /* * ++Copyright++ 1983, 1990, 1993 * - * Copyright (c) 1983, 1990, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * Portions Copyright (c) 1993 by Digital Equipment Corporation. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies, and that * the name of Digital Equipment Corporation not be used in advertising or * publicity pertaining to distribution of the document or software without * specific, written prior permission. * * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - * --Copyright-- */ #if !defined(lint) static const char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93"; static const char rcsid[] = "@(#)$Id: inet_addr.c,v 1.8.2.3 2004/12/09 19:41:20 darrenr Exp $"; #endif /* LIBC_SCCS and not lint */ #include #include #include #include #ifndef __P # ifdef __STDC__ # define __P(x) x # else # define __P(x) () # endif #endif #ifndef linux int inet_aton __P((const char *, struct in_addr *)); /* * Because the ctype(3) posix definition, if used "safely" in code everywhere, * would mean all normal code that walks through strings needed casts. Yuck. */ #define ISALNUM(x) isalnum((u_char)(x)) #define ISALPHA(x) isalpha((u_char)(x)) #define ISASCII(x) isascii((u_char)(x)) #define ISDIGIT(x) isdigit((u_char)(x)) #define ISPRINT(x) isprint((u_char)(x)) #define ISSPACE(x) isspace((u_char)(x)) #define ISUPPER(x) isupper((u_char)(x)) #define ISXDIGIT(x) isxdigit((u_char)(x)) #define ISLOWER(x) islower((u_char)(x)) /* * Check whether "cp" is a valid ascii representation * of an Internet address and convert to a binary address. * Returns 1 if the address is valid, 0 if not. * This replaces inet_addr, the return value from which * cannot distinguish between failure and a local broadcast address. */ int inet_aton(cp, addr) register const char *cp; struct in_addr *addr; { register u_long val; register int base, n; register char c; u_int parts[4]; register u_int *pp = parts; c = *cp; for (;;) { /* * Collect number up to ``.''. * Values are specified as for C: * 0x=hex, 0=octal, isdigit=decimal. */ if (!ISDIGIT(c)) return (0); val = 0; base = 10; if (c == '0') { c = *++cp; if (c == 'x' || c == 'X') base = 16, c = *++cp; else base = 8; } for (;;) { if (ISASCII(c) && ISDIGIT(c)) { val = (val * base) + (c - '0'); c = *++cp; } else if (base == 16 && ISASCII(c) && ISXDIGIT(c)) { val = (val << 4) | (c + 10 - (ISLOWER(c) ? 'a' : 'A')); c = *++cp; } else break; } if (c == '.') { /* * Internet format: * a.b.c.d * a.b.c (with c treated as 16 bits) * a.b (with b treated as 24 bits) */ if (pp >= parts + 3) return (0); *pp++ = val; c = *++cp; } else break; } /* * Check for trailing characters. */ if (c != '\0' && (!ISASCII(c) || !ISSPACE(c))) return (0); /* * Concoct the address according to * the number of parts specified. */ n = pp - parts + 1; switch (n) { case 0: return (0); /* initial nondigit */ case 1: /* a -- 32 bits */ break; case 2: /* a.b -- 8.24 bits */ if (val > 0xffffff) return (0); val |= parts[0] << 24; break; case 3: /* a.b.c -- 8.8.16 bits */ if (val > 0xffff) return (0); val |= (parts[0] << 24) | (parts[1] << 16); break; case 4: /* a.b.c.d -- 8.8.8.8 bits */ if (val > 0xff) return (0); val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8); break; } if (addr) addr->s_addr = htonl(val); return (1); } #endif /* these are compatibility routines, not needed on recent BSD releases */ /* * Ascii internet address interpretation routine. * The value returned is in network order. */ #if 0 inet_addr(cp) const char *cp; { struct in_addr val; if (inet_aton(cp, &val)) return (val.s_addr); return (0xffffffff); } #endif /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: initparse.c,v 1.6 2002/01/28 06:50:46 darrenr Exp $ */ #include "ipf.h" char thishost[MAXHOSTNAMELEN]; void initparse __P((void)) { gethostname(thishost, sizeof(thishost)); thishost[sizeof(thishost) - 1] = '\0'; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ionames.c,v 1.7 2002/01/28 06:50:46 darrenr Exp $ */ #include "ipf.h" struct ipopt_names ionames[] ={ { IPOPT_NOP, 0x000001, 1, "nop" }, /* RFC791 */ { IPOPT_RR, 0x000002, 7, "rr" }, /* 1 route */ { IPOPT_ZSU, 0x000004, 3, "zsu" }, /* size ?? */ { IPOPT_MTUP, 0x000008, 3, "mtup" }, /* RFC1191 */ { IPOPT_MTUR, 0x000010, 3, "mtur" }, /* RFC1191 */ { IPOPT_ENCODE, 0x000020, 3, "encode" }, /* size ?? */ { IPOPT_TS, 0x000040, 8, "ts" }, /* 1 TS */ { IPOPT_TR, 0x000080, 3, "tr" }, /* RFC1393 */ { IPOPT_SECURITY,0x000100, 11, "sec" }, /* RFC1108 */ { IPOPT_SECURITY,0x000100, 11, "sec-class" }, /* RFC1108 */ { IPOPT_LSRR, 0x000200, 7, "lsrr" }, /* 1 route */ { IPOPT_E_SEC, 0x000400, 3, "e-sec" }, /* RFC1108 */ { IPOPT_CIPSO, 0x000800, 3, "cipso" }, /* size ?? */ { IPOPT_SATID, 0x001000, 4, "satid" }, /* RFC791 */ { IPOPT_SSRR, 0x002000, 7, "ssrr" }, /* 1 route */ { IPOPT_ADDEXT, 0x004000, 3, "addext" }, /* IPv7 ?? */ { IPOPT_VISA, 0x008000, 3, "visa" }, /* size ?? */ { IPOPT_IMITD, 0x010000, 3, "imitd" }, /* size ?? */ { IPOPT_EIP, 0x020000, 3, "eip" }, /* RFC1385 */ { IPOPT_FINN, 0x040000, 3, "finn" }, /* size ?? */ { IPOPT_DPS, 0x080000, 3, "dps" }, /* size ?? */ { IPOPT_SDB, 0x100000, 3, "sdb" }, /* size ?? */ { IPOPT_NSAPA, 0x200000, 3, "nsapa" }, /* size ?? */ { IPOPT_RTRALRT,0x400000, 3, "rtralrt" }, /* RFC2113 */ { IPOPT_UMP, 0x800000, 3, "ump" }, /* size ?? */ { 0, 0, 0, (char *)NULL } /* must be last */ }; /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" #include "netinet/ipl.h" #include void ipf_dotuning(fd, tuneargs, iocfn) int fd; char *tuneargs; ioctlfunc_t iocfn; { ipfobj_t obj; ipftune_t tu; char *s, *t; bzero((char *)&tu, sizeof(tu)); obj.ipfo_rev = IPFILTER_VERSION; obj.ipfo_size = sizeof(tu);; obj.ipfo_ptr = (void *)&tu; obj.ipfo_type = IPFOBJ_TUNEABLE; for (s = strtok(tuneargs, ","); s != NULL; s = strtok(NULL, ",")) { if (!strcmp(s, "list")) { while (1) { if ((*iocfn)(fd, SIOCIPFGETNEXT, &obj) == -1) { perror("ioctl(SIOCIPFGETNEXT)"); break; } if (tu.ipft_cookie == NULL) break; tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; printtunable(&tu); } } else if ((t = strchr(s, '=')) != NULL) { tu.ipft_cookie = NULL; *t++ = '\0'; strncpy(tu.ipft_name, s, sizeof(tu.ipft_name)); if (sscanf(t, "%lu", &tu.ipft_vlong) == 1) { if ((*iocfn)(fd, SIOCIPFSET, &obj) == -1) { perror("ioctl(SIOCIPFSET)"); return; } } else { fprintf(stderr, "invalid value '%s'\n", s); return; } } else { tu.ipft_cookie = NULL; strncpy(tu.ipft_name, s, sizeof(tu.ipft_name)); if ((*iocfn)(fd, SIOCIPFGET, &obj) == -1) { perror("ioctl(SIOCIPFGET)"); return; } if (tu.ipft_cookie == NULL) { fprintf(stderr, "Null cookie for %s\n", s); return; } tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; printtunable(&tu); } } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ipft_ef.c,v 1.14 2004/01/08 13:34:31 darrenr Exp $ */ /* icmp type lnth proto source destination src port dst port etherfind -n 60 tcp 128.250.20.20 128.250.133.13 2419 telnet etherfind -n -t 0.32 91 04 131.170.1.10 128.250.133.13 0.33 566 udp 128.250.37.155 128.250.133.3 901 901 */ #include "ipf.h" #include "ipt.h" #ifndef linux #include #endif #include #if !defined(lint) static const char sccsid[] = "@(#)ipft_ef.c 1.6 2/4/96 (C)1995 Darren Reed"; static const char rcsid[] = "@(#)$Id: ipft_ef.c,v 1.14 2004/01/08 13:34:31 darrenr Exp $"; #endif static int etherf_open __P((char *)); static int etherf_close __P((void)); static int etherf_readip __P((char *, int, char **, int *)); struct ipread etherf = { etherf_open, etherf_close, etherf_readip, 0 }; static FILE *efp = NULL; static int efd = -1; static int etherf_open(fname) char *fname; { if (efd != -1) return efd; if (!strcmp(fname, "-")) { efd = 0; efp = stdin; } else { efd = open(fname, O_RDONLY); efp = fdopen(efd, "r"); } return efd; } static int etherf_close() { return close(efd); } static int etherf_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { struct tcpiphdr pkt; ip_t *ip = (ip_t *)&pkt; char src[16], dst[16], sprt[16], dprt[16]; char lbuf[128], len[8], prot[8], time[8], *s; int slen, extra = 0, i; if (!fgets(lbuf, sizeof(lbuf) - 1, efp)) return 0; if ((s = strchr(lbuf, '\n'))) *s = '\0'; lbuf[sizeof(lbuf)-1] = '\0'; bzero(&pkt, sizeof(pkt)); if (sscanf(lbuf, "%7s %7s %15s %15s %15s %15s", len, prot, src, dst, sprt, dprt) != 6) if (sscanf(lbuf, "%7s %7s %7s %15s %15s %15s %15s", time, len, prot, src, dst, sprt, dprt) != 7) return -1; ip->ip_p = getproto(prot); switch (ip->ip_p) { case IPPROTO_TCP : case IPPROTO_UDP : s = strtok(NULL, " :"); ip->ip_len += atoi(s); if (ip->ip_p == IPPROTO_TCP) extra = sizeof(struct tcphdr); else if (ip->ip_p == IPPROTO_UDP) extra = sizeof(struct udphdr); break; #ifdef IGMP case IPPROTO_IGMP : extra = sizeof(struct igmp); break; #endif case IPPROTO_ICMP : extra = sizeof(struct icmp); break; default : break; } (void) inet_aton(src, &ip->ip_src); (void) inet_aton(dst, &ip->ip_dst); ip->ip_len = atoi(len); IP_HL_A(ip, sizeof(ip_t)); slen = IP_HL(ip) + extra; i = MIN(cnt, slen); bcopy((char *)&pkt, buf, i); return i; } /* * Copyright (C) 1995-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ #if !defined(lint) static const char sccsid[] = "@(#)ipft_hx.c 1.1 3/9/96 (C) 1996 Darren Reed"; static const char rcsid[] = "@(#)$Id: ipft_hx.c,v 1.11.4.1 2004/12/09 19:41:20 darrenr Exp $"; #endif #include #include "ipf.h" #include "ipt.h" extern int opts; static int hex_open __P((char *)); static int hex_close __P((void)); static int hex_readip __P((char *, int, char **, int *)); static char *readhex __P((char *, char *)); struct ipread iphex = { hex_open, hex_close, hex_readip, 0 }; static FILE *tfp = NULL; static int tfd = -1; static int hex_open(fname) char *fname; { if (tfp && tfd != -1) { rewind(tfp); return tfd; } if (!strcmp(fname, "-")) { tfd = 0; tfp = stdin; } else { tfd = open(fname, O_RDONLY); if (tfd != -1) tfp = fdopen(tfd, "r"); } return tfd; } static int hex_close() { int cfd = tfd; tfd = -1; return close(cfd); } static int hex_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { register char *s, *t, *u; char line[513]; ip_t *ip; /* * interpret start of line as possibly "[ifname]" or * "[in/out,ifname]". */ if (ifn) *ifn = NULL; if (dir) *dir = 0; ip = (ip_t *)buf; while (fgets(line, sizeof(line)-1, tfp)) { if ((s = strchr(line, '\n'))) { if (s == line) return (char *)ip - buf; *s = '\0'; } if ((s = strchr(line, '#'))) *s = '\0'; if (!*line) continue; if (!(opts & OPT_BRIEF)) { printf("input: %s", line); } if ((*line == '[') && (s = strchr(line, ']'))) { t = line + 1; if (s - t > 0) { *s++ = '\0'; if ((u = strchr(t, ',')) && (u < s)) { u++; if (ifn) *ifn = strdup(u); if (dir) { if (*t == 'i') *dir = 0; else if (*t == 'o') *dir = 1; } } else if (ifn) *ifn = t; } } else s = line; t = (char *)ip; ip = (ip_t *)readhex(s, (char *)ip); if (!(opts & OPT_BRIEF)) { if (opts & OPT_ASCII) { if (t < (char *)ip) putchar('\t'); while (t < (char *)ip) { if (ISPRINT(*t) && ISASCII(*t)) putchar(*t); else putchar('.'); t++; } } putchar('\n'); fflush(stdout); } } return -1; } static char *readhex(src, dst) register char *src, *dst; { int state = 0; char c; while ((c = *src++)) { if (ISSPACE(c)) { if (state) { dst++; state = 0; } continue; } else if ((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) { c = ISDIGIT(c) ? (c - '0') : (TOUPPER(c) - 55); if (state == 0) { *dst = (c << 4); state++; } else { *dst++ |= c; state = 0; } } else break; } return dst; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ipft_pc.c,v 1.10 2004/02/07 18:17:40 darrenr Exp $ */ #include "ipf.h" #include "pcap-ipf.h" #include "bpf-ipf.h" #include "ipt.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: ipft_pc.c,v 1.10 2004/02/07 18:17:40 darrenr Exp $"; #endif struct llc { int lc_type; int lc_sz; /* LLC header length */ int lc_to; /* LLC Type offset */ int lc_tl; /* LLC Type length */ }; /* * While many of these maybe the same, some do have different header formats * which make this useful. */ static struct llc llcs[] = { { DLT_NULL, 0, 0, 0 }, { DLT_EN10MB, 14, 12, 2 }, { DLT_EN3MB, 0, 0, 0 }, { DLT_AX25, 0, 0, 0 }, { DLT_PRONET, 0, 0, 0 }, { DLT_CHAOS, 0, 0, 0 }, { DLT_IEEE802, 0, 0, 0 }, { DLT_ARCNET, 0, 0, 0 }, { DLT_SLIP, 0, 0, 0 }, { DLT_PPP, 0, 0, 0 }, { DLT_FDDI, 0, 0, 0 }, #ifdef DLT_ATMRFC1483 { DLT_ATMRFC1483, 0, 0, 0 }, #endif { DLT_RAW, 0, 0, 0 }, #ifdef DLT_ENC { DLT_ENC, 0, 0, 0 }, #endif #ifdef DLT_SLIP_BSDOS { DLT_SLIP_BSDOS, 0, 0, 0 }, #endif #ifdef DLT_PPP_BSDOS { DLT_PPP_BSDOS, 0, 0, 0 }, #endif #ifdef DLT_HIPPI { DLT_HIPPI, 0, 0, 0 }, #endif #ifdef DLT_HDLC { DLT_HDLC, 0, 0, 0 }, #endif #ifdef DLT_PPP_SERIAL { DLT_PPP_SERIAL, 4, 4, 0 }, #endif #ifdef DLT_PPP_ETHER { DLT_PPP_ETHER, 8, 8, 0 }, #endif #ifdef DLT_ECONET { DLT_ECONET, 0, 0, 0 }, #endif { -1, -1, -1, -1 } }; static int pcap_open __P((char *)); static int pcap_close __P((void)); static int pcap_readip __P((char *, int, char **, int *)); static void swap_hdr __P((pcaphdr_t *)); static int pcap_read_rec __P((struct pcap_pkthdr *)); static int pfd = -1, swapped = 0; static struct llc *llcp = NULL; struct ipread pcap = { pcap_open, pcap_close, pcap_readip, 0 }; #define SWAPLONG(y) \ ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) #define SWAPSHORT(y) \ ( (((y)&0xff)<<8) | (((y)&0xff00)>>8) ) static void swap_hdr(p) pcaphdr_t *p; { p->pc_v_maj = SWAPSHORT(p->pc_v_maj); p->pc_v_min = SWAPSHORT(p->pc_v_min); p->pc_zone = SWAPLONG(p->pc_zone); p->pc_sigfigs = SWAPLONG(p->pc_sigfigs); p->pc_slen = SWAPLONG(p->pc_slen); p->pc_type = SWAPLONG(p->pc_type); } static int pcap_open(fname) char *fname; { pcaphdr_t ph; int fd, i; if (pfd != -1) return pfd; if (!strcmp(fname, "-")) fd = 0; else if ((fd = open(fname, O_RDONLY)) == -1) return -1; if (read(fd, (char *)&ph, sizeof(ph)) != sizeof(ph)) return -2; if (ph.pc_id != TCPDUMP_MAGIC) { if (SWAPLONG(ph.pc_id) != TCPDUMP_MAGIC) { (void) close(fd); return -2; } swapped = 1; swap_hdr(&ph); } if (ph.pc_v_maj != PCAP_VERSION_MAJ) { (void) close(fd); return -2; } for (i = 0; llcs[i].lc_type != -1; i++) if (llcs[i].lc_type == ph.pc_type) { llcp = llcs + i; break; } if (llcp == NULL) { (void) close(fd); return -2; } pfd = fd; printf("opened pcap file %s:\n", fname); printf("\tid: %08x version: %d.%d type: %d snap %d\n", ph.pc_id, ph.pc_v_maj, ph.pc_v_min, ph.pc_type, ph.pc_slen); return fd; } static int pcap_close() { return close(pfd); } /* * read in the header (and validate) which should be the first record * in a pcap file. */ static int pcap_read_rec(rec) struct pcap_pkthdr *rec; { int n, p; if (read(pfd, (char *)rec, sizeof(*rec)) != sizeof(*rec)) return -2; if (swapped) { rec->ph_clen = SWAPLONG(rec->ph_clen); rec->ph_len = SWAPLONG(rec->ph_len); rec->ph_ts.tv_sec = SWAPLONG(rec->ph_ts.tv_sec); rec->ph_ts.tv_usec = SWAPLONG(rec->ph_ts.tv_usec); } p = rec->ph_clen; n = MIN(p, rec->ph_len); if (!n || n < 0) return -3; return p; } #ifdef notyet /* * read an entire pcap packet record. only the data part is copied into * the available buffer, with the number of bytes copied returned. */ static int pcap_read(buf, cnt) char *buf; int cnt; { struct pcap_pkthdr rec; static char *bufp = NULL; int i, n; if ((i = pcap_read_rec(&rec)) <= 0) return i; if (!bufp) bufp = malloc(i); else bufp = realloc(bufp, i); if (read(pfd, bufp, i) != i) return -2; n = MIN(i, cnt); bcopy(bufp, buf, n); return n; } #endif /* * return only an IP packet read into buf */ static int pcap_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { static char *bufp = NULL; struct pcap_pkthdr rec; struct llc *l; char *s, ty[4]; int i, n; l = llcp; /* do { */ if ((i = pcap_read_rec(&rec)) <= 0) return i; if (!bufp) bufp = malloc(i); else bufp = realloc(bufp, i); s = bufp; if (read(pfd, s, i) != i) return -2; i -= l->lc_sz; s += l->lc_to; bcopy(s, ty, l->lc_tl); s += l->lc_tl; /* } while (ty[0] != 0x8 && ty[1] != 0); */ n = MIN(i, cnt); bcopy(s, buf, n); return n; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $ */ /* * Written to comply with the recent RFC 1761 from Sun. */ #include "ipf.h" #include "snoop.h" #include "ipt.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $"; #endif struct llc { int lc_sz; /* LLC header length */ int lc_to; /* LLC Type offset */ int lc_tl; /* LLC Type length */ }; /* * While many of these maybe the same, some do have different header formats * which make this useful. */ static struct llc llcs[SDL_MAX+1] = { { 0, 0, 0 }, /* SDL_8023 */ { 0, 0, 0 }, /* SDL_8024 */ { 0, 0, 0 }, /* SDL_8025 */ { 0, 0, 0 }, /* SDL_8026 */ { 14, 12, 2 }, /* SDL_ETHER */ { 0, 0, 0 }, /* SDL_HDLC */ { 0, 0, 0 }, /* SDL_CHSYNC */ { 0, 0, 0 }, /* SDL_IBMCC */ { 0, 0, 0 }, /* SDL_FDDI */ { 0, 0, 0 }, /* SDL_OTHER */ }; static int snoop_open __P((char *)); static int snoop_close __P((void)); static int snoop_readip __P((char *, int, char **, int *)); static int sfd = -1, s_type = -1; static int snoop_read_rec __P((struct snooppkt *)); struct ipread snoop = { snoop_open, snoop_close, snoop_readip, 0 }; static int snoop_open(fname) char *fname; { struct snoophdr sh; int fd; int s_v; if (sfd != -1) return sfd; if (!strcmp(fname, "-")) fd = 0; else if ((fd = open(fname, O_RDONLY)) == -1) return -1; if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh)) return -2; s_v = (int)ntohl(sh.s_v); s_type = (int)ntohl(sh.s_type); if (s_v != SNOOP_VERSION || s_type < 0 || s_type > SDL_MAX) { (void) close(fd); return -2; } sfd = fd; printf("opened snoop file %s:\n", fname); printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type); return fd; } static int snoop_close() { return close(sfd); } /* * read in the header (and validate) which should be the first record * in a snoop file. */ static int snoop_read_rec(rec) struct snooppkt *rec; { int n, plen, ilen; if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec)) return -2; ilen = (int)ntohl(rec->sp_ilen); plen = (int)ntohl(rec->sp_plen); if (ilen > plen || plen < sizeof(*rec)) return -2; plen -= sizeof(*rec); n = MIN(plen, ilen); if (!n || n < 0) return -3; return plen; } #ifdef notyet /* * read an entire snoop packet record. only the data part is copied into * the available buffer, with the number of bytes copied returned. */ static int snoop_read(buf, cnt) char *buf; int cnt; { struct snooppkt rec; static char *bufp = NULL; int i, n; if ((i = snoop_read_rec(&rec)) <= 0) return i; if (!bufp) bufp = malloc(i); else bufp = realloc(bufp, i); if (read(sfd, bufp, i) != i) return -2; n = MIN(i, cnt); bcopy(bufp, buf, n); return n; } #endif /* * return only an IP packet read into buf */ static int snoop_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { static char *bufp = NULL; struct snooppkt rec; struct llc *l; char ty[4], *s; int i, n; do { if ((i = snoop_read_rec(&rec)) <= 0) return i; if (!bufp) bufp = malloc(i); else bufp = realloc(bufp, i); s = bufp; if (read(sfd, s, i) != i) return -2; l = &llcs[s_type]; i -= l->lc_to; s += l->lc_to; /* * XXX - bogus assumption here on the part of the time field * that it won't be greater than 4 bytes and the 1st two will * have the values 8 and 0 for IP. Should be a table of * these too somewhere. Really only works for SDL_ETHER. */ bcopy(s, ty, l->lc_tl); } while (ty[0] != 0x8 && ty[1] != 0); i -= l->lc_tl; s += l->lc_tl; n = MIN(i, cnt); bcopy(s, buf, n); return n; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ipft_td.c,v 1.15 2004/01/08 13:34:31 darrenr Exp $ */ /* tcpdump -n 00:05:47.816843 128.231.76.76.3291 > 224.2.252.231.36573: udp 36 (encap) tcpdump -nq 00:33:48.410771 192.73.213.11.1463 > 224.2.248.153.59360: udp 31 (encap) tcpdump -nqt 128.250.133.13.23 > 128.250.20.20.2419: tcp 27 tcpdump -nqtt 123456789.1234567 128.250.133.13.23 > 128.250.20.20.2419: tcp 27 tcpdump -nqte 8:0:20:f:65:f7 0:0:c:1:8a:c5 81: 128.250.133.13.23 > 128.250.20.20.2419: tcp 27 */ #include "ipf.h" #include "ipt.h" #ifndef linux #include #endif #include #if !defined(lint) static const char sccsid[] = "@(#)ipft_td.c 1.8 2/4/96 (C)1995 Darren Reed"; static const char rcsid[] = "@(#)$Id: ipft_td.c,v 1.15 2004/01/08 13:34:31 darrenr Exp $"; #endif static int tcpd_open __P((char *)); static int tcpd_close __P((void)); static int tcpd_readip __P((char *, int, char **, int *)); static int count_dots __P((char *)); struct ipread tcpd = { tcpd_open, tcpd_close, tcpd_readip, 0 }; static FILE *tfp = NULL; static int tfd = -1; static int tcpd_open(fname) char *fname; { if (tfd != -1) return tfd; if (!strcmp(fname, "-")) { tfd = 0; tfp = stdin; } else { tfd = open(fname, O_RDONLY); tfp = fdopen(tfd, "r"); } return tfd; } static int tcpd_close() { (void) fclose(tfp); return close(tfd); } static int count_dots(str) char *str; { int i = 0; while (*str) if (*str++ == '.') i++; return i; } static int tcpd_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { struct tcpiphdr pkt; ip_t *ip = (ip_t *)&pkt; char src[32], dst[32], misc[256], time[32], link1[32], link2[32]; char lbuf[160], *s; int n, slen, extra = 0; if (!fgets(lbuf, sizeof(lbuf) - 1, tfp)) return 0; if ((s = strchr(lbuf, '\n'))) *s = '\0'; lbuf[sizeof(lbuf)-1] = '\0'; bzero(&pkt, sizeof(pkt)); if ((n = sscanf(lbuf, "%31s > %31s: %255s", src, dst, misc)) != 3) if ((n = sscanf(lbuf, "%31s %31s > %31s: %255s", time, src, dst, misc)) != 4) if ((n = sscanf(lbuf, "%31s %31s: %31s > %31s: %255s", link1, link2, src, dst, misc)) != 5) { n = sscanf(lbuf, "%31s %31s %31s: %31s > %31s: %255s", time, link1, link2, src, dst, misc); if (n != 6) return -1; } if (count_dots(dst) == 4) { s = strrchr(src, '.'); *s++ = '\0'; (void) inet_aton(src, &ip->ip_src); pkt.ti_sport = htons(atoi(s)); *--s = '.'; s = strrchr(dst, '.'); *s++ = '\0'; (void) inet_aton(src, &ip->ip_dst); pkt.ti_dport = htons(atoi(s)); *--s = '.'; } else { (void) inet_aton(src, &ip->ip_src); (void) inet_aton(src, &ip->ip_dst); } ip->ip_len = sizeof(ip_t); IP_HL_A(ip, sizeof(ip_t)); s = strtok(misc, " :"); ip->ip_p = getproto(s); switch (ip->ip_p) { case IPPROTO_TCP : case IPPROTO_UDP : s = strtok(NULL, " :"); ip->ip_len += atoi(s); if (ip->ip_p == IPPROTO_TCP) extra = sizeof(struct tcphdr); else if (ip->ip_p == IPPROTO_UDP) extra = sizeof(struct udphdr); break; #ifdef IGMP case IPPROTO_IGMP : extra = sizeof(struct igmp); break; #endif case IPPROTO_ICMP : extra = sizeof(struct icmp); break; default : break; } slen = IP_HL(ip) + extra + ip->ip_len; return slen; } /* * Copyright (C) 1995-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #if !defined(lint) static const char sccsid[] = "@(#)ipft_tx.c 1.7 6/5/96 (C) 1993 Darren Reed"; static const char rcsid[] = "@(#)$Id: ipft_tx.c,v 1.15.2.3 2005/06/18 02:41:34 darrenr Exp $"; #endif #include #include "ipf.h" #include "ipt.h" #ifndef linux #include #endif #include extern int opts; static char *tx_proto = ""; static int text_open __P((char *)), text_close __P((void)); static int text_readip __P((char *, int, char **, int *)); static int parseline __P((char *, ip_t *, char **, int *)); static char myflagset[] = "FSRPAUEC"; static u_char myflags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, TH_ACK, TH_URG, TH_ECN, TH_CWR }; struct ipread iptext = { text_open, text_close, text_readip, R_DO_CKSUM }; static FILE *tfp = NULL; static int tfd = -1; static u_32_t tx_hostnum __P((char *, int *)); static u_short tx_portnum __P((char *)); /* * returns an ip address as a long var as a result of either a DNS lookup or * straight inet_addr() call */ static u_32_t tx_hostnum(host, resolved) char *host; int *resolved; { i6addr_t ipa; *resolved = 0; if (!strcasecmp("any", host)) return 0L; if (ISDIGIT(*host)) return inet_addr(host); if (gethost(host, &ipa, 0) == -1) { *resolved = -1; fprintf(stderr, "can't resolve hostname: %s\n", host); return 0; } return ipa.in4_addr; } /* * find the port number given by the name, either from getservbyname() or * straight atoi() */ static u_short tx_portnum(name) char *name; { struct servent *sp, *sp2; u_short p1 = 0; if (ISDIGIT(*name)) return (u_short)atoi(name); if (!tx_proto) tx_proto = "tcp/udp"; if (strcasecmp(tx_proto, "tcp/udp")) { sp = getservbyname(name, tx_proto); if (sp) return ntohs(sp->s_port); (void) fprintf(stderr, "unknown service \"%s\".\n", name); return 0; } sp = getservbyname(name, "tcp"); if (sp) p1 = sp->s_port; sp2 = getservbyname(name, "udp"); if (!sp || !sp2) { (void) fprintf(stderr, "unknown tcp/udp service \"%s\".\n", name); return 0; } if (p1 != sp2->s_port) { (void) fprintf(stderr, "%s %d/tcp is a different port to ", name, p1); (void) fprintf(stderr, "%s %d/udp\n", name, sp->s_port); return 0; } return ntohs(p1); } char *tx_icmptypes[] = { "echorep", (char *)NULL, (char *)NULL, "unreach", "squench", "redir", (char *)NULL, (char *)NULL, "echo", "routerad", "routersol", "timex", "paramprob", "timest", "timestrep", "inforeq", "inforep", "maskreq", "maskrep", "END" }; static int text_open(fname) char *fname; { if (tfp && tfd != -1) { rewind(tfp); return tfd; } if (!strcmp(fname, "-")) { tfd = 0; tfp = stdin; } else { tfd = open(fname, O_RDONLY); if (tfd != -1) tfp = fdopen(tfd, "r"); } return tfd; } static int text_close() { int cfd = tfd; tfd = -1; return close(cfd); } static int text_readip(buf, cnt, ifn, dir) char *buf, **ifn; int cnt, *dir; { register char *s; char line[513]; *ifn = NULL; while (fgets(line, sizeof(line)-1, tfp)) { if ((s = strchr(line, '\n'))) *s = '\0'; if ((s = strchr(line, '\r'))) *s = '\0'; if ((s = strchr(line, '#'))) *s = '\0'; if (!*line) continue; if (!(opts & OPT_BRIEF)) printf("input: %s\n", line); *ifn = NULL; *dir = 0; if (!parseline(line, (ip_t *)buf, ifn, dir)) #if 0 return sizeof(ip_t) + sizeof(tcphdr_t); #else return sizeof(ip_t); #endif } return -1; } static int parseline(line, ip, ifn, out) char *line; ip_t *ip; char **ifn; int *out; { tcphdr_t th, *tcp = &th; struct icmp icmp, *ic = &icmp; char *cps[20], **cpp, c, ipopts[68]; int i, r; if (*ifn) free(*ifn); bzero((char *)ip, MAX(sizeof(*tcp), sizeof(*ic)) + sizeof(*ip)); bzero((char *)tcp, sizeof(*tcp)); bzero((char *)ic, sizeof(*ic)); bzero(ipopts, sizeof(ipopts)); IP_HL_A(ip, sizeof(*ip) >> 2); IP_V_A(ip, IPVERSION); for (i = 0, cps[0] = strtok(line, " \b\t\r\n"); cps[i] && i < 19; ) cps[++i] = strtok(NULL, " \b\t\r\n"); cpp = cps; if (!*cpp) return 1; c = **cpp; if (!ISALPHA(c) || (TOLOWER(c) != 'o' && TOLOWER(c) != 'i')) { fprintf(stderr, "bad direction \"%s\"\n", *cpp); return 1; } *out = (TOLOWER(c) == 'o') ? 1 : 0; cpp++; if (!*cpp) return 1; if (!strcasecmp(*cpp, "on")) { cpp++; if (!*cpp) return 1; *ifn = strdup(*cpp++); if (!*cpp) return 1; } c = **cpp; ip->ip_len = sizeof(ip_t); if (!strcasecmp(*cpp, "tcp") || !strcasecmp(*cpp, "udp") || !strcasecmp(*cpp, "icmp")) { if (c == 't') { ip->ip_p = IPPROTO_TCP; ip->ip_len += sizeof(struct tcphdr); tx_proto = "tcp"; } else if (c == 'u') { ip->ip_p = IPPROTO_UDP; ip->ip_len += sizeof(struct udphdr); tx_proto = "udp"; } else { ip->ip_p = IPPROTO_ICMP; ip->ip_len += ICMPERR_IPICMPHLEN; tx_proto = "icmp"; } cpp++; } else if (ISDIGIT(**cpp) && !index(*cpp, '.')) { ip->ip_p = atoi(*cpp); cpp++; } else ip->ip_p = IPPROTO_IP; if (!*cpp) return 1; if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { char *last; last = strchr(*cpp, ','); if (!last) { fprintf(stderr, "tcp/udp with no source port\n"); return 1; } *last++ = '\0'; tcp->th_sport = htons(tx_portnum(last)); if (ip->ip_p == IPPROTO_TCP) { tcp->th_win = htons(4096); TCP_OFF_A(tcp, sizeof(*tcp) >> 2); } } ip->ip_src.s_addr = tx_hostnum(*cpp, &r); cpp++; if (!*cpp) return 1; if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) { char *last; last = strchr(*cpp, ','); if (!last) { fprintf(stderr, "tcp/udp with no destination port\n"); return 1; } *last++ = '\0'; tcp->th_dport = htons(tx_portnum(last)); } ip->ip_dst.s_addr = tx_hostnum(*cpp, &r); cpp++; if (*cpp && ip->ip_p == IPPROTO_TCP) { char *s, *t; tcp->th_flags = 0; for (s = *cpp; *s; s++) if ((t = strchr(myflagset, *s))) tcp->th_flags |= myflags[t - myflagset]; if (tcp->th_flags) cpp++; if (tcp->th_flags == 0) abort(); if (tcp->th_flags & TH_URG) tcp->th_urp = htons(1); } else if (*cpp && ip->ip_p == IPPROTO_ICMP) { extern char *tx_icmptypes[]; char **s, *t; int i; for (s = tx_icmptypes, i = 0; !*s || strcmp(*s, "END"); s++, i++) if (*s && !strncasecmp(*cpp, *s, strlen(*s))) { ic->icmp_type = i; if ((t = strchr(*cpp, ','))) ic->icmp_code = atoi(t+1); cpp++; break; } } if (*cpp && !strcasecmp(*cpp, "opt")) { u_long olen; cpp++; olen = buildopts(*cpp, ipopts, (IP_HL(ip) - 5) << 2); if (olen) { bcopy(ipopts, (char *)(ip + 1), olen); IP_HL_A(ip, IP_HL(ip) + (olen >> 2)); } } if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) bcopy((char *)tcp, ((char *)ip) + (IP_HL(ip) << 2), sizeof(*tcp)); else if (ip->ip_p == IPPROTO_ICMP) bcopy((char *)ic, ((char *)ip) + (IP_HL(ip) << 2), sizeof(*ic)); ip->ip_len = htons(ip->ip_len); return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ipoptsec.c,v 1.2 2002/01/28 06:50:46 darrenr Exp $ */ #include "ipf.h" struct ipopt_names secclass[] = { { IPSO_CLASS_RES4, 0x01, 0, "reserv-4" }, { IPSO_CLASS_TOPS, 0x02, 0, "topsecret" }, { IPSO_CLASS_SECR, 0x04, 0, "secret" }, { IPSO_CLASS_RES3, 0x08, 0, "reserv-3" }, { IPSO_CLASS_CONF, 0x10, 0, "confid" }, { IPSO_CLASS_UNCL, 0x20, 0, "unclass" }, { IPSO_CLASS_RES2, 0x40, 0, "reserv-2" }, { IPSO_CLASS_RES1, 0x80, 0, "reserv-1" }, { 0, 0, 0, NULL } /* must be last */ }; u_char seclevel(slevel) char *slevel; { struct ipopt_names *so; for (so = secclass; so->on_name; so++) if (!strcasecmp(slevel, so->on_name)) break; if (!so->on_name) { fprintf(stderr, "no such security level: %s\n", slevel); return 0; } return (u_char)so->on_value; } u_char secbit(class) int class; { struct ipopt_names *so; for (so = secclass; so->on_name; so++) if (so->on_value == class) break; if (!so->on_name) { fprintf(stderr, "no such security class: %d\n", class); return 0; } return (u_char)so->on_bit; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ /* * kmemcpy() - copies n bytes from kernel memory into user buffer. * returns 0 on success, -1 on error. */ /* * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #if !defined(__sgi) && !defined(__hpux) && !defined(__osf__) && !defined(linux) && !defined(_AIX51) #include #endif #include #include #include #include #include #include #include #include #if __FreeBSD_version >= 300000 # include #endif #if defined(linux) || defined(__osf__) || defined(__sgi) || defined(__hpux) # include #endif #include "kmem.h" #ifndef __STDC__ # define const #endif #if !defined(lint) static const char sccsid[] = "@(#)kmem.c 1.4 1/12/96 (C) 1992 Darren Reed"; static const char rcsid[] = "@(#)$Id: kmem.c,v 1.16.2.2 2005/06/12 07:18:41 darrenr Exp $"; #endif #if !defined(__sgi) && !defined(__hpux) && !defined(__osf__) && \ !defined(linux) && !defined(_AIX51) /* * For all platforms where there is a libkvm and a kvm_t, we use that... */ static kvm_t *kvm_f = NULL; #else /* *...and for the others (HP-UX, IRIX, Tru64), we have to provide our own. */ typedef int * kvm_t; static kvm_t kvm_f = NULL; static char *kvm_errstr = NULL; kvm_t kvm_open __P((char *, char *, char *, int, char *)); int kvm_read __P((kvm_t, u_long, char *, size_t)); kvm_t kvm_open(kernel, core, swap, mode, errstr) char *kernel, *core, *swap; int mode; char *errstr; { kvm_t k; int fd; kvm_errstr = errstr; if (core == NULL) core = "/dev/kmem"; fd = open(core, mode); if (fd == -1) return NULL; k = malloc(sizeof(*k)); if (k == NULL) { close(fd); return NULL; } *k = fd; return k; } int kvm_read(kvm, pos, buffer, size) kvm_t kvm; u_long pos; char *buffer; size_t size; { int r = 0, left; char *bufp; if (lseek(*kvm, pos, 0) == -1) { if (kvm_errstr != NULL) { fprintf(stderr, "%s", kvm_errstr); perror("lseek"); } return -1; } for (bufp = buffer, left = size; left > 0; bufp += r, left -= r) { r = read(*kvm, bufp, left); #ifdef __osf__ /* * Tru64 returns "0" for successful operation, not the number * of bytes read. */ if (r == 0) r = left; #endif if (r <= 0) return -1; } return r; } #endif /* !defined(__sgi) && !defined(__hpux) && !defined(__osf__) */ int openkmem(kern, core) char *kern, *core; { kvm_f = kvm_open(kern, core, NULL, O_RDONLY, NULL); if (kvm_f == NULL) { perror("openkmem:open"); return -1; } return kvm_f != NULL; } int kmemcpy(buf, pos, n) register char *buf; long pos; register int n; { register int r; if (!n) return 0; if (kvm_f == NULL) if (openkmem(NULL, NULL) == -1) return -1; while ((r = kvm_read(kvm_f, pos, buf, n)) < n) if (r <= 0) { fprintf(stderr, "pos=0x%lx ", (u_long)pos); perror("kmemcpy:read"); return -1; } else { buf += r; pos += r; n -= r; } return 0; } int kstrncpy(buf, pos, n) register char *buf; long pos; register int n; { register int r; if (!n) return 0; if (kvm_f == NULL) if (openkmem(NULL, NULL) == -1) return -1; while (n > 0) { r = kvm_read(kvm_f, pos, buf, 1); if (r <= 0) { fprintf(stderr, "pos=0x%lx ", (u_long)pos); perror("kmemcpy:read"); return -1; } else { if (*buf == '\0') break; buf++; pos++; n--; } } return 0; } #include "ipf.h" #include "kmem.h" int kmemcpywrap(from, to, size) void *from, *to; size_t size; { int ret; ret = kmemcpy((caddr_t)to, (u_long)from, size); return ret; } #include "ipf.h" #include #include char *kvatoname(func, iocfunc) ipfunc_t func; ioctlfunc_t iocfunc; { static char funcname[40]; ipfunc_resolve_t res; int fd; res.ipfu_addr = func; res.ipfu_name[0] = '\0'; fd = -1; if ((opts & OPT_DONOTHING) == 0) { fd = open(IPL_NAME, O_RDONLY); if (fd == -1) return NULL; } (void) (*iocfunc)(fd, SIOCFUNCL, &res); if (fd >= 0) close(fd); strncpy(funcname, res.ipfu_name, sizeof(funcname)); funcname[sizeof(funcname) - 1] = '\0'; return funcname; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: load_hash.c,v 1.11.2.2 2005/02/01 02:44:05 darrenr Exp $ * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. * * Copyright (c) 2014, Joyent, Inc. All rights reserved. */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_htable.h" #include "ipfzone.h" static int hashfd = -1; int load_hash(iphp, list, iocfunc) iphtable_t *iphp; iphtent_t *list; ioctlfunc_t iocfunc; { iplookupop_t op; iphtable_t iph; iphtent_t *a; size_t size; int n; if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) hashfd = open(IPLOOKUP_NAME, O_RDWR); if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; if (setzone(hashfd) != 0) { close(hashfd); return -1; } for (n = 0, a = list; a != NULL; a = a->ipe_next) n++; op.iplo_arg = 0; op.iplo_type = IPLT_HASH; op.iplo_unit = iphp->iph_unit; strncpy(op.iplo_name, iphp->iph_name, sizeof(op.iplo_name)); if (*op.iplo_name == '\0') op.iplo_arg = IPHASH_ANON; op.iplo_size = sizeof(iph); op.iplo_struct = &iph; iph.iph_unit = iphp->iph_unit; iph.iph_type = iphp->iph_type; strncpy(iph.iph_name, iphp->iph_name, sizeof(iph.iph_name)); iph.iph_flags = iphp->iph_flags; if (n <= 0) n = 1; if (iphp->iph_size == 0) size = n * 2 - 1; else size = iphp->iph_size; if ((list == NULL) && (size == 1)) { fprintf(stderr, "WARNING: empty hash table %s, recommend setting %s\n", iphp->iph_name, "size to match expected use"); } iph.iph_size = size; iph.iph_seed = iphp->iph_seed; iph.iph_table = NULL; iph.iph_ref = 0; if ((opts & OPT_REMOVE) == 0) { if ((*iocfunc)(hashfd, SIOCLOOKUPADDTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("load_hash:SIOCLOOKUPADDTABLE"); return -1; } } strncpy(op.iplo_name, iph.iph_name, sizeof(op.iplo_name)); strncpy(iphp->iph_name, iph.iph_name, sizeof(op.iplo_name)); if (opts & OPT_VERBOSE) { for (a = list; a != NULL; a = a->ipe_next) { if (a->ipe_family == AF_INET) { a->ipe_addr.in4_addr = ntohl(a->ipe_addr.in4_addr); a->ipe_mask.in4_addr = ntohl(a->ipe_mask.in4_addr); } } iph.iph_table = calloc(size, sizeof(*iph.iph_table)); if (iph.iph_table == NULL) { perror("calloc(size, sizeof(*iph.iph_table))"); return -1; } iph.iph_table[0] = list; printhash(&iph, bcopywrap, iph.iph_name, opts); free(iph.iph_table); for (a = list; a != NULL; a = a->ipe_next) { if (a->ipe_family == AF_INET) { a->ipe_addr.in4_addr = htonl(a->ipe_addr.in4_addr); a->ipe_mask.in4_addr = htonl(a->ipe_mask.in4_addr); } } } if (opts & OPT_DEBUG) printf("Hash %s:\n", iph.iph_name); for (a = list; a != NULL; a = a->ipe_next) load_hashnode(iphp->iph_unit, iph.iph_name, a, iocfunc); if ((opts & OPT_REMOVE) != 0) { if ((*iocfunc)(hashfd, SIOCLOOKUPDELTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("load_hash:SIOCLOOKUPDELTABLE"); return -1; } } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: load_hashnode.c,v 1.2.4.1 2004/03/06 14:33:28 darrenr Exp $ * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. * * Copyright (c) 2014, Joyent, Inc. All rights reserved. */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_htable.h" #include "ipfzone.h" static int hashfd = -1; int load_hashnode(unit, name, node, iocfunc) int unit; char *name; iphtent_t *node; ioctlfunc_t iocfunc; { iplookupop_t op; iphtent_t ipe; int err; if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) hashfd = open(IPLOOKUP_NAME, O_RDWR); if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; if (setzone(hashfd) != 0) { close(hashfd); return -1; } op.iplo_type = IPLT_HASH; op.iplo_unit = unit; op.iplo_arg = 0; op.iplo_size = sizeof(ipe); op.iplo_struct = &ipe; strncpy(op.iplo_name, name, sizeof(op.iplo_name)); bzero((char *)&ipe, sizeof(ipe)); ipe.ipe_family = node->ipe_family; bcopy((char *)&node->ipe_addr, (char *)&ipe.ipe_addr, sizeof(ipe.ipe_addr)); bcopy((char *)&node->ipe_mask, (char *)&ipe.ipe_mask, sizeof(ipe.ipe_mask)); bcopy((char *)&node->ipe_group, (char *)&ipe.ipe_group, sizeof(ipe.ipe_group)); if ((opts & OPT_REMOVE) == 0) err = (*iocfunc)(hashfd, SIOCLOOKUPADDNODE, &op); else err = (*iocfunc)(hashfd, SIOCLOOKUPDELNODE, &op); if (err != 0) if (!(opts & OPT_DONOTHING)) { perror("load_hash:SIOCLOOKUP*NODE"); return -1; } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: load_pool.c,v 1.14.2.2 2005/02/01 02:44:06 darrenr Exp $ * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. * * Copyright (c) 2014, Joyent, Inc. All rights reserved. */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_pool.h" #include "ipfzone.h" static int poolfd = -1; int load_pool(plp, iocfunc) ip_pool_t *plp; ioctlfunc_t iocfunc; { iplookupop_t op; ip_pool_node_t *a; ip_pool_t pool; if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) poolfd = open(IPLOOKUP_NAME, O_RDWR); if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; if (setzone(poolfd) != 0) { close(poolfd); return -1; } op.iplo_unit = plp->ipo_unit; op.iplo_type = IPLT_POOL; op.iplo_arg = 0; strncpy(op.iplo_name, plp->ipo_name, sizeof(op.iplo_name)); op.iplo_size = sizeof(pool); op.iplo_struct = &pool; bzero((char *)&pool, sizeof(pool)); strncpy(pool.ipo_name, plp->ipo_name, sizeof(pool.ipo_name)); if (*plp->ipo_name == '\0') op.iplo_arg |= IPOOL_ANON; if ((opts & OPT_REMOVE) == 0) { if ((*iocfunc)(poolfd, SIOCLOOKUPADDTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("load_pool:SIOCLOOKUPADDTABLE"); return -1; } } if ((opts & OPT_VERBOSE) != 0) { pool.ipo_list = plp->ipo_list; printpool(&pool, bcopywrap, pool.ipo_name, opts); pool.ipo_list = NULL; } for (a = plp->ipo_list; a != NULL; a = a->ipn_next) load_poolnode(plp->ipo_unit, plp->ipo_name, a, iocfunc); if ((opts & OPT_REMOVE) != 0) { if ((*iocfunc)(poolfd, SIOCLOOKUPDELTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("load_pool:SIOCLOOKUPDELTABLE"); return -1; } } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: load_poolnode.c,v 1.3.2.1 2004/03/06 14:33:29 darrenr Exp $ * * Copyright (c) 2014, Joyent, Inc. All rights reserved. */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_pool.h" #include "ipfzone.h" static int poolfd = -1; int load_poolnode(role, name, node, iocfunc) int role; char *name; ip_pool_node_t *node; ioctlfunc_t iocfunc; { ip_pool_node_t pn; iplookupop_t op; int err; if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) poolfd = open(IPLOOKUP_NAME, O_RDWR); if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; if (setzone(poolfd) != 0) { close(poolfd); return -1; } op.iplo_unit = role; op.iplo_type = IPLT_POOL; op.iplo_arg = 0; op.iplo_struct = &pn; op.iplo_size = sizeof(pn); strncpy(op.iplo_name, name, sizeof(op.iplo_name)); bzero((char *)&pn, sizeof(pn)); bcopy((char *)&node->ipn_addr, (char *)&pn.ipn_addr, sizeof(pn.ipn_addr)); bcopy((char *)&node->ipn_mask, (char *)&pn.ipn_mask, sizeof(pn.ipn_mask)); pn.ipn_info = node->ipn_info; strncpy(pn.ipn_name, node->ipn_name, sizeof(pn.ipn_name)); if ((opts & OPT_REMOVE) == 0) err = (*iocfunc)(poolfd, SIOCLOOKUPADDNODE, &op); else err = (*iocfunc)(poolfd, SIOCLOOKUPDELNODE, &op); if (err != 0) { if ((opts & OPT_DONOTHING) == 0) { perror("load_pool:SIOCLOOKUP*NODE"); return -1; } } return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: loglevel.c,v 1.5 2001/06/09 17:09:24 darrenr Exp $ */ #include "ipf.h" int loglevel(cpp, facpri, linenum) char **cpp; u_int *facpri; int linenum; { int fac, pri; char *s; fac = 0; pri = 0; if (!*++cpp) { fprintf(stderr, "%d: %s\n", linenum, "missing identifier after level"); return -1; } s = strchr(*cpp, '.'); if (s) { *s++ = '\0'; fac = fac_findname(*cpp); if (fac == -1) { fprintf(stderr, "%d: %s %s\n", linenum, "Unknown facility", *cpp); return -1; } pri = pri_findname(s); if (pri == -1) { fprintf(stderr, "%d: %s %s\n", linenum, "Unknown priority", s); return -1; } } else { pri = pri_findname(*cpp); if (pri == -1) { fprintf(stderr, "%d: %s %s\n", linenum, "Unknown priority", *cpp); return -1; } } *facpri = fac|pri; return 0; } #include "ipf.h" #define EMM_MAGIC 0x9d7adba3 void eMmutex_enter(mtx, file, line) eMmutex_t *mtx; char *file; int line; { if (mtx->eMm_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMmutex_enter(%p): bad magic: %#x\n", mtx->eMm_owner, mtx, mtx->eMm_magic); abort(); } if (mtx->eMm_held != 0) { fprintf(stderr, "%s:eMmutex_enter(%p): already locked: %d\n", mtx->eMm_owner, mtx, mtx->eMm_held); abort(); } mtx->eMm_held++; mtx->eMm_heldin = file; mtx->eMm_heldat = line; } void eMmutex_exit(mtx) eMmutex_t *mtx; { if (mtx->eMm_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMmutex_exit(%p): bad magic: %#x\n", mtx->eMm_owner, mtx, mtx->eMm_magic); abort(); } if (mtx->eMm_held != 1) { fprintf(stderr, "%s:eMmutex_exit(%p): not locked: %d\n", mtx->eMm_owner, mtx, mtx->eMm_held); abort(); } mtx->eMm_held--; mtx->eMm_heldin = NULL; mtx->eMm_heldat = 0; } void eMmutex_init(mtx, who) eMmutex_t *mtx; char *who; { if (mtx->eMm_magic == EMM_MAGIC) { /* safe bet ? */ fprintf(stderr, "%s:eMmutex_init(%p): already initialised?: %#x\n", mtx->eMm_owner, mtx, mtx->eMm_magic); abort(); } mtx->eMm_magic = EMM_MAGIC; mtx->eMm_held = 0; if (who != NULL) mtx->eMm_owner = strdup(who); else mtx->eMm_owner = NULL; } void eMmutex_destroy(mtx) eMmutex_t *mtx; { if (mtx->eMm_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMmutex_destroy(%p): bad magic: %#x\n", mtx->eMm_owner, mtx, mtx->eMm_magic); abort(); } if (mtx->eMm_held != 0) { fprintf(stderr, "%s:eMmutex_enter(%p): still locked: %d\n", mtx->eMm_owner, mtx, mtx->eMm_held); abort(); } memset(mtx, 0xa5, sizeof(*mtx)); } #include "ipf.h" #include #include ipfunc_t nametokva(name, iocfunc) char *name; ioctlfunc_t iocfunc; { ipfunc_resolve_t res; int fd; strncpy(res.ipfu_name, name, sizeof(res.ipfu_name)); res.ipfu_addr = NULL; fd = -1; if ((opts & OPT_DONOTHING) == 0) { fd = open(IPL_NAME, O_RDONLY); if (fd == -1) return NULL; } (void) (*iocfunc)(fd, SIOCFUNCL, &res); if (fd >= 0) close(fd); if (res.ipfu_addr == NULL) res.ipfu_addr = (ipfunc_t)-1; return res.ipfu_addr; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" void nat_setgroupmap(n) ipnat_t *n; { if (n->in_outmsk == n->in_inmsk) n->in_ippip = 1; else if (n->in_flags & IPN_AUTOPORTMAP) { n->in_ippip = ~ntohl(n->in_inmsk); if (n->in_outmsk != 0xffffffff) n->in_ippip /= (~ntohl(n->in_outmsk) + 1); n->in_ippip++; if (n->in_ippip == 0) n->in_ippip = 1; n->in_ppip = USABLE_PORTS / n->in_ippip; } else { n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); n->in_nip = 0; if (!(n->in_ppip = n->in_pmin)) n->in_ppip = 1; n->in_ippip = USABLE_PORTS / n->in_ppip; } } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2005 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" int ntomask(v, nbits, ap) int v, nbits; u_32_t *ap; { u_32_t mask; if (nbits < 0) return -1; switch (v) { case 4 : if (nbits > 32 || use_inet6 != 0) return -1; if (nbits == 0) { mask = 0; } else { mask = 0xffffffff; mask <<= (32 - nbits); } *ap = htonl(mask); break; case 6 : if (nbits > 128) return -1; fill6bits(nbits, ap); break; default : return -1; } return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: optname.c,v 1.3 2001/06/09 17:09:24 darrenr Exp $ */ #include "ipf.h" u_32_t optname(cp, sp, linenum) char ***cp; u_short *sp; int linenum; { struct ipopt_names *io, *so; u_long msk = 0; u_short smsk = 0; char *s; int sec = 0; for (s = strtok(**cp, ","); s; s = strtok(NULL, ",")) { for (io = ionames; io->on_name; io++) if (!strcasecmp(s, io->on_name)) { msk |= io->on_bit; break; } if (!io->on_name) { fprintf(stderr, "%d: unknown IP option name %s\n", linenum, s); return 0; } if (!strcasecmp(s, "sec-class")) sec = 1; } if (sec && !*(*cp + 1)) { fprintf(stderr, "%d: missing security level after sec-class\n", linenum); return 0; } if (sec) { (*cp)++; for (s = strtok(**cp, ","); s; s = strtok(NULL, ",")) { for (so = secclass; so->on_name; so++) if (!strcasecmp(s, so->on_name)) { smsk |= so->on_bit; break; } if (!so->on_name) { fprintf(stderr, "%d: no such security level: %s\n", linenum, s); return 0; } } if (smsk) *sp = smsk; } return msk; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: optprint.c,v 1.6 2002/07/13 15:59:49 darrenr Exp $ */ #include "ipf.h" void optprint(sec, optmsk, optbits) u_short *sec; u_long optmsk, optbits; { u_short secmsk = sec[0], secbits = sec[1]; struct ipopt_names *io, *so; char *s; s = " opt "; for (io = ionames; io->on_name; io++) if ((io->on_bit & optmsk) && ((io->on_bit & optmsk) == (io->on_bit & optbits))) { if ((io->on_value != IPOPT_SECURITY) || (!secmsk && !secbits)) { printf("%s%s", s, io->on_name); if (io->on_value == IPOPT_SECURITY) io++; s = ","; } } if (secmsk & secbits) { printf("%ssec-class", s); s = " "; for (so = secclass; so->on_name; so++) if ((secmsk & so->on_bit) && ((so->on_bit & secmsk) == (so->on_bit & secbits))) { printf("%s%s", s, so->on_name); s = ","; } } if ((optmsk && (optmsk != optbits)) || (secmsk && (secmsk != secbits))) { s = " "; printf(" not opt"); if (optmsk != optbits) { for (io = ionames; io->on_name; io++) if ((io->on_bit & optmsk) && ((io->on_bit & optmsk) != (io->on_bit & optbits))) { if ((io->on_value != IPOPT_SECURITY) || (!secmsk && !secbits)) { printf("%s%s", s, io->on_name); s = ","; if (io->on_value == IPOPT_SECURITY) io++; } else io++; } } if (secmsk != secbits) { printf("%ssec-class", s); s = " "; for (so = secclass; so->on_name; so++) if ((so->on_bit & secmsk) && ((so->on_bit & secmsk) != (so->on_bit & secbits))) { printf("%s%s", s, so->on_name); s = ","; } } } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: optprintv6.c,v 1.2 2003/04/30 00:39:39 darrenr Exp $ */ #include "ipf.h" #ifdef USE_INET6 void optprintv6(sec, optmsk, optbits) u_short *sec; u_long optmsk, optbits; { u_short secmsk = sec[0], secbits = sec[1]; struct ipopt_names *io; char *s; s = " v6hdrs "; for (io = v6ionames; io->on_name; io++) if ((io->on_bit & optmsk) && ((io->on_bit & optmsk) == (io->on_bit & optbits))) { printf("%s%s", s, io->on_name); s = ","; } if ((optmsk && (optmsk != optbits)) || (secmsk && (secmsk != secbits))) { s = " "; printf(" not v6hdrs"); if (optmsk != optbits) { for (io = v6ionames; io->on_name; io++) if ((io->on_bit & optmsk) && ((io->on_bit & optmsk) != (io->on_bit & optbits))) { printf("%s%s", s, io->on_name); s = ","; } } } } #endif /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: optvalue.c,v 1.2 2002/01/28 06:50:47 darrenr Exp $ */ #include "ipf.h" u_32_t getoptbyname(optname) char *optname; { struct ipopt_names *io; for (io = ionames; io->on_name; io++) if (!strcasecmp(optname, io->on_name)) return io->on_bit; return -1; } u_32_t getoptbyvalue(optval) int optval; { struct ipopt_names *io; for (io = ionames; io->on_name; io++) if (io->on_value == optval) return io->on_bit; return -1; } /* * Copyright (C) 1993-2001, 2003 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2003 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ /* * This header file is constructed to match the version described by * PCAP_VERSION_MAJ. * * The structure largely derives from libpcap which wouldn't include * nicely without bpf. */ typedef struct pcap_filehdr { u_int pc_id; u_short pc_v_maj; u_short pc_v_min; u_int pc_zone; u_int pc_sigfigs; u_int pc_slen; u_int pc_type; } pcaphdr_t; #define TCPDUMP_MAGIC 0xa1b2c3d4 #define PCAP_VERSION_MAJ 2 typedef struct pcap_pkthdr { struct timeval ph_ts; u_int ph_clen; u_int ph_len; } pcappkt_t; /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: portname.c,v 1.7 2003/08/14 14:27:43 darrenr Exp $ */ #include "ipf.h" char *portname(pr, port) int pr, port; { static char buf[32]; struct protoent *p = NULL; struct servent *sv = NULL, *sv1 = NULL; if ((opts & OPT_NORESOLVE) == 0) { if (pr == -1) { if ((sv = getservbyport(htons(port), "tcp"))) { strncpy(buf, sv->s_name, sizeof(buf)-1); buf[sizeof(buf)-1] = '\0'; sv1 = getservbyport(htons(port), "udp"); sv = strncasecmp(buf, sv->s_name, strlen(buf)) ? NULL : sv1; } if (sv) return buf; } else if ((pr != -2) && (p = getprotobynumber(pr))) { if ((sv = getservbyport(htons(port), p->p_name))) { strncpy(buf, sv->s_name, sizeof(buf)-1); buf[sizeof(buf)-1] = '\0'; return buf; } } } (void) sprintf(buf, "%d", port); return buf; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * * $Id: portnum.c,v 1.6.4.1 2004/12/09 19:41:22 darrenr Exp $ */ #include #include "ipf.h" /* * find the port number given by the name, either from getservbyname() or * straight atoi(). Return 1 on success, 0 on failure */ int portnum(name, proto, port, linenum) char *name, *proto; u_short *port; int linenum; { struct servent *sp, *sp2; u_short p1 = 0; int i; if (ISDIGIT(*name)) { if (ratoi(name, &i, 0, USHRT_MAX)) { *port = (u_short)i; return 1; } fprintf(stderr, "%d: unknown port \"%s\"\n", linenum, name); return 0; } if (proto != NULL && strcasecmp(proto, "tcp/udp") != 0) { sp = getservbyname(name, proto); if (sp) { *port = ntohs(sp->s_port); return 1; } fprintf(stderr, "%d: unknown service \"%s\".\n", linenum, name); return 0; } sp = getservbyname(name, "tcp"); if (sp) p1 = sp->s_port; sp2 = getservbyname(name, "udp"); if (!sp || !sp2) { fprintf(stderr, "%d: unknown tcp/udp service \"%s\".\n", linenum, name); return 0; } if (p1 != sp2->s_port) { fprintf(stderr, "%d: %s %d/tcp is a different port to ", linenum, name, p1); fprintf(stderr, "%d: %s %d/udp\n", linenum, name, sp->s_port); return 0; } *port = ntohs(p1); return 1; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ports.c,v 1.9.4.1 2004/12/09 19:41:22 darrenr Exp $ */ #include #include "ipf.h" /* * check for possible presence of the port fields in the line */ int ports(seg, proto, pp, cp, tp, linenum) char ***seg; char *proto; u_short *pp; int *cp; u_short *tp; int linenum; { int comp = -1; if (!*seg || !**seg || !***seg) return 0; if (!strcasecmp(**seg, "port") && *(*seg + 1) && *(*seg + 2)) { (*seg)++; if (ISALNUM(***seg) && *(*seg + 2)) { if (portnum(**seg, proto, pp, linenum) == 0) return -1; (*seg)++; if (!strcmp(**seg, "<>")) comp = FR_OUTRANGE; else if (!strcmp(**seg, "><")) comp = FR_INRANGE; else { fprintf(stderr, "%d: unknown range operator (%s)\n", linenum, **seg); return -1; } (*seg)++; if (**seg == NULL) { fprintf(stderr, "%d: missing 2nd port value\n", linenum); return -1; } if (portnum(**seg, proto, tp, linenum) == 0) return -1; } else if (!strcmp(**seg, "=") || !strcasecmp(**seg, "eq")) comp = FR_EQUAL; else if (!strcmp(**seg, "!=") || !strcasecmp(**seg, "ne")) comp = FR_NEQUAL; else if (!strcmp(**seg, "<") || !strcasecmp(**seg, "lt")) comp = FR_LESST; else if (!strcmp(**seg, ">") || !strcasecmp(**seg, "gt")) comp = FR_GREATERT; else if (!strcmp(**seg, "<=") || !strcasecmp(**seg, "le")) comp = FR_LESSTE; else if (!strcmp(**seg, ">=") || !strcasecmp(**seg, "ge")) comp = FR_GREATERTE; else { fprintf(stderr, "%d: unknown comparator (%s)\n", linenum, **seg); return -1; } if (comp != FR_OUTRANGE && comp != FR_INRANGE) { (*seg)++; if (portnum(**seg, proto, pp, linenum) == 0) return -1; } *cp = comp; (*seg)++; } return 0; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: print_toif.c,v 1.8 2002/01/28 06:50:47 darrenr Exp $ * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" void print_toif(tag, fdp) char *tag; frdest_t *fdp; { printf("%s %s", tag, fdp->fd_ifname); if (opts & OPT_UNDEF) { if (!fdp->fd_ifp) printf("(!)"); } #ifdef USE_INET6 if (use_inet6 && IP6_NOTZERO(&fdp->fd_ip6.in6)) { char ipv6addr[INET6_ADDRSTRLEN]; inet_ntop(AF_INET6, &fdp->fd_ip6, ipv6addr, sizeof(ipv6addr)); printf(":%s", ipv6addr); } else #endif if (fdp->fd_ip.s_addr) printf(":%s", inet_ntoa(fdp->fd_ip)); putchar(' '); } /* * Copyright (C) 2002-2004 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) */ #include "ipf.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: printactiveaddr.c,v 1.1 2008/02/12 16:11:49 darren_r Exp $"; #endif void printactiveaddress(v, fmt, addr, ifname) int v; char *fmt; i6addr_t *addr; char *ifname; { switch (v) { case 4 : printf(fmt, inet_ntoa(addr->in4)); break; #ifdef USE_INET6 case 6 : printaddr(v, FRI_NORMAL, ifname, (u_32_t *)&addr->in6, NULL); break; #endif default : break; } } /* * Copyright (C) 2002-2004 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: printactivenat.c,v 1.3.2.4 2004/05/11 16:07:32 darrenr Exp $"; #endif void printactivenat(nat, opts, alive) nat_t *nat; int opts, alive; { printf("%s", getnattype(nat, alive)); if (nat->nat_flags & SI_CLONE) printf(" CLONE"); printactiveaddress(nat->nat_v, " %-15s", &nat->nat_inip6, nat->nat_ifnames[0]); if ((nat->nat_flags & IPN_TCPUDP) != 0) printf(" %-5hu", ntohs(nat->nat_inport)); printf(" <- -> "); printactiveaddress(nat->nat_v, "%-15s", &nat->nat_outip6, nat->nat_ifnames[0]); if ((nat->nat_flags & IPN_TCPUDP) != 0) printf(" %-5hu", ntohs(nat->nat_outport)); printf(" ["); printactiveaddress(nat->nat_v, "%s", &nat->nat_oip6, nat->nat_ifnames[0]); if ((nat->nat_flags & IPN_TCPUDP) != 0) printf(" %hu", ntohs(nat->nat_oport)); printf("]"); if (opts & OPT_VERBOSE) { printf("\n\tage %lu use %hu sumd %s/", nat->nat_age, nat->nat_use, getsumd(nat->nat_sumd[0])); printf("%s pr %u bkt %d/%d flags %x\n", getsumd(nat->nat_sumd[1]), nat->nat_p, nat->nat_hv[0], nat->nat_hv[1], nat->nat_flags); printf("\tifp %s", getifname(nat->nat_ifps[0])); printf(",%s ", getifname(nat->nat_ifps[1])); #ifdef USE_QUAD_T printf("bytes %qu/%qu pkts %qu/%qu", (unsigned long long)nat->nat_bytes[0], (unsigned long long)nat->nat_bytes[1], (unsigned long long)nat->nat_pkts[0], (unsigned long long)nat->nat_pkts[1]); #else printf("bytes %lu/%lu pkts %lu/%lu", nat->nat_bytes[0], nat->nat_bytes[1], nat->nat_pkts[0], nat->nat_pkts[1]); #endif printf(" ipsumd %x", nat->nat_ipsumd); } if (opts & OPT_DEBUG) { printf("\n\tnat_next %p _pnext %p _hm %p\n", nat->nat_next, nat->nat_pnext, nat->nat_hm); printf("\t_hnext %p/%p _phnext %p/%p\n", nat->nat_hnext[0], nat->nat_hnext[1], nat->nat_phnext[0], nat->nat_phnext[1]); printf("\t_data %p _me %p _state %p _aps %p\n", nat->nat_data, nat->nat_me, nat->nat_state, nat->nat_aps); printf("\tfr %p ptr %p ifps %p/%p sync %p\n", nat->nat_fr, nat->nat_ptr, nat->nat_ifps[0], nat->nat_ifps[1], nat->nat_sync); printf("\ttqe:pnext %p next %p ifq %p parent %p/%p\n", nat->nat_tqe.tqe_pnext, nat->nat_tqe.tqe_next, nat->nat_tqe.tqe_ifq, nat->nat_tqe.tqe_parent, nat); printf("\ttqe:die %ld touched %ld flags %x state %d/%d\n", nat->nat_tqe.tqe_die, nat->nat_tqe.tqe_touched, nat->nat_tqe.tqe_flags, nat->nat_tqe.tqe_state[0], nat->nat_tqe.tqe_state[1]); } putchar('\n'); } /* * Copyright (C) 2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * */ #include "ipf.h" void printaddr(v, type, ifname, addr, mask) int v, type; char *ifname; u_32_t *addr, *mask; { char *suffix; switch (type) { case FRI_BROADCAST : suffix = "/bcast"; break; case FRI_DYNAMIC : printf("%s", ifname); printmask(v, mask); suffix = NULL; break; case FRI_NETWORK : suffix = "/net"; break; case FRI_NETMASKED : suffix = "/netmasked"; break; case FRI_PEERADDR : suffix = "/peer"; break; case FRI_LOOKUP : suffix = NULL; printlookup((i6addr_t *)addr, (i6addr_t *)mask); break; case FRI_NORMAL : printhostmask(v, addr, mask); suffix = NULL; break; default : printf("<%d>", type); printmask(v, mask); suffix = NULL; break; } if (suffix != NULL) { printf("%s/%s", ifname, suffix); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) */ #include "ipf.h" #include "kmem.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: printaps.c,v 1.4 2004/01/08 13:34:32 darrenr Exp $"; #endif void printaps(aps, opts) ap_session_t *aps; int opts; { ipsec_pxy_t ipsec; ap_session_t ap; ftpinfo_t ftp; aproxy_t apr; raudio_t ra; if (kmemcpy((char *)&ap, (long)aps, sizeof(ap))) return; if (kmemcpy((char *)&apr, (long)ap.aps_apr, sizeof(apr))) return; printf("\tproxy %s/%d use %d flags %x\n", apr.apr_label, apr.apr_p, apr.apr_ref, apr.apr_flags); printf("\t\tproto %d flags %#x bytes ", ap.aps_p, ap.aps_flags); #ifdef USE_QUAD_T printf("%qu pkts %qu", (unsigned long long)ap.aps_bytes, (unsigned long long)ap.aps_pkts); #else printf("%lu pkts %lu", ap.aps_bytes, ap.aps_pkts); #endif printf(" data %s size %d\n", ap.aps_data ? "YES" : "NO", ap.aps_psiz); if ((ap.aps_p == IPPROTO_TCP) && (opts & OPT_VERBOSE)) { printf("\t\tstate[%u,%u], sel[%d,%d]\n", ap.aps_state[0], ap.aps_state[1], ap.aps_sel[0], ap.aps_sel[1]); #if (defined(NetBSD) && (NetBSD >= 199905) && (NetBSD < 1991011)) || \ (__FreeBSD_version >= 300000) || defined(OpenBSD) printf("\t\tseq: off %hd/%hd min %x/%x\n", ap.aps_seqoff[0], ap.aps_seqoff[1], ap.aps_seqmin[0], ap.aps_seqmin[1]); printf("\t\tack: off %hd/%hd min %x/%x\n", ap.aps_ackoff[0], ap.aps_ackoff[1], ap.aps_ackmin[0], ap.aps_ackmin[1]); #else printf("\t\tseq: off %hd/%hd min %lx/%lx\n", ap.aps_seqoff[0], ap.aps_seqoff[1], ap.aps_seqmin[0], ap.aps_seqmin[1]); printf("\t\tack: off %hd/%hd min %lx/%lx\n", ap.aps_ackoff[0], ap.aps_ackoff[1], ap.aps_ackmin[0], ap.aps_ackmin[1]); #endif } if (!strcmp(apr.apr_label, "raudio") && ap.aps_psiz == sizeof(ra)) { if (kmemcpy((char *)&ra, (long)ap.aps_data, sizeof(ra))) return; printf("\tReal Audio Proxy:\n"); printf("\t\tSeen PNA: %d\tVersion: %d\tEOS: %d\n", ra.rap_seenpna, ra.rap_version, ra.rap_eos); printf("\t\tMode: %#x\tSBF: %#x\n", ra.rap_mode, ra.rap_sbf); printf("\t\tPorts:pl %hu, pr %hu, sr %hu\n", ra.rap_plport, ra.rap_prport, ra.rap_srport); } else if (!strcmp(apr.apr_label, "ftp") && (ap.aps_psiz == sizeof(ftp))) { if (kmemcpy((char *)&ftp, (long)ap.aps_data, sizeof(ftp))) return; printf("\tFTP Proxy:\n"); printf("\t\tpassok: %d\n", ftp.ftp_passok); ftp.ftp_side[0].ftps_buf[FTP_BUFSZ - 1] = '\0'; ftp.ftp_side[1].ftps_buf[FTP_BUFSZ - 1] = '\0'; printf("\tClient:\n"); printf("\t\tseq %x (ack %x) len %d junk %d cmds %d\n", ftp.ftp_side[0].ftps_seq[0], ftp.ftp_side[0].ftps_seq[1], ftp.ftp_side[0].ftps_len, ftp.ftp_side[0].ftps_junk, ftp.ftp_side[0].ftps_cmds); printf("\t\tbuf ["); printbuf(ftp.ftp_side[0].ftps_buf, FTP_BUFSZ, 1); printf("]\n\tServer:\n"); printf("\t\tseq %x (ack %x) len %d junk %d cmds %d\n", ftp.ftp_side[1].ftps_seq[0], ftp.ftp_side[1].ftps_seq[1], ftp.ftp_side[1].ftps_len, ftp.ftp_side[1].ftps_junk, ftp.ftp_side[1].ftps_cmds); printf("\t\tbuf ["); printbuf(ftp.ftp_side[1].ftps_buf, FTP_BUFSZ, 1); printf("]\n"); } else if (!strcmp(apr.apr_label, "ipsec") && (ap.aps_psiz == sizeof(ipsec))) { if (kmemcpy((char *)&ipsec, (long)ap.aps_data, sizeof(ipsec))) return; printf("\tIPSec Proxy:\n"); printf("\t\tICookie %08x%08x RCookie %08x%08x %s\n", (u_int)ntohl(ipsec.ipsc_icookie[0]), (u_int)ntohl(ipsec.ipsc_icookie[1]), (u_int)ntohl(ipsec.ipsc_rcookie[0]), (u_int)ntohl(ipsec.ipsc_rcookie[1]), ipsec.ipsc_rckset ? "(Set)" : "(Not set)"); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printbuf.c,v 1.5.4.1 2004/12/09 19:41:22 darrenr Exp $ */ #include #include "ipf.h" void printbuf(buf, len, zend) char *buf; int len, zend; { char *s, c; int i; for (s = buf, i = len; i; i--) { c = *s++; if (ISPRINT(c)) putchar(c); else printf("\\%03o", c); if ((c == '\0') && zend) break; } } /* * Copyright (C) 2000-2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printfr.c,v 1.43.2.12 2005/06/12 07:18:42 darrenr Exp $ * * Copyright 2008 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" /* * print the filter structure in a useful way */ void printfr(fp, iocfunc) struct frentry *fp; ioctlfunc_t iocfunc; { struct protoent *p; u_short sec[2]; u_32_t type; u_char *t; char *s; int pr; pr = -2; type = fp->fr_type & ~FR_T_BUILTIN; if ((fp->fr_type & FR_T_BUILTIN) != 0) printf("# Builtin: "); if (fp->fr_collect != 0) printf("%u ", fp->fr_collect); if (fp->fr_type == FR_T_CALLFUNC) { ; } else if (fp->fr_func != NULL) { printf("call"); if ((fp->fr_flags & FR_CALLNOW) != 0) printf(" now"); s = kvatoname(fp->fr_func, iocfunc); printf(" %s/%u", s ? s : "?", fp->fr_arg); } else if (FR_ISPASS(fp->fr_flags)) printf("pass"); else if (FR_ISBLOCK(fp->fr_flags)) { printf("block"); if (fp->fr_flags & FR_RETICMP) { if ((fp->fr_flags & FR_RETMASK) == FR_FAKEICMP) printf(" return-icmp-as-dest"); else if ((fp->fr_flags & FR_RETMASK) == FR_RETICMP) printf(" return-icmp"); if (fp->fr_icode) { if (fp->fr_icode <= MAX_ICMPCODE) printf("(%s)", icmpcodes[(int)fp->fr_icode]); else printf("(%d)", fp->fr_icode); } } else if ((fp->fr_flags & FR_RETMASK) == FR_RETRST) printf(" return-rst"); } else if ((fp->fr_flags & FR_LOGMASK) == FR_LOG) { printlog(fp); } else if (FR_ISACCOUNT(fp->fr_flags)) printf("count"); else if (FR_ISAUTH(fp->fr_flags)) printf("auth"); else if (FR_ISPREAUTH(fp->fr_flags)) printf("preauth"); else if (FR_ISNOMATCH(fp->fr_flags)) printf("nomatch"); else if (FR_ISSKIP(fp->fr_flags)) printf("skip %u", fp->fr_arg); else { printf("%x", fp->fr_flags); } if (fp->fr_flags & FR_OUTQUE) printf(" out "); else printf(" in "); if (((fp->fr_flags & FR_LOGB) == FR_LOGB) || ((fp->fr_flags & FR_LOGP) == FR_LOGP)) { printlog(fp); putchar(' '); } if (fp->fr_flags & FR_QUICK) printf("quick "); if (*fp->fr_ifname) { printifname("on ", fp->fr_ifname, fp->fr_ifa); if (*fp->fr_ifnames[1] && strcmp(fp->fr_ifnames[1], "*")) printifname(",", fp->fr_ifnames[1], fp->fr_ifas[1]); putchar(' '); } if (*fp->fr_dif.fd_ifname || (fp->fr_flags & FR_DUP)) print_toif("dup-to", &fp->fr_dif); if (*fp->fr_tif.fd_ifname) print_toif("to", &fp->fr_tif); if (*fp->fr_rif.fd_ifname) print_toif("reply-to", &fp->fr_rif); if (fp->fr_flags & FR_FASTROUTE) printf("fastroute "); if ((*fp->fr_ifnames[2] && strcmp(fp->fr_ifnames[2], "*")) || (*fp->fr_ifnames[3] && strcmp(fp->fr_ifnames[3], "*"))) { if (fp->fr_flags & FR_OUTQUE) printf("in-via "); else printf("out-via "); if (*fp->fr_ifnames[2]) { printifname("", fp->fr_ifnames[2], fp->fr_ifas[2]); putchar(' '); if (*fp->fr_ifnames[3]) { printifname(",", fp->fr_ifnames[3], fp->fr_ifas[3]); } } } if (type == FR_T_IPF) { if (fp->fr_mip.fi_tos) printf("tos %#x ", fp->fr_tos); if (fp->fr_mip.fi_ttl) printf("ttl %d ", fp->fr_ttl); if (fp->fr_flx & FI_TCPUDP) { printf("proto tcp/udp "); pr = -1; } else if (fp->fr_mip.fi_p) { pr = fp->fr_ip.fi_p; p = getprotobynumber(pr); printf("proto "); printproto(p, pr, NULL); putchar(' '); } } if (type == FR_T_NONE) { printf("all"); } else if (type == FR_T_IPF) { printf("from %s", fp->fr_flags & FR_NOTSRCIP ? "!" : ""); printaddr(fp->fr_v, fp->fr_satype, fp->fr_ifname, &fp->fr_src.s_addr, &fp->fr_smsk.s_addr); if (fp->fr_scmp) printportcmp(pr, &fp->fr_tuc.ftu_src); printf(" to %s", fp->fr_flags & FR_NOTDSTIP ? "!" : ""); printaddr(fp->fr_v, fp->fr_datype, fp->fr_ifname, &fp->fr_dst.s_addr, &fp->fr_dmsk.s_addr); if (fp->fr_dcmp) printportcmp(pr, &fp->fr_tuc.ftu_dst); if ((fp->fr_proto == IPPROTO_ICMP #ifdef USE_INET6 || fp->fr_proto == IPPROTO_ICMPV6 #endif ) && fp->fr_icmpm) { int type = fp->fr_icmp, code; type = ntohs(fp->fr_icmp); code = type & 0xff; type /= 256; if (type < (sizeof(icmptypes) / sizeof(char *) - 1) && icmptypes[type] && fp->fr_proto == IPPROTO_ICMP) printf(" icmp-type %s", icmptypes[type]); else printf(" icmp-type %d", type); if (ntohs(fp->fr_icmpm) & 0xff) printf(" code %d", code); } if ((fp->fr_proto == IPPROTO_TCP) && (fp->fr_tcpf || fp->fr_tcpfm)) { printf(" flags "); if (fp->fr_tcpf & ~TCPF_ALL) printf("0x%x", fp->fr_tcpf); else for (s = flagset, t = flags; *s; s++, t++) if (fp->fr_tcpf & *t) (void)putchar(*s); if (fp->fr_tcpfm) { (void)putchar('/'); if (fp->fr_tcpfm & ~TCPF_ALL) printf("0x%x", fp->fr_tcpfm); else for (s = flagset, t = flags; *s; s++, t++) if (fp->fr_tcpfm & *t) (void)putchar(*s); } } } else if (type == FR_T_BPFOPC) { fakebpf_t *fb; int i; printf("bpf-v%d { \"", fp->fr_v); i = fp->fr_dsize / sizeof(*fb); for (fb = fp->fr_data, s = ""; i; i--, fb++, s = " ") printf("%s%#x %#x %#x %#x", s, fb->fb_c, fb->fb_t, fb->fb_f, fb->fb_k); printf("\" }"); } else if (type == FR_T_COMPIPF) { ; } else if (type == FR_T_CALLFUNC) { printf("call function at %p", fp->fr_data); } else { printf("[unknown filter type %#x]", fp->fr_type); } if ((type == FR_T_IPF) && ((fp->fr_flx & FI_WITH) || (fp->fr_mflx & FI_WITH) || fp->fr_optbits || fp->fr_optmask || fp->fr_secbits || fp->fr_secmask)) { char *comma = " "; printf(" with"); if (fp->fr_optbits || fp->fr_optmask || fp->fr_secbits || fp->fr_secmask) { sec[0] = fp->fr_secmask; sec[1] = fp->fr_secbits; if (fp->fr_v == 4) optprint(sec, fp->fr_optmask, fp->fr_optbits); #ifdef USE_INET6 else optprintv6(sec, fp->fr_optmask, fp->fr_optbits); #endif } else if (fp->fr_mflx & FI_OPTIONS) { fputs(comma, stdout); if (!(fp->fr_flx & FI_OPTIONS)) printf("not "); printf("ipopts"); comma = ","; } if (fp->fr_mflx & FI_SHORT) { fputs(comma, stdout); if (!(fp->fr_flx & FI_SHORT)) printf("not "); printf("short"); comma = ","; } if (fp->fr_mflx & FI_FRAG) { fputs(comma, stdout); if (!(fp->fr_flx & FI_FRAG)) printf("not "); printf("frag"); comma = ","; } if (fp->fr_mflx & FI_FRAGBODY) { fputs(comma, stdout); if (!(fp->fr_flx & FI_FRAGBODY)) printf("not "); printf("frag-body"); comma = ","; } if (fp->fr_mflx & FI_NATED) { fputs(comma, stdout); if (!(fp->fr_flx & FI_NATED)) printf("not "); printf("nat"); comma = ","; } if (fp->fr_mflx & FI_LOWTTL) { fputs(comma, stdout); if (!(fp->fr_flx & FI_LOWTTL)) printf("not "); printf("lowttl"); comma = ","; } if (fp->fr_mflx & FI_BAD) { fputs(comma, stdout); if (!(fp->fr_flx & FI_BAD)) printf("not "); printf("bad"); comma = ","; } if (fp->fr_mflx & FI_BADSRC) { fputs(comma, stdout); if (!(fp->fr_flx & FI_BADSRC)) printf("not "); printf("bad-src"); comma = ","; } if (fp->fr_mflx & FI_BADNAT) { fputs(comma, stdout); if (!(fp->fr_flx & FI_BADNAT)) printf("not "); printf("bad-nat"); comma = ","; } if (fp->fr_mflx & FI_OOW) { fputs(comma, stdout); if (!(fp->fr_flx & FI_OOW)) printf("not "); printf("oow"); } if (fp->fr_mflx & FI_MULTICAST) { fputs(comma, stdout); if (!(fp->fr_flx & FI_MULTICAST)) printf("not "); printf("mcast"); comma = ","; } if (fp->fr_mflx & FI_BROADCAST) { fputs(comma, stdout); if (!(fp->fr_flx & FI_BROADCAST)) printf("not "); printf("bcast"); comma = ","; } if (fp->fr_mflx & FI_MBCAST) { fputs(comma, stdout); if (!(fp->fr_flx & FI_MBCAST)) printf("not "); printf("mbcast"); comma = ","; } if (fp->fr_mflx & FI_STATE) { fputs(comma, stdout); if (!(fp->fr_flx & FI_STATE)) printf("not "); printf("state"); comma = ","; } } if (fp->fr_flags & FR_KEEPSTATE) { printf(" keep state"); if ((fp->fr_flags & (FR_STSTRICT|FR_NEWISN|FR_NOICMPERR|FR_STATESYNC)) || (fp->fr_statemax != 0) || (fp->fr_age[0] != 0)) { char *comma = ""; printf(" ("); if (fp->fr_statemax != 0) { printf("limit %u", fp->fr_statemax); comma = ","; } if (fp->fr_flags & FR_STSTRICT) { printf("%sstrict", comma); comma = ","; } if (fp->fr_flags & FR_NEWISN) { printf("%snewisn", comma); comma = ","; } if (fp->fr_flags & FR_NOICMPERR) { printf("%sno-icmp-err", comma); comma = ","; } if (fp->fr_flags & FR_STATESYNC) { printf("%ssync", comma); comma = ","; } if (fp->fr_age[0] || fp->fr_age[1]) printf("%sage %d/%d", comma, fp->fr_age[0], fp->fr_age[1]); printf(")"); } } if (fp->fr_flags & FR_KEEPFRAG) { printf(" keep frags"); if (fp->fr_flags & (FR_FRSTRICT)) { printf(" ("); if (fp->fr_flags & FR_FRSTRICT) printf(" strict"); printf(" )"); } } if (fp->fr_isc != (struct ipscan *)-1) { if (fp->fr_isctag[0]) printf(" scan %s", fp->fr_isctag); else printf(" scan *"); } if (*fp->fr_grhead != '\0') printf(" head %s", fp->fr_grhead); if (*fp->fr_group != '\0') printf(" group %s", fp->fr_group); if (fp->fr_logtag != FR_NOLOGTAG || *fp->fr_nattag.ipt_tag) { char *s = ""; printf(" set-tag("); if (fp->fr_logtag != FR_NOLOGTAG) { printf("log=%u", fp->fr_logtag); s = ", "; } if (*fp->fr_nattag.ipt_tag) { printf("%snat=%-.*s", s, IPFTAG_LEN, fp->fr_nattag.ipt_tag); } printf(")"); } if (fp->fr_pps) printf(" pps %d", fp->fr_pps); (void)putchar('\n'); } /* * Copyright (C) 2004 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printfraginfo.c,v 1.1.2.2 2004/03/23 15:15:45 darrenr Exp $ */ #include "ipf.h" #include "kmem.h" void printfraginfo(prefix, ifr) char *prefix; struct ipfr *ifr; { frentry_t fr; fr.fr_flags = 0xffffffff; printf("%s%s -> ", prefix, hostname(4, &ifr->ipfr_src)); if (kmemcpy((char *)&fr, (u_long)ifr->ipfr_rule, sizeof(fr)) == -1) return; printf("%s id %d ttl %d pr %d seen0 %d ifp %p tos %#02x = %#x\n", hostname(4, &ifr->ipfr_dst), ifr->ipfr_id, ifr->ipfr_ttl, ifr->ipfr_p, ifr->ipfr_seen0, ifr->ipfr_ifp, ifr->ipfr_tos, fr.fr_flags); } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf iphtable_t *printhash(hp, copyfunc, name, opts) iphtable_t *hp; copyfunc_t copyfunc; char *name; int opts; { iphtent_t *ipep, **table; iphtable_t iph; int i, printed; size_t sz; if ((*copyfunc)((char *)hp, (char *)&iph, sizeof(iph))) return NULL; if ((name != NULL) && strncmp(name, iph.iph_name, FR_GROUPLEN)) return iph.iph_next; if ((opts & OPT_DEBUG) == 0) { if ((iph.iph_type & IPHASH_ANON) == IPHASH_ANON) PRINTF("# 'anonymous' table\n"); switch (iph.iph_type & ~IPHASH_ANON) { case IPHASH_LOOKUP : PRINTF("table"); break; case IPHASH_GROUPMAP : PRINTF("group-map"); if (iph.iph_flags & FR_INQUE) PRINTF(" in"); else if (iph.iph_flags & FR_OUTQUE) PRINTF(" out"); else PRINTF(" ???"); break; default : PRINTF("%#x", iph.iph_type); break; } PRINTF(" role = "); } else { PRINTF("Hash Table Number: %s", iph.iph_name); if ((iph.iph_type & IPHASH_ANON) == IPHASH_ANON) PRINTF("(anon)"); putchar(' '); PRINTF("Role: "); } switch (iph.iph_unit) { case IPL_LOGNAT : PRINTF("nat"); break; case IPL_LOGIPF : PRINTF("ipf"); break; case IPL_LOGAUTH : PRINTF("auth"); break; case IPL_LOGCOUNT : PRINTF("count"); break; default : PRINTF("#%d", iph.iph_unit); break; } if ((opts & OPT_DEBUG) == 0) { if ((iph.iph_type & ~IPHASH_ANON) == IPHASH_LOOKUP) PRINTF(" type = hash"); PRINTF(" number = %s size = %lu", iph.iph_name, (u_long)iph.iph_size); if (iph.iph_seed != 0) PRINTF(" seed = %lu", iph.iph_seed); putchar('\n'); } else { PRINTF(" Type: "); switch (iph.iph_type & ~IPHASH_ANON) { case IPHASH_LOOKUP : PRINTF("lookup"); break; case IPHASH_GROUPMAP : PRINTF("groupmap Group. %s", iph.iph_name); break; default : break; } putchar('\n'); PRINTF("\t\tSize: %lu\tSeed: %lu", (u_long)iph.iph_size, iph.iph_seed); PRINTF("\tRef. Count: %d\tMasks: %#x\n", iph.iph_ref, iph.iph_masks[3]); } if ((opts & OPT_DEBUG) != 0) { struct in_addr m; for (i = 0; i < 32; i++) { if ((1 << i) & iph.iph_masks[3]) { ntomask(4, i, &m.s_addr); PRINTF("\t\tMask: %s\n", inet_ntoa(m)); } } } if ((opts & OPT_DEBUG) == 0) PRINTF("\t{"); sz = iph.iph_size * sizeof(*table); table = malloc(sz); if ((*copyfunc)((char *)iph.iph_table, (char *)table, sz)) return NULL; for (i = 0, printed = 0; i < iph.iph_size; i++) { for (ipep = table[i]; ipep != NULL; ) { ipep = printhashnode(&iph, ipep, copyfunc, opts); printed++; } } if (printed == 0) putchar(';'); free(table); if ((opts & OPT_DEBUG) == 0) PRINTF(" };\n"); return iph.iph_next; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include "ipf.h" #include "netinet/ipl.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf iphtable_t *printhash_live(hp, fd, name, opts) iphtable_t *hp; int fd; char *name; int opts; { iphtent_t entry, *top, *node; ipflookupiter_t iter; int i, printed = 0, last; ipfobj_t obj; if ((name != NULL) && strncmp(name, hp->iph_name, FR_GROUPLEN)) return hp->iph_next; printhashdata(hp, opts); if ((opts & OPT_DEBUG) == 0) PRINTF("\t{"); obj.ipfo_rev = IPFILTER_VERSION; obj.ipfo_type = IPFOBJ_LOOKUPITER; obj.ipfo_ptr = &iter; obj.ipfo_size = sizeof(iter); iter.ili_data = &entry; iter.ili_type = IPLT_HASH; iter.ili_otype = IPFLOOKUPITER_NODE; iter.ili_ival = IPFGENITER_LOOKUP; iter.ili_unit = hp->iph_unit; strncpy(iter.ili_name, hp->iph_name, FR_GROUPLEN); last = 0; top = NULL; while (!last && (ioctl(fd, SIOCLOOKUPITER, &obj) == 0)) { if (entry.ipe_snext == NULL) last = 1; entry.ipe_snext = top; top = malloc(sizeof(*top)); if (top == NULL) break; bcopy(&entry, top, sizeof(entry)); } while (top != NULL) { node = top; (void) printhashnode(hp, node, bcopywrap, opts); top = node->ipe_snext; free(node); printed++; if ((opts & OPT_DEBUG) == 0) putchar(';'); } if (printed == 0) putchar(';'); if ((opts & OPT_DEBUG) == 0) PRINTF(" };\n"); return hp->iph_next; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf void printhashdata(hp, opts) iphtable_t *hp; int opts; { if ((opts & OPT_DEBUG) == 0) { if ((hp->iph_type & IPHASH_ANON) == IPHASH_ANON) PRINTF("# 'anonymous' table\n"); switch (hp->iph_type & ~IPHASH_ANON) { case IPHASH_LOOKUP : PRINTF("table"); break; case IPHASH_GROUPMAP : PRINTF("group-map"); if (hp->iph_flags & FR_INQUE) PRINTF(" in"); else if (hp->iph_flags & FR_OUTQUE) PRINTF(" out"); else PRINTF(" ???"); break; default : PRINTF("%#x", hp->iph_type); break; } PRINTF(" role = "); } else { PRINTF("Hash Table Number: %s", hp->iph_name); if ((hp->iph_type & IPHASH_ANON) == IPHASH_ANON) PRINTF("(anon)"); putchar(' '); PRINTF("Role: "); } switch (hp->iph_unit) { case IPL_LOGNAT : PRINTF("nat"); break; case IPL_LOGIPF : PRINTF("ipf"); break; case IPL_LOGAUTH : PRINTF("auth"); break; case IPL_LOGCOUNT : PRINTF("count"); break; default : PRINTF("#%d", hp->iph_unit); break; } if ((opts & OPT_DEBUG) == 0) { if ((hp->iph_type & ~IPHASH_ANON) == IPHASH_LOOKUP) PRINTF(" type = hash"); PRINTF(" number = %s size = %lu", hp->iph_name, (u_long)hp->iph_size); if (hp->iph_seed != 0) PRINTF(" seed = %lu", hp->iph_seed); putchar('\n'); } else { PRINTF(" Type: "); switch (hp->iph_type & ~IPHASH_ANON) { case IPHASH_LOOKUP : PRINTF("lookup"); break; case IPHASH_GROUPMAP : PRINTF("groupmap Group. %s", hp->iph_name); break; default : break; } putchar('\n'); PRINTF("\t\tSize: %lu\tSeed: %lu", (u_long)hp->iph_size, hp->iph_seed); PRINTF("\tRef. Count: %d\tMasks: %#x\n", hp->iph_ref, hp->iph_masks[0]); } if ((opts & OPT_DEBUG) != 0) { struct in_addr m; int i; for (i = 0; i < 32; i++) { if ((1 << i) & hp->iph_masks[0]) { ntomask(4, i, &m.s_addr); PRINTF("\t\tMask: %s\n", inet_ntoa(m)); } } } } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. */ #include "ipf.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf iphtent_t *printhashnode(iph, ipep, copyfunc, opts) iphtable_t *iph; iphtent_t *ipep; copyfunc_t copyfunc; int opts; { iphtent_t ipe; if ((*copyfunc)(ipep, &ipe, sizeof(ipe))) return NULL; if (ipe.ipe_family == AF_INET) { ipe.ipe_addr.in4_addr = htonl(ipe.ipe_addr.in4_addr); ipe.ipe_mask.in4_addr = htonl(ipe.ipe_mask.in4_addr); } if ((opts & OPT_DEBUG) != 0) { #ifdef USE_INET6 char addinfo[INET6_ADDRSTRLEN]; PRINTF("\tAddress: %s", inet_ntop(ipe.ipe_family, (void *)&ipe.ipe_addr.in4, addinfo, sizeof(addinfo))); #else PRINTF("\tAddress: %s", inet_ntoa(ipe.ipe_addr.in4)); #endif #ifdef USE_INET6 if (ipe.ipe_family == AF_INET6) printmask(6, (u_32_t *)&ipe.ipe_mask.in6); else #endif printmask(4, (u_32_t *)&ipe.ipe_mask.in4_addr); #ifdef USE_QUAD_T PRINTF("\tHits %qu\tBytes %qu", ipe.ipe_hits, ipe.ipe_bytes); #else PRINTF("\tHits %lu\tBytes %lu", ipe.ipe_hits, ipe.ipe_bytes); #endif PRINTF("\tRef. Count: %d\tGroup: %s\n", ipe.ipe_ref, ipe.ipe_group); } else { putchar(' '); #ifdef USE_INET6 if (ipe.ipe_family == AF_INET6) printhostmask(6, (u_32_t *)&ipe.ipe_addr.in6, (u_32_t *)&ipe.ipe_mask.in6); else #endif { printip((u_32_t *)&ipe.ipe_addr.in4_addr); printmask(4, (u_32_t *)&ipe.ipe_mask.in4_addr); } if (ipe.ipe_value != 0) { switch (iph->iph_type & ~IPHASH_ANON) { case IPHASH_GROUPMAP : if (strncmp(ipe.ipe_group, iph->iph_name, FR_GROUPLEN)) PRINTF(", group = %s", ipe.ipe_group); break; } } putchar(';'); } ipep = ipe.ipe_next; return ipep; } #include "ipf.h" void printhostmap(hmp, hv) hostmap_t *hmp; u_int hv; { printf("%s,", inet_ntoa(hmp->hm_srcip)); printf("%s -> ", inet_ntoa(hmp->hm_dstip)); printf("%s ", inet_ntoa(hmp->hm_mapip)); printf("(use = %d hv = %u)\n", hmp->hm_ref, hv); } /* * Copyright (C) 2000-2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printhostmask.c,v 1.8 2002/04/11 15:01:19 darrenr Exp $ * * Copyright 2008 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" void printhostmask(v, addr, mask) int v; u_32_t *addr, *mask; { #ifdef USE_INET6 char ipbuf[INET6_ADDRSTRLEN]; #else struct in_addr ipa; #endif if ((v == 4) && (!*addr) && (!*mask)) printf("any"); else { #ifdef USE_INET6 void *ptr = addr; int af; if (v == 4) af = AF_INET; else if (v == 6) af = AF_INET6; else af = 0; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof(ipbuf))); #else ipa.s_addr = *addr; printf("%s", inet_ntoa(ipa)); #endif if (mask != NULL) printmask(v, mask); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printifname.c,v 1.2 2002/01/28 06:50:47 darrenr Exp $ * * Copyright 2005 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" void printifname(format, name, ifp) char *format, *name; void *ifp; { printf("%s%s", format, name); if (opts & OPT_UNDEF) { if ((ifp == NULL) && strcmp(name, "-") && strcmp(name, "*")) { printf("(!)"); } } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printip.c,v 1.3 2002/07/13 12:10:27 darrenr Exp $ */ #include "ipf.h" void printip(addr) u_32_t *addr; { struct in_addr ipa; ipa.s_addr = *addr; if (ntohl(ipa.s_addr) < 256) printf("%lu", (u_long)ntohl(ipa.s_addr)); else printf("%s", inet_ntoa(ipa)); } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printlog.c,v 1.6 2002/01/28 06:50:47 darrenr Exp $ */ #include "ipf.h" #include void printlog(fp) frentry_t *fp; { char *s, *u; printf("log"); if (fp->fr_flags & FR_LOGBODY) printf(" body"); if (fp->fr_flags & FR_LOGFIRST) printf(" first"); if (fp->fr_flags & FR_LOGORBLOCK) printf(" or-block"); if (fp->fr_loglevel != 0xffff) { printf(" level "); if (fp->fr_loglevel & LOG_FACMASK) { s = fac_toname(fp->fr_loglevel); if (s == NULL) s = "!!!"; } else s = ""; u = pri_toname(fp->fr_loglevel); if (u == NULL) u = "!!!"; if (*s) printf("%s.%s", s, u); else printf("%s", u); } } /* * Copyright (C) 2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * */ #include "ipf.h" void printlookup(addr, mask) i6addr_t *addr, *mask; { switch (addr->iplookuptype) { case IPLT_POOL : printf("pool/"); break; case IPLT_HASH : printf("hash/"); break; default : printf("lookup(%x)=", addr->iplookuptype); break; } printf("%u", addr->iplookupnum); if (opts & OPT_UNDEF) { if (mask->iplookupptr == NULL) printf("(!)"); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printmask.c,v 1.5 2002/06/15 04:48:33 darrenr Exp $ * * Copyright 2005 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" void printmask(v, mask) int v; u_32_t *mask; { struct in_addr ipa; int ones; #ifdef USE_INET6 if (v == 6) printf("/%d", count6bits(mask)); else #endif if ((ones = count4bits(*mask)) == -1) { ipa.s_addr = *mask; printf("/%s", inet_ntoa(ipa)); } else printf("/%d", ones); } /* * Copyright (C) 2002-2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) * * Copyright 2008 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #include "kmem.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: printnat.c,v 1.22.2.9 2005/06/12 07:18:43 darrenr Exp $"; #endif /* * Print out a NAT rule */ void printnat(np, opts) ipnat_t *np; int opts; { struct protoent *pr; int bits, af; char ipbuf[INET6_ADDRSTRLEN]; void *ptr; pr = getprotobynumber(np->in_p); switch (np->in_redir) { case NAT_REDIRECT : printf("rdr"); break; case NAT_MAP : printf("map"); break; case NAT_MAPBLK : printf("map-block"); break; case NAT_BIMAP : printf("bimap"); break; default : fprintf(stderr, "unknown value for in_redir: %#x\n", np->in_redir); break; } printf(" %s", np->in_ifnames[0]); if ((np->in_ifnames[1][0] != '\0') && (strncmp(np->in_ifnames[0], np->in_ifnames[1], LIFNAMSIZ) != 0)) { printf(",%s ", np->in_ifnames[1]); } putchar(' '); if (np->in_flags & IPN_FILTER) { if (np->in_flags & IPN_NOTSRC) printf("! "); printf("from "); if (np->in_redir == NAT_REDIRECT) { printhostmask(np->in_v, (u_32_t *)&np->in_src[0], (u_32_t *)&np->in_src[1]); } else { printhostmask(np->in_v, (u_32_t *)&np->in_in[0], (u_32_t *)&np->in_in[1]); } if (np->in_scmp) printportcmp(np->in_p, &np->in_tuc.ftu_src); if (np->in_flags & IPN_NOTDST) printf(" !"); printf(" to "); if (np->in_redir == NAT_REDIRECT) { printhostmask(np->in_v, (u_32_t *)&np->in_out[0], (u_32_t *)&np->in_out[1]); } else { printhostmask(np->in_v, (u_32_t *)&np->in_src[0], (u_32_t *)&np->in_src[1]); } if (np->in_dcmp) printportcmp(np->in_p, &np->in_tuc.ftu_dst); } if (np->in_v == 4) af = AF_INET; else if (np->in_v == 6) af = AF_INET6; else af = 0; if (np->in_redir == NAT_REDIRECT) { if (!(np->in_flags & IPN_FILTER)) { ptr = (void *)(u_32_t *)&np->in_out[0]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); printmask(np->in_v, (u_32_t *)&np->in_out[1]); if (np->in_flags & IPN_TCPUDP) { printf(" port %d", ntohs(np->in_pmin)); if (np->in_pmax != np->in_pmin) printf("-%d", ntohs(np->in_pmax)); } } printf(" -> "); ptr = (void *)(u_32_t *)&np->in_in[0]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); if (np->in_flags & IPN_SPLIT) { printf(","); ptr = (void *)(u_32_t *)&np->in_in[1]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); } if (((np->in_v == 4) && (np->in_inip == 0)) || ((np->in_v == 6) && IP6_ISZERO(&np->in_in[0]))) printmask(np->in_v, (u_32_t *)&np->in_in[1]); if (np->in_flags & IPN_TCPUDP) { if ((np->in_flags & IPN_FIXEDDPORT) != 0) printf(" port = %d", ntohs(np->in_pnext)); else printf(" port %d", ntohs(np->in_pnext)); } putchar(' '); printproto(pr, np->in_p, np); if (np->in_flags & IPN_ROUNDR) printf(" round-robin"); if (np->in_flags & IPN_FRAG) printf(" frag"); if (np->in_age[0] != 0 || np->in_age[1] != 0) { printf(" age %d/%d", np->in_age[0], np->in_age[1]); } if (np->in_flags & IPN_STICKY) printf(" sticky"); if (np->in_mssclamp != 0) printf(" mssclamp %d", np->in_mssclamp); if (*np->in_plabel != '\0') printf(" proxy %.*s", (int)sizeof (np->in_plabel), np->in_plabel); if (np->in_tag.ipt_tag[0] != '\0') printf(" tag %-.*s", IPFTAG_LEN, np->in_tag.ipt_tag); printf("\n"); if (opts & OPT_DEBUG) printf("\tpmax %u\n", np->in_pmax); } else { if (!(np->in_flags & IPN_FILTER)) { ptr = (void *)(u_32_t *)&np->in_in[0]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); printmask(np->in_v, (u_32_t *)&np->in_in[1]); } printf(" -> "); if (np->in_flags & IPN_IPRANGE) { printf("range "); ptr = (void *)(u_32_t *)&np->in_out[0]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); printf("-"); ptr = (void *)(u_32_t *)&np->in_out[1]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); } else { ptr = (void *)(u_32_t *)&np->in_out[0]; printf("%s", inet_ntop(af, ptr, ipbuf, sizeof (ipbuf))); printmask(np->in_v, (u_32_t *)&np->in_out[1]); } if (*np->in_plabel != '\0') { printf(" proxy port "); if (np->in_dcmp != 0) np->in_dport = htons(np->in_dport); if (np->in_dport != 0) { char *s; s = portname(np->in_p, ntohs(np->in_dport)); if (s != NULL) fputs(s, stdout); else fputs("???", stdout); } printf(" %.*s/", (int)sizeof (np->in_plabel), np->in_plabel); printproto(pr, np->in_p, NULL); } else if (np->in_redir == NAT_MAPBLK) { if ((np->in_pmin == 0) && (np->in_flags & IPN_AUTOPORTMAP)) printf(" ports auto"); else printf(" ports %d", np->in_pmin); if (opts & OPT_DEBUG) printf("\n\tip modulous %d", np->in_pmax); } else if (np->in_pmin || np->in_pmax) { if (np->in_flags & IPN_ICMPQUERY) { printf(" icmpidmap "); } else { printf(" portmap "); } printproto(pr, np->in_p, np); if (np->in_flags & IPN_AUTOPORTMAP) { printf(" auto"); if (opts & OPT_DEBUG) printf(" [%d:%d %d %d]", ntohs(np->in_pmin), ntohs(np->in_pmax), np->in_ippip, np->in_ppip); } else { printf(" %d:%d", ntohs(np->in_pmin), ntohs(np->in_pmax)); } } else if (np->in_flags & IPN_TCPUDP || np->in_p) { putchar(' '); printproto(pr, np->in_p, np); } if (np->in_flags & IPN_FRAG) printf(" frag"); if (np->in_age[0] != 0 || np->in_age[1] != 0) { printf(" age %d/%d", np->in_age[0], np->in_age[1]); } if (np->in_mssclamp != 0) printf(" mssclamp %d", np->in_mssclamp); if (np->in_tag.ipt_tag[0] != '\0') printf(" tag %s", np->in_tag.ipt_tag); if (np->in_flags & IPN_SEQUENTIAL) printf(" sequential"); printf("\n"); if (opts & OPT_DEBUG) { struct in_addr nip; nip.s_addr = htonl(np->in_nextip.s_addr); printf("\tnextip %s pnext %d\n", inet_ntoa(nip), np->in_pnext); } } if (opts & OPT_DEBUG) { printf("\tspace %lu use %u hits %lu flags %#x proto %d hv %d\n", np->in_space, np->in_use, np->in_hits, np->in_flags, np->in_p, np->in_hv); printf("\tifp[0] %p ifp[1] %p apr %p\n", np->in_ifps[0], np->in_ifps[1], np->in_apr); printf("\ttqehead %p/%p comment %p\n", np->in_tqehead[0], np->in_tqehead[1], np->in_comment); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printpacket.c,v 1.12.4.1 2005/02/21 05:09:24 darrenr Exp $ */ #include "ipf.h" #ifndef IP_OFFMASK # define IP_OFFMASK 0x3fff #endif void printpacket(ip) struct ip *ip; { struct tcphdr *tcp; u_short len; u_short off; if (IP_V(ip) == 6) { off = 0; len = ntohs(((u_short *)ip)[2]) + 40; } else { off = ntohs(ip->ip_off); len = ntohs(ip->ip_len); } if ((opts & OPT_HEX) == OPT_HEX) { u_char *s; int i; for (s = (u_char *)ip, i = 0; i < len; i++) { printf("%02x", *s++ & 0xff); if (len - i > 1) { i++; printf("%02x", *s++ & 0xff); } putchar(' '); } putchar('\n'); return; } if (IP_V(ip) == 6) { printpacket6(ip); return; } tcp = (struct tcphdr *)((char *)ip + (IP_HL(ip) << 2)); printf("ip %d(%d) %d", ntohs(ip->ip_len), IP_HL(ip) << 2, ip->ip_p); if (off & IP_OFFMASK) printf(" @%d", off << 3); printf(" %s", inet_ntoa(ip->ip_src)); if (!(off & IP_OFFMASK)) if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) printf(",%d", ntohs(tcp->th_sport)); printf(" > "); printf("%s", inet_ntoa(ip->ip_dst)); if (!(off & IP_OFFMASK)) { if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP) printf(",%d", ntohs(tcp->th_dport)); if ((ip->ip_p == IPPROTO_TCP) && (tcp->th_flags != 0)) { putchar(' '); if (tcp->th_flags & TH_FIN) putchar('F'); if (tcp->th_flags & TH_SYN) putchar('S'); if (tcp->th_flags & TH_RST) putchar('R'); if (tcp->th_flags & TH_PUSH) putchar('P'); if (tcp->th_flags & TH_ACK) putchar('A'); if (tcp->th_flags & TH_URG) putchar('U'); if (tcp->th_flags & TH_ECN) putchar('E'); if (tcp->th_flags & TH_CWR) putchar('C'); } } putchar('\n'); } #include "ipf.h" /* * This is meant to work without the IPv6 header files being present or * the inet_ntop() library. */ void printpacket6(ip) struct ip *ip; { u_char *buf, p; u_short plen, *addrs; tcphdr_t *tcp; u_32_t flow; buf = (u_char *)ip; tcp = (tcphdr_t *)(buf + 40); p = buf[6]; flow = ntohl(*(u_32_t *)buf); flow &= 0xfffff; plen = ntohs(*((u_short *)buf +2)); addrs = (u_short *)buf + 4; printf("ip6/%d %d %#x %d", buf[0] & 0xf, plen, flow, p); printf(" %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x", ntohs(addrs[0]), ntohs(addrs[1]), ntohs(addrs[2]), ntohs(addrs[3]), ntohs(addrs[4]), ntohs(addrs[5]), ntohs(addrs[6]), ntohs(addrs[7])); if (plen >= 4) if (p == IPPROTO_TCP || p == IPPROTO_UDP) (void)printf(",%d", ntohs(tcp->th_sport)); printf(" >"); addrs += 8; printf(" %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x", ntohs(addrs[0]), ntohs(addrs[1]), ntohs(addrs[2]), ntohs(addrs[3]), ntohs(addrs[4]), ntohs(addrs[5]), ntohs(addrs[6]), ntohs(addrs[7])); if (plen >= 4) if (p == IPPROTO_TCP || p == IPPROTO_UDP) (void)printf(",%d", ntohs(tcp->th_dport)); putchar('\n'); } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf ip_pool_t *printpool(pp, copyfunc, name, opts) ip_pool_t *pp; copyfunc_t copyfunc; char *name; int opts; { ip_pool_node_t *ipnp, *ipnpn, ipn; ip_pool_t ipp; if ((*copyfunc)(pp, &ipp, sizeof(ipp))) return NULL; if ((name != NULL) && strncmp(name, ipp.ipo_name, FR_GROUPLEN)) return ipp.ipo_next; if ((opts & OPT_DEBUG) == 0) { if ((ipp.ipo_flags & IPOOL_ANON) != 0) PRINTF("# 'anonymous' tree %s\n", ipp.ipo_name); PRINTF("table role = "); } else { PRINTF("Name: %s", ipp.ipo_name); if ((ipp.ipo_flags & IPOOL_ANON) == IPOOL_ANON) PRINTF("(anon)"); putchar(' '); PRINTF("Role: "); } switch (ipp.ipo_unit) { case IPL_LOGIPF : printf("ipf"); break; case IPL_LOGNAT : printf("nat"); break; case IPL_LOGSTATE : printf("state"); break; case IPL_LOGAUTH : printf("auth"); break; case IPL_LOGSYNC : printf("sync"); break; case IPL_LOGSCAN : printf("scan"); break; case IPL_LOGLOOKUP : printf("lookup"); break; case IPL_LOGCOUNT : printf("count"); break; default : printf("unknown(%d)", ipp.ipo_unit); } if ((opts & OPT_DEBUG) == 0) { PRINTF(" type = tree number = %s\n", ipp.ipo_name); PRINTF("\t{"); } else { putchar(' '); PRINTF("\tReferences: %d\tHits: %lu\n", ipp.ipo_ref, ipp.ipo_hits); PRINTF("\tNodes Starting at %p\n", ipp.ipo_list); } ipnpn = ipp.ipo_list; ipp.ipo_list = NULL; while (ipnpn != NULL) { ipnp = (ip_pool_node_t *)malloc(sizeof(*ipnp)); (*copyfunc)(ipnpn, ipnp, sizeof(ipn)); ipnpn = ipnp->ipn_next; ipnp->ipn_next = ipp.ipo_list; ipp.ipo_list = ipnp; } if (ipp.ipo_list == NULL) { putchar(';'); } else { for (ipnp = ipp.ipo_list; ipnp != NULL; ) { ipnp = printpoolnode(ipnp, opts); if ((opts & OPT_DEBUG) == 0) { putchar(';'); } } } if ((opts & OPT_DEBUG) == 0) PRINTF(" };\n"); return ipp.ipo_next; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include "ipf.h" #include "netinet/ipl.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf ip_pool_t *printpool_live(pool, fd, name, opts) ip_pool_t *pool; int fd; char *name; int opts; { ip_pool_node_t entry, *top, *node; ipflookupiter_t iter; int i, printed = 0, last; ipfobj_t obj; if ((name != NULL) && strncmp(name, pool->ipo_name, FR_GROUPLEN)) return pool->ipo_next; printpooldata(pool, opts); if ((opts & OPT_DEBUG) == 0) PRINTF("\t{"); obj.ipfo_rev = IPFILTER_VERSION; obj.ipfo_type = IPFOBJ_LOOKUPITER; obj.ipfo_ptr = &iter; obj.ipfo_size = sizeof(iter); iter.ili_data = &entry; iter.ili_type = IPLT_POOL; iter.ili_otype = IPFLOOKUPITER_NODE; iter.ili_ival = IPFGENITER_LOOKUP; iter.ili_unit = pool->ipo_unit; strncpy(iter.ili_name, pool->ipo_name, FR_GROUPLEN); last = 0; top = NULL; while (!last && (ioctl(fd, SIOCLOOKUPITER, &obj) == 0)) { if (entry.ipn_next == NULL) last = 1; entry.ipn_next = top; top = malloc(sizeof(*top)); if (top == NULL) break; bcopy(&entry, top, sizeof(entry)); } while (top != NULL) { node = top; (void) printpoolnode(node, opts); top = node->ipn_next; free(node); printed++; if ((opts & OPT_DEBUG) == 0) putchar(';'); } if (printed == 0) putchar(';'); if ((opts & OPT_DEBUG) == 0) PRINTF(" };\n"); return pool->ipo_next; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include "ipf.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf void printpooldata(pool, opts) ip_pool_t *pool; int opts; { if ((opts & OPT_DEBUG) == 0) { if ((pool->ipo_flags & IPOOL_ANON) != 0) PRINTF("# 'anonymous' tree %s\n", pool->ipo_name); PRINTF("table role = "); } else { PRINTF("Name: %s", pool->ipo_name); if ((pool->ipo_flags & IPOOL_ANON) == IPOOL_ANON) PRINTF("(anon)"); putchar(' '); PRINTF("Role: "); } switch (pool->ipo_unit) { case IPL_LOGIPF : PRINTF("ipf"); break; case IPL_LOGNAT : PRINTF("nat"); break; case IPL_LOGSTATE : PRINTF("state"); break; case IPL_LOGAUTH : PRINTF("auth"); break; case IPL_LOGSYNC : PRINTF("sync"); break; case IPL_LOGSCAN : PRINTF("scan"); break; case IPL_LOGLOOKUP : PRINTF("lookup"); break; case IPL_LOGCOUNT : PRINTF("count"); break; default : PRINTF("unknown(%d)", pool->ipo_unit); } if ((opts & OPT_DEBUG) == 0) { PRINTF(" type = tree number = %s\n", pool->ipo_name); } else { putchar(' '); PRINTF("\tReferences: %d\tHits: %lu\n", pool->ipo_ref, pool->ipo_hits); PRINTF("\tNodes Starting at %p\n", pool->ipo_list); } } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. */ #include "ipf.h" #define PRINTF (void)printf ip_pool_node_t *printpoolnode(np, opts) ip_pool_node_t *np; int opts; { if ((opts & OPT_DEBUG) == 0) PRINTF(" %s", np->ipn_info ? "! " : ""); else PRINTF("\tAddress: %s", np->ipn_info ? "! " : ""); #ifdef USE_INET6 if (np->ipn_addr.adf_family == AF_INET6) printhostmask(6, (u_32_t *)&np->ipn_addr.adf_addr.in6, (u_32_t *)&np->ipn_mask.adf_addr); else #endif { printip((u_32_t *)&np->ipn_addr.adf_addr.in4); printmask(4, (u_32_t *)&np->ipn_mask.adf_addr); } if ((opts & OPT_DEBUG) != 0) #ifdef USE_QUAD_T PRINTF("\t\tHits %qu\t\tBytes %qu\t\tName %s\n", np->ipn_hits, np->ipn_bytes, np->ipn_name); #else PRINTF("\t\tHits %lu\t\tBytes %lu\t\tName %s\n", np->ipn_hits, np->ipn_bytes, np->ipn_name); #endif return np->ipn_next; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: printportcmp.c,v 1.7 2003/02/16 02:31:05 darrenr Exp $ */ #include "ipf.h" void printportcmp(pr, frp) int pr; frpcmp_t *frp; { static char *pcmp1[] = { "*", "=", "!=", "<", ">", "<=", ">=", "<>", "><", ":" }; if (frp->frp_cmp == FR_INRANGE || frp->frp_cmp == FR_OUTRANGE) printf(" port %d %s %d", frp->frp_port, pcmp1[frp->frp_cmp], frp->frp_top); else if (frp->frp_cmp == FR_INCRANGE) printf(" port %d:%d", frp->frp_port, frp->frp_top); else printf(" port %s %s", pcmp1[frp->frp_cmp], portname(pr, frp->frp_port)); } /* * Copyright (C) 1993-2005 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" #if !defined(lint) static const char rcsid[] = "@(#)$Id: printproto.c,v 1.1.2.1 2005/06/12 07:21:53 darrenr Exp $"; #endif void printproto(pr, p, np) struct protoent *pr; int p; ipnat_t *np; { if (np != NULL) { if ((np->in_flags & IPN_TCPUDP) == IPN_TCPUDP) printf("tcp/udp"); else if (np->in_flags & IPN_TCP) printf("tcp"); else if (np->in_flags & IPN_UDP) printf("udp"); else if (np->in_flags & IPN_ICMPQUERY) printf("icmp"); #ifdef _AIX51 /* * To make up for "ip = 252" and "hopopt = 0" in /etc/protocols */ else if (np->in_p == 0) printf("ip"); #endif else if (pr != NULL) printf("%s", pr->p_name); else printf("%d", np->in_p); } else { #ifdef _AIX51 if (p == 0) printf("ip"); else #endif if (pr != NULL) printf("%s", pr->p_name); else printf("%d", p); } } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #ifdef IPFILTER_SCAN #include #include #include "ipf.h" #include "netinet/ip_scan.h" void printsbuf(buf) char *buf; { u_char *s; int i; for (s = (u_char *)buf, i = ISC_TLEN; i; i--, s++) { if (ISPRINT(*s)) putchar(*s); else printf("\\%o", *s); } } #endif /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" #include "kmem.h" #define PRINTF (void)printf #define FPRINTF (void)fprintf ipstate_t *printstate(sp, opts, now) ipstate_t *sp; int opts; u_long now; { ipstate_t ips; #ifdef IPFILTER_SYNC synclist_t ipsync; #endif if (kmemcpy((char *)&ips, (u_long)sp, sizeof(ips))) return NULL; PRINTF("%s -> ", hostname(ips.is_v, &ips.is_src.in4)); PRINTF("%s pass %#x pr %d state %d/%d bkt %d\n", hostname(ips.is_v, &ips.is_dst.in4), ips.is_pass, ips.is_p, ips.is_state[0], ips.is_state[1], ips.is_hv); PRINTF("\ttag %u ttl %lu", ips.is_tag, ips.is_die - now); if (ips.is_p == IPPROTO_TCP) { PRINTF("\n\t%hu -> %hu %x:%x %hu<<%d:%hu<<%d\n", ntohs(ips.is_sport), ntohs(ips.is_dport), ips.is_send, ips.is_dend, ips.is_maxswin, ips.is_swinscale, ips.is_maxdwin, ips.is_dwinscale); PRINTF("\tcmsk %04x smsk %04x isc %p s0 %08x/%08x\n", ips.is_smsk[0], ips.is_smsk[1], ips.is_isc, ips.is_s0[0], ips.is_s0[1]); PRINTF("\tFWD:ISN inc %x sumd %x\n", ips.is_isninc[0], ips.is_sumd[0]); PRINTF("\tREV:ISN inc %x sumd %x\n", ips.is_isninc[1], ips.is_sumd[1]); #ifdef IPFILTER_SCAN PRINTF("\tsbuf[0] ["); printsbuf(ips.is_sbuf[0]); PRINTF("] sbuf[1] ["); printsbuf(ips.is_sbuf[1]); PRINTF("]\n"); #endif } else if (ips.is_p == IPPROTO_UDP) { PRINTF(" %hu -> %hu\n", ntohs(ips.is_sport), ntohs(ips.is_dport)); } else if (ips.is_p == IPPROTO_GRE) { PRINTF(" call %hx/%hx\n", ntohs(ips.is_gre.gs_call[0]), ntohs(ips.is_gre.gs_call[1])); } else if (ips.is_p == IPPROTO_ICMP #ifdef USE_INET6 || ips.is_p == IPPROTO_ICMPV6 #endif ) PRINTF(" id %hu seq %hu type %d\n", ntohs(ips.is_icmp.ici_id), ntohs(ips.is_icmp.ici_seq), ips.is_icmp.ici_type); #ifdef USE_QUAD_T PRINTF("\tforward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd\n\tbackward: pkts in %qd bytes in %qd pkts out %qd bytes out %qd\n", ips.is_pkts[0], ips.is_bytes[0], ips.is_pkts[1], ips.is_bytes[1], ips.is_pkts[2], ips.is_bytes[2], ips.is_pkts[3], ips.is_bytes[3]); #else PRINTF("\tforward: pkts in %ld bytes in %ld pkts out %ld bytes out %ld\n\tbackward: pkts in %ld bytes in %ld pkts out %ld bytes out %ld\n", ips.is_pkts[0], ips.is_bytes[0], ips.is_pkts[1], ips.is_bytes[1], ips.is_pkts[2], ips.is_bytes[2], ips.is_pkts[3], ips.is_bytes[3]); #endif PRINTF("\t"); /* * Print out bits set in the result code for the state being * kept as they would for a rule. */ if (FR_ISPASS(ips.is_pass)) { PRINTF("pass"); } else if (FR_ISBLOCK(ips.is_pass)) { PRINTF("block"); switch (ips.is_pass & FR_RETMASK) { case FR_RETICMP : PRINTF(" return-icmp"); break; case FR_FAKEICMP : PRINTF(" return-icmp-as-dest"); break; case FR_RETRST : PRINTF(" return-rst"); break; default : break; } } else if ((ips.is_pass & FR_LOGMASK) == FR_LOG) { PRINTF("log"); if (ips.is_pass & FR_LOGBODY) PRINTF(" body"); if (ips.is_pass & FR_LOGFIRST) PRINTF(" first"); } else if (FR_ISACCOUNT(ips.is_pass)) { PRINTF("count"); } else if (FR_ISPREAUTH(ips.is_pass)) { PRINTF("preauth"); } else if (FR_ISAUTH(ips.is_pass)) PRINTF("auth"); if (ips.is_pass & FR_OUTQUE) PRINTF(" out"); else PRINTF(" in"); if ((ips.is_pass & FR_LOG) != 0) { PRINTF(" log"); if (ips.is_pass & FR_LOGBODY) PRINTF(" body"); if (ips.is_pass & FR_LOGFIRST) PRINTF(" first"); if (ips.is_pass & FR_LOGORBLOCK) PRINTF(" or-block"); } if (ips.is_pass & FR_QUICK) PRINTF(" quick"); if (ips.is_pass & FR_KEEPFRAG) PRINTF(" keep frags"); /* a given; no? */ if (ips.is_pass & FR_KEEPSTATE) { PRINTF(" keep state"); if (ips.is_pass & FR_STATESYNC) PRINTF(" ( sync )"); } PRINTF("\tIPv%d", ips.is_v); PRINTF("\n"); PRINTF("\tpkt_flags & %x(%x) = %x,\t", ips.is_flags & 0xf, ips.is_flags, ips.is_flags >> 4); PRINTF("\tpkt_options & %x = %x, %x = %x \n", ips.is_optmsk[0], ips.is_opt[0], ips.is_optmsk[1], ips.is_opt[1]); PRINTF("\tpkt_security & %x = %x, pkt_auth & %x = %x\n", ips.is_secmsk, ips.is_sec, ips.is_authmsk, ips.is_auth); PRINTF("\tis_flx %#x %#x %#x %#x\n", ips.is_flx[0][0], ips.is_flx[0][1], ips.is_flx[1][0], ips.is_flx[1][1]); PRINTF("\tinterfaces: in %s[%s", getifname(ips.is_ifp[0]), ips.is_ifname[0]); if (opts & OPT_DEBUG) PRINTF("/%p", ips.is_ifp[0]); putchar(']'); PRINTF(",%s[%s", getifname(ips.is_ifp[1]), ips.is_ifname[1]); if (opts & OPT_DEBUG) PRINTF("/%p", ips.is_ifp[1]); putchar(']'); PRINTF(" out %s[%s", getifname(ips.is_ifp[2]), ips.is_ifname[2]); if (opts & OPT_DEBUG) PRINTF("/%p", ips.is_ifp[2]); putchar(']'); PRINTF(",%s[%s", getifname(ips.is_ifp[3]), ips.is_ifname[3]); if (opts & OPT_DEBUG) PRINTF("/%p", ips.is_ifp[3]); PRINTF("]\n"); #ifdef IPFILTER_SYNC if (ips.is_sync != NULL) { if (kmemcpy((char *)&ipsync, (u_long)ips.is_sync, sizeof(ipsync))) { PRINTF("\tSync status: status could not be retrieved\n"); return NULL; } PRINTF("\tSync status: idx %d num %d v %d pr %d rev %d\n", ipsync.sl_idx, ipsync.sl_num, ipsync.sl_v, ipsync.sl_p, ipsync.sl_rev); } else { PRINTF("\tSync status: not synchronized\n"); } #endif return ips.is_next; } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include "ipf.h" void printtunable(tup) ipftune_t *tup; { printf("%s\tmin %#lx\tmax %#lx\tcurrent ", tup->ipft_name, tup->ipft_min, tup->ipft_max); if (tup->ipft_sz == sizeof(u_long)) printf("%lu\n", tup->ipft_vlong); else if (tup->ipft_sz == sizeof(u_int)) printf("%u\n", tup->ipft_vint); else if (tup->ipft_sz == sizeof(u_short)) printf("%hu\n", tup->ipft_vshort); else if (tup->ipft_sz == sizeof(u_char)) printf("%u\n", (u_int)tup->ipft_vchar); else { printf("sz = %d\n", tup->ipft_sz); } } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: ratoi.c,v 1.4 2001/06/09 17:09:25 darrenr Exp $ */ #include "ipf.h" int ratoi(ps, pi, min, max) char *ps; int *pi, min, max; { int i; char *pe; i = (int)strtol(ps, &pe, 0); if (*pe != '\0' || i < min || i > max) return 0; *pi = i; return 1; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: remove_hash.c,v 1.1 2003/04/13 06:40:14 darrenr Exp $ */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_htable.h" static int hashfd = -1; int remove_hash(iphp, iocfunc) iphtable_t *iphp; ioctlfunc_t iocfunc; { iplookupop_t op; iphtable_t iph; if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) hashfd = open(IPLOOKUP_NAME, O_RDWR); if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; op.iplo_type = IPLT_HASH; op.iplo_unit = iphp->iph_unit; strncpy(op.iplo_name, iphp->iph_name, sizeof(op.iplo_name)); if (*op.iplo_name == '\0') op.iplo_arg = IPHASH_ANON; op.iplo_size = sizeof(iph); op.iplo_struct = &iph; bzero((char *)&iph, sizeof(iph)); iph.iph_unit = iphp->iph_unit; iph.iph_type = iphp->iph_type; strncpy(iph.iph_name, iphp->iph_name, sizeof(iph.iph_name)); iph.iph_flags = iphp->iph_flags; if ((*iocfunc)(hashfd, SIOCLOOKUPDELTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("remove_hash:SIOCLOOKUPDELTABLE"); return -1; } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: remove_hashnode.c,v 1.1 2003/04/13 06:40:14 darrenr Exp $ */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_htable.h" static int hashfd = -1; int remove_hashnode(unit, name, node, iocfunc) int unit; char *name; iphtent_t *node; ioctlfunc_t iocfunc; { iplookupop_t op; iphtent_t ipe; if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) hashfd = open(IPLOOKUP_NAME, O_RDWR); if ((hashfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; op.iplo_type = IPLT_HASH; op.iplo_unit = unit; op.iplo_size = sizeof(ipe); op.iplo_struct = &ipe; op.iplo_arg = 0; strncpy(op.iplo_name, name, sizeof(op.iplo_name)); bzero((char *)&ipe, sizeof(ipe)); bcopy((char *)&node->ipe_addr, (char *)&ipe.ipe_addr, sizeof(ipe.ipe_addr)); bcopy((char *)&node->ipe_mask, (char *)&ipe.ipe_mask, sizeof(ipe.ipe_mask)); if (opts & OPT_DEBUG) { printf("\t%s - ", inet_ntoa(ipe.ipe_addr.in4)); printf("%s\n", inet_ntoa(ipe.ipe_mask.in4)); } if ((*iocfunc)(hashfd, SIOCLOOKUPDELNODE, &op)) if (!(opts & OPT_DONOTHING)) { perror("remove_hash:SIOCLOOKUPDELNODE"); return -1; } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: remove_pool.c,v 1.1 2003/04/13 06:40:14 darrenr Exp $ */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_htable.h" static int poolfd = -1; int remove_pool(poolp, iocfunc) ip_pool_t *poolp; ioctlfunc_t iocfunc; { iplookupop_t op; ip_pool_t pool; if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) poolfd = open(IPLOOKUP_NAME, O_RDWR); if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; op.iplo_type = IPLT_POOL; op.iplo_unit = poolp->ipo_unit; strncpy(op.iplo_name, poolp->ipo_name, sizeof(op.iplo_name)); op.iplo_size = sizeof(pool); op.iplo_struct = &pool; bzero((char *)&pool, sizeof(pool)); pool.ipo_unit = poolp->ipo_unit; strncpy(pool.ipo_name, poolp->ipo_name, sizeof(pool.ipo_name)); pool.ipo_flags = poolp->ipo_flags; if ((*iocfunc)(poolfd, SIOCLOOKUPDELTABLE, &op)) if ((opts & OPT_DONOTHING) == 0) { perror("remove_pool:SIOCLOOKUPDELTABLE"); return -1; } return 0; } /* * Copyright (C) 2002 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: remove_poolnode.c,v 1.3 2003/11/22 10:14:36 darrenr Exp $ */ #include #include #include "ipf.h" #include "netinet/ip_lookup.h" #include "netinet/ip_pool.h" static int poolfd = -1; int remove_poolnode(unit, name, node, iocfunc) int unit; char *name; ip_pool_node_t *node; ioctlfunc_t iocfunc; { ip_pool_node_t pn; iplookupop_t op; if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) poolfd = open(IPLOOKUP_NAME, O_RDWR); if ((poolfd == -1) && ((opts & OPT_DONOTHING) == 0)) return -1; op.iplo_unit = unit; op.iplo_type = IPLT_POOL; op.iplo_arg = 0; strncpy(op.iplo_name, name, sizeof(op.iplo_name)); op.iplo_struct = &pn; op.iplo_size = sizeof(pn); bzero((char *)&pn, sizeof(pn)); bcopy((char *)&node->ipn_addr, (char *)&pn.ipn_addr, sizeof(pn.ipn_addr)); bcopy((char *)&node->ipn_mask, (char *)&pn.ipn_mask, sizeof(pn.ipn_mask)); pn.ipn_info = node->ipn_info; strncpy(pn.ipn_name, node->ipn_name, sizeof(pn.ipn_name)); if ((*iocfunc)(poolfd, SIOCLOOKUPDELNODE, &op)) { if ((opts & OPT_DONOTHING) == 0) { perror("remove_pool:SIOCLOOKUPDELNODE"); return -1; } } return 0; } #include "ipf.h" long string_start = -1; long string_end = -1; char *string_val = NULL; long pos = 0; void resetlexer() { string_start = -1; string_end = -1; string_val = NULL; pos = 0; } #include "ipf.h" #define EMM_MAGIC 0x97dd8b3a void eMrwlock_read_enter(rw, file, line) eMrwlock_t *rw; char *file; int line; { if (rw->eMrw_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMrwlock_read_enter(%p): bad magic: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } if (rw->eMrw_read != 0 || rw->eMrw_write != 0) { fprintf(stderr, "%s:eMrwlock_read_enter(%p): already locked: %d/%d\n", rw->eMrw_owner, rw, rw->eMrw_read, rw->eMrw_write); abort(); } rw->eMrw_read++; rw->eMrw_heldin = file; rw->eMrw_heldat = line; } void eMrwlock_write_enter(rw, file, line) eMrwlock_t *rw; char *file; int line; { if (rw->eMrw_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMrwlock_write_enter(%p): bad magic: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } if (rw->eMrw_read != 0 || rw->eMrw_write != 0) { fprintf(stderr, "%s:eMrwlock_write_enter(%p): already locked: %d/%d\n", rw->eMrw_owner, rw, rw->eMrw_read, rw->eMrw_write); abort(); } rw->eMrw_write++; rw->eMrw_heldin = file; rw->eMrw_heldat = line; } void eMrwlock_downgrade(rw, file, line) eMrwlock_t *rw; char *file; int line; { if (rw->eMrw_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMrwlock_write_enter(%p): bad magic: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } if (rw->eMrw_read != 0 || rw->eMrw_write != 1) { fprintf(stderr, "%s:eMrwlock_write_enter(%p): already locked: %d/%d\n", rw->eMrw_owner, rw, rw->eMrw_read, rw->eMrw_write); abort(); } rw->eMrw_write--; rw->eMrw_read++; rw->eMrw_heldin = file; rw->eMrw_heldat = line; } void eMrwlock_exit(rw) eMrwlock_t *rw; { if (rw->eMrw_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMrwlock_exit(%p): bad magic: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } if (rw->eMrw_read != 1 && rw->eMrw_write != 1) { fprintf(stderr, "%s:eMrwlock_exit(%p): not locked: %d/%d\n", rw->eMrw_owner, rw, rw->eMrw_read, rw->eMrw_write); abort(); } if (rw->eMrw_read == 1) rw->eMrw_read--; else if (rw->eMrw_write == 1) rw->eMrw_write--; rw->eMrw_heldin = NULL; rw->eMrw_heldat = 0; } void eMrwlock_init(rw, who) eMrwlock_t *rw; char *who; { if (rw->eMrw_magic == EMM_MAGIC) { /* safe bet ? */ fprintf(stderr, "%s:eMrwlock_init(%p): already initialised?: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } rw->eMrw_magic = EMM_MAGIC; rw->eMrw_read = 0; rw->eMrw_write = 0; if (who != NULL) rw->eMrw_owner = strdup(who); else rw->eMrw_owner = NULL; } void eMrwlock_destroy(rw) eMrwlock_t *rw; { if (rw->eMrw_magic != EMM_MAGIC) { fprintf(stderr, "%s:eMrwlock_destroy(%p): bad magic: %#x\n", rw->eMrw_owner, rw, rw->eMrw_magic); abort(); } memset(rw, 0xa5, sizeof(*rw)); } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. */ #ifndef __SNOOP_H__ #define __SNOOP_H__ /* * written to comply with the RFC (1761) from Sun. * $Id: snoop.h,v 2.3 2001/06/09 17:09:23 darrenr Exp $ */ struct snoophdr { char s_id[8]; int s_v; int s_type; }; #define SNOOP_VERSION 2 #define SDL_8023 0 #define SDL_8024 1 #define SDL_8025 2 #define SDL_8026 3 #define SDL_ETHER 4 #define SDL_HDLC 5 #define SDL_CHSYNC 6 #define SDL_IBMCC 7 #define SDL_FDDI 8 #define SDL_OTHER 9 #define SDL_MAX 9 struct snooppkt { int sp_olen; int sp_ilen; int sp_plen; int sp_drop; int sp_sec; int sp_usec; }; #endif /* __SNOOP_H__ */ /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: tcpflags.c,v 1.3 2002/11/02 07:18:01 darrenr Exp $ */ #include "ipf.h" /* * ECN is a new addition to TCP - RFC 2481 */ #ifndef TH_ECN # define TH_ECN 0x40 #endif #ifndef TH_CWR # define TH_CWR 0x80 #endif extern char flagset[]; extern u_char flags[]; u_char tcpflags(flgs) char *flgs; { u_char tcpf = 0; char *s, *t; for (s = flgs; *s; s++) { if (*s == 'W') tcpf |= TH_CWR; else { if (!(t = strchr(flagset, *s))) { return 0; } tcpf |= flags[t - flagset]; } } return tcpf; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: v6ionames.c,v 1.1.4.1 2005/01/02 13:08:49 darrenr Exp $ */ #include "ipf.h" #ifdef USE_INET6 struct ipopt_names v6ionames[] ={ { IPPROTO_HOPOPTS, 0x000001, 0, "hopopts" }, { IPPROTO_IPV6, 0x000002, 0, "ipv6" }, { IPPROTO_ROUTING, 0x000004, 0, "routing" }, { IPPROTO_FRAGMENT, 0x000008, 0, "frag" }, { IPPROTO_ESP, 0x000010, 0, "esp" }, { IPPROTO_AH, 0x000020, 0, "ah" }, { IPPROTO_NONE, 0x000040, 0, "none" }, { IPPROTO_DSTOPTS, 0x000080, 0, "dstopts" }, { 0, 0, 0, (char *)NULL } }; #endif /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: v6optvalue.c,v 1.1 2003/04/26 04:55:58 darrenr Exp $ */ #include "ipf.h" u_32_t getv6optbyname(optname) char *optname; { #ifdef USE_INET6 struct ipopt_names *io; for (io = v6ionames; io->on_name; io++) if (!strcasecmp(optname, io->on_name)) return io->on_bit; #endif return -1; } u_32_t getv6optbyvalue(optval) int optval; { #ifdef USE_INET6 struct ipopt_names *io; for (io = v6ionames; io->on_name; io++) if (io->on_value == optval) return io->on_bit; #endif return -1; } /* * Copyright (C) 1993-2005 by Darren Reed. * See the IPFILTER.LICENCE file for details on licencing. */ #include #include "ipf.h" typedef struct variable { struct variable *v_next; char *v_name; char *v_value; } variable_t; static variable_t *vtop = NULL; static variable_t *find_var __P((char *)); static char *expand_string __P((char *, int)); static variable_t *find_var(name) char *name; { variable_t *v; for (v = vtop; v != NULL; v = v->v_next) if (!strcmp(name, v->v_name)) return v; return NULL; } char *get_variable(string, after, line) char *string, **after; int line; { char c, *s, *t, *value; variable_t *v; s = string; if (*s == '{') { s++; for (t = s; *t != '\0'; t++) if (*t == '}') break; if (*t == '\0') { fprintf(stderr, "%d: { without }\n", line); return NULL; } } else if (ISALPHA(*s)) { for (t = s + 1; *t != '\0'; t++) if (!ISALPHA(*t) && !ISDIGIT(*t) && (*t != '_')) break; } else { fprintf(stderr, "%d: variables cannot start with '%c'\n", line, *s); return NULL; } if (after != NULL) *after = t; c = *t; *t = '\0'; v = find_var(s); *t = c; if (v == NULL) { fprintf(stderr, "%d: unknown variable '%s'\n", line, s); return NULL; } s = strdup(v->v_value); value = expand_string(s, line); if (value != s) free(s); return value; } static char *expand_string(oldstring, line) char *oldstring; int line; { char c, *s, *p1, *p2, *p3, *newstring, *value; int len; p3 = NULL; newstring = oldstring; for (s = oldstring; *s != '\0'; s++) if (*s == '$') { *s = '\0'; s++; switch (*s) { case '$' : bcopy(s, s - 1, strlen(s)); break; default : c = *s; if (c == '\0') return newstring; value = get_variable(s, &p3, line); if (value == NULL) return NULL; p2 = expand_string(value, line); if (p2 == NULL) return NULL; len = strlen(newstring) + strlen(p2); if (p3 != NULL) { if (c == '{' && *p3 == '}') p3++; len += strlen(p3); } p1 = malloc(len + 1); if (p1 == NULL) return NULL; *(s - 1) = '\0'; strcpy(p1, newstring); strcat(p1, p2); if (p3 != NULL) strcat(p1, p3); s = p1 + len - strlen(p3) - 1; if (newstring != oldstring) free(newstring); newstring = p1; break; } } return newstring; } void set_variable(name, value) char *name; char *value; { variable_t *v; int len; if (name == NULL || value == NULL || *name == '\0') return; v = find_var(name); if (v != NULL) { free(v->v_value); v->v_value = strdup(value); return; } len = strlen(value); if ((*value == '"' && value[len - 1] == '"') || (*value == '\'' && value[len - 1] == '\'')) { value[len - 1] = '\0'; value++; len -=2; } v = (variable_t *)malloc(sizeof(*v)); if (v == NULL) return; v->v_name = strdup(name); v->v_value = strdup(value); v->v_next = vtop; vtop = v; } /* * Copyright (C) 1993-2001 by Darren Reed. * * See the IPFILTER.LICENCE file for details on licencing. * * $Id: verbose.c,v 1.6 2001/06/09 17:09:25 darrenr Exp $ */ #if defined(__STDC__) # include #else # include #endif #include #include "ipt.h" #include "opts.h" #if defined(__STDC__) void verbose(char *fmt, ...) #else void verbose(fmt, va_alist) char *fmt; va_dcl #endif { va_list pvar; va_start(pvar, fmt); if (opts & OPT_VERBOSE) vprintf(fmt, pvar); va_end(pvar); }