1 /* $NetBSD: npf_data.c,v 1.23 2013/11/22 00:25:51 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * npfctl(8) data manipulation and helper routines. 31 */ 32 33 #include <sys/cdefs.h> 34 __RCSID("$NetBSD: npf_data.c,v 1.23 2013/11/22 00:25:51 rmind Exp $"); 35 36 #include <sys/types.h> 37 #include <sys/null.h> 38 39 #include <netinet/in.h> 40 #include <netinet/in_systm.h> 41 #include <netinet/ip.h> 42 #define ICMP_STRINGS 43 #include <netinet/ip_icmp.h> 44 #define ICMP6_STRINGS 45 #include <netinet/icmp6.h> 46 #include <netinet/tcp.h> 47 #include <net/if.h> 48 49 #include <stdlib.h> 50 #include <stddef.h> 51 #include <string.h> 52 #include <ctype.h> 53 #include <err.h> 54 #include <errno.h> 55 #include <ifaddrs.h> 56 #include <netdb.h> 57 58 #include "npfctl.h" 59 60 static struct ifaddrs * ifs_list = NULL; 61 62 void 63 npfctl_note_interface(const char *ifname) 64 { 65 unsigned long if_idx = if_nametoindex(ifname); 66 bool testif = npfctl_debug_addif(ifname); 67 const char *p = ifname; 68 69 /* If such interface exists or if it is a test interface - done. */ 70 if (if_idx || testif) { 71 return; 72 } 73 74 /* 75 * Minimum sanity check. The interface name shall be non-empty 76 * string shorter than IFNAMSIZ and alphanumeric only. 77 */ 78 if (*p == '\0') { 79 goto invalid; 80 } 81 while (*p) { 82 const size_t len = (ptrdiff_t)p - (ptrdiff_t)ifname; 83 84 if (!isalnum((unsigned char)*p) || len > IFNAMSIZ) { 85 invalid: yyerror("illegitimate interface name '%s'", ifname); 86 } 87 p++; 88 } 89 90 /* Throw a warning, so that the user could double check. */ 91 warnx("warning - unknown interface '%s'", ifname); 92 } 93 94 static unsigned long 95 npfctl_find_ifindex(const char *ifname) 96 { 97 unsigned long if_idx = if_nametoindex(ifname); 98 bool testif = npfctl_debug_addif(ifname); 99 100 if (!if_idx) { 101 if (testif) { 102 static u_int dummy_if_idx = (1 << 15); 103 return ++dummy_if_idx; 104 } 105 yyerror("unknown interface '%s'", ifname); 106 } 107 return if_idx; 108 } 109 110 static bool 111 npfctl_copy_address(sa_family_t fam, npf_addr_t *addr, const void *ptr) 112 { 113 memset(addr, 0, sizeof(npf_addr_t)); 114 115 switch (fam) { 116 case AF_INET: { 117 const struct sockaddr_in *sin = ptr; 118 memcpy(addr, &sin->sin_addr, sizeof(sin->sin_addr)); 119 return true; 120 } 121 case AF_INET6: { 122 const struct sockaddr_in6 *sin6 = ptr; 123 memcpy(addr, &sin6->sin6_addr, sizeof(sin6->sin6_addr)); 124 return true; 125 } 126 default: 127 yyerror("unknown address family %u", fam); 128 return false; 129 } 130 } 131 132 static bool 133 npfctl_parse_fam_addr(const char *name, sa_family_t *fam, npf_addr_t *addr) 134 { 135 static const struct addrinfo hint = { 136 .ai_family = AF_UNSPEC, 137 .ai_flags = AI_NUMERICHOST 138 }; 139 struct addrinfo *ai; 140 int ret; 141 142 ret = getaddrinfo(name, NULL, &hint, &ai); 143 if (ret) { 144 yyerror("cannot parse '%s' (%s)", name, gai_strerror(ret)); 145 return false; 146 } 147 if (fam) { 148 *fam = ai->ai_family; 149 } 150 if (!npfctl_copy_address(*fam, addr, ai->ai_addr)) { 151 return false; 152 } 153 freeaddrinfo(ai); 154 return true; 155 } 156 157 static bool 158 npfctl_parse_mask(const char *s, sa_family_t fam, npf_netmask_t *mask) 159 { 160 char *ep = NULL; 161 npf_addr_t addr; 162 uint8_t *ap; 163 164 if (s) { 165 errno = 0; 166 *mask = (npf_netmask_t)strtol(s, &ep, 0); 167 if (*ep == '\0' && s != ep && errno != ERANGE) 168 return true; 169 if (!npfctl_parse_fam_addr(s, &fam, &addr)) 170 return false; 171 } 172 173 assert(fam == AF_INET || fam == AF_INET6); 174 *mask = NPF_NO_NETMASK; 175 if (ep == NULL) { 176 return true; 177 } 178 179 ap = addr.s6_addr + (*mask / 8) - 1; 180 while (ap >= addr.s6_addr) { 181 for (int j = 8; j > 0; j--) { 182 if (*ap & 1) 183 return true; 184 *ap >>= 1; 185 (*mask)--; 186 if (*mask == 0) 187 return true; 188 } 189 ap--; 190 } 191 return true; 192 } 193 194 /* 195 * npfctl_parse_fam_addr_mask: return address family, address and mask. 196 * 197 * => Mask is optional and can be NULL. 198 * => Returns true on success or false if unable to parse. 199 */ 200 npfvar_t * 201 npfctl_parse_fam_addr_mask(const char *addr, const char *mask, 202 unsigned long *nummask) 203 { 204 fam_addr_mask_t fam; 205 206 memset(&fam, 0, sizeof(fam)); 207 208 if (!npfctl_parse_fam_addr(addr, &fam.fam_family, &fam.fam_addr)) 209 return NULL; 210 211 /* 212 * Note: both mask and nummask may be NULL. In such case, 213 * npfctl_parse_mask() will handle and will set full mask. 214 */ 215 if (nummask) { 216 fam.fam_mask = *nummask; 217 } else if (!npfctl_parse_mask(mask, fam.fam_family, &fam.fam_mask)) { 218 return NULL; 219 } 220 return npfvar_create_element(NPFVAR_FAM, &fam, sizeof(fam)); 221 } 222 223 npfvar_t * 224 npfctl_parse_table_id(const char *name) 225 { 226 if (!npfctl_table_exists_p(name)) { 227 yyerror("table '%s' is not defined", name); 228 return NULL; 229 } 230 return npfvar_create_from_string(NPFVAR_TABLE, name); 231 } 232 233 /* 234 * npfctl_parse_port_range: create a port-range variable. Note that the 235 * passed port numbers should be in host byte order. 236 */ 237 npfvar_t * 238 npfctl_parse_port_range(in_port_t s, in_port_t e) 239 { 240 port_range_t pr; 241 242 pr.pr_start = htons(s); 243 pr.pr_end = htons(e); 244 245 return npfvar_create_element(NPFVAR_PORT_RANGE, &pr, sizeof(pr)); 246 } 247 248 npfvar_t * 249 npfctl_parse_port_range_variable(const char *v) 250 { 251 npfvar_t *vp = npfvar_lookup(v); 252 size_t count = npfvar_get_count(vp); 253 npfvar_t *pvp = npfvar_create(); 254 port_range_t *pr; 255 in_port_t p; 256 257 for (size_t i = 0; i < count; i++) { 258 int type = npfvar_get_type(vp, i); 259 void *data = npfvar_get_data(vp, type, i); 260 261 switch (type) { 262 case NPFVAR_IDENTIFIER: 263 case NPFVAR_STRING: 264 p = npfctl_portno(data); 265 npfvar_add_elements(pvp, npfctl_parse_port_range(p, p)); 266 break; 267 case NPFVAR_PORT_RANGE: 268 pr = data; 269 npfvar_add_element(pvp, NPFVAR_PORT_RANGE, pr, 270 sizeof(*pr)); 271 break; 272 case NPFVAR_NUM: 273 p = *(unsigned long *)data; 274 npfvar_add_elements(pvp, npfctl_parse_port_range(p, p)); 275 break; 276 default: 277 yyerror("wrong variable '%s' type '%s' for port range", 278 v, npfvar_type(type)); 279 npfvar_destroy(pvp); 280 return NULL; 281 } 282 } 283 return pvp; 284 } 285 286 npfvar_t * 287 npfctl_parse_ifnet(const char *ifname, const int family) 288 { 289 struct ifaddrs *ifa; 290 ifnet_addr_t ifna; 291 npfvar_t *vpa; 292 293 if (ifs_list == NULL && getifaddrs(&ifs_list) == -1) { 294 err(EXIT_FAILURE, "getifaddrs"); 295 } 296 297 vpa = npfvar_create(); 298 ifna.ifna_name = estrdup(ifname); 299 ifna.ifna_addrs = vpa; 300 ifna.ifna_index = npfctl_find_ifindex(ifname); 301 assert(ifna.ifna_index != 0); 302 303 for (ifa = ifs_list; ifa != NULL; ifa = ifa->ifa_next) { 304 fam_addr_mask_t fam; 305 struct sockaddr *sa; 306 307 if (strcmp(ifa->ifa_name, ifname) != 0) 308 continue; 309 310 if ((ifa->ifa_flags & IFF_UP) == 0) 311 warnx("interface '%s' is down", ifname); 312 313 sa = ifa->ifa_addr; 314 if (sa->sa_family != AF_INET && sa->sa_family != AF_INET6) 315 continue; 316 if (family != AF_UNSPEC && sa->sa_family != family) 317 continue; 318 319 memset(&fam, 0, sizeof(fam)); 320 fam.fam_family = sa->sa_family; 321 fam.fam_ifindex = ifna.ifna_index; 322 323 if (!npfctl_copy_address(sa->sa_family, &fam.fam_addr, sa)) 324 goto out; 325 326 if (!npfctl_parse_mask(NULL, fam.fam_family, &fam.fam_mask)) 327 goto out; 328 329 if (!npfvar_add_element(vpa, NPFVAR_FAM, &fam, sizeof(fam))) 330 goto out; 331 } 332 if (npfvar_get_count(vpa) == 0) { 333 yyerror("no addresses matched for interface '%s'", ifname); 334 goto out; 335 } 336 337 return npfvar_create_element(NPFVAR_INTERFACE, &ifna, sizeof(ifna)); 338 out: 339 npfvar_destroy(ifna.ifna_addrs); 340 return NULL; 341 } 342 343 bool 344 npfctl_parse_cidr(char *cidr, fam_addr_mask_t *fam, int *alen) 345 { 346 char *mask, *p; 347 348 p = strchr(cidr, '\n'); 349 if (p) { 350 *p = '\0'; 351 } 352 mask = strchr(cidr, '/'); 353 if (mask) { 354 *mask++ = '\0'; 355 } 356 357 memset(fam, 0, sizeof(*fam)); 358 if (!npfctl_parse_fam_addr(cidr, &fam->fam_family, &fam->fam_addr)) { 359 return false; 360 } 361 if (!npfctl_parse_mask(mask, fam->fam_family, &fam->fam_mask)) { 362 return false; 363 } 364 switch (fam->fam_family) { 365 case AF_INET: 366 *alen = sizeof(struct in_addr); 367 break; 368 case AF_INET6: 369 *alen = sizeof(struct in6_addr); 370 break; 371 default: 372 return false; 373 } 374 return true; 375 } 376 377 int 378 npfctl_protono(const char *proto) 379 { 380 struct protoent *pe; 381 382 pe = getprotobyname(proto); 383 if (pe == NULL) { 384 yyerror("unknown protocol '%s'", proto); 385 return -1; 386 } 387 return pe->p_proto; 388 } 389 390 /* 391 * npfctl_portno: convert port identifier (string) to a number. 392 * 393 * => Returns port number in host byte order. 394 */ 395 in_port_t 396 npfctl_portno(const char *port) 397 { 398 struct addrinfo *ai, *rai; 399 in_port_t p = 0; 400 int e; 401 402 e = getaddrinfo(NULL, port, NULL, &rai); 403 if (e != 0) { 404 yyerror("invalid port name '%s' (%s)", port, gai_strerror(e)); 405 return 0; 406 } 407 408 for (ai = rai; ai; ai = ai->ai_next) { 409 switch (ai->ai_family) { 410 case AF_INET: { 411 struct sockaddr_in *sin = (void *)ai->ai_addr; 412 p = sin->sin_port; 413 goto out; 414 } 415 case AF_INET6: { 416 struct sockaddr_in6 *sin6 = (void *)ai->ai_addr; 417 p = sin6->sin6_port; 418 goto out; 419 } 420 default: 421 break; 422 } 423 } 424 out: 425 freeaddrinfo(rai); 426 return ntohs(p); 427 } 428 429 npfvar_t * 430 npfctl_parse_tcpflag(const char *s) 431 { 432 uint8_t tfl = 0; 433 434 while (*s) { 435 switch (*s) { 436 case 'F': tfl |= TH_FIN; break; 437 case 'S': tfl |= TH_SYN; break; 438 case 'R': tfl |= TH_RST; break; 439 case 'P': tfl |= TH_PUSH; break; 440 case 'A': tfl |= TH_ACK; break; 441 case 'U': tfl |= TH_URG; break; 442 case 'E': tfl |= TH_ECE; break; 443 case 'W': tfl |= TH_CWR; break; 444 default: 445 yyerror("invalid flag '%c'", *s); 446 return NULL; 447 } 448 s++; 449 } 450 return npfvar_create_element(NPFVAR_TCPFLAG, &tfl, sizeof(tfl)); 451 } 452 453 uint8_t 454 npfctl_icmptype(int proto, const char *type) 455 { 456 uint8_t ul; 457 458 switch (proto) { 459 case IPPROTO_ICMP: 460 for (ul = 0; icmp_type[ul]; ul++) 461 if (strcmp(icmp_type[ul], type) == 0) 462 return ul; 463 break; 464 case IPPROTO_ICMPV6: 465 for (ul = 0; icmp6_type_err[ul]; ul++) 466 if (strcmp(icmp6_type_err[ul], type) == 0) 467 return ul; 468 for (ul = 0; icmp6_type_info[ul]; ul++) 469 if (strcmp(icmp6_type_info[ul], type) == 0) 470 return ul + 128; 471 break; 472 default: 473 assert(false); 474 } 475 476 yyerror("unknown icmp-type %s", type); 477 return ~0; 478 } 479 480 uint8_t 481 npfctl_icmpcode(int proto, uint8_t type, const char *code) 482 { 483 const char * const *arr; 484 485 switch (proto) { 486 case IPPROTO_ICMP: 487 switch (type) { 488 case ICMP_ECHOREPLY: 489 case ICMP_SOURCEQUENCH: 490 case ICMP_ALTHOSTADDR: 491 case ICMP_ECHO: 492 case ICMP_ROUTERSOLICIT: 493 case ICMP_TSTAMP: 494 case ICMP_TSTAMPREPLY: 495 case ICMP_IREQ: 496 case ICMP_IREQREPLY: 497 case ICMP_MASKREQ: 498 case ICMP_MASKREPLY: 499 arr = icmp_code_none; 500 break; 501 case ICMP_ROUTERADVERT: 502 arr = icmp_code_routeradvert; 503 break; 504 case ICMP_UNREACH: 505 arr = icmp_code_unreach; 506 break; 507 case ICMP_REDIRECT: 508 arr = icmp_code_redirect; 509 break; 510 case ICMP_TIMXCEED: 511 arr = icmp_code_timxceed; 512 break; 513 case ICMP_PARAMPROB: 514 arr = icmp_code_paramprob; 515 break; 516 case ICMP_PHOTURIS: 517 arr = icmp_code_photuris; 518 break; 519 default: 520 yyerror("unknown icmp-type %d while parsing code %s", 521 type, code); 522 return ~0; 523 } 524 break; 525 case IPPROTO_ICMPV6: 526 switch (type) { 527 case ICMP6_DST_UNREACH: 528 arr = icmp6_code_unreach; 529 break; 530 case ICMP6_TIME_EXCEEDED: 531 arr = icmp6_code_timxceed; 532 break; 533 case ICMP6_PARAM_PROB: 534 arr = icmp6_code_paramprob; 535 break; 536 case ICMP6_PACKET_TOO_BIG: 537 /* code-less info ICMPs */ 538 case ICMP6_ECHO_REQUEST: 539 case ICMP6_ECHO_REPLY: 540 case MLD_LISTENER_QUERY: 541 case MLD_LISTENER_REPORT: 542 case MLD_LISTENER_DONE: 543 case ND_ROUTER_SOLICIT: 544 case ND_ROUTER_ADVERT: 545 case ND_NEIGHBOR_SOLICIT: 546 case ND_NEIGHBOR_ADVERT: 547 case ND_REDIRECT: 548 arr = icmp6_code_none; 549 break; 550 /* XXX TODO: info ICMPs with code values */ 551 default: 552 yyerror("unknown icmp-type %d while parsing code %s", 553 type, code); 554 return ~0; 555 } 556 break; 557 default: 558 assert(false); 559 } 560 561 for (uint8_t ul = 0; arr[ul]; ul++) { 562 if (strcmp(arr[ul], code) == 0) 563 return ul; 564 } 565 yyerror("unknown code %s for icmp-type %d", code, type); 566 return ~0; 567 } 568 569 npfvar_t * 570 npfctl_parse_icmp(int proto, int type, int code) 571 { 572 npfvar_t *vp = npfvar_create(); 573 574 if (!npfvar_add_element(vp, NPFVAR_ICMP, &type, sizeof(type))) 575 goto out; 576 577 if (!npfvar_add_element(vp, NPFVAR_ICMP, &code, sizeof(code))) 578 goto out; 579 580 return vp; 581 out: 582 npfvar_destroy(vp); 583 return NULL; 584 } 585