fw-ipf.c

Go to the documentation of this file.

/*
 * fw-ipf.c
 *
 * Copyright (c) 2001 Dug Song <dugsong@monkey.org>
 *
 * $Id: fw-ipf.c,v 1.18 2005/02/16 21:42:53 dugsong Exp $
 */

#include "config.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/socket.h>

#include <net/if.h>
#define _NETINET_IP6_H_         /* XXX */
#include <netinet/in.h>
#define ip_t    ipf_ip_t
#ifdef HAVE_NETINET_IP_FIL_COMPAT_H
# include <netinet/ip_fil_compat.h>
#else
# include <netinet/ip_compat.h>
#endif
#include <netinet/ip_fil.h>
#undef ip_t

#include <assert.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define KMEM_NAME       "/dev/kmem"

#include "dnet.h"

#if !defined(fi_saddr) && !defined(fi_daddr)
# define fi_saddr       fi_src.s_addr
# define fi_daddr       fi_dst.s_addr
#endif

struct fw_handle {
        int     fd;
        int     kfd;
};

static void
rule_to_ipf(const struct fw_rule *rule, struct frentry *fr)
{
        memset(fr, 0, sizeof(*fr));

        if (*rule->fw_device != '\0') {
                strlcpy(fr->fr_ifname, rule->fw_device, IFNAMSIZ);
                strlcpy(fr->fr_oifname, rule->fw_device, IFNAMSIZ);
        }
        if (rule->fw_op == FW_OP_ALLOW)
                fr->fr_flags |= FR_PASS;
        else
                fr->fr_flags |= FR_BLOCK;

        if (rule->fw_dir == FW_DIR_IN)
                fr->fr_flags |= FR_INQUE;
        else
                fr->fr_flags |= FR_OUTQUE;
        
        fr->fr_ip.fi_p = rule->fw_proto;
        fr->fr_ip.fi_saddr = rule->fw_src.addr_ip;
        fr->fr_ip.fi_daddr = rule->fw_dst.addr_ip;
        addr_btom(rule->fw_src.addr_bits, &fr->fr_mip.fi_saddr, IP_ADDR_LEN);
        addr_btom(rule->fw_dst.addr_bits, &fr->fr_mip.fi_daddr, IP_ADDR_LEN);
        
        switch (rule->fw_proto) {
        case IPPROTO_ICMP:
                fr->fr_icmpm = rule->fw_sport[1] << 8 |
                    (rule->fw_dport[1] & 0xff);
                fr->fr_icmp = rule->fw_sport[0] << 8 |
                    (rule->fw_dport[0] & 0xff);
                break;
        case IPPROTO_TCP:
        case IPPROTO_UDP:
                fr->fr_sport = rule->fw_sport[0];
                if (rule->fw_sport[0] != rule->fw_sport[1]) {
                        fr->fr_scmp = FR_INRANGE;
                        fr->fr_stop = rule->fw_sport[1];
                } else
                        fr->fr_scmp = FR_EQUAL;

                fr->fr_dport = rule->fw_dport[0];
                if (rule->fw_dport[0] != rule->fw_dport[1]) {
                        fr->fr_dcmp = FR_INRANGE;
                        fr->fr_dtop = rule->fw_dport[1];
                } else
                        fr->fr_dcmp = FR_EQUAL;
                break;
        }
}

static void
ipf_ports_to_rule(uint8_t cmp, uint16_t port, uint16_t top, uint16_t *range)
{
        switch (cmp) {
        case FR_EQUAL:
                range[0] = range[1] = port;
                break;
        case FR_NEQUAL:
                range[0] = port - 1;
                range[1] = port + 1;
                break;
        case FR_LESST:
                range[0] = 0;
                range[1] = port - 1;
                break;
        case FR_GREATERT:
                range[0] = port + 1;
                range[1] = TCP_PORT_MAX;
                break;
        case FR_LESSTE:
                range[0] = 0;
                range[1] = port;
                break;
        case FR_GREATERTE:
                range[0] = port;
                range[1] = TCP_PORT_MAX;
                break;
        case FR_OUTRANGE:
                range[0] = port;
                range[1] = top;
                break;
        case FR_INRANGE:
                range[0] = port;
                range[1] = top;
                break;
        default:
                range[0] = 0;
                range[1] = TCP_PORT_MAX;
        }
}

static void
ipf_to_rule(const struct frentry *fr, struct fw_rule *rule)
{
        memset(rule, 0, sizeof(*rule));

        strlcpy(rule->fw_device, fr->fr_ifname, sizeof(rule->fw_device));
        rule->fw_op = (fr->fr_flags & FR_PASS) ? FW_OP_ALLOW : FW_OP_BLOCK;
        rule->fw_dir = (fr->fr_flags & FR_INQUE) ? FW_DIR_IN : FW_DIR_OUT;
        rule->fw_proto = fr->fr_ip.fi_p;

        rule->fw_src.addr_type = rule->fw_dst.addr_type = ADDR_TYPE_IP;
        rule->fw_src.addr_ip = fr->fr_ip.fi_saddr;
        rule->fw_dst.addr_ip = fr->fr_ip.fi_daddr;
        addr_mtob(&fr->fr_mip.fi_saddr, IP_ADDR_LEN,
            &rule->fw_src.addr_bits);
        addr_mtob(&fr->fr_mip.fi_daddr, IP_ADDR_LEN,
            &rule->fw_dst.addr_bits);
        
        switch (rule->fw_proto) {
        case IPPROTO_ICMP:
                rule->fw_sport[0] = ntohs(fr->fr_icmp & fr->fr_icmpm) >> 8;
                rule->fw_sport[1] = ntohs(fr->fr_icmpm) >> 8;
                rule->fw_dport[0] = ntohs(fr->fr_icmp & fr->fr_icmpm) & 0xff;
                rule->fw_dport[1] = ntohs(fr->fr_icmpm) & 0xff;
                break;
        case IPPROTO_TCP:
        case IPPROTO_UDP:
                ipf_ports_to_rule(fr->fr_scmp, fr->fr_sport,
                    fr->fr_stop, rule->fw_sport);
                ipf_ports_to_rule(fr->fr_dcmp, fr->fr_dport,
                    fr->fr_dtop, rule->fw_dport);
                break;
        }
}

fw_t *
fw_open(void)
{
        fw_t *fw;
        
        if ((fw = calloc(1, sizeof(*fw))) != NULL) {
                fw->fd = fw->kfd = -1;
                if ((fw->fd = open(IPL_NAME, O_RDWR, 0)) < 0)
                        return (fw_close(fw));
                if ((fw->kfd = open(KMEM_NAME, O_RDONLY)) < 0)
                        return (fw_close(fw));
        }
        return (fw);
}

int
fw_add(fw_t *fw, const struct fw_rule *rule)
{
        struct frentry fr;
        
        assert(fw != NULL && rule != NULL);
        
        rule_to_ipf(rule, &fr);
        
        return (ioctl(fw->fd, SIOCADDFR, &fr));
}

int
fw_delete(fw_t *fw, const struct fw_rule *rule)
{
        struct frentry fr;
        
        assert(fw != NULL && rule != NULL);

        rule_to_ipf(rule, &fr);
        
        return (ioctl(fw->fd, SIOCDELFR, &fr));
}

static int
fw_kcopy(fw_t *fw, u_char *buf, off_t pos, size_t n)
{
        int i;
        
        if (lseek(fw->kfd, pos, 0) < 0)
                return (-1);

        while ((i = read(fw->kfd, buf, n)) < n) {
                if (i <= 0)
                        return (-1);
                buf += i;
                n -= i;
        }
        return (0);
}

int
fw_loop(fw_t *fw, fw_handler callback, void *arg)
{
        struct friostat fio;
        struct friostat *fiop = &fio;
        struct frentry *frp, fr;
        struct fw_rule rule;
        int ret;
        
        memset(&fio, 0, sizeof(fio));
#ifdef __OpenBSD__
        if (ioctl(fw->fd, SIOCGETFS, fiop) < 0)
#else
        if (ioctl(fw->fd, SIOCGETFS, &fiop) < 0)        /* XXX - darren! */
#endif
                return (-1);

        for (frp = fio.f_fout[(int)fio.f_active]; frp != NULL;
            frp = fr.fr_next) {
                if (fw_kcopy(fw, (u_char *)&fr, (u_long)frp, sizeof(fr)) < 0)
                        return (-1);
                ipf_to_rule(&fr, &rule);
                if ((ret = callback(&rule, arg)) != 0)
                        return (ret);
        }
        for (frp = fio.f_fin[(int)fio.f_active]; frp != NULL;
            frp = fr.fr_next) {
                if (fw_kcopy(fw, (u_char *)&fr, (u_long)frp, sizeof(fr)) < 0)
                        return (-1);
                ipf_to_rule(&fr, &rule);
                if ((ret = callback(&rule, arg)) != 0)
                        return (ret);
        }
        return (0);
}

fw_t *
fw_close(fw_t *fw)
{
        if (fw != NULL) {
                if (fw->fd >= 0)
                        close(fw->fd);
                if (fw->kfd >= 0)
                        close(fw->kfd);
                free(fw);
        }
        return (NULL);
}

---