summaryrefslogtreecommitdiff
path: root/sbin/ipf
diff options
context:
space:
mode:
Diffstat (limited to 'sbin/ipf')
-rw-r--r--sbin/ipf/Makefile4
-rw-r--r--sbin/ipf/ipf.c132
-rw-r--r--sbin/ipf/ipf.h52
-rw-r--r--sbin/ipf/opt.c10
-rw-r--r--sbin/ipf/parse.c606
5 files changed, 491 insertions, 313 deletions
diff --git a/sbin/ipf/Makefile b/sbin/ipf/Makefile
index 80354684536..4940b8564ee 100644
--- a/sbin/ipf/Makefile
+++ b/sbin/ipf/Makefile
@@ -1,7 +1,7 @@
-# $OpenBSD: Makefile,v 1.5 1999/02/07 00:48:28 deraadt Exp $
+# $OpenBSD: Makefile,v 1.6 1999/12/15 05:20:23 kjell Exp $
PROG= ipf
MAN= ipf.8 ipf.4 ipf.5
-SRCS= ipf.c parse.c opt.c
+SRCS= ipf.c parse.c opt.c facpri.c
.include <bsd.prog.mk>
diff --git a/sbin/ipf/ipf.c b/sbin/ipf/ipf.c
index eaaf94e6094..bf2517b13af 100644
--- a/sbin/ipf/ipf.c
+++ b/sbin/ipf/ipf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipf.c,v 1.19 1999/07/06 19:06:42 kjell Exp $ */
+/* $OpenBSD: ipf.c,v 1.20 1999/12/15 05:20:24 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -35,20 +35,18 @@
#include <netdb.h>
#include <arpa/nameser.h>
#include <resolv.h>
-#if defined(__OpenBSD__)
-# include <netinet/ip_fil_compat.h>
-#else
-# include <netinet/ip_compat.h>
-#endif
+#include <netinet/ip_fil_compat.h>
#include <netinet/ip_fil.h>
+#include <netinet/ip_nat.h>
+#include <netinet/ip_state.h>
#include "ipf.h"
+#include <netinet/ipl.h>
#if !defined(lint)
static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ipf.c,v 1.19 1999/07/06 19:06:42 kjell Exp $";
+static const char rcsid[] = "@(#)$Id: ipf.c,v 1.20 1999/12/15 05:20:24 kjell Exp $";
#endif
-static void frsync __P((void));
#if SOLARIS
static void blockunknown __P((void));
#endif
@@ -60,6 +58,7 @@ extern char *optarg;
extern int optind;
extern int optreset;
+void frsync __P((void));
void zerostats __P((void));
int main __P((int, char *[]));
@@ -74,24 +73,28 @@ static int opendevice __P((char *));
static void closedevice __P((void));
static char *getline __P((char *, size_t, FILE *));
static char *ipfname = IPL_NAME;
+static void usage __P((void));
+static void showversion __P((void));
+static int get_flags __P((void));
#if SOLARIS
-#define OPTS "AdDEf:F:Il:noPrsUvyzZ"
+#define OPTS "AdDEf:F:Il:noPrsUvVyzZ"
#else
-#define OPTS "AdDEf:F:Il:noPrsvyzZ"
+#define OPTS "AdDEf:F:Il:noPrsvVyzZ"
#endif
-void usage()
+static void usage()
{
#if SOLARIS
- fprintf(stderr, "usage: ipf [-AdDEInorsUvyzZ] [-l block|pass|nomatch] "
+ fprintf(stderr, "usage: ipf [-AdDEInoPrsUvVyzZ] %s %s %s\n",
#else
- fprintf(stderr, "usage: ipf [-AdDEInorsvyzZ] [-l block|pass|nomatch] "
+ fprintf(stderr, "usage: ipf [-AdDEInoPrsvVyzZ] %s %s %s\n",
#endif
- "[-F i|o|a|s|S] [-f filename]\n");
+ "[-l block|pass|nomatch]", "[-F i|o|a|s|S]", "[-f filename]");
exit(1);
}
+
int main(argc,argv)
int argc;
char *argv[];
@@ -154,6 +157,9 @@ char *argv[];
case 'v' :
opts |= OPT_VERBOSE;
break;
+ case 'V' :
+ showversion();
+ break;
case 'y' :
frsync();
break;
@@ -198,6 +204,18 @@ static void closedevice()
}
+static int get_flags()
+{
+ int i;
+
+ if ((opendevice(ipfname) != -2) && (ioctl(fd, SIOCGETFF, &i) == -1)) {
+ perror("SIOCFRENB");
+ return 0;
+ }
+ return i;
+}
+
+
static void set_state(enable)
u_int enable;
{
@@ -213,13 +231,17 @@ char *name, *file;
FILE *fp;
char line[513], *s;
struct frentry *fr;
- u_int add = SIOCADAFR, del = SIOCRMAFR;
+ u_int add, del;
+ int linenum = 0;
(void) opendevice(ipfname);
if (opts & OPT_INACTIVE) {
add = SIOCADIFR;
del = SIOCRMIFR;
+ } else {
+ add = SIOCADAFR;
+ del = SIOCRMAFR;
}
if (opts & OPT_DEBUG)
printf("add %x del %x\n", add, del);
@@ -235,6 +257,7 @@ char *name, *file;
}
while (getline(line, sizeof(line), fp)) {
+ linenum++;
/*
* treat CR as EOL. LF is converted to NUL by getline().
*/
@@ -252,7 +275,7 @@ char *name, *file;
if (opts & OPT_VERBOSE)
(void)fprintf(stderr, "[%s]\n", line);
- fr = parse(line);
+ fr = parse(line, linenum);
(void)fflush(stdout);
if (fr) {
@@ -339,13 +362,12 @@ FILE *file;
static void packetlogon(opt)
char *opt;
{
- int err, flag = 0;
-
- if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
- if ((err = ioctl(fd, SIOCGETFF, &flag)))
- perror("ioctl(SIOCGETFF)");
+ int flag, err;
- printf("log flag is currently %#x\n", flag);
+ err = get_flags();
+ if (err != 0) {
+ if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE)
+ printf("log flag is currently %#x\n", flag);
}
flag &= ~(FF_LOGPASS|FF_LOGNOMATCH|FF_LOGBLOCK);
@@ -370,9 +392,7 @@ char *opt;
perror("ioctl(SIOCSETFF)");
if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
- if ((err = ioctl(fd, SIOCGETFF, &flag)))
- perror("ioctl(SIOCGETFF)");
-
+ flag = get_flags();
printf("log flag is now %#x\n", flag);
}
}
@@ -434,7 +454,7 @@ static void swapactive()
}
-static void frsync()
+void frsync()
{
int frsyn = 0;
@@ -495,17 +515,14 @@ friostat_t *fp;
#if SOLARIS
static void blockunknown()
{
- int flag;
+ u_32_t flag;
if (opendevice(ipfname) == -1)
return;
- if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
- if (ioctl(fd, SIOCGETFF, &flag))
- perror("ioctl(SIOCGETFF)");
-
+ flag = get_flags();
+ if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE)
printf("log flag is currently %#x\n", flag);
- }
flag ^= FF_BLOCKNONIP;
@@ -520,3 +537,54 @@ static void blockunknown()
}
}
#endif
+
+
+static void showversion()
+{
+ struct friostat fio;
+ u_32_t flags;
+ char *s;
+
+ printf("ipf: %s (%d)\n", IPL_VERSION, sizeof(frentry_t));
+
+ if (opendevice(ipfname) != -2 && ioctl(fd, SIOCGETFS, &fio)) {
+ perror("ioctl(SIOCGETFS");
+ return;
+ }
+ flags = get_flags();
+
+ printf("Kernel: %-*.*s\n", (int)sizeof(fio.f_version),
+ (int)sizeof(fio.f_version), fio.f_version);
+ printf("Running: %s\n", fio.f_running ? "yes" : "no");
+ printf("Log Flags: %#x = ", flags);
+ s = "";
+ if (flags & FF_LOGPASS) {
+ printf("pass");
+ s = ", ";
+ }
+ if (flags & FF_LOGBLOCK) {
+ printf("%sblock", s);
+ s = ", ";
+ }
+ if (flags & FF_LOGNOMATCH) {
+ printf("%snomatch", s);
+ s = ", ";
+ }
+ if (flags & FF_BLOCKNONIP) {
+ printf("%snonip", s);
+ s = ", ";
+ }
+ if (!*s)
+ printf("none set");
+ putchar('\n');
+
+ printf("Default: ");
+ if (fio.f_defpass & FR_PASS)
+ s = "pass";
+ else if (fio.f_defpass & FR_BLOCK)
+ s = "block";
+ else
+ s = "nomatch -> block";
+ printf("%s all, Logging: %savailable\n", s, fio.f_logging ? "" : "un");
+ printf("Active list: %d\n", fio.f_active);
+}
diff --git a/sbin/ipf/ipf.h b/sbin/ipf/ipf.h
index 04705ab16ec..5435972babd 100644
--- a/sbin/ipf/ipf.h
+++ b/sbin/ipf/ipf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipf.h,v 1.10 1999/07/05 20:12:43 kjell Exp $ */
+/* $OpenBSD: ipf.h,v 1.11 1999/12/15 05:20:24 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -7,7 +7,7 @@
* to the original author and the contributors.
*
* @(#)ipf.h 1.12 6/5/96
- * $Id: ipf.h,v 1.10 1999/07/05 20:12:43 kjell Exp $
+ * $Id: ipf.h,v 1.11 1999/12/15 05:20:24 kjell Exp $
*/
#ifndef __IPF_H__
@@ -16,26 +16,28 @@
#ifndef SOLARIS
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif
-#define OPT_REMOVE 0x00001
-#define OPT_DEBUG 0x00002
-#define OPT_OUTQUE FR_OUTQUE /* 0x0004 */
-#define OPT_INQUE FR_INQUE /* 0x0008 */
-#define OPT_LOG FR_LOG /* 0x0010 */
-#define OPT_SHOWLIST 0x00020
-#define OPT_VERBOSE 0x00040
-#define OPT_DONOTHING 0x00080
-#define OPT_HITS 0x00100
-#define OPT_BRIEF 0x00200
+#define OPT_REMOVE 0x000001
+#define OPT_DEBUG 0x000002
+#define OPT_OUTQUE FR_OUTQUE /* 0x00004 */
+#define OPT_INQUE FR_INQUE /* 0x00008 */
+#define OPT_LOG FR_LOG /* 0x00010 */
+#define OPT_SHOWLIST 0x000020
+#define OPT_VERBOSE 0x000040
+#define OPT_DONOTHING 0x000080
+#define OPT_HITS 0x000100
+#define OPT_BRIEF 0x000200
#define OPT_ACCNT FR_ACCOUNT /* 0x0400 */
#define OPT_FRSTATES FR_KEEPFRAG /* 0x0800 */
#define OPT_IPSTATES FR_KEEPSTATE /* 0x1000 */
#define OPT_INACTIVE FR_INACTIVE /* 0x2000 */
-#define OPT_SHOWLINENO 0x04000
-#define OPT_PRINTFR 0x08000
-#define OPT_ZERORULEST 0x10000
-#define OPT_SAVEOUT 0x20000
-#define OPT_AUTHSTATS 0x40000
-#define OPT_RAW 0x80000
+#define OPT_SHOWLINENO 0x004000
+#define OPT_PRINTFR 0x008000
+#define OPT_ZERORULEST 0x010000
+#define OPT_SAVEOUT 0x020000
+#define OPT_AUTHSTATS 0x040000
+#define OPT_RAW 0x080000
+#define OPT_NAT 0x100000
+#define OPT_GROUPS 0x200000
#ifndef __P
# ifdef __STDC__
@@ -49,11 +51,11 @@
extern char *strdup __P((char *));
#endif
-extern struct frentry *parse __P((char *));
+extern struct frentry *parse __P((char *, int));
extern void printfr __P((struct frentry *));
extern void binprint __P((struct frentry *)), initparse __P((void));
-extern int portnum __P((char *, u_short *));
+extern int portnum __P((char *, u_short *, int));
struct ipopt_names {
@@ -65,8 +67,8 @@ struct ipopt_names {
extern u_32_t buildopts __P((char *, char *, int));
-extern u_32_t hostnum __P((char *, int *));
-extern u_32_t optname __P((char ***, u_short *));
+extern u_32_t hostnum __P((char *, int *, int));
+extern u_32_t optname __P((char ***, u_short *, int));
extern void printpacket __P((ip_t *));
#if SOLARIS
extern int inet_aton __P((const char *, struct in_addr *));
@@ -74,11 +76,11 @@ extern int gethostname __P((char *, int ));
extern void sync __P((void));
#endif
-#ifdef sun
-#define STRERROR(x) sys_errlist[x]
+#if defined(sun) && !SOLARIS
+# define STRERROR(x) sys_errlist[x]
extern char *sys_errlist[];
#else
-#define STRERROR(x) strerror(x)
+# define STRERROR(x) strerror(x)
#endif
#ifndef MIN
diff --git a/sbin/ipf/opt.c b/sbin/ipf/opt.c
index c659bdedda9..74df2df5c45 100644
--- a/sbin/ipf/opt.c
+++ b/sbin/ipf/opt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: opt.c,v 1.10 1999/02/05 05:58:42 deraadt Exp $ */
+/* $OpenBSD: opt.c,v 1.11 1999/12/15 05:20:24 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -21,18 +21,14 @@
#include <netinet/tcp.h>
#include <net/if.h>
#include <arpa/inet.h>
-#if defined(__OpenBSD__)
-# include <netinet/ip_fil_compat.h>
-#else
-# include <netinet/ip_compat.h>
-#endif
+#include <netinet/ip_fil_compat.h>
#include <netinet/tcpip.h>
#include <netinet/ip_fil.h>
#include "ipf.h"
#if !defined(lint)
static const char sccsid[] = "@(#)opt.c 1.8 4/10/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: opt.c,v 1.10 1999/02/05 05:58:42 deraadt Exp $";
+static const char rcsid[] = "@(#)$Id: opt.c,v 1.11 1999/12/15 05:20:24 kjell Exp $";
#endif
extern int opts;
diff --git a/sbin/ipf/parse.c b/sbin/ipf/parse.c
index 79372c41d3f..93053d32032 100644
--- a/sbin/ipf/parse.c
+++ b/sbin/ipf/parse.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: parse.c,v 1.26 1999/07/06 04:38:11 deraadt Exp $ */
+/* $OpenBSD: parse.c,v 1.27 1999/12/15 05:20:24 kjell Exp $ */
/*
* Copyright (C) 1993-1998 by Darren Reed.
*
@@ -6,8 +6,6 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
-#include <stdio.h>
-#include <string.h>
#include <sys/types.h>
#if !defined(__SVR4) && !defined(__svr4__)
#include <strings.h>
@@ -16,48 +14,56 @@
#endif
#include <sys/param.h>
#include <sys/time.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stddef.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <net/if.h>
+#if __FreeBSD_version >= 300000
+# include <net/if_var.h>
+#endif
+#include <stdio.h>
+#include <string.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stddef.h>
#include <netdb.h>
#include <arpa/nameser.h>
#include <arpa/inet.h>
#include <resolv.h>
#include <ctype.h>
+#include <syslog.h>
#include <netinet/ip_fil_compat.h>
#include <netinet/ip_fil.h>
#include "ipf.h"
+#include "facpri.h"
#if !defined(lint)
-static const char sccsid[] ="@(#)parse.c 1.44 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: parse.c,v 1.26 1999/07/06 04:38:11 deraadt Exp $";
+static const char sccsid[] = "@(#)parse.c 1.44 6/5/96 (C) 1993-1996 Darren Reed";
+static const char rcsid[] = "@(#)$Id: parse.c,v 1.27 1999/12/15 05:20:24 kjell Exp $";
#endif
extern struct ipopt_names ionames[], secclass[];
extern int opts;
-int portnum __P((char *, u_short *));
-u_char tcp_flags __P((char *, u_char *));
-int addicmp __P((char ***, struct frentry *));
-int extras __P((char ***, struct frentry *));
+int portnum __P((char *, u_short *, int));
+u_char tcp_flags __P((char *, u_char *, int));
+int addicmp __P((char ***, struct frentry *, int));
+int extras __P((char ***, struct frentry *, int));
char ***seg;
u_long *sa, *msk;
u_short *pp, *tp;
u_char *cp;
int hostmask __P((char ***, u_32_t *, u_32_t *, u_short *, u_char *,
- u_short *));
-int ports __P((char ***, u_short *, u_char *, u_short *));
-int icmpcode __P((char *)), addkeep __P((char ***, struct frentry *));
-int to_interface __P((frdest_t *, char *));
+ u_short *, int));
+int ports __P((char ***, u_short *, u_char *, u_short *, int));
+int icmpcode __P((char *)), addkeep __P((char ***, struct frentry *, int));
+int to_interface __P((frdest_t *, char *, int));
void print_toif __P((char *, frdest_t *));
-void optprint __P((u_short, u_short, u_long, u_long));
+void optprint __P((u_short *, u_long, u_long));
int countbits __P((u_32_t));
char *portname __P((int, int));
int ratoi __P((char *, int *, int, int));
@@ -69,6 +75,7 @@ u_char flags[] = { TH_FIN, TH_SYN, TH_RST, TH_PUSH, TH_ACK, TH_URG };
static char thishost[MAXHOSTNAMELEN];
+
void initparse()
{
gethostname(thishost, sizeof(thishost));
@@ -79,14 +86,15 @@ void initparse()
*
* parse a line read from the input filter rule file
*/
-struct frentry *parse(line)
+struct frentry *parse(line, linenum)
char *line;
+int linenum;
{
static struct frentry fil;
struct protoent *p = NULL;
char *cps[31], **cpp, *endptr;
u_char ch;
- int i, cnt = 1;
+ int i, cnt = 1, j;
while (*line && isspace(*line))
line++;
@@ -96,6 +104,8 @@ char *line;
bzero((char *)&fil, sizeof(fil));
fil.fr_mip.fi_v = 0xf;
fil.fr_ip.fi_v = 4;
+ fil.fr_loglevel = 0xffff;
+
/*
* break line up into max of 20 segments
*/
@@ -106,7 +116,7 @@ char *line;
cps[i] = NULL;
if (cnt < 3) {
- (void)fprintf(stderr, "not enough segments in line\n");
+ fprintf(stderr, "%d: not enough segments in line\n", linenum);
return NULL;
}
@@ -117,18 +127,25 @@ char *line;
if (!strcasecmp("block", *cpp)) {
fil.fr_flags |= FR_BLOCK;
- if (!strncasecmp(*(cpp+1), "return-icmp", 11)) {
+ if (!strncasecmp(*(cpp+1), "return-icmp-as-dest", 19))
+ fil.fr_flags |= FR_FAKEICMP;
+ else if (!strncasecmp(*(cpp+1), "return-icmp", 11))
fil.fr_flags |= FR_RETICMP;
+ if (fil.fr_flags & FR_RETICMP) {
cpp++;
- if (*(*cpp + 11) == '(') {
- i = icmpcode(*cpp + 12);
- if (i == -1) {
+ i = 11;
+ if ((strlen(*cpp) > i) && (*(*cpp + i) != '('))
+ i = 19;
+ if (*(*cpp + i) == '(') {
+ i++;
+ j = icmpcode(*cpp + i);
+ if (j == -1) {
fprintf(stderr,
- "unrecognised icmp code %s\n",
- *cpp + 12);
+ "%d: unrecognised icmp code %s\n",
+ linenum, *cpp + 20);
return NULL;
}
- fil.fr_icode = i;
+ fil.fr_icode = j;
}
} else if (!strncasecmp(*(cpp+1), "return-rst", 10)) {
fil.fr_flags |= FR_RETRST;
@@ -144,10 +161,11 @@ char *line;
fil.fr_flags |= FR_PREAUTH;
} else if (!strcasecmp("skip", *cpp)) {
cpp++;
- if (ratoi(*cpp, &i, 0, INT_MAX))
+ if (ratoi(*cpp, &i, 0, USHRT_MAX))
fil.fr_skip = i;
else {
- (void)fprintf(stderr, "integer must follow skip\n");
+ fprintf(stderr, "%d: integer must follow skip\n",
+ linenum);
return NULL;
}
} else if (!strcasecmp("log", *cpp)) {
@@ -158,13 +176,45 @@ char *line;
}
if (!strcasecmp(*(cpp+1), "first")) {
fil.fr_flags |= FR_LOGFIRST;
+ }
+ if (!strcasecmp(*(cpp+1), "level")) {
+ int fac, pri;
+ char *s;
+
+ fac = 0;
+ pri = 0;
+ cpp++;
+ s = index(*cpp, '.');
+ if (s) {
+ *s++ = '\0';
+ fac = fac_findname(*cpp);
+ if (fac == -1) {
+ fprintf(stderr, "%d: %s %s\n", linenum,
+ "Unknown facility", *cpp);
+ return NULL;
+ }
+ pri = pri_findname(s);
+ if (pri == -1) {
+ fprintf(stderr, "%d: %s %s\n", linenum,
+ "Unknown priority", s);
+ return NULL;
+ }
+ } else {
+ pri = pri_findname(*cpp);
+ if (pri == -1) {
+ fprintf(stderr, "%d: %s %s\n", linenum,
+ "Unknown priority", *cpp);
+ return NULL;
+ }
+ }
+ fil.fr_loglevel = fac|pri;
cpp++;
}
} else {
/*
* Doesn't start with one of the action words
*/
- (void)fprintf(stderr, "unknown keyword (%s)\n", *cpp);
+ fprintf(stderr, "%d: unknown keyword (%s)\n", linenum, *cpp);
return NULL;
}
cpp++;
@@ -174,17 +224,19 @@ char *line;
else if (!strcasecmp("out", *cpp)) {
fil.fr_flags |= FR_OUTQUE;
if (fil.fr_flags & FR_RETICMP) {
- (void)fprintf(stderr,
- "Can only use return-icmp with 'in'\n");
+ fprintf(stderr,
+ "%d: Can only use return-icmp with 'in'\n",
+ linenum);
return NULL;
} else if (fil.fr_flags & FR_RETRST) {
- (void)fprintf(stderr,
- "Can only use return-rst with 'in'\n");
+ fprintf(stderr,
+ "%d: Can only use return-rst with 'in'\n",
+ linenum);
return NULL;
}
} else {
- (void)fprintf(stderr,
- "missing 'in'/'out' keyword (%s)\n", *cpp);
+ fprintf(stderr, "%d: missing 'in'/'out' keyword (%s)\n",
+ linenum, *cpp);
return NULL;
}
if (!*++cpp)
@@ -206,8 +258,9 @@ char *line;
}
if (!strcasecmp(*cpp, "or-block")) {
if (!(fil.fr_flags & FR_PASS)) {
- (void)fprintf(stderr,
- "or-block must be used with pass\n");
+ fprintf(stderr,
+ "%d: or-block must be used with pass\n",
+ linenum);
return NULL;
}
fil.fr_flags |= FR_LOGORBLOCK;
@@ -223,17 +276,18 @@ char *line;
*fil.fr_ifname = '\0';
if (*cpp && !strcasecmp(*cpp, "on")) {
if (!*++cpp) {
- (void)fprintf(stderr, "interface name missing\n");
+ fprintf(stderr, "%d: interface name missing\n",
+ linenum);
return NULL;
}
(void)strncpy(fil.fr_ifname, *cpp, IFNAMSIZ-1);
fil.fr_ifname[IFNAMSIZ-1] = '\0';
cpp++;
if (!*cpp) {
- if (fil.fr_flags & FR_RETRST) {
- (void)fprintf(stderr,
- "%s can only be used with TCP\n",
- "return-rst");
+ if ((fil.fr_flags & FR_RETMASK) == FR_RETRST) {
+ fprintf(stderr,
+ "%d: %s can only be used with TCP\n",
+ linenum, "return-rst");
return NULL;
}
return &fil;
@@ -242,16 +296,22 @@ char *line;
if (*cpp) {
if (!strcasecmp(*cpp, "dup-to") && *(cpp + 1)) {
cpp++;
- if (to_interface(&fil.fr_dif, *cpp))
+ if (to_interface(&fil.fr_dif, *cpp, linenum))
return NULL;
cpp++;
}
if (!strcasecmp(*cpp, "to") && *(cpp + 1)) {
cpp++;
- if (to_interface(&fil.fr_tif, *cpp))
+ if (to_interface(&fil.fr_tif, *cpp, linenum))
return NULL;
cpp++;
} else if (!strcasecmp(*cpp, "fastroute")) {
+ if (!(fil.fr_flags & FR_INQUE)) {
+ fprintf(stderr,
+ "can only use %s with 'in'\n",
+ "fastroute");
+ return NULL;
+ }
fil.fr_flags |= FR_FASTROUTE;
cpp++;
}
@@ -259,7 +319,7 @@ char *line;
}
if (*cpp && !strcasecmp(*cpp, "tos")) {
if (!*++cpp) {
- (void)fprintf(stderr, "tos missing value\n");
+ fprintf(stderr, "%d: tos missing value\n", linenum);
return NULL;
}
fil.fr_tos = strtol(*cpp, NULL, 0);
@@ -269,13 +329,15 @@ char *line;
if (*cpp && !strcasecmp(*cpp, "ttl")) {
if (!*++cpp) {
- (void)fprintf(stderr, "ttl missing hopcount value\n");
+ fprintf(stderr, "%d: ttl missing hopcount value\n",
+ linenum);
return NULL;
}
if (ratoi(*cpp, &i, 0, 255))
fil.fr_ttl = i;
else {
- (void)fprintf(stderr, "invalid ttl (%s)\n", *cpp);
+ fprintf(stderr, "%d: invalid ttl (%s)\n",
+ linenum, *cpp);
return NULL;
}
fil.fr_mip.fi_ttl = 0xff;
@@ -288,44 +350,39 @@ char *line;
proto = NULL;
if (*cpp && !strcasecmp(*cpp, "proto")) {
if (!*++cpp) {
- (void)fprintf(stderr, "protocol name missing\n");
+ fprintf(stderr, "%d: protocol name missing\n", linenum);
return NULL;
}
- if (!strcasecmp(*cpp, "tcp/udp")) {
+ proto = *cpp++;
+ if (!strcasecmp(proto, "tcp/udp")) {
fil.fr_ip.fi_fl |= FI_TCPUDP;
fil.fr_mip.fi_fl |= FI_TCPUDP;
} else {
- if (!(p = getprotobyname(*cpp)) && !isdigit(**cpp)) {
- (void)fprintf(stderr,
- "unknown protocol (%s)\n", *cpp);
+ if (!(p = getprotobyname(proto)) && !isdigit(*proto)) {
+ fprintf(stderr,
+ "%d: unknown protocol (%s)\n",
+ linenum, proto);
return NULL;
}
if (p)
fil.fr_proto = p->p_proto;
- else if (isdigit(**cpp)) {
- i = (int)strtol(*cpp, &endptr, 0);
+ else if (isdigit(*proto)) {
+ i = (int)strtol(proto, &endptr, 0);
if (*endptr != '\0' || i < 0 || i > 255) {
- (void)fprintf(stderr,
- "unknown protocol (%s)\n", *cpp);
+ fprintf(stderr,
+ "%d: unknown protocol (%s)\n",
+ linenum, proto);
return NULL;
}
fil.fr_proto = i;
}
fil.fr_mip.fi_p = 0xff;
}
- proto = *cpp;
- if (fil.fr_proto != IPPROTO_TCP && fil.fr_flags & FR_RETRST) {
- (void)fprintf(stderr,
- "%s can only be used with TCP\n",
- "return-rst");
- return NULL;
- }
- if (!*++cpp)
- return &fil;
}
- if (fil.fr_proto != IPPROTO_TCP && fil.fr_flags & FR_RETRST) {
- (void)fprintf(stderr, "%s can only be used with TCP\n",
- "return-rst");
+ if ((fil.fr_proto != IPPROTO_TCP) &&
+ ((fil.fr_flags & FR_RETMASK) == FR_RETRST)) {
+ fprintf(stderr, "%d: %s can only be used with TCP\n",
+ linenum, "return-rst");
return NULL;
}
@@ -334,7 +391,7 @@ char *line;
*/
if (!*cpp) {
- fprintf(stderr, "missing source specification\n");
+ fprintf(stderr, "%d: missing source specification\n", linenum);
return NULL;
}
if (!strcasecmp(*cpp, "all")) {
@@ -343,12 +400,13 @@ char *line;
return &fil;
} else {
if (strcasecmp(*cpp, "from")) {
- (void)fprintf(stderr,
- "unexpected keyword (%s) - from\n", *cpp);
+ fprintf(stderr, "%d: unexpected keyword (%s) - from\n",
+ linenum, *cpp);
return NULL;
}
if (!*++cpp) {
- (void)fprintf(stderr, "missing host after from\n");
+ fprintf(stderr, "%d: missing host after from\n",
+ linenum);
return NULL;
}
ch = 0;
@@ -358,12 +416,12 @@ char *line;
}
if (hostmask(&cpp, (u_32_t *)&fil.fr_src,
(u_32_t *)&fil.fr_smsk, &fil.fr_sport, &ch,
- &fil.fr_stop)) {
+ &fil.fr_stop, linenum)) {
return NULL;
}
fil.fr_scmp = ch;
if (!*cpp) {
- (void)fprintf(stderr, "missing to fields\n");
+ fprintf(stderr, "%d: missing to fields\n", linenum);
return NULL;
}
@@ -371,12 +429,12 @@ char *line;
* do the same for the to field (destination host)
*/
if (strcasecmp(*cpp, "to")) {
- (void)fprintf(stderr,
- "unexpected keyword (%s) - to\n", *cpp);
+ fprintf(stderr, "%d: unexpected keyword (%s) - to\n",
+ linenum, *cpp);
return NULL;
}
if (!*++cpp) {
- (void)fprintf(stderr, "missing host after to\n");
+ fprintf(stderr, "%d: missing host after to\n", linenum);
return NULL;
}
ch = 0;
@@ -386,7 +444,7 @@ char *line;
}
if (hostmask(&cpp, (u_32_t *)&fil.fr_dst,
(u_32_t *)&fil.fr_dmsk, &fil.fr_dport, &ch,
- &fil.fr_dtop)) {
+ &fil.fr_dtop, linenum)) {
return NULL;
}
fil.fr_dcmp = ch;
@@ -398,11 +456,12 @@ char *line;
*/
if (fil.fr_proto && (fil.fr_dcmp || fil.fr_scmp) &&
fil.fr_proto != IPPROTO_TCP && fil.fr_proto != IPPROTO_UDP) {
- (void)fprintf(stderr, "port operation on non tcp/udp\n");
+ fprintf(stderr, "%d: port operation on non tcp/udp\n", linenum);
return NULL;
}
if (fil.fr_icmp && fil.fr_proto != IPPROTO_ICMP) {
- (void)fprintf(stderr, "icmp comparisons on wrong protocol\n");
+ fprintf(stderr, "%d: icmp comparisons on wrong protocol\n",
+ linenum);
return NULL;
}
@@ -411,10 +470,10 @@ char *line;
if (*cpp && !strcasecmp(*cpp, "flags")) {
if (!*++cpp) {
- (void)fprintf(stderr, "no flags present\n");
+ fprintf(stderr, "%d: no flags present\n", linenum);
return NULL;
}
- fil.fr_tcpf = tcp_flags(*cpp, &fil.fr_tcpfm);
+ fil.fr_tcpf = tcp_flags(*cpp, &fil.fr_tcpfm, linenum);
cpp++;
}
@@ -422,7 +481,7 @@ char *line;
* extras...
*/
if (*cpp && (!strcasecmp(*cpp, "with") || !strcasecmp(*cpp, "and")))
- if (extras(&cpp, &fil))
+ if (extras(&cpp, &fil, linenum))
return NULL;
/*
@@ -430,12 +489,12 @@ char *line;
*/
if (*cpp && !strcasecmp(*cpp, "icmp-type")) {
if (fil.fr_proto != IPPROTO_ICMP) {
- (void)fprintf(stderr,
- "icmp with wrong protocol (%d)\n",
- fil.fr_proto);
+ fprintf(stderr,
+ "%d: icmp with wrong protocol (%d)\n",
+ linenum, fil.fr_proto);
return NULL;
}
- if (addicmp(&cpp, &fil))
+ if (addicmp(&cpp, &fil, linenum))
return NULL;
fil.fr_icmp = htons(fil.fr_icmp);
fil.fr_icmpm = htons(fil.fr_icmpm);
@@ -445,7 +504,7 @@ char *line;
* Keep something...
*/
while (*cpp && !strcasecmp(*cpp, "keep"))
- if (addkeep(&cpp, &fil))
+ if (addkeep(&cpp, &fil, linenum))
return NULL;
/*
@@ -453,13 +512,14 @@ char *line;
*/
if (*cpp && !strcasecmp(*cpp, "head")) {
if (!*++cpp) {
- (void)fprintf(stderr, "head without group #\n");
+ fprintf(stderr, "%d: head without group #\n", linenum);
return NULL;
}
if (ratoi(*cpp, &i, 0, USHRT_MAX))
fil.fr_grhead = i;
else {
- (void)fprintf(stderr, "invalid group (%s)\n", *cpp);
+ fprintf(stderr, "%d: invalid group (%s)\n",
+ linenum, *cpp);
return NULL;
}
cpp++;
@@ -470,15 +530,17 @@ char *line;
*/
if (*cpp && !strcasecmp(*cpp, "group")) {
if (!*++cpp) {
- (void)fprintf(stderr, "group without group #\n");
+ fprintf(stderr, "%d: group without group #\n",
+ linenum);
return NULL;
}
if (ratoi(*cpp, &i, 0, USHRT_MAX))
fil.fr_group = i;
else {
- (void)fprintf(stderr, "invalid group (%s)\n", *cpp);
- return NULL;
- }
+ fprintf(stderr, "%d: invalid group (%s)\n",
+ linenum, *cpp);
+ return NULL;
+ }
cpp++;
}
@@ -486,10 +548,10 @@ char *line;
* leftovers...yuck
*/
if (*cpp && **cpp) {
- fprintf(stderr, "unknown words at end: [");
+ fprintf(stderr, "%d: unknown words at end: [", linenum);
for (; *cpp; cpp++)
- (void)fprintf(stderr, "%s ", *cpp);
- (void)fprintf(stderr, "]\n");
+ fprintf(stderr, "%s ", *cpp);
+ fprintf(stderr, "]\n");
return NULL;
}
@@ -497,7 +559,7 @@ char *line;
* lazy users...
*/
if ((fil.fr_tcpf || fil.fr_tcpfm) && fil.fr_proto != IPPROTO_TCP) {
- (void)fprintf(stderr, "TCP protocol not specified\n");
+ fprintf(stderr, "%d: TCP protocol not specified\n", linenum);
return NULL;
}
if (!(fil.fr_ip.fi_fl & FI_TCPUDP) && (fil.fr_proto != IPPROTO_TCP) &&
@@ -506,16 +568,18 @@ char *line;
fil.fr_ip.fi_fl |= FI_TCPUDP;
fil.fr_mip.fi_fl |= FI_TCPUDP;
} else {
- (void)fprintf(stderr,
- "port comparisons for non-TCP/UDP\n");
+ fprintf(stderr,
+ "%d: port comparisons for non-TCP/UDP\n",
+ linenum);
return NULL;
}
}
/*
if ((fil.fr_flags & FR_KEEPFRAG) &&
(!(fil.fr_ip.fi_fl & FI_FRAG) || !(fil.fr_ip.fi_fl & FI_FRAG))) {
- (void)fprintf(stderr,
- "must use 'with frags' with 'keep frags'\n");
+ fprintf(stderr,
+ "%d: must use 'with frags' with 'keep frags'\n",
+ linenum);
return NULL;
}
*/
@@ -523,9 +587,10 @@ char *line;
}
-int to_interface(fdp, to)
+int to_interface(fdp, to, linenum)
frdest_t *fdp;
char *to;
+int linenum;
{
int r = 0;
char *s;
@@ -534,7 +599,7 @@ char *to;
fdp->fd_ifp = NULL;
if (s) {
*s++ = '\0';
- fdp->fd_ip.s_addr = hostnum(s, &r);
+ fdp->fd_ip.s_addr = hostnum(s, &r, linenum);
if (r == -1)
return -1;
}
@@ -548,10 +613,10 @@ void print_toif(tag, fdp)
char *tag;
frdest_t *fdp;
{
- (void)printf("%s %s%s", tag, fdp->fd_ifname,
+ printf("%s %s%s", tag, fdp->fd_ifname,
(fdp->fd_ifp || (long)fdp->fd_ifp == -1) ? "" : "(!)");
if (fdp->fd_ip.s_addr)
- (void)printf(":%s", inet_ntoa(fdp->fd_ip));
+ printf(":%s", inet_ntoa(fdp->fd_ip));
putchar(' ');
}
@@ -561,11 +626,12 @@ frdest_t *fdp;
* found in the line segments, there is an error processing this information,
* or there is an error processing ports information.
*/
-int hostmask(seg, sa, msk, pp, cp, tp)
+int hostmask(seg, sa, msk, pp, cp, tp, linenum)
char ***seg;
u_32_t *sa, *msk;
u_short *pp, *tp;
u_char *cp;
+int linenum;
{
char *s, *endptr;
int bits = -1, resolved;
@@ -577,12 +643,11 @@ u_char *cp;
if ((s = index(**seg, '/')) || (s = index(**seg, ':'))) {
*s++ = '\0';
if (index(s, '.') || index(s, 'x')) {
- /*
- * Netmask possibly of the form xxx.xxx.xxx.xxx
- * or 0xYYYYYYYY
- */
+ /* possibly of the form xxx.xxx.xxx.xxx
+ * or 0xYYYYYYYY */
if (inet_aton(s, &maskaddr) == 0) {
- (void)fprintf(stderr, "bad mask (%s)\n", s);
+ fprintf(stderr, "%d: bad mask (%s)\n",
+ linenum, s);
return -1;
}
*msk = maskaddr.s_addr;
@@ -592,7 +657,8 @@ u_char *cp;
*/
bits = (int)strtol(s, &endptr, 0);
if (*endptr != '\0' || bits > 32 || bits < 0) {
- (void)fprintf(stderr, "bad mask (/%s)\n", s);
+ fprintf(stderr, "%d: bad mask (/%s)\n",
+ linenum, s);
return -1;
}
if (bits == 0)
@@ -600,75 +666,78 @@ u_char *cp;
else
*msk = htonl(0xffffffff << (32 - bits));
}
- *sa = hostnum(**seg, &resolved) & *msk;
+ *sa = hostnum(**seg, &resolved, linenum) & *msk;
if (resolved == -1) {
- (void)fprintf(stderr, "bad host (%s)\n", **seg);
+ fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
return -1;
}
(*seg)++;
- return ports(seg, pp, cp, tp);
+ return ports(seg, pp, cp, tp, linenum);
}
/*
* look for extra segments if "mask" found in right spot
*/
if (*(*seg+1) && *(*seg+2) && !strcasecmp(*(*seg+1), "mask")) {
- *sa = hostnum(**seg, &resolved);
+ *sa = hostnum(**seg, &resolved, linenum);
if (resolved == -1) {
- (void)fprintf(stderr, "bad host (%s)\n", **seg);
+ fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
return -1;
}
(*seg)++;
(*seg)++;
if (inet_aton(**seg, &maskaddr) == 0) {
- (void)fprintf(stderr, "bad mask (%s)\n", **seg);
+ fprintf(stderr, "%d: bad mask (%s)\n", linenum, **seg);
return -1;
}
*msk = maskaddr.s_addr;
(*seg)++;
*sa &= *msk;
- return ports(seg, pp, cp, tp);
+ return ports(seg, pp, cp, tp, linenum);
}
if (**seg) {
- *sa = hostnum(**seg, &resolved);
+ *sa = hostnum(**seg, &resolved, linenum);
if (resolved == -1) {
- (void)fprintf(stderr, "bad host (%s)\n", **seg);
+ fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
return -1;
}
(*seg)++;
*msk = (*sa ? inet_addr("255.255.255.255") : 0L);
*sa &= *msk;
- return ports(seg, pp, cp, tp);
+ return ports(seg, pp, cp, tp, linenum);
}
- (void)fprintf(stderr, "bad host (%s)\n", **seg);
+ fprintf(stderr, "%d: bad host (%s)\n", linenum, **seg);
return -1;
}
/*
* returns an ip address as a long var as a result of either a DNS lookup or
- * straight inet_addr() call
+ * straight inet_aton() call
*/
-u_32_t hostnum(host, resolved)
+u_32_t hostnum(host, resolved, linenum)
char *host;
int *resolved;
+int linenum;
{
struct hostent *hp;
struct netent *np;
- struct in_addr addr;
+ struct in_addr ip;
*resolved = 0;
if (!strcasecmp("any", host))
- return 0L;
- if (inet_aton(host, &addr))
- return addr.s_addr;
+ return 0;
+ if (isdigit(*host) && inet_aton(host, &ip))
+ return ip.s_addr;
+
if (!strcasecmp("<thishost>", host))
host = thishost;
if (!(hp = gethostbyname(host))) {
if (!(np = getnetbyname(host))) {
*resolved = -1;
- fprintf(stderr, "can't resolve hostname: %s\n", host);
+ fprintf(stderr, "%d: can't resolve hostname: %s\n",
+ linenum, host);
return 0;
}
return htonl(np->n_net);
@@ -679,10 +748,11 @@ int *resolved;
/*
* check for possible presence of the port fields in the line
*/
-int ports(seg, pp, cp, tp)
+int ports(seg, pp, cp, tp, linenum)
char ***seg;
u_short *pp, *tp;
u_char *cp;
+int linenum;
{
int comp = -1;
@@ -691,7 +761,7 @@ u_char *cp;
if (!strcasecmp(**seg, "port") && *(*seg + 1) && *(*seg + 2)) {
(*seg)++;
if (isdigit(***seg) && *(*seg + 2)) {
- if (portnum(**seg, pp) == 0)
+ if (portnum(**seg, pp, linenum) == 0)
return -1;
(*seg)++;
if (!strcmp(**seg, "<>"))
@@ -699,16 +769,18 @@ u_char *cp;
else if (!strcmp(**seg, "><"))
comp = FR_INRANGE;
else {
- fprintf(stderr, "unknown range operator (%s)\n",
- **seg);
+ fprintf(stderr,
+ "%d: unknown range operator (%s)\n",
+ linenum, **seg);
return -1;
}
(*seg)++;
if (**seg == NULL) {
- fprintf(stderr, "missing 2nd port value\n");
+ fprintf(stderr, "%d: missing 2nd port value\n",
+ linenum);
return -1;
}
- if (portnum(**seg, tp) == 0)
+ if (portnum(**seg, tp, linenum) == 0)
return -1;
} else if (!strcmp(**seg, "=") || !strcasecmp(**seg, "eq"))
comp = FR_EQUAL;
@@ -723,13 +795,13 @@ u_char *cp;
else if (!strcmp(**seg, ">=") || !strcasecmp(**seg, "ge"))
comp = FR_GREATERTE;
else {
- (void)fprintf(stderr, "unknown comparator (%s)\n",
- **seg);
+ fprintf(stderr, "%d: unknown comparator (%s)\n",
+ linenum, **seg);
return -1;
}
if (comp != FR_OUTRANGE && comp != FR_INRANGE) {
(*seg)++;
- if (portnum(**seg, pp) == 0)
+ if (portnum(**seg, pp, linenum) == 0)
return -1;
}
*cp = comp;
@@ -742,9 +814,10 @@ u_char *cp;
* find the port number given by the name, either from getservbyname() or
* straight atoi(). Return 1 on success, 0 on failure
*/
-int portnum(name, port)
+int portnum(name, port, linenum)
char *name;
u_short *port;
+int linenum;
{
struct servent *sp, *sp2;
u_short p1 = 0;
@@ -754,7 +827,7 @@ u_short *port;
*port = (u_short)i;
return 1;
}
- (void)fprintf(stderr, "unknown port \"%s\"\n", name);
+ fprintf(stderr, "%d: unknown port \"%s\"\n", linenum, name);
return 0;
}
if (proto != NULL && strcasecmp(proto, "tcp/udp") != 0) {
@@ -763,7 +836,7 @@ u_short *port;
*port = ntohs(sp->s_port);
return 1;
}
- (void) fprintf(stderr, "unknown service \"%s\".\n", name);
+ fprintf(stderr, "%d: unknown service \"%s\".\n", linenum, name);
return 0;
}
sp = getservbyname(name, "tcp");
@@ -771,14 +844,14 @@ u_short *port;
p1 = sp->s_port;
sp2 = getservbyname(name, "udp");
if (!sp || !sp2) {
- (void) fprintf(stderr, "unknown tcp/udp service \"%s\".\n",
- name);
+ fprintf(stderr, "%d: unknown tcp/udp service \"%s\".\n",
+ linenum, name);
return 0;
}
if (p1 != sp2->s_port) {
- (void) fprintf(stderr, "%s %d/tcp is a different port to ",
- name, p1);
- (void) fprintf(stderr, "%s %d/udp\n", name, sp->s_port);
+ fprintf(stderr, "%d: %s %d/tcp is a different port to ",
+ linenum, name, p1);
+ fprintf(stderr, "%d: %s %d/udp\n", linenum, name, sp->s_port);
return 0;
}
*port = ntohs(p1);
@@ -786,9 +859,10 @@ u_short *port;
}
-u_char tcp_flags(flgs, mask)
+u_char tcp_flags(flgs, mask, linenum)
char *flgs;
u_char *mask;
+int linenum;
{
u_char tcpf = 0, tcpfm = 0, *fp = &tcpf;
char *s, *t;
@@ -799,7 +873,7 @@ u_char *mask;
continue;
}
if (!(t = index(flagset, *s))) {
- (void)fprintf(stderr, "unknown flag (%c)\n", *s);
+ fprintf(stderr, "%d: unknown flag (%c)\n", linenum, *s);
return 0;
}
*fp |= flags[t - flagset];
@@ -814,9 +888,10 @@ u_char *mask;
/*
* deal with extra bits on end of the line
*/
-int extras(cp, fr)
+int extras(cp, fr, linenum)
char ***cp;
struct frentry *fr;
+int linenum;
{
u_short secmsk;
u_long opts;
@@ -850,18 +925,20 @@ struct frentry *fr;
goto nextopt;
} else if (***cp == 'o' || ***cp == 'O') {
if (!*(*cp + 1)) {
- (void)fprintf(stderr,
- "opt missing arguements\n");
+ fprintf(stderr,
+ "%d: opt missing arguements\n",
+ linenum);
return -1;
}
(*cp)++;
- if (!(opts = optname(cp, &secmsk)))
+ if (!(opts = optname(cp, &secmsk, linenum)))
return -1;
oflags = FI_OPTIONS;
} else if (***cp == 's' || ***cp == 'S') {
if (fr->fr_tcpf) {
- (void) fprintf(stderr,
- "short cannot be used with TCP flags\n");
+ fprintf(stderr,
+ "%d: short cannot be used with TCP flags\n",
+ linenum);
return -1;
}
@@ -874,13 +951,15 @@ struct frentry *fr;
if (!notopt || !opts)
fr->fr_mip.fi_fl |= oflags;
- if (notopt)
- if (!secmsk)
+ if (notopt) {
+ if (!secmsk) {
fr->fr_mip.fi_optmsk |= opts;
- else
+ } else {
fr->fr_mip.fi_optmsk |= (opts & ~0x0100);
- else
+ }
+ } else {
fr->fr_mip.fi_optmsk |= opts;
+ }
fr->fr_mip.fi_secmsk |= secmsk;
if (notopt) {
@@ -903,9 +982,10 @@ nextopt:
}
-u_32_t optname(cp, sp)
+u_32_t optname(cp, sp, linenum)
char ***cp;
u_short *sp;
+int linenum;
{
struct ipopt_names *io, *so;
u_long msk = 0;
@@ -920,7 +1000,8 @@ u_short *sp;
break;
}
if (!io->on_name) {
- fprintf(stderr, "unknown IP option name %s\n", s);
+ fprintf(stderr, "%d: unknown IP option name %s\n",
+ linenum, s);
return 0;
}
if (!strcasecmp(s, "sec-class"))
@@ -928,7 +1009,8 @@ u_short *sp;
}
if (sec && !*(*cp + 1)) {
- fprintf(stderr, "missing security level after sec-class\n");
+ fprintf(stderr, "%d: missing security level after sec-class\n",
+ linenum);
return 0;
}
@@ -941,8 +1023,9 @@ u_short *sp;
break;
}
if (!so->on_name) {
- fprintf(stderr, "no such security level: %s\n",
- s);
+ fprintf(stderr,
+ "%d: no such security level: %s\n",
+ linenum, s);
return 0;
}
}
@@ -954,13 +1037,14 @@ u_short *sp;
#ifdef __STDC__
-void optprint(u_short secmsk, u_short secbits, u_long optmsk, u_long optbits)
+void optprint(u_short *sec, u_long optmsk, u_long optbits)
#else
-void optprint(secmsk, secbits, optmsk, optbits)
-u_short secmsk, secbits;
+void optprint(sec, optmsk, optbits)
+u_short *sec;
u_long optmsk, optbits;
#endif
{
+ u_short secmsk = sec[0], secbits = sec[1];
struct ipopt_names *io, *so;
char *s;
int secflag = 0;
@@ -1036,9 +1120,10 @@ char *icmptypes[] = {
/*
* set the icmp field to the correct type if "icmp" word is found
*/
-int addicmp(cp, fp)
+int addicmp(cp, fp, linenum)
char ***cp;
struct frentry *fp;
+int linenum;
{
char **t;
int i;
@@ -1050,8 +1135,9 @@ struct frentry *fp;
fp->fr_proto = IPPROTO_ICMP;
if (isdigit(***cp)) {
if (!ratoi(**cp, &i, 0, 255)) {
- (void)fprintf(stderr,
- "Invalid icmp-type (%s) specified\n", **cp);
+ fprintf(stderr,
+ "%d: Invalid icmp-type (%s) specified\n",
+ linenum, **cp);
return -1;
}
} else {
@@ -1066,8 +1152,9 @@ struct frentry *fp;
break;
}
if (i == -1) {
- (void)fprintf(stderr,
- "Invalid icmp-type (%s) specified\n", **cp);
+ fprintf(stderr,
+ "%d: Invalid icmp-type (%s) specified\n",
+ linenum, **cp);
return -1;
}
}
@@ -1082,8 +1169,9 @@ struct frentry *fp;
(*cp)++;
if (isdigit(***cp)) {
if (!ratoi(**cp, &i, 0, 255)) {
- (void)fprintf(stderr,
- "Invalid icmp code (%s) specified\n", **cp);
+ fprintf(stderr,
+ "%d: Invalid icmp code (%s) specified\n",
+ linenum, **cp);
return -1;
}
fp->fr_icmp |= (u_short)i;
@@ -1091,7 +1179,8 @@ struct frentry *fp;
(*cp)++;
return 0;
}
- (void)fprintf(stderr, "Invalid icmp code (%s) specified\n", **cp);
+ fprintf(stderr, "%d: Invalid icmp code (%s) specified\n",
+ linenum, **cp);
return -1;
}
@@ -1132,20 +1221,22 @@ char *str;
/*
* set the icmp field to the correct type if "icmp" word is found
*/
-int addkeep(cp, fp)
+int addkeep(cp, fp, linenum)
char ***cp;
struct frentry *fp;
+int linenum;
{
if (fp->fr_proto != IPPROTO_TCP && fp->fr_proto != IPPROTO_UDP &&
fp->fr_proto != IPPROTO_ICMP && !(fp->fr_ip.fi_fl & FI_TCPUDP)) {
- (void)fprintf(stderr, "Can only use keep with UDP/ICMP/TCP\n");
+ fprintf(stderr, "%d: Can only use keep with UDP/ICMP/TCP\n",
+ linenum);
return -1;
}
(*cp)++;
if (**cp && strcasecmp(**cp, "state") && strcasecmp(**cp, "frags")) {
- (void)fprintf(stderr, "Unrecognised state keyword \"%s\"\n",
- **cp);
+ fprintf(stderr, "%d: Unrecognised state keyword \"%s\"\n",
+ linenum, **cp);
return -1;
}
@@ -1195,17 +1286,17 @@ int pr, port;
struct servent *sv = NULL, *sv1 = NULL;
if (pr == -1) {
- if ((sv = getservbyport(port, "tcp"))) {
+ if ((sv = getservbyport(htons(port), "tcp"))) {
strncpy(buf, sv->s_name, sizeof(buf)-1);
buf[sizeof(buf)-1] = '\0';
- sv1 = getservbyport(port, "udp");
+ sv1 = getservbyport(htons(port), "udp");
sv = strncasecmp(buf, sv->s_name, strlen(buf)) ?
NULL : sv1;
}
if (sv)
return buf;
} else if (pr && (p = getprotobynumber(pr))) {
- if ((sv = getservbyport(port, p->p_name))) {
+ if ((sv = getservbyport(htons(port), p->p_name))) {
strncpy(buf, sv->s_name, sizeof(buf)-1);
buf[sizeof(buf)-1] = '\0';
return buf;
@@ -1227,143 +1318,164 @@ struct frentry *fp;
"<>", "><"};
struct protoent *p;
int ones = 0, pr;
- char *s;
+ char *s, *u;
u_char *t;
+ u_short sec[2];
if (fp->fr_flags & FR_PASS)
- (void)printf("pass");
+ printf("pass");
else if (fp->fr_flags & FR_BLOCK) {
- (void)printf("block");
+ printf("block");
if (fp->fr_flags & FR_RETICMP) {
- (void)printf(" return-icmp");
- if (fp->fr_icode)
+ if ((fp->fr_flags & FR_RETMASK) == FR_FAKEICMP)
+ printf(" return-icmp-as-dest");
+ else if ((fp->fr_flags & FR_RETMASK) == FR_RETICMP)
+ printf(" return-icmp");
+ if (fp->fr_icode) {
if (fp->fr_icode <= MAX_ICMPCODE)
printf("(%s)",
icmpcodes[(int)fp->fr_icode]);
else
printf("(%d)", fp->fr_icode);
- }
- if (fp->fr_flags & FR_RETRST)
- (void)printf(" return-rst");
+ }
+ } else if ((fp->fr_flags & FR_RETMASK) == FR_RETRST)
+ printf(" return-rst");
} else if ((fp->fr_flags & FR_LOGMASK) == FR_LOG) {
- (void)printf("log");
+ printf("log");
if (fp->fr_flags & FR_LOGBODY)
- (void)printf(" body");
+ printf(" body");
if (fp->fr_flags & FR_LOGFIRST)
- (void)printf(" first");
+ printf(" first");
} else if (fp->fr_flags & FR_ACCOUNT)
- (void)printf("count");
+ printf("count");
else if (fp->fr_flags & FR_AUTH)
- (void)printf("auth");
+ printf("auth");
else if (fp->fr_flags & FR_PREAUTH)
- (void)printf("preauth");
+ printf("preauth");
else if (fp->fr_skip)
- (void)printf("skip %d", fp->fr_skip);
+ printf("skip %hu", fp->fr_skip);
if (fp->fr_flags & FR_OUTQUE)
- (void)printf(" out ");
+ printf(" out ");
else
- (void)printf(" in ");
+ printf(" in ");
if (((fp->fr_flags & FR_LOGB) == FR_LOGB) ||
((fp->fr_flags & FR_LOGP) == FR_LOGP)) {
- (void)printf("log ");
+ printf("log ");
if (fp->fr_flags & FR_LOGBODY)
- (void)printf("body ");
+ printf("body ");
if (fp->fr_flags & FR_LOGFIRST)
- (void)printf("first ");
+ printf("first ");
if (fp->fr_flags & FR_LOGORBLOCK)
- (void)printf("or-block ");
+ printf("or-block ");
+ if (fp->fr_loglevel != 0xffff) {
+ if (fp->fr_loglevel & LOG_FACMASK) {
+ s = fac_toname(fp->fr_loglevel);
+ if (s == NULL)
+ s = "!!!";
+ } else
+ s = "";
+ u = pri_toname(fp->fr_loglevel);
+ if (u == NULL)
+ u = "!!!";
+ if (*s)
+ printf("%s.%s ", s, u);
+ else
+ printf("%s ", u);
+ }
+
}
if (fp->fr_flags & FR_QUICK)
- (void)printf("quick ");
+ printf("quick ");
if (*fp->fr_ifname) {
- (void)printf("on %s%s ", fp->fr_ifname,
+ printf("on %s%s ", fp->fr_ifname,
(fp->fr_ifa || (long)fp->fr_ifa == -1) ? "" : "(!)");
if (*fp->fr_dif.fd_ifname)
print_toif("dup-to", &fp->fr_dif);
if (*fp->fr_tif.fd_ifname)
print_toif("to", &fp->fr_tif);
if (fp->fr_flags & FR_FASTROUTE)
- (void)printf("fastroute ");
+ printf("fastroute ");
}
if (fp->fr_mip.fi_tos)
- (void)printf("tos %#x ", fp->fr_tos);
+ printf("tos %#x ", fp->fr_tos);
if (fp->fr_mip.fi_ttl)
- (void)printf("ttl %d ", fp->fr_ttl);
+ printf("ttl %d ", fp->fr_ttl);
if (fp->fr_ip.fi_fl & FI_TCPUDP) {
- (void)printf("proto tcp/udp ");
+ printf("proto tcp/udp ");
pr = -1;
} else if ((pr = fp->fr_mip.fi_p)) {
if ((p = getprotobynumber(fp->fr_proto)))
- (void)printf("proto %s ", p->p_name);
+ printf("proto %s ", p->p_name);
else
- (void)printf("proto %d ", fp->fr_proto);
+ printf("proto %d ", fp->fr_proto);
}
printf("from %s", fp->fr_flags & FR_NOTSRCIP ? "!" : "");
- if (!fp->fr_src.s_addr & !fp->fr_smsk.s_addr)
- (void)printf("any ");
+ if (!fp->fr_src.s_addr && !fp->fr_smsk.s_addr)
+ printf("any ");
else {
- (void)printf("%s", inet_ntoa(fp->fr_src));
+ printf("%s", inet_ntoa(fp->fr_src));
if ((ones = countbits(fp->fr_smsk.s_addr)) == -1)
- (void)printf("/%s ", inet_ntoa(fp->fr_smsk));
+ printf("/%s ", inet_ntoa(fp->fr_smsk));
else
- (void)printf("/%d ", ones);
+ printf("/%d ", ones);
}
- if (fp->fr_scmp)
+ if (fp->fr_scmp) {
if (fp->fr_scmp == FR_INRANGE || fp->fr_scmp == FR_OUTRANGE)
- (void)printf("port %d %s %d ", fp->fr_sport,
+ printf("port %d %s %d ", fp->fr_sport,
pcmp1[fp->fr_scmp], fp->fr_stop);
else
- (void)printf("port %s %s ", pcmp1[fp->fr_scmp],
+ printf("port %s %s ", pcmp1[fp->fr_scmp],
portname(pr, fp->fr_sport));
+ }
printf("to %s", fp->fr_flags & FR_NOTDSTIP ? "!" : "");
- if (!fp->fr_dst.s_addr & !fp->fr_dmsk.s_addr)
- (void)printf("any");
+ if (!fp->fr_dst.s_addr && !fp->fr_dmsk.s_addr)
+ printf("any");
else {
- (void)printf("%s", inet_ntoa(fp->fr_dst));
+ printf("%s", inet_ntoa(fp->fr_dst));
if ((ones = countbits(fp->fr_dmsk.s_addr)) == -1)
- (void)printf("/%s", inet_ntoa(fp->fr_dmsk));
+ printf("/%s", inet_ntoa(fp->fr_dmsk));
else
- (void)printf("/%d", ones);
+ printf("/%d", ones);
}
if (fp->fr_dcmp) {
if (fp->fr_dcmp == FR_INRANGE || fp->fr_dcmp == FR_OUTRANGE)
- (void)printf(" port %d %s %d", fp->fr_dport,
+ printf(" port %d %s %d", fp->fr_dport,
pcmp1[fp->fr_dcmp], fp->fr_dtop);
else
- (void)printf(" port %s %s", pcmp1[fp->fr_dcmp],
+ printf(" port %s %s", pcmp1[fp->fr_dcmp],
portname(pr, fp->fr_dport));
}
if ((fp->fr_ip.fi_fl & ~FI_TCPUDP) ||
(fp->fr_mip.fi_fl & ~FI_TCPUDP) ||
fp->fr_ip.fi_optmsk || fp->fr_mip.fi_optmsk ||
fp->fr_ip.fi_secmsk || fp->fr_mip.fi_secmsk) {
- (void)printf(" with");
+ printf(" with");
if (fp->fr_ip.fi_optmsk || fp->fr_mip.fi_optmsk ||
- fp->fr_ip.fi_secmsk || fp->fr_mip.fi_secmsk)
- optprint(fp->fr_mip.fi_secmsk,
- fp->fr_ip.fi_secmsk,
- fp->fr_mip.fi_optmsk,
- fp->fr_ip.fi_optmsk);
- else if (fp->fr_mip.fi_fl & FI_OPTIONS) {
+ fp->fr_ip.fi_secmsk || fp->fr_mip.fi_secmsk) {
+ sec[0] = fp->fr_mip.fi_secmsk;
+ sec[1] = fp->fr_ip.fi_secmsk;
+ optprint(sec,
+ fp->fr_mip.fi_optmsk, fp->fr_ip.fi_optmsk);
+ } else if (fp->fr_mip.fi_fl & FI_OPTIONS) {
if (!(fp->fr_ip.fi_fl & FI_OPTIONS))
- (void)printf(" not");
- (void)printf(" ipopt");
+ printf(" not");
+ printf(" ipopt");
}
if (fp->fr_mip.fi_fl & FI_SHORT) {
if (!(fp->fr_ip.fi_fl & FI_SHORT))
- (void)printf(" not");
- (void)printf(" short");
+ printf(" not");
+ printf(" short");
}
if (fp->fr_mip.fi_fl & FI_FRAG) {
if (!(fp->fr_ip.fi_fl & FI_FRAG))
- (void)printf(" not");
- (void)printf(" frag");
+ printf(" not");
+ printf(" frag");
}
}
if (fp->fr_proto == IPPROTO_ICMP && fp->fr_icmpm) {
@@ -1374,14 +1486,14 @@ struct frentry *fp;
type /= 256;
if (type < (sizeof(icmptypes) / sizeof(char *)) &&
icmptypes[type])
- (void)printf(" icmp-type %s", icmptypes[type]);
+ printf(" icmp-type %s", icmptypes[type]);
else
- (void)printf(" icmp-type %d", type);
+ printf(" icmp-type %d", type);
if (code)
- (void)printf(" code %d", code);
+ printf(" code %d", code);
}
if (fp->fr_proto == IPPROTO_TCP && (fp->fr_tcpf || fp->fr_tcpfm)) {
- (void)printf(" flags ");
+ printf(" flags ");
for (s = flagset, t = flags; *s; s++, t++)
if (fp->fr_tcpf & *t)
(void)putchar(*s);
@@ -1412,9 +1524,9 @@ struct frentry *fp;
for (s = (u_char *)fp; i; i--, s++) {
j++;
- (void)printf("%02x ", *s);
+ printf("%02x ", *s);
if (j == 16) {
- (void)printf("\n");
+ printf("\n");
j = 0;
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 07:26:48 +0000