summaryrefslogtreecommitdiffstats
path: root/contrib/ipfilter/tools/ipmon_y.y
diff options
context:
space:
mode:
authorcy <cy@FreeBSD.org>2013-07-19 05:41:57 +0000
committercy <cy@FreeBSD.org>2013-07-19 05:41:57 +0000
commit672af8808c0e7c15f330b401482f9271c2eb3fa6 (patch)
tree225b5acf68c01bc6a260b386c2b2dbf4fa2839e3 /contrib/ipfilter/tools/ipmon_y.y
parent71e82d94e82560b20789833f60056506de34de8b (diff)
downloadFreeBSD-src-672af8808c0e7c15f330b401482f9271c2eb3fa6.zip
FreeBSD-src-672af8808c0e7c15f330b401482f9271c2eb3fa6.tar.gz
As per the developers handbook (5.3.1 step 1), prepare the vendor trees for
import of new ipfilter vendor sources by flattening them. To keep the tags consistent with dist, the tags are also flattened. Approved by: glebius (Mentor)
Diffstat (limited to 'contrib/ipfilter/tools/ipmon_y.y')
-rw-r--r--contrib/ipfilter/tools/ipmon_y.y698
1 files changed, 0 insertions, 698 deletions
diff --git a/contrib/ipfilter/tools/ipmon_y.y b/contrib/ipfilter/tools/ipmon_y.y
deleted file mode 100644
index bc3ec6d..0000000
--- a/contrib/ipfilter/tools/ipmon_y.y
+++ /dev/null
@@ -1,698 +0,0 @@
-/*
- * Copyright (C) 2001-2004 by Darren Reed.
- *
- * See the IPFILTER.LICENCE file for details on licencing.
- */
-%{
-#include "ipf.h"
-#include <syslog.h>
-#undef OPT_NAT
-#undef OPT_VERBOSE
-#include "ipmon_l.h"
-#include "ipmon.h"
-
-#define YYDEBUG 1
-
-extern void yyerror __P((char *));
-extern int yyparse __P((void));
-extern int yylex __P((void));
-extern int yydebug;
-extern FILE *yyin;
-extern int yylineNum;
-
-typedef struct opt {
- struct opt *o_next;
- int o_line;
- int o_type;
- int o_num;
- char *o_str;
- struct in_addr o_ip;
-} opt_t;
-
-static void build_action __P((struct opt *));
-static opt_t *new_opt __P((int));
-static void free_action __P((ipmon_action_t *));
-
-static ipmon_action_t *alist = NULL;
-%}
-
-%union {
- char *str;
- u_32_t num;
- struct in_addr addr;
- struct opt *opt;
- union i6addr ip6;
-}
-
-%token <num> YY_NUMBER YY_HEX
-%token <str> YY_STR
-%token <ip6> YY_IPV6
-%token YY_COMMENT
-%token YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT
-%token YY_RANGE_OUT YY_RANGE_IN
-
-%token IPM_MATCH IPM_BODY IPM_COMMENT IPM_DIRECTION IPM_DSTIP IPM_DSTPORT
-%token IPM_EVERY IPM_EXECUTE IPM_GROUP IPM_INTERFACE IPM_IN IPM_NO IPM_OUT
-%token IPM_PACKET IPM_PACKETS IPM_POOL IPM_PROTOCOL IPM_RESULT IPM_RULE
-%token IPM_SECOND IPM_SECONDS IPM_SRCIP IPM_SRCPORT IPM_LOGTAG IPM_WITH
-%token IPM_DO IPM_SAVE IPM_SYSLOG IPM_NOTHING IPM_RAW IPM_TYPE IPM_NAT
-%token IPM_STATE IPM_NATTAG IPM_IPF
-%type <addr> ipv4
-%type <opt> direction dstip dstport every execute group interface
-%type <opt> protocol result rule srcip srcport logtag matching
-%type <opt> matchopt nattag type doopt doing save syslog nothing
-%type <num> saveopts saveopt typeopt
-
-%%
-file: line
- | assign
- | file line
- | file assign
- ;
-
-line: IPM_MATCH '{' matching '}' IPM_DO '{' doing '}' ';'
- { build_action($3); resetlexer(); }
- | IPM_COMMENT
- | YY_COMMENT
- ;
-
-assign: YY_STR assigning YY_STR ';' { set_variable($1, $3);
- resetlexer();
- free($1);
- free($3);
- yyvarnext = 0;
- }
- ;
-
-assigning:
- '=' { yyvarnext = 1; }
- ;
-
-matching:
- matchopt { $$ = $1; }
- | matchopt ',' matching { $1->o_next = $3; $$ = $1; }
- ;
-
-matchopt:
- direction { $$ = $1; }
- | dstip { $$ = $1; }
- | dstport { $$ = $1; }
- | every { $$ = $1; }
- | group { $$ = $1; }
- | interface { $$ = $1; }
- | protocol { $$ = $1; }
- | result { $$ = $1; }
- | rule { $$ = $1; }
- | srcip { $$ = $1; }
- | srcport { $$ = $1; }
- | logtag { $$ = $1; }
- | nattag { $$ = $1; }
- | type { $$ = $1; }
- ;
-
-doing:
- doopt { $$ = $1; }
- | doopt ',' doing { $1->o_next = $3; $$ = $1; }
- ;
-
-doopt:
- execute { $$ = $1; }
- | save { $$ = $1; }
- | syslog { $$ = $1; }
- | nothing { $$ = $1; }
- ;
-
-direction:
- IPM_DIRECTION '=' IPM_IN { $$ = new_opt(IPM_DIRECTION);
- $$->o_num = IPM_IN; }
- | IPM_DIRECTION '=' IPM_OUT { $$ = new_opt(IPM_DIRECTION);
- $$->o_num = IPM_OUT; }
- ;
-
-dstip: IPM_DSTIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_DSTIP);
- $$->o_ip = $3;
- $$->o_num = $5; }
- ;
-
-dstport:
- IPM_DSTPORT '=' YY_NUMBER { $$ = new_opt(IPM_DSTPORT);
- $$->o_num = $3; }
- | IPM_DSTPORT '=' YY_STR { $$ = new_opt(IPM_DSTPORT);
- $$->o_str = $3; }
- ;
-
-every: IPM_EVERY IPM_SECOND { $$ = new_opt(IPM_SECOND);
- $$->o_num = 1; }
- | IPM_EVERY YY_NUMBER IPM_SECONDS { $$ = new_opt(IPM_SECOND);
- $$->o_num = $2; }
- | IPM_EVERY IPM_PACKET { $$ = new_opt(IPM_PACKET);
- $$->o_num = 1; }
- | IPM_EVERY YY_NUMBER IPM_PACKETS { $$ = new_opt(IPM_PACKET);
- $$->o_num = $2; }
- ;
-
-group: IPM_GROUP '=' YY_NUMBER { $$ = new_opt(IPM_GROUP);
- $$->o_num = $3; }
- | IPM_GROUP '=' YY_STR { $$ = new_opt(IPM_GROUP);
- $$->o_str = $3; }
- ;
-
-interface:
- IPM_INTERFACE '=' YY_STR { $$ = new_opt(IPM_INTERFACE);
- $$->o_str = $3; }
- ;
-
-logtag: IPM_LOGTAG '=' YY_NUMBER { $$ = new_opt(IPM_LOGTAG);
- $$->o_num = $3; }
- ;
-
-nattag: IPM_NATTAG '=' YY_STR { $$ = new_opt(IPM_NATTAG);
- $$->o_str = $3; }
- ;
-
-protocol:
- IPM_PROTOCOL '=' YY_NUMBER { $$ = new_opt(IPM_PROTOCOL);
- $$->o_num = $3; }
- | IPM_PROTOCOL '=' YY_STR { $$ = new_opt(IPM_PROTOCOL);
- $$->o_num = getproto($3);
- free($3);
- }
- ;
-
-result: IPM_RESULT '=' YY_STR { $$ = new_opt(IPM_RESULT);
- $$->o_str = $3; }
- ;
-
-rule: IPM_RULE '=' YY_NUMBER { $$ = new_opt(IPM_RULE);
- $$->o_num = YY_NUMBER; }
- ;
-
-srcip: IPM_SRCIP '=' ipv4 '/' YY_NUMBER { $$ = new_opt(IPM_SRCIP);
- $$->o_ip = $3;
- $$->o_num = $5; }
- ;
-
-srcport:
- IPM_SRCPORT '=' YY_NUMBER { $$ = new_opt(IPM_SRCPORT);
- $$->o_num = $3; }
- | IPM_SRCPORT '=' YY_STR { $$ = new_opt(IPM_SRCPORT);
- $$->o_str = $3; }
- ;
-
-type: IPM_TYPE '=' typeopt { $$ = new_opt(IPM_TYPE);
- $$->o_num = $3; }
- ;
-
-typeopt:
- IPM_IPF { $$ = IPL_MAGIC; }
- | IPM_NAT { $$ = IPL_MAGIC_NAT; }
- | IPM_STATE { $$ = IPL_MAGIC_STATE; }
- ;
-
-execute:
- IPM_EXECUTE YY_STR { $$ = new_opt(IPM_EXECUTE);
- $$->o_str = $2; }
- ;
-
-save: IPM_SAVE saveopts YY_STR { $$ = new_opt(IPM_SAVE);
- $$->o_num = $2;
- $$->o_str = $3; }
- ;
-
-saveopts: { $$ = 0; }
- | saveopt { $$ = $1; }
- | saveopt ',' saveopts { $$ = $1 | $3; }
- ;
-
-saveopt:
- IPM_RAW { $$ = IPMDO_SAVERAW; }
- ;
-
-syslog: IPM_SYSLOG { $$ = new_opt(IPM_SYSLOG); }
- ;
-
-nothing:
- IPM_NOTHING { $$ = 0; }
- ;
-
-ipv4: YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER '.' YY_NUMBER
- { if ($1 > 255 || $3 > 255 || $5 > 255 || $7 > 255) {
- yyerror("Invalid octet string for IP address");
- return 0;
- }
- $$.s_addr = ($1 << 24) | ($3 << 16) | ($5 << 8) | $7;
- $$.s_addr = htonl($$.s_addr);
- }
-%%
-static struct wordtab yywords[] = {
- { "body", IPM_BODY },
- { "direction", IPM_DIRECTION },
- { "do", IPM_DO },
- { "dstip", IPM_DSTIP },
- { "dstport", IPM_DSTPORT },
- { "every", IPM_EVERY },
- { "execute", IPM_EXECUTE },
- { "group", IPM_GROUP },
- { "in", IPM_IN },
- { "interface", IPM_INTERFACE },
- { "ipf", IPM_IPF },
- { "logtag", IPM_LOGTAG },
- { "match", IPM_MATCH },
- { "nat", IPM_NAT },
- { "nattag", IPM_NATTAG },
- { "no", IPM_NO },
- { "nothing", IPM_NOTHING },
- { "out", IPM_OUT },
- { "packet", IPM_PACKET },
- { "packets", IPM_PACKETS },
- { "protocol", IPM_PROTOCOL },
- { "result", IPM_RESULT },
- { "rule", IPM_RULE },
- { "save", IPM_SAVE },
- { "second", IPM_SECOND },
- { "seconds", IPM_SECONDS },
- { "srcip", IPM_SRCIP },
- { "srcport", IPM_SRCPORT },
- { "state", IPM_STATE },
- { "syslog", IPM_SYSLOG },
- { "with", IPM_WITH },
- { NULL, 0 }
-};
-
-static int macflags[17][2] = {
- { IPM_DIRECTION, IPMAC_DIRECTION },
- { IPM_DSTIP, IPMAC_DSTIP },
- { IPM_DSTPORT, IPMAC_DSTPORT },
- { IPM_GROUP, IPMAC_GROUP },
- { IPM_INTERFACE, IPMAC_INTERFACE },
- { IPM_LOGTAG, IPMAC_LOGTAG },
- { IPM_NATTAG, IPMAC_NATTAG },
- { IPM_PACKET, IPMAC_EVERY },
- { IPM_PROTOCOL, IPMAC_PROTOCOL },
- { IPM_RESULT, IPMAC_RESULT },
- { IPM_RULE, IPMAC_RULE },
- { IPM_SECOND, IPMAC_EVERY },
- { IPM_SRCIP, IPMAC_SRCIP },
- { IPM_SRCPORT, IPMAC_SRCPORT },
- { IPM_TYPE, IPMAC_TYPE },
- { IPM_WITH, IPMAC_WITH },
- { 0, 0 }
-};
-
-static opt_t *new_opt(type)
-int type;
-{
- opt_t *o;
-
- o = (opt_t *)malloc(sizeof(*o));
- o->o_type = type;
- o->o_line = yylineNum;
- o->o_num = 0;
- o->o_str = (char *)0;
- o->o_next = NULL;
- return o;
-}
-
-static void build_action(olist)
-opt_t *olist;
-{
- ipmon_action_t *a;
- opt_t *o;
- char c;
- int i;
-
- a = (ipmon_action_t *)calloc(1, sizeof(*a));
- if (a == NULL)
- return;
- while ((o = olist) != NULL) {
- /*
- * Check to see if the same comparator is being used more than
- * once per matching statement.
- */
- for (i = 0; macflags[i][0]; i++)
- if (macflags[i][0] == o->o_type)
- break;
- if (macflags[i][1] & a->ac_mflag) {
- fprintf(stderr, "%s redfined on line %d\n",
- yykeytostr(o->o_type), yylineNum);
- if (o->o_str != NULL)
- free(o->o_str);
- olist = o->o_next;
- free(o);
- continue;
- }
-
- a->ac_mflag |= macflags[i][1];
-
- switch (o->o_type)
- {
- case IPM_DIRECTION :
- a->ac_direction = o->o_num;
- break;
- case IPM_DSTIP :
- a->ac_dip = o->o_ip.s_addr;
- a->ac_dmsk = htonl(0xffffffff << (32 - o->o_num));
- break;
- case IPM_DSTPORT :
- a->ac_dport = htons(o->o_num);
- break;
- case IPM_EXECUTE :
- a->ac_exec = o->o_str;
- c = *o->o_str;
- if (c== '"'|| c == '\'') {
- if (o->o_str[strlen(o->o_str) - 1] == c) {
- a->ac_run = strdup(o->o_str + 1);
- a->ac_run[strlen(a->ac_run) - 1] ='\0';
- } else
- a->ac_run = o->o_str;
- } else
- a->ac_run = o->o_str;
- o->o_str = NULL;
- break;
- case IPM_INTERFACE :
- a->ac_iface = o->o_str;
- o->o_str = NULL;
- break;
- case IPM_GROUP :
- if (o->o_str != NULL)
- strncpy(a->ac_group, o->o_str, FR_GROUPLEN);
- else
- sprintf(a->ac_group, "%d", o->o_num);
- break;
- case IPM_LOGTAG :
- a->ac_logtag = o->o_num;
- break;
- case IPM_NATTAG :
- strncpy(a->ac_nattag, o->o_str, sizeof(a->ac_nattag));
- break;
- case IPM_PACKET :
- a->ac_packet = o->o_num;
- break;
- case IPM_PROTOCOL :
- a->ac_proto = o->o_num;
- break;
- case IPM_RULE :
- a->ac_rule = o->o_num;
- break;
- case IPM_RESULT :
- if (!strcasecmp(o->o_str, "pass"))
- a->ac_result = IPMR_PASS;
- else if (!strcasecmp(o->o_str, "block"))
- a->ac_result = IPMR_BLOCK;
- else if (!strcasecmp(o->o_str, "nomatch"))
- a->ac_result = IPMR_NOMATCH;
- else if (!strcasecmp(o->o_str, "log"))
- a->ac_result = IPMR_LOG;
- break;
- case IPM_SECOND :
- a->ac_second = o->o_num;
- break;
- case IPM_SRCIP :
- a->ac_sip = o->o_ip.s_addr;
- a->ac_smsk = htonl(0xffffffff << (32 - o->o_num));
- break;
- case IPM_SRCPORT :
- a->ac_sport = htons(o->o_num);
- break;
- case IPM_SAVE :
- if (a->ac_savefile != NULL) {
- fprintf(stderr, "%s redfined on line %d\n",
- yykeytostr(o->o_type), yylineNum);
- break;
- }
- a->ac_savefile = strdup(o->o_str);
- a->ac_savefp = fopen(o->o_str, "a");
- a->ac_dflag |= o->o_num & IPMDO_SAVERAW;
- break;
- case IPM_SYSLOG :
- if (a->ac_syslog != 0) {
- fprintf(stderr, "%s redfined on line %d\n",
- yykeytostr(o->o_type), yylineNum);
- break;
- }
- a->ac_syslog = 1;
- break;
- case IPM_TYPE :
- a->ac_type = o->o_num;
- break;
- case IPM_WITH :
- break;
- default :
- break;
- }
-
- olist = o->o_next;
- if (o->o_str != NULL)
- free(o->o_str);
- free(o);
- }
- a->ac_next = alist;
- alist = a;
-}
-
-
-int check_action(buf, log, opts, lvl)
-char *buf, *log;
-int opts, lvl;
-{
- ipmon_action_t *a;
- struct timeval tv;
- ipflog_t *ipf;
- tcphdr_t *tcp;
- iplog_t *ipl;
- int matched;
- u_long t1;
- ip_t *ip;
-
- matched = 0;
- ipl = (iplog_t *)buf;
- ipf = (ipflog_t *)(ipl +1);
- ip = (ip_t *)(ipf + 1);
- tcp = (tcphdr_t *)((char *)ip + (IP_HL(ip) << 2));
-
- for (a = alist; a != NULL; a = a->ac_next) {
- if ((a->ac_mflag & IPMAC_DIRECTION) != 0) {
- if (a->ac_direction == IPM_IN) {
- if ((ipf->fl_flags & FR_INQUE) == 0)
- continue;
- } else if (a->ac_direction == IPM_OUT) {
- if ((ipf->fl_flags & FR_OUTQUE) == 0)
- continue;
- }
- }
-
- if ((a->ac_type != 0) && (a->ac_type != ipl->ipl_magic))
- continue;
-
- if ((a->ac_mflag & IPMAC_EVERY) != 0) {
- gettimeofday(&tv, NULL);
- t1 = tv.tv_sec - a->ac_lastsec;
- if (tv.tv_usec <= a->ac_lastusec)
- t1--;
- if (a->ac_second != 0) {
- if (t1 < a->ac_second)
- continue;
- a->ac_lastsec = tv.tv_sec;
- a->ac_lastusec = tv.tv_usec;
- }
-
- if (a->ac_packet != 0) {
- if (a->ac_pktcnt == 0)
- a->ac_pktcnt++;
- else if (a->ac_pktcnt == a->ac_packet) {
- a->ac_pktcnt = 0;
- continue;
- } else {
- a->ac_pktcnt++;
- continue;
- }
- }
- }
-
- if ((a->ac_mflag & IPMAC_DSTIP) != 0) {
- if ((ip->ip_dst.s_addr & a->ac_dmsk) != a->ac_dip)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_DSTPORT) != 0) {
- if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP)
- continue;
- if (tcp->th_dport != a->ac_dport)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_GROUP) != 0) {
- if (strncmp(a->ac_group, ipf->fl_group,
- FR_GROUPLEN) != 0)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_INTERFACE) != 0) {
- if (strcmp(a->ac_iface, ipf->fl_ifname))
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_PROTOCOL) != 0) {
- if (a->ac_proto != ip->ip_p)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_RESULT) != 0) {
- if ((ipf->fl_flags & FF_LOGNOMATCH) != 0) {
- if (a->ac_result != IPMR_NOMATCH)
- continue;
- } else if (FR_ISPASS(ipf->fl_flags)) {
- if (a->ac_result != IPMR_PASS)
- continue;
- } else if (FR_ISBLOCK(ipf->fl_flags)) {
- if (a->ac_result != IPMR_BLOCK)
- continue;
- } else { /* Log only */
- if (a->ac_result != IPMR_LOG)
- continue;
- }
- }
-
- if ((a->ac_mflag & IPMAC_RULE) != 0) {
- if (a->ac_rule != ipf->fl_rule)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_SRCIP) != 0) {
- if ((ip->ip_src.s_addr & a->ac_smsk) != a->ac_sip)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_SRCPORT) != 0) {
- if (ip->ip_p != IPPROTO_UDP && ip->ip_p != IPPROTO_TCP)
- continue;
- if (tcp->th_sport != a->ac_sport)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_LOGTAG) != 0) {
- if (a->ac_logtag != ipf->fl_logtag)
- continue;
- }
-
- if ((a->ac_mflag & IPMAC_NATTAG) != 0) {
- if (strncmp(a->ac_nattag, ipf->fl_nattag.ipt_tag,
- IPFTAG_LEN) != 0)
- continue;
- }
-
- matched = 1;
-
- /*
- * It matched so now execute the command
- */
- if (a->ac_syslog != 0) {
- syslog(lvl, "%s", log);
- }
-
- if (a->ac_savefp != NULL) {
- if (a->ac_dflag & IPMDO_SAVERAW)
- fwrite(ipl, 1, ipl->ipl_dsize, a->ac_savefp);
- else
- fputs(log, a->ac_savefp);
- }
-
- if (a->ac_exec != NULL) {
- switch (fork())
- {
- case 0 :
- {
- FILE *pi;
-
- pi = popen(a->ac_run, "w");
- if (pi != NULL) {
- fprintf(pi, "%s\n", log);
- if ((opts & OPT_HEXHDR) != 0) {
- dumphex(pi, 0, buf,
- sizeof(*ipl) +
- sizeof(*ipf));
- }
- if ((opts & OPT_HEXBODY) != 0) {
- dumphex(pi, 0, (char *)ip,
- ipf->fl_hlen +
- ipf->fl_plen);
- }
- pclose(pi);
- }
- exit(1);
- }
- case -1 :
- break;
- default :
- break;
- }
- }
- }
-
- return matched;
-}
-
-
-static void free_action(a)
-ipmon_action_t *a;
-{
- if (a->ac_savefile != NULL) {
- free(a->ac_savefile);
- a->ac_savefile = NULL;
- }
- if (a->ac_savefp != NULL) {
- fclose(a->ac_savefp);
- a->ac_savefp = NULL;
- }
- if (a->ac_exec != NULL) {
- free(a->ac_exec);
- if (a->ac_run == a->ac_exec)
- a->ac_run = NULL;
- a->ac_exec = NULL;
- }
- if (a->ac_run != NULL) {
- free(a->ac_run);
- a->ac_run = NULL;
- }
- if (a->ac_iface != NULL) {
- free(a->ac_iface);
- a->ac_iface = NULL;
- }
- a->ac_next = NULL;
- free(a);
-}
-
-
-int load_config(file)
-char *file;
-{
- ipmon_action_t *a;
- FILE *fp;
- char *s;
-
- s = getenv("YYDEBUG");
- if (s != NULL)
- yydebug = atoi(s);
- else
- yydebug = 0;
-
- while ((a = alist) != NULL) {
- alist = a->ac_next;
- free_action(a);
- }
-
- yylineNum = 1;
-
- (void) yysettab(yywords);
-
- fp = fopen(file, "r");
- if (!fp) {
- perror("load_config:fopen:");
- return -1;
- }
- yyin = fp;
- while (!feof(fp))
- yyparse();
- fclose(fp);
- return 0;
-}
OpenPOWER on IntegriCloud