o Implement net.inet.tcp.drop sysctl and userland part, tcpdrop(8)

utility:

    The tcpdrop command drops the TCP connection specified by the
    local address laddr, port lport and the foreign address faddr,
    port fport.

Obtained from:	OpenBSD
Reviewed by:	rwatson (locking), ru (man page), -current
MFC after:	1 month

3 files changed, 160 insertions, 0 deletions

diff --git a/usr.sbin/tcpdrop/Makefile b/usr.sbin/tcpdrop/Makefile
new file mode 100644
index 0000000..44766eb
--- /dev/null
+++ b/usr.sbin/tcpdrop/Makefile
@@ -0,0 +1,8 @@
+# $OpenBSD: Makefile,v 1.1 2004/04/26 19:51:20 markus Exp $
+# $FreeBSD$
+
+PROG=	tcpdrop
+MAN=	tcpdrop.8
+WARNS?=	6
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/tcpdrop/tcpdrop.8 b/usr.sbin/tcpdrop/tcpdrop.8
new file mode 100644
index 0000000..a77c1d3
--- /dev/null
+++ b/usr.sbin/tcpdrop/tcpdrop.8
@@ -0,0 +1,64 @@
+.\"	$OpenBSD: tcpdrop.8,v 1.5 2004/05/24 13:57:31 jmc Exp $
+.\"
+.\" Copyright (c) 2004 Markus Friedl <markus@openbsd.org>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd March 21, 2004
+.Dt TCPDROP 8
+.Os
+.Sh NAME
+.Nm tcpdrop
+.Nd drop a TCP connection
+.Sh SYNOPSIS
+.Nm tcpdrop
+.Ar laddr
+.Ar lport
+.Ar faddr
+.Ar fport
+.Sh DESCRIPTION
+The
+.Nm
+command drops the TCP connection specified by the local address
+.Ar laddr ,
+port
+.Ar lport
+and the foreign address
+.Ar faddr ,
+port
+.Ar fport .
+Addresses and ports can be specified by name or numeric value.
+.Sh EXIT STATUS
+.Ex -std
+.Sh EXAMPLES
+If a connection to
+.Xr httpd 8
+is causing congestion on a network link, one can drop the TCP session
+in charge:
+.Bd -literal -offset indent
+# fstat | egrep 'httpd.*internet.*<--'
+www      httpd      21307    3* internet stream tcp \e
+	0xd1007ca8 192.168.5.41:80 <-- 192.168.5.1:26747
+.Ed
+.Pp
+The following command will drop the connection:
+.Bd -literal -offset indent
+# tcpdrop 192.168.5.41 80 192.168.5.1 26747
+.Ed
+.Sh SEE ALSO
+.Xr fstat 1 ,
+.Xr netstat 1
+.Sh AUTHORS
+.An Markus Friedl Aq markus@openbsd.org
diff --git a/usr.sbin/tcpdrop/tcpdrop.c b/usr.sbin/tcpdrop/tcpdrop.c
new file mode 100644
index 0000000..cfa8c2a
--- /dev/null
+++ b/usr.sbin/tcpdrop/tcpdrop.c
@@ -0,0 +1,88 @@
+/* $OpenBSD: tcpdrop.c,v 1.4 2004/05/22 23:55:22 deraadt Exp $ */
+
+/*-
+ * Copyright (c) 2004 Markus Friedl <markus@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/sysctl.h>
+#include <netinet/in.h>
+#include <netinet/tcp_var.h>
+
+#include <err.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * Drop a tcp connection.
+ */
+int
+main(int argc, char *argv[])
+{
+	struct addrinfo hints, *ail, *aif, *laddr, *faddr;
+	struct tcp_ident_mapping tir;
+	int mib[] = { CTL_NET, PF_INET, IPPROTO_TCP, TCPCTL_DROP };
+	int gaierr, rval = 0;
+	char fhbuf[NI_MAXHOST], fsbuf[NI_MAXSERV], lhbuf[NI_MAXHOST],
+	    lsbuf[NI_MAXSERV];
+
+	if (argc != 5)
+		errx(1, "usage: tcpdrop laddr lport faddr fport\n");
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = AF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	if ((gaierr = getaddrinfo(argv[1], argv[2], &hints, &laddr)) != 0)
+		errx(1, "%s port %s: %s", argv[1], argv[2],
+		    gai_strerror(gaierr));
+	if ((gaierr = getaddrinfo(argv[3], argv[4], &hints, &faddr)) != 0) {
+		freeaddrinfo(laddr);
+		errx(1, "%s port %s: %s", argv[3], argv[4],
+		    gai_strerror(gaierr));
+	}
+	for (ail = laddr; ail; ail = ail->ai_next) {
+		for (aif = faddr; aif; aif = aif->ai_next) {
+			if (ail->ai_family != aif->ai_family)
+				continue;
+			memcpy(&tir.faddr, aif->ai_addr, aif->ai_addrlen);
+			memcpy(&tir.laddr, ail->ai_addr, ail->ai_addrlen);
+			if (getnameinfo(aif->ai_addr, aif->ai_addrlen,
+			    fhbuf, sizeof(fhbuf),
+			    fsbuf, sizeof(fsbuf),
+			    NI_NUMERICHOST | NI_NUMERICSERV) == -1)
+				err(1, "getnameinfo");
+			if (getnameinfo(ail->ai_addr, ail->ai_addrlen,
+			    lhbuf, sizeof(lhbuf),
+			    lsbuf, sizeof(lsbuf),
+			    NI_NUMERICHOST | NI_NUMERICSERV) == -1)
+				err(1, "getnameinfo");
+			if (sysctl(mib, sizeof (mib) / sizeof (int), NULL,
+			    NULL, &tir, sizeof(tir)) == -1) {
+				rval = 1;
+				warn("%s %s %s %s", lhbuf, lsbuf, fhbuf, fsbuf);
+			} else
+				printf("%s %s %s %s: dropped\n",
+				    lhbuf, lsbuf, fhbuf, fsbuf);
+		}
+	}
+	freeaddrinfo(laddr);
+	freeaddrinfo(faddr);
+	exit(rval);
+}