?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
MFC:
[dragonfly.git] / contrib / ipfilter / natparse.c
blob72462340b1a5e27fc7f43e694a8d73619e6a51de
1 /*
2 * Copyright (C) 1993-2002 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 */
6 #if defined(__sgi) && (IRIX > 602)
7 # include <sys/ptimers.h>
8 #endif
9 #include <stdio.h>
10 #include <string.h>
11 #include <fcntl.h>
12 #include <errno.h>
13 #include <sys/types.h>
14 #if !defined(__SVR4) && !defined(__svr4__)
15 # include <strings.h>
16 #else
17 # include <sys/byteorder.h>
18 #endif
19 #include <sys/time.h>
20 #include <sys/param.h>
21 #include <stdlib.h>
22 #include <unistd.h>
23 #include <stddef.h>
24 #include <sys/socket.h>
25 #include <sys/ioctl.h>
26 #if defined(sun) && (defined(__svr4__) || defined(__SVR4))
27 # include <sys/ioccom.h>
28 # include <sys/sysmacros.h>
29 #endif
30 #include <netinet/in.h>
31 #include <netinet/in_systm.h>
32 #include <netinet/ip.h>
33 #include <netinet/tcp.h>
34 #include <net/if.h>
35 #if __FreeBSD_version >= 300000
36 # include <net/if_var.h>
37 #endif
38 #include <netdb.h>
39 #include <arpa/nameser.h>
40 #include <arpa/inet.h>
41 #include <resolv.h>
42 #include <ctype.h>
43 #include "netinet/ip_compat.h"
44 #include "netinet/ip_fil.h"
45 #include "netinet/ip_nat.h"
46 #include "netinet/ip_state.h"
47 #include "netinet/ip_proxy.h"
48 #include "ipf.h"
49
50 #if defined(sun) && !SOLARIS2
51 # define STRERROR(x) sys_errlist[x]
52 extern char *sys_errlist[];
53 #else
54 # define STRERROR(x) strerror(x)
55 #endif
56
57 #if !defined(lint)
58 static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
59 static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.29 2003/05/15 17:45:34 darrenr Exp $";
60 #endif
61
62
63 #if SOLARIS
64 #define bzero(a,b) memset(a,0,b)
65 #endif
66
67 extern void printnat __P((ipnat_t *, int));
68 extern int countbits __P((u_32_t));
69 extern char *proto;
70
71 ipnat_t *natparse __P((char *, int, int *));
72 void natparsefile __P((int, char *, int));
73 void nat_setgroupmap __P((struct ipnat *));
74
75
76 void nat_setgroupmap(n)
77 ipnat_t *n;
78 {
79 if (n->in_outmsk == n->in_inmsk)
80 n->in_ippip = 1;
81 else if (n->in_flags & IPN_AUTOPORTMAP) {
82 n->in_ippip = ~ntohl(n->in_inmsk);
83 if (n->in_outmsk != 0xffffffff)
84 n->in_ippip /= (~ntohl(n->in_outmsk) + 1);
85 n->in_ippip++;
86 if (n->in_ippip == 0)
87 n->in_ippip = 1;
88 n->in_ppip = USABLE_PORTS / n->in_ippip;
89 } else {
90 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
91 n->in_nip = 0;
92 if (!(n->in_ppip = n->in_pmin))
93 n->in_ppip = 1;
94 n->in_ippip = USABLE_PORTS / n->in_ppip;
95 }
96 }
97
98
99 /*
100 * Parse a line of input from the ipnat configuration file
101 *
102 * status:
103 * < 0 error
104 * = 0 OK
105 * > 0 programmer error
106 */
107 ipnat_t *natparse(line, linenum, status)
108 char *line;
109 int linenum;
110 int *status;
111 {
112 static ipnat_t ipn;
113 struct protoent *pr;
114 char *dnetm = NULL, *dport = NULL;
115 char *s, *t, *cps[31], **cpp;
116 int i, cnt;
117 char *port1a = NULL, *port1b = NULL, *port2a = NULL;
118
119 *status = 100; /* default to error */
120 proto = NULL;
121
122 /*
123 * Search for end of line and comment marker, advance of leading spaces
124 */
125 if ((s = strchr(line, '\n')))
126 *s = '\0';
127 if ((s = strchr(line, '#')))
128 *s = '\0';
129 while (*line && isspace(*line))
130 line++;
131 if (!*line) {
132 *status = 0;
133 return NULL;
134 }
135
136 bzero((char *)&ipn, sizeof(ipn));
137 cnt = 0;
138
139 /*
140 * split line upto into segments.
141 */
142 for (i = 0, *cps = strtok(line, " \b\t\r\n"); cps[i] && i < 30; cnt++)
143 cps[++i] = strtok(NULL, " \b\t\r\n");
144
145 cps[i] = NULL;
146
147 if (cnt < 3) {
148 fprintf(stderr, "%d: not enough segments in line\n", linenum);
149 *status = -1;
150 return NULL;
151 }
152
153 cpp = cps;
154
155 /*
156 * Check first word is a recognised keyword and then is the interface
157 */
158 if (!strcasecmp(*cpp, "map"))
159 ipn.in_redir = NAT_MAP;
160 else if (!strcasecmp(*cpp, "map-block"))
161 ipn.in_redir = NAT_MAPBLK;
162 else if (!strcasecmp(*cpp, "rdr"))
163 ipn.in_redir = NAT_REDIRECT;
164 else if (!strcasecmp(*cpp, "bimap"))
165 ipn.in_redir = NAT_BIMAP;
166 else {
167 fprintf(stderr, "%d: unknown mapping: \"%s\"\n",
168 linenum, *cpp);
169 *status = -1;
170 return NULL;
171 }
172
173 cpp++;
174
175 strncpy(ipn.in_ifname, *cpp, sizeof(ipn.in_ifname) - 1);
176 ipn.in_ifname[sizeof(ipn.in_ifname) - 1] = '\0';
177 cpp++;
178
179 /*
180 * If the first word after the interface is "from" or is a ! then
181 * the expanded syntax is being used so parse it differently.
182 */
183 if (!strcasecmp(*cpp, "from") || (**cpp == '!')) {
184 if (!strcmp(*cpp, "!")) {
185 cpp++;
186 if (strcasecmp(*cpp, "from")) {
187 fprintf(stderr, "Missing from after !\n");
188 *status = -1;
189 return NULL;
190 }
191 ipn.in_flags |= IPN_NOTSRC;
192 } else if (**cpp == '!') {
193 if (strcasecmp(*cpp + 1, "from")) {
194 fprintf(stderr, "Missing from after !\n");
195 *status = -1;
196 return NULL;
197 }
198 ipn.in_flags |= IPN_NOTSRC;
199 }
200 if ((ipn.in_flags & IPN_NOTSRC) &&
201 (ipn.in_redir & (NAT_MAP|NAT_MAPBLK))) {
202 fprintf(stderr, "Cannot use '! from' with map\n");
203 *status = -1;
204 return NULL;
205 }
206
207 ipn.in_flags |= IPN_FILTER;
208 cpp++;
209 if (ipn.in_redir == NAT_REDIRECT) {
210 if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip,
211 (u_32_t *)&ipn.in_srcmsk, &ipn.in_sport,
212 &ipn.in_scmp, &ipn.in_stop, linenum)) {
213 *status = -1;
214 return NULL;
215 }
216 } else {
217 if (hostmask(&cpp, (u_32_t *)&ipn.in_inip,
218 (u_32_t *)&ipn.in_inmsk, &ipn.in_sport,
219 &ipn.in_scmp, &ipn.in_stop, linenum)) {
220 *status = -1;
221 return NULL;
222 }
223 }
224
225 if (!strcmp(*cpp, "!")) {
226 cpp++;
227 ipn.in_flags |= IPN_NOTDST;
228 } else if (**cpp == '!') {
229 (*cpp)++;
230 ipn.in_flags |= IPN_NOTDST;
231 }
232
233 if (strcasecmp(*cpp, "to")) {
234 fprintf(stderr, "%d: unexpected keyword (%s) - to\n",
235 linenum, *cpp);
236 *status = -1;
237 return NULL;
238 }
239 if ((ipn.in_flags & IPN_NOTDST) &&
240 (ipn.in_redir & (NAT_REDIRECT))) {
241 fprintf(stderr, "Cannot use '! to' with rdr\n");
242 *status = -1;
243 return NULL;
244 }
245
246 if (!*++cpp) {
247 fprintf(stderr, "%d: missing host after to\n", linenum);
248 *status = -1;
249 return NULL;
250 }
251 if (ipn.in_redir == NAT_REDIRECT) {
252 if (hostmask(&cpp, (u_32_t *)&ipn.in_outip,
253 (u_32_t *)&ipn.in_outmsk, &ipn.in_dport,
254 &ipn.in_dcmp, &ipn.in_dtop, linenum)) {
255 *status = -1;
256 return NULL;
257 }
258 ipn.in_pmin = htons(ipn.in_dport);
259 } else {
260 if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip,
261 (u_32_t *)&ipn.in_srcmsk, &ipn.in_dport,
262 &ipn.in_dcmp, &ipn.in_dtop, linenum)) {
263 *status = -1;
264 return NULL;
265 }
266 }
267 } else {
268 s = *cpp;
269 if (!s) {
270 fprintf(stderr, "%d: short line\n", linenum);
271 *status = -1;
272 return NULL;
273 }
274 t = strchr(s, '/');
275 if (!t) {
276 fprintf(stderr, "%d: no netmask on LHS\n", linenum);
277 *status = -1;
278 return NULL;
279 }
280 *t++ = '\0';
281 if (ipn.in_redir == NAT_REDIRECT) {
282 if (hostnum((u_32_t *)&ipn.in_outip, s, linenum) == -1){
283 *status = -1;
284 return NULL;
285 }
286 if (genmask(t, (u_32_t *)&ipn.in_outmsk) == -1) {
287 *status = -1;
288 return NULL;
289 }
290 } else {
291 if (hostnum((u_32_t *)&ipn.in_inip, s, linenum) == -1) {
292 *status = -1;
293 return NULL;
294 }
295 if (genmask(t, (u_32_t *)&ipn.in_inmsk) == -1) {
296 *status = -1;
297 return NULL;
298 }
299 }
300 cpp++;
301 if (!*cpp) {
302 fprintf(stderr, "%d: short line\n", linenum);
303 *status = -1;
304 return NULL;
305 }
306 }
307
308 /*
309 * If it is a standard redirect then we expect it to have a port
310 * match after the hostmask.
311 */
312 if ((ipn.in_redir == NAT_REDIRECT) && !(ipn.in_flags & IPN_FILTER)) {
313 if (strcasecmp(*cpp, "port")) {
314 fprintf(stderr, "%d: missing fields - 1st port\n",
315 linenum);
316 *status = -1;
317 return NULL;
318 }
319
320 cpp++;
321
322 if (!*cpp) {
323 fprintf(stderr,
324 "%d: missing fields (destination port)\n",
325 linenum);
326 *status = -1;
327 return NULL;
328 }
329
330 if (isdigit(**cpp) && (s = strchr(*cpp, '-')))
331 *s++ = '\0';
332 else
333 s = NULL;
334
335 port1a = *cpp++;
336
337 if (!strcmp(*cpp, "-")) {
338 cpp++;
339 s = *cpp++;
340 }
341
342 if (s)
343 port1b = s;
344 else
345 ipn.in_pmax = ipn.in_pmin;
346 }
347
348 /*
349 * In the middle of the NAT rule syntax is -> to indicate the
350 * direction of translation.
351 */
352 if (!*cpp) {
353 fprintf(stderr, "%d: missing fields (->)\n", linenum);
354 *status = -1;
355 return NULL;
356 }
357 if (strcmp(*cpp, "->")) {
358 fprintf(stderr, "%d: missing ->\n", linenum);
359 *status = -1;
360 return NULL;
361 }
362 cpp++;
363
364 if (!*cpp) {
365 fprintf(stderr, "%d: missing fields (%s)\n",
366 linenum, ipn.in_redir ? "destination" : "target");
367 *status = -1;
368 return NULL;
369 }
370
371 if (ipn.in_redir == NAT_MAP) {
372 if (!strcasecmp(*cpp, "range")) {
373 cpp++;
374 ipn.in_flags |= IPN_IPRANGE;
375 if (!*cpp) {
376 fprintf(stderr, "%d: missing fields (%s)\n",
377 linenum,
378 ipn.in_redir ? "destination":"target");
379 *status = -1;
380 return NULL;
381 }
382 }
383 }
384
385 if (ipn.in_flags & IPN_IPRANGE) {
386 dnetm = strrchr(*cpp, '-');
387 if (dnetm == NULL) {
388 cpp++;
389 if (*cpp && !strcmp(*cpp, "-") && *(cpp + 1))
390 dnetm = *(cpp + 1);
391 } else
392 *dnetm++ = '\0';
393 if (dnetm == NULL || *dnetm == '\0') {
394 fprintf(stderr,
395 "%d: desination range not specified\n",
396 linenum);
397 *status = -1;
398 return NULL;
399 }
400 } else if (ipn.in_redir != NAT_REDIRECT) {
401 dnetm = strrchr(*cpp, '/');
402 if (dnetm == NULL) {
403 cpp++;
404 if (*cpp && !strcasecmp(*cpp, "netmask"))
405 dnetm = *++cpp;
406 }
407 if (dnetm == NULL) {
408 fprintf(stderr,
409 "%d: missing fields (dest netmask)\n",
410 linenum);
411 *status = -1;
412 return NULL;
413 }
414 if (*dnetm == '/')
415 *dnetm++ = '\0';
416 }
417
418 if (ipn.in_redir == NAT_REDIRECT) {
419 dnetm = strchr(*cpp, ',');
420 if (dnetm != NULL) {
421 ipn.in_flags |= IPN_SPLIT;
422 *dnetm++ = '\0';
423 }
424 if (hostnum((u_32_t *)&ipn.in_inip, *cpp, linenum) == -1) {
425 *status = -1;
426 return NULL;
427 }
428 #if SOLARIS
429 if (ntohl(ipn.in_inip) == INADDR_LOOPBACK) {
430 fprintf(stderr,
431 "localhost as destination not supported\n");
432 *status = -1;
433 return NULL;
434 }
435 #endif
436 } else {
437 if (!strcmp(*cpp, ipn.in_ifname))
438 *cpp = "0";
439 if (hostnum((u_32_t *)&ipn.in_outip, *cpp, linenum) == -1) {
440 *status = -1;
441 return NULL;
442 }
443 }
444 cpp++;
445
446 if (ipn.in_redir & NAT_MAPBLK) {
447 if (*cpp) {
448 if (strcasecmp(*cpp, "ports")) {
449 fprintf(stderr,
450 "%d: expected \"ports\" - got \"%s\"\n",
451 linenum, *cpp);
452 *status = -1;
453 return NULL;
454 }
455 cpp++;
456 if (*cpp == NULL) {
457 fprintf(stderr,
458 "%d: missing argument to \"ports\"\n",
459 linenum);
460 *status = -1;
461 return NULL;
462 }
463 if (!strcasecmp(*cpp, "auto"))
464 ipn.in_flags |= IPN_AUTOPORTMAP;
465 else
466 ipn.in_pmin = atoi(*cpp);
467 cpp++;
468 } else
469 ipn.in_pmin = 0;
470 } else if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) {
471 if (*cpp && (strrchr(*cpp, '/') != NULL)) {
472 fprintf(stderr, "%d: No netmask supported in %s\n",
473 linenum, "destination host for redirect");
474 *status = -1;
475 return NULL;
476 }
477
478 if (!*cpp) {
479 fprintf(stderr, "%d: Missing destination port %s\n",
480 linenum, "in redirect");
481 *status = -1;
482 return NULL;
483 }
484
485 /* If it's a in_redir, expect target port */
486
487 if (strcasecmp(*cpp, "port")) {
488 fprintf(stderr, "%d: missing fields - 2nd port (%s)\n",
489 linenum, *cpp);
490 *status = -1;
491 return NULL;
492 }
493 cpp++;
494 if (!*cpp) {
495 fprintf(stderr,
496 "%d: missing fields (destination port)\n",
497 linenum);
498 *status = -1;
499 return NULL;
500 }
501
502 port2a = *cpp++;
503 }
504 if (dnetm && *dnetm == '/')
505 *dnetm++ = '\0';
506
507 if (ipn.in_redir & (NAT_MAP|NAT_MAPBLK)) {
508 if (ipn.in_flags & IPN_IPRANGE) {
509 if (hostnum((u_32_t *)&ipn.in_outmsk, dnetm,
510 linenum) == -1) {
511 *status = -1;
512 return NULL;
513 }
514 } else if (genmask(dnetm, (u_32_t *)&ipn.in_outmsk)) {
515 *status = -1;
516 return NULL;
517 }
518 } else {
519 if (ipn.in_flags & IPN_SPLIT) {
520 if (hostnum((u_32_t *)&ipn.in_inmsk, dnetm,
521 linenum) == -1) {
522 *status = -1;
523 return NULL;
524 }
525 } else if (genmask("255.255.255.255", (u_32_t *)&ipn.in_inmsk)){
526 *status = -1;
527 return NULL;
528 }
529 if (!*cpp) {
530 ipn.in_flags |= IPN_TCP; /* XXX- TCP only by default */
531 proto = "tcp";
532 } else {
533 proto = *cpp++;
534 if (!strcasecmp(proto, "tcp"))
535 ipn.in_flags |= IPN_TCP;
536 else if (!strcasecmp(proto, "udp"))
537 ipn.in_flags |= IPN_UDP;
538 else if (!strcasecmp(proto, "tcp/udp"))
539 ipn.in_flags |= IPN_TCPUDP;
540 else if (!strcasecmp(proto, "tcpudp")) {
541 ipn.in_flags |= IPN_TCPUDP;
542 proto = "tcp/udp";
543 } else if (!strcasecmp(proto, "ip"))
544 ipn.in_flags |= IPN_ANY;
545 else {
546 ipn.in_flags |= IPN_ANY;
547 if ((pr = getprotobyname(proto)))
548 ipn.in_p = pr->p_proto;
549 else {
550 if (!isdigit(*proto)) {
551 fprintf(stderr,
552 "%d: Unknown protocol %s\n",
553 linenum, proto);
554 *status = -1;
555 return NULL;
556 } else
557 ipn.in_p = atoi(proto);
558 }
559 }
560 if ((ipn.in_flags & IPN_TCPUDP) == 0) {
561 port1a = "0";
562 port2a = "0";
563 }
564
565 if (*cpp && !strcasecmp(*cpp, "round-robin")) {
566 cpp++;
567 ipn.in_flags |= IPN_ROUNDR;
568 }
569
570 if (*cpp && !strcasecmp(*cpp, "frag")) {
571 cpp++;
572 ipn.in_flags |= IPN_FRAG;
573 }
574
575 if (*cpp && !strcasecmp(*cpp, "age")) {
576 cpp++;
577 if (!*cpp) {
578 fprintf(stderr,
579 "%d: age with no parameters\n",
580 linenum);
581 *status = -1;
582 return NULL;
583 }
584
585 ipn.in_age[0] = atoi(*cpp);
586 s = index(*cpp, '/');
587 if (s != NULL)
588 ipn.in_age[1] = atoi(s + 1);
589 else
590 ipn.in_age[1] = ipn.in_age[0];
591 cpp++;
592 }
593
594 if (*cpp && !strcasecmp(*cpp, "mssclamp")) {
595 cpp++;
596 if (*cpp) {
597 ipn.in_mssclamp = atoi(*cpp);
598 cpp++;
599 } else {
600 fprintf(stderr,
601 "%d: mssclamp with no parameters\n",
602 linenum);
603 *status = -1;
604 return NULL;
605 }
606 }
607
608 if (*cpp) {
609 fprintf(stderr,
610 "%d: extra junk at the end of the line: %s\n",
611 linenum, *cpp);
612 *status = -1;
613 return NULL;
614 }
615 }
616 }
617
618 if ((ipn.in_redir == NAT_REDIRECT) && !(ipn.in_flags & IPN_FILTER)) {
619 if (!portnum(port1a, &ipn.in_pmin, linenum)) {
620 *status = -1;
621 return NULL;
622 }
623 ipn.in_pmin = htons(ipn.in_pmin);
624 if (port1b != NULL) {
625 if (!portnum(port1b, &ipn.in_pmax, linenum)) {
626 *status = -1;
627 return NULL;
628 }
629 ipn.in_pmax = htons(ipn.in_pmax);
630 } else
631 ipn.in_pmax = ipn.in_pmin;
632 }
633
634 if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) {
635 if (!portnum(port2a, &ipn.in_pnext, linenum)) {
636 *status = -1;
637 return NULL;
638 }
639 ipn.in_pnext = htons(ipn.in_pnext);
640 }
641
642 if (!(ipn.in_flags & IPN_SPLIT))
643 ipn.in_inip &= ipn.in_inmsk;
644 if ((ipn.in_flags & IPN_IPRANGE) == 0)
645 ipn.in_outip &= ipn.in_outmsk;
646 ipn.in_srcip &= ipn.in_srcmsk;
647
648 if ((ipn.in_redir & NAT_MAPBLK) != 0)
649 nat_setgroupmap(&ipn);
650
651 if (*cpp && !*(cpp+1) && !strcasecmp(*cpp, "frag")) {
652 cpp++;
653 ipn.in_flags |= IPN_FRAG;
654 }
655
656 if (!*cpp) {
657 *status = 0;
658 return &ipn;
659 }
660
661 if (ipn.in_redir != NAT_BIMAP && !strcasecmp(*cpp, "proxy")) {
662 u_short pport;
663
664 if (ipn.in_redir == NAT_BIMAP) {
665 fprintf(stderr, "%d: cannot use proxy with bimap\n",
666 linenum);
667 *status = -1;
668 return NULL;
669 }
670 cpp++;
671 if (!*cpp) {
672 fprintf(stderr,
673 "%d: missing parameter for \"proxy\"\n",
674 linenum);
675 *status = -1;
676 return NULL;
677 }
678 dport = NULL;
679
680 if (!strcasecmp(*cpp, "port")) {
681 cpp++;
682 if (!*cpp) {
683 fprintf(stderr,
684 "%d: missing parameter for \"port\"\n",
685 linenum);
686 *status = -1;
687 return NULL;
688 }
689
690 dport = *cpp;
691 cpp++;
692
693 if (!*cpp) {
694 fprintf(stderr,
695 "%d: missing parameter for \"proxy\"\n",
696 linenum);
697 *status = -1;
698 return NULL;
699 }
700 } else {
701 fprintf(stderr,
702 "%d: missing keyword \"port\"\n", linenum);
703 *status = -1;
704 return NULL;
705 }
706
707 if ((proto = index(*cpp, '/'))) {
708 *proto++ = '\0';
709 if ((pr = getprotobyname(proto)))
710 ipn.in_p = pr->p_proto;
711 else
712 ipn.in_p = atoi(proto);
713 } else
714 ipn.in_p = 0;
715
716 if (dport && !portnum(dport, &pport, linenum))
717 return NULL;
718 if (ipn.in_dcmp != 0) {
719 if (pport != ipn.in_dport) {
720 fprintf(stderr,
721 "%d: mismatch in port numbers\n",
722 linenum);
723 return NULL;
724 }
725 } else
726 ipn.in_dport = htons(pport);
727
728 (void) strncpy(ipn.in_plabel, *cpp, sizeof(ipn.in_plabel));
729 cpp++;
730
731 } else if (ipn.in_redir != NAT_BIMAP && !strcasecmp(*cpp, "portmap")) {
732 if (ipn.in_redir == NAT_BIMAP) {
733 fprintf(stderr, "%d: cannot use portmap with bimap\n",
734 linenum);
735 *status = -1;
736 return NULL;
737 }
738 cpp++;
739 if (!*cpp) {
740 fprintf(stderr,
741 "%d: missing expression following portmap\n",
742 linenum);
743 *status = -1;
744 return NULL;
745 }
746
747 if (!strcasecmp(*cpp, "tcp"))
748 ipn.in_flags |= IPN_TCP;
749 else if (!strcasecmp(*cpp, "udp"))
750 ipn.in_flags |= IPN_UDP;
751 else if (!strcasecmp(*cpp, "tcpudp"))
752 ipn.in_flags |= IPN_TCPUDP;
753 else if (!strcasecmp(*cpp, "tcp/udp"))
754 ipn.in_flags |= IPN_TCPUDP;
755 else {
756 fprintf(stderr,
757 "%d: expected protocol name - got \"%s\"\n",
758 linenum, *cpp);
759 *status = -1;
760 return NULL;
761 }
762 proto = *cpp;
763 cpp++;
764
765 if (!*cpp) {
766 fprintf(stderr, "%d: no port range found\n", linenum);
767 *status = -1;
768 return NULL;
769 }
770
771 if (!strcasecmp(*cpp, "auto")) {
772 ipn.in_flags |= IPN_AUTOPORTMAP;
773 ipn.in_pmin = htons(1024);
774 ipn.in_pmax = htons(65535);
775 nat_setgroupmap(&ipn);
776 cpp++;
777 } else {
778 if (!(t = strchr(*cpp, ':'))) {
779 fprintf(stderr,
780 "%d: no port range in \"%s\"\n",
781 linenum, *cpp);
782 *status = -1;
783 return NULL;
784 }
785 *t++ = '\0';
786 if (!portnum(*cpp, &ipn.in_pmin, linenum) ||
787 !portnum(t, &ipn.in_pmax, linenum)) {
788 *status = -1;
789 return NULL;
790 }
791 ipn.in_pmin = htons(ipn.in_pmin);
792 ipn.in_pmax = htons(ipn.in_pmax);
793 cpp++;
794 }
795 }
796
797 if (*cpp && !strcasecmp(*cpp, "frag")) {
798 cpp++;
799 ipn.in_flags |= IPN_FRAG;
800 }
801
802 if (*cpp && !strcasecmp(*cpp, "age")) {
803 cpp++;
804 if (!*cpp) {
805 fprintf(stderr, "%d: age with no parameters\n",
806 linenum);
807 *status = -1;
808 return NULL;
809 }
810 ipn.in_age[0] = atoi(*cpp);
811 s = index(*cpp, '/');
812 if (s != NULL)
813 ipn.in_age[1] = atoi(s + 1);
814 else
815 ipn.in_age[1] = ipn.in_age[0];
816 cpp++;
817 }
818
819 if (*cpp && !strcasecmp(*cpp, "mssclamp")) {
820 cpp++;
821 if (*cpp) {
822 ipn.in_mssclamp = atoi(*cpp);
823 cpp++;
824 } else {
825 fprintf(stderr, "%d: mssclamp with no parameters\n",
826 linenum);
827 *status = -1;
828 return NULL;
829 }
830 }
831
832 if (*cpp) {
833 fprintf(stderr, "%d: extra junk at the end of the line: %s\n",
834 linenum, *cpp);
835 *status = -1;
836 return NULL;
837 }
838
839 *status = 0;
840 return &ipn;
841 }
842
843
844 void natparsefile(fd, file, opts)
845 int fd;
846 char *file;
847 int opts;
848 {
849 char line[512], *s;
850 ipnat_t *np;
851 FILE *fp;
852 int linenum = 0;
853 int parsestatus;
854
855 if (strcmp(file, "-")) {
856 if (!(fp = fopen(file, "r"))) {
857 fprintf(stderr, "%s: open: %s\n", file,
858 STRERROR(errno));
859 exit(1);
860 }
861 } else
862 fp = stdin;
863
864 while (fgets(line, sizeof(line) - 1, fp)) {
865 linenum++;
866 line[sizeof(line) - 1] = '\0';
867 if ((s = strchr(line, '\n')))
868 *s = '\0';
869
870 parsestatus = 1;
871 np = natparse(line, linenum, &parsestatus);
872 if (parsestatus != 0) {
873 if (*line) {
874 fprintf(stderr, "%d: syntax error in \"%s\"\n",
875 linenum, line);
876 }
877 fprintf(stderr, "%s: %s error (%d), quitting\n",
878 file,
879 ((parsestatus < 0)? "parse": "internal"),
880 parsestatus);
881 exit(1);
882 }
883 if (np) {
884 if ((opts & OPT_VERBOSE) && np)
885 printnat(np, opts);
886 if (!(opts & OPT_NODO)) {
887 if (!(opts & OPT_REMOVE)) {
888 if (ioctl(fd, SIOCADNAT, &np) == -1) {
889 fprintf(stderr, "%d:",
890 linenum);
891 perror("ioctl(SIOCADNAT)");
892 }
893 } else if (ioctl(fd, SIOCRMNAT, &np) == -1) {
894 fprintf(stderr, "%d:", linenum);
895 perror("ioctl(SIOCRMNAT)");
896 }
897 }
898 }
899 }
900 if (fp != stdin)
901 fclose(fp);
902 }
DragonFly BSD