cidr.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604
  1. /* $Id$ */
  2. /*
  3. * Copyright (c) 2001-2010 Aaron Turner <aturner at synfin dot net>
  4. * Copyright (c) 2013-2024 Fred Klassen <tcpreplay at appneta dot com> - AppNeta
  5. *
  6. * The Tcpreplay Suite of tools is free software: you can redistribute it
  7. * and/or modify it under the terms of the GNU General Public License as
  8. * published by the Free Software Foundation, either version 3 of the
  9. * License, or with the authors permission any later version.
  10. *
  11. * The Tcpreplay Suite is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with the Tcpreplay Suite. If not, see <http://www.gnu.org/licenses/>.
  18. */
  19. #include "defines.h"
  20. #include "config.h"
  21. #include "common.h"
  22. #include <arpa/inet.h>
  23. #include <netinet/in.h>
  24. #include <stdio.h>
  25. #include <stdlib.h>
  26. #include <string.h>
  27. #include <sys/socket.h>
  28. static tcpr_cidr_t *cidr2cidr(char *);
  29. /**
  30. * prints to the given fd all the entries in mycidr
  31. */
  32. void
  33. print_cidr(tcpr_cidr_t *mycidr)
  34. {
  35. tcpr_cidr_t *cidr_ptr;
  36. fprintf(stderr, "Cidr List: ");
  37. cidr_ptr = mycidr;
  38. while (cidr_ptr != NULL) {
  39. /* print it */
  40. fprintf(stderr, "%s/%d, ", get_cidr2name(cidr_ptr, RESOLVE), cidr_ptr->masklen);
  41. /* go to the next */
  42. if (cidr_ptr->next != NULL) {
  43. cidr_ptr = cidr_ptr->next;
  44. } else {
  45. break;
  46. }
  47. }
  48. fprintf(stderr, "\n");
  49. }
  50. /**
  51. * deletes all entries in a cidr and destroys the datastructure
  52. */
  53. void
  54. destroy_cidr(tcpr_cidr_t *cidr)
  55. {
  56. if (cidr != NULL) {
  57. if (cidr->next != NULL)
  58. destroy_cidr(cidr->next);
  59. safe_free(cidr);
  60. }
  61. }
  62. /**
  63. * adds a new tcpr_cidr_t entry to cidrdata
  64. */
  65. void
  66. add_cidr(tcpr_cidr_t **cidrdata, tcpr_cidr_t **newcidr)
  67. {
  68. tcpr_cidr_t *cidr_ptr;
  69. dbg(1, "Running new_cidr()");
  70. if (*cidrdata == NULL) {
  71. *cidrdata = *newcidr;
  72. } else {
  73. cidr_ptr = *cidrdata;
  74. while (cidr_ptr->next != NULL)
  75. cidr_ptr = cidr_ptr->next;
  76. cidr_ptr->next = *newcidr;
  77. }
  78. }
  79. /**
  80. * Mallocs and sets to sane defaults a tcpr_cidr_t structure
  81. */
  82. tcpr_cidr_t *
  83. new_cidr(void)
  84. {
  85. tcpr_cidr_t *newcidr;
  86. newcidr = (tcpr_cidr_t *)safe_malloc(sizeof(tcpr_cidr_t));
  87. memset(newcidr, '\0', sizeof(tcpr_cidr_t));
  88. newcidr->masklen = 99;
  89. newcidr->next = NULL;
  90. return (newcidr);
  91. }
  92. /**
  93. * Creates a new tcpr_cidrmap_t structure. Malloc's memory
  94. */
  95. tcpr_cidrmap_t *
  96. new_cidr_map(void)
  97. {
  98. tcpr_cidrmap_t *new;
  99. new = (tcpr_cidrmap_t *)safe_malloc(sizeof(tcpr_cidrmap_t));
  100. memset(new, '\0', sizeof(tcpr_cidrmap_t));
  101. new->next = NULL;
  102. return (new);
  103. }
  104. /**
  105. * Converts a single cidr (string) in the form of x.x.x.x/y into a
  106. * tcpr_cidr_t structure. Will malloc the tcpr_cidr_t structure.
  107. */
  108. static tcpr_cidr_t *
  109. cidr2cidr(char *cidr)
  110. {
  111. int count;
  112. unsigned int octets[4]; /* used in sscanf */
  113. tcpr_cidr_t *newcidr;
  114. char networkip[16], tempoctet[4];
  115. int family;
  116. char *p;
  117. assert(cidr);
  118. newcidr = new_cidr();
  119. for (p = cidr; *p; ++p) {
  120. if (*p == '#') {
  121. *p = ':';
  122. } else if (*p == ']') {
  123. *p = 0;
  124. break;
  125. }
  126. }
  127. /*
  128. * scan it, and make sure it scanned correctly, also copy over the
  129. * masklen
  130. */
  131. count = sscanf(cidr, "%u.%u.%u.%u/%d", &octets[0], &octets[1], &octets[2], &octets[3], &newcidr->masklen);
  132. if (count == 4) {
  133. newcidr->masklen = 32;
  134. family = AF_INET;
  135. } else if (count == 5) {
  136. family = AF_INET;
  137. } else {
  138. p = strstr(cidr, "/");
  139. if (p) {
  140. *p = 0;
  141. ++p;
  142. sscanf(p, "%d", &newcidr->masklen);
  143. } else {
  144. newcidr->masklen = 128;
  145. }
  146. if (newcidr->masklen < 0 || newcidr->masklen > 128)
  147. goto error;
  148. /* skip past the opening [ */
  149. if (*cidr == '[')
  150. cidr++;
  151. if (get_name2addr6(cidr, RESOLVE, &newcidr->u.network6) > 0) {
  152. family = AF_INET6;
  153. } else {
  154. goto error;
  155. }
  156. }
  157. if (family == AF_INET) {
  158. /* masklen better be 0 =< masklen <= 32 */
  159. if (newcidr->masklen > 32)
  160. goto error;
  161. /* copy in the ip address */
  162. memset(networkip, '\0', 16);
  163. for (count = 0; count < 4; count++) {
  164. if (octets[count] > 255)
  165. goto error;
  166. snprintf(tempoctet, sizeof(octets[count]), "%u", octets[count]);
  167. strcat(networkip, tempoctet);
  168. /* we don't want a '.' at the end of the last octet */
  169. if (count < 3)
  170. strcat(networkip, ".");
  171. }
  172. /* copy over the network address and return */
  173. #ifdef HAVE_INET_ATON
  174. inet_aton(networkip, (struct in_addr *)&newcidr->u.network);
  175. #elif HAVE_INET_ADDR
  176. newcidr->network = inet_addr(networkip);
  177. #endif
  178. } else {
  179. /* Everything's done */
  180. }
  181. newcidr->family = family;
  182. return (newcidr);
  183. /* we only get here on error parsing input */
  184. error:
  185. errx(-1, "%s: %s", "Unable to parse as a valid CIDR", cidr);
  186. }
  187. static void
  188. mask_cidr6(char **cidrin, const char *delim)
  189. {
  190. if (**cidrin == '[' && *delim == ':') {
  191. char *p;
  192. ++*cidrin;
  193. /* make strtok happy */
  194. for (p = *cidrin; *p && *p != ']'; ++p) {
  195. if (*p == ':')
  196. *p = '#';
  197. }
  198. }
  199. }
  200. /**
  201. * parses a list of tcpr_cidr_t's input from the user which should be in the form
  202. * of x.x.x.x/y,x.x.x.x/y...
  203. * returns 1 for success, or fails to return on failure (exit 1)
  204. * since we use strtok to process cidr, it gets zeroed out.
  205. */
  206. int
  207. parse_cidr(tcpr_cidr_t **cidrdata, char *cidrin, char *delim)
  208. {
  209. tcpr_cidr_t *cidr_ptr; /* ptr to current cidr record */
  210. char *network;
  211. char *token = NULL;
  212. if (cidrin == NULL) {
  213. errx(-1, "%s", "Unable to parse empty CIDR");
  214. }
  215. mask_cidr6(&cidrin, delim);
  216. /* first iteration of input using strtok */
  217. network = strtok_r(cidrin, delim, &token);
  218. if (network == NULL)
  219. return 0;
  220. *cidrdata = cidr2cidr(network);
  221. cidr_ptr = *cidrdata;
  222. /* do the same with the rest of the input */
  223. while (1) {
  224. if (token)
  225. mask_cidr6(&token, delim);
  226. network = strtok_r(NULL, delim, &token);
  227. /* if that was the last CIDR, then kickout */
  228. if (network == NULL)
  229. break;
  230. /* next record */
  231. cidr_ptr->next = cidr2cidr(network);
  232. cidr_ptr = cidr_ptr->next;
  233. }
  234. return 1;
  235. }
  236. /**
  237. * parses a pair of IP addresses: <IP1>:<IP2> and processes it like:
  238. * -N 0.0.0.0/0:<IP1> -N 0.0.0.0/0:<IP2>
  239. * returns 1 for success or returns 0 on failure
  240. * since we use strtok to process optarg, it gets zeroed out
  241. */
  242. int
  243. parse_endpoints(tcpr_cidrmap_t **cidrmap1, tcpr_cidrmap_t **cidrmap2, const char *optarg)
  244. {
  245. #define NEWMAP_LEN (INET6_ADDRSTRLEN * 2)
  246. char *map = NULL, newmap[NEWMAP_LEN];
  247. char *token = NULL;
  248. char *string;
  249. char *p;
  250. int res = 0;
  251. string = safe_strdup(optarg);
  252. if (*string == '[') {
  253. /* ipv6 mode */
  254. memset(newmap, '\0', NEWMAP_LEN);
  255. p = strstr(string, "]:[");
  256. if (!p)
  257. goto done;
  258. *p = 0;
  259. strlcpy(newmap, "[::/0]:", NEWMAP_LEN);
  260. strlcat(newmap, string, NEWMAP_LEN);
  261. strlcat(newmap, "]", NEWMAP_LEN);
  262. if (!parse_cidr_map(cidrmap1, newmap))
  263. goto done;
  264. /* do again with the second IP */
  265. memset(newmap, '\0', NEWMAP_LEN);
  266. strlcpy(newmap, "[::/0]:", NEWMAP_LEN);
  267. strlcat(newmap, p + 2, NEWMAP_LEN);
  268. if (!parse_cidr_map(cidrmap2, newmap))
  269. goto done;
  270. } else {
  271. /* ipv4 mode */
  272. memset(newmap, '\0', NEWMAP_LEN);
  273. map = strtok_r(string, ":", &token);
  274. if (map == NULL)
  275. goto done;
  276. strlcpy(newmap, "0.0.0.0/0:", NEWMAP_LEN);
  277. strlcat(newmap, map, NEWMAP_LEN);
  278. if (!parse_cidr_map(cidrmap1, newmap))
  279. goto done;
  280. /* do again with the second IP */
  281. memset(newmap, '\0', NEWMAP_LEN);
  282. map = strtok_r(NULL, ":", &token);
  283. if (map == NULL)
  284. goto done;
  285. strlcpy(newmap, "0.0.0.0/0:", NEWMAP_LEN);
  286. strlcat(newmap, map, NEWMAP_LEN);
  287. if (!parse_cidr_map(cidrmap2, newmap))
  288. goto done;
  289. }
  290. /* success */
  291. res = 1;
  292. done:
  293. safe_free(string);
  294. return res;
  295. }
  296. /**
  297. * parses a list of tcpr_cidrmap_t's input from the user which should be in the form
  298. * of x.x.x.x/y:x.x.x.x/y,...
  299. * IPv6 syntax: [addr/y]:[addr/y],...
  300. * returns 1 for success, or returns 0 on failure
  301. * since we use strtok to process optarg, it gets zeroed out.
  302. */
  303. int
  304. parse_cidr_map(tcpr_cidrmap_t **cidrmap, const char *optarg)
  305. {
  306. tcpr_cidr_t *cidr = NULL;
  307. char *map;
  308. char *token = NULL, *string;
  309. tcpr_cidrmap_t *ptr;
  310. int res = 0;
  311. string = safe_strdup(optarg);
  312. /* first iteration */
  313. map = strtok_r(string, ",", &token);
  314. if (!parse_cidr(&cidr, map, ":"))
  315. goto done;
  316. /* must return a linked list of two */
  317. if (cidr->next == NULL)
  318. goto done;
  319. /* copy over */
  320. *cidrmap = new_cidr_map();
  321. ptr = *cidrmap;
  322. ptr->from = cidr;
  323. ptr->to = cidr->next;
  324. ptr->from->next = NULL;
  325. /* do the same with the reset of the input */
  326. while (1) {
  327. map = strtok_r(NULL, ",", &token);
  328. if (map == NULL)
  329. break;
  330. if (!parse_cidr(&cidr, map, ":"))
  331. goto done;
  332. /* must return a linked list of two */
  333. if (cidr->next == NULL)
  334. goto done;
  335. /* copy over */
  336. ptr->next = new_cidr_map();
  337. ptr = ptr->next;
  338. ptr->from = cidr;
  339. ptr->to = cidr->next;
  340. ptr->from->next = NULL;
  341. }
  342. /* success */
  343. res = 1;
  344. done:
  345. safe_free(string);
  346. return res;
  347. }
  348. /**
  349. * checks to see if the ip address is in the cidr
  350. * returns 1 for true, 0 for false
  351. */
  352. int
  353. ip_in_cidr(const tcpr_cidr_t *mycidr, const unsigned long ip)
  354. {
  355. unsigned long ipaddr, network, mask;
  356. int ret;
  357. #ifdef DEBUG
  358. char netstr[20];
  359. #endif
  360. if (mycidr->family != AF_INET)
  361. return 0;
  362. /* always return 1 if 0.0.0.0/0 */
  363. if (mycidr->masklen == 0 && mycidr->u.network == 0)
  364. return 1;
  365. mask = ~0; /* turn on all the bits */
  366. /* shift over by the correct number of bits */
  367. mask = mask << (32 - mycidr->masklen);
  368. /* apply the mask to the network and ip */
  369. ipaddr = ntohl(ip) & mask;
  370. network = htonl(mycidr->u.network) & mask;
  371. #ifdef DEBUG
  372. /* copy this for debug purposes, since it's not re-entrant */
  373. strlcpy(netstr, get_addr2name4(mycidr->u.network, RESOLVE), 20);
  374. #endif
  375. /* if they're the same, then ip is in network */
  376. if (network == ipaddr) {
  377. #ifdef DEBUG
  378. dbgx(1, "The ip %s is inside of %s/%d", get_addr2name4(ip, RESOLVE), netstr, mycidr->masklen);
  379. #endif
  380. ret = 1;
  381. } else {
  382. #ifdef DEBUG
  383. dbgx(1, "The ip %s is not inside of %s/%d", get_addr2name4(ip, RESOLVE), netstr, mycidr->masklen);
  384. #endif
  385. ret = 0;
  386. }
  387. return ret;
  388. }
  389. static int
  390. ip6_addr_is_unspec(const struct tcpr_in6_addr *addr)
  391. {
  392. return addr->tcpr_s6_addr32[0] == 0 && addr->tcpr_s6_addr32[1] == 0 && addr->tcpr_s6_addr32[2] == 0 &&
  393. addr->tcpr_s6_addr32[3] == 0;
  394. }
  395. int
  396. ip6_in_cidr(const tcpr_cidr_t *mycidr, const struct tcpr_in6_addr *addr)
  397. {
  398. int ret;
  399. #ifdef DEBUG
  400. char netstr[INET6_ADDRSTRLEN];
  401. #endif
  402. uint32_t i, j, k;
  403. if (mycidr->family != AF_INET6)
  404. return 0;
  405. /* always return 1 if ::/0 */
  406. if (mycidr->masklen == 0 && ip6_addr_is_unspec(addr))
  407. return 1;
  408. j = mycidr->masklen / 8;
  409. for (i = 0; i < j; i++) {
  410. if (addr->tcpr_s6_addr[i] != mycidr->u.network6.tcpr_s6_addr[i]) {
  411. ret = 0;
  412. goto out;
  413. }
  414. }
  415. if ((k = mycidr->masklen % 8) == 0) {
  416. ret = 1;
  417. goto out;
  418. }
  419. k = (uint32_t)~0 << (8 - k);
  420. i = addr->tcpr_s6_addr[j] & k;
  421. j = mycidr->u.network6.tcpr_s6_addr[j] & k;
  422. ret = i == j;
  423. out:
  424. #ifdef DEBUG
  425. /* copy this for debug purposes, since it's not re-entrant */
  426. strlcpy(netstr, get_addr2name6(&mycidr->u.network6, RESOLVE), INET6_ADDRSTRLEN);
  427. #endif
  428. /* if they're the same, then ip is in network */
  429. if (ret) {
  430. #ifdef DEBUG
  431. dbgx(1, "The ip %s is inside of %s/%d", get_addr2name6(addr, RESOLVE), netstr, mycidr->masklen);
  432. #endif
  433. } else {
  434. #ifdef DEBUG
  435. dbgx(1, "The ip %s is not inside of %s/%d", get_addr2name6(addr, RESOLVE), netstr, mycidr->masklen);
  436. #endif
  437. }
  438. return ret;
  439. }
  440. /**
  441. * iterates over cidrdata to find if a given ip matches
  442. * returns 1 for true, 0 for false
  443. */
  444. int
  445. check_ip_cidr(tcpr_cidr_t *cidrdata, const unsigned long ip)
  446. {
  447. tcpr_cidr_t *mycidr;
  448. /* if we have no cidrdata, of course it isn't in there
  449. * this actually should happen occasionally, so don't put an assert here
  450. */
  451. if (cidrdata == NULL)
  452. return 1;
  453. mycidr = cidrdata;
  454. /* loop through cidr */
  455. while (1) {
  456. /* if match, return 1 */
  457. if (ip_in_cidr(mycidr, ip)) {
  458. dbgx(3, "Found %s in cidr", get_addr2name4(ip, RESOLVE));
  459. return 1;
  460. }
  461. /* check for next record */
  462. if (mycidr->next != NULL) {
  463. mycidr = mycidr->next;
  464. } else {
  465. break;
  466. }
  467. }
  468. /* if we get here, no match */
  469. dbgx(3, "Didn't find %s in cidr", get_addr2name4(ip, RESOLVE));
  470. return 0;
  471. }
  472. int
  473. check_ip6_cidr(tcpr_cidr_t *cidrdata, const struct tcpr_in6_addr *addr)
  474. {
  475. tcpr_cidr_t *mycidr;
  476. /* if we have no cidrdata, of course it isn't in there
  477. * this actually should happen occasionally, so don't put an assert here
  478. */
  479. if (cidrdata == NULL) {
  480. return 1;
  481. }
  482. mycidr = cidrdata;
  483. /* loop through cidr */
  484. while (1) {
  485. /* if match, return 1 */
  486. if (ip6_in_cidr(mycidr, addr)) {
  487. dbgx(3, "Found %s in cidr", get_addr2name6(addr, RESOLVE));
  488. return 1;
  489. }
  490. /* check for next record */
  491. if (mycidr->next != NULL) {
  492. mycidr = mycidr->next;
  493. } else {
  494. break;
  495. }
  496. }
  497. /* if we get here, no match */
  498. dbgx(3, "Didn't find %s in cidr", get_addr2name6(addr, RESOLVE));
  499. return 0;
  500. }