rlpL4.c

Go to the documentation of this file.

/** \file rlpL4.c


 \brief Routines for building a L4 check structure from a formula.

******************************************************************************/

#include "rlp.h"


/**AutomaticStart*************************************************************/

static int L4CheckStructPopulateComponentStrings (Rlp_L4Check_t * result,
                          char *rawFormula);
static char *computeComponentN (char *aString, int N);
static Rlp_OperatorEnum_t computeTypeFromString (char *aString);
static Rlp_Formula_t *createIpFormulaFromList (char *aString);
static Rlp_Formula_t *processLeafIpFormula (char *leafString);
static char *clearBrackets (char *text);

/**AutomaticEnd***************************************************************/


/**
  * \brief  Allocate an L4 check struct
  * 
  * Initialize entries to NIL, which indicates
  * an any in that field
  * 
  */

Rlp_L4Check_t *
Rlp_AllocL4CheckStruct ()
{
  Rlp_L4Check_t *result = (Rlp_L4Check_t *) malloc (sizeof (Rlp_L4Check_t));
  result->type = Rlp_Undef_c;

  result->srcIp = NIL (Rlp_Formula_t);
  result->srcPort = NIL (Rlp_Formula_t);
  result->destIp = NIL (Rlp_Formula_t);
  result->destPort = NIL (Rlp_Formula_t);

  return result;
}


/**
  * \brief  Create an l4 check struct from a raw formula
  */

Rlp_L4Check_t *
Rlp_CreateL4CheckFromRawFormula (char *rawFormula)
{
  Rlp_L4Check_t *result = Rlp_AllocL4CheckStruct ();
  L4CheckStructPopulateComponentStrings (result, rawFormula);

  result->type = computeTypeFromString (result->typeString);

  result->srcIpString = clearBrackets (result->srcIpString);
  result->srcIp = Rlp_ComputeIpFormulaFromString (result->srcIpString);
  result->srcPort = Rlp_ComputePortFormulaFromString (result->srcPortString);

  result->destIpString = clearBrackets (result->destIpString);
  result->destIp = Rlp_ComputeIpFormulaFromString (result->destIpString);
  result->destPort =
    Rlp_ComputePortFormulaFromString (result->destPortString);

  return result;
}


/**
  * \brief  Compute the raw strings defining each component of the L4 struct
  */

static int
L4CheckStructPopulateComponentStrings (Rlp_L4Check_t * result,
                       char *rawFormula)
{
  char tmpBuf[1000];
  char *tmpPtr;

  // create a copy of rawformula with no leading whitespace,
  // and a single blank between fields
  while (isspace (*rawFormula))
    rawFormula++;
  tmpPtr = tmpBuf;
  while (*rawFormula != '\0')
    {
      if (!isspace (*rawFormula))
    {
      *tmpPtr = *rawFormula;
      tmpPtr++;
      rawFormula++;
    }
      else
    {
      *tmpPtr = ' ';
      tmpPtr++;
      while (isspace (*rawFormula))
        rawFormula++;
    }
    }

  // tcp $HN 80 -> 192.168.1.1 1234
  result->typeString = computeComponentN (tmpBuf, 0);
  result->srcIpString = computeComponentN (tmpBuf, 1);
  result->srcPortString = computeComponentN (tmpBuf, 2);
  result->destIpString = computeComponentN (tmpBuf, 4);
  result->destPortString = computeComponentN (tmpBuf, 5);

  return 0;

}


/**
  * \brief  Extract the N-th component of a string, assumed to be
  * separated by single blanks, no leading whitespace.
  * 
  * Numbering begins at 0, i.e., calling with "foo bar widget" 
  * with N=0 return foo.  Caller must free string.
  * 
  */

static char *
computeComponentN (char *aString, int N)
{
  char *result;

  char *tmp1Ptr;
  char *tmp2Ptr = util_strchr_N (aString, ' ', N + 1);
  *tmp2Ptr = '\0';

  if (N > 0)
    {
      tmp1Ptr = util_strchr_N (aString, ' ', N);
    }
  else
    {
      tmp1Ptr = aString;    // assume no white space in the beginning
    }

  while (isspace (*tmp1Ptr))
    tmp1Ptr++;
  result = strdup (tmp1Ptr);
  *tmp2Ptr = ' ';       // restore the ' '

  return result;
}


/** \brief  Compute type from raw string */

static Rlp_OperatorEnum_t
computeTypeFromString (char *aString)
{
  assert (util_strequal (aString, "icmp") ||
      util_strequal (aString, "ip") ||
      util_strequal (aString, "tcp") ||
      util_strequal (aString, "udp") ||
      util_strequal (aString, "generic") ||
      util_strequal (aString, "any"));

  if (util_strequal (aString, "icmp"))
    {
      return Rlp_Icmp_c;
    }
  if (util_strequal (aString, "ip"))
    {
      return Rlp_Ip_c;
    }
  if (util_strequal (aString, "tcp"))
    {
      return Rlp_Tcp_c;
    }
  if (util_strequal (aString, "udp"))
    {
      return Rlp_Udp_c;
    }
  if (util_strequal (aString, "any"))
    {
      return Rlp_Any_c;
    }
  if (util_strequal (aString, "generic"))
    {
      return Rlp_Generic_c;
    }

  return Rlp_Undef_c;
}


/**
  * \brief  Parse a raw string representing a set of IP addresses into
  * an Rlp_Formula_t
  * 
  Parse a raw string representing a set of IP addresses into
  an Rlp_Formula_t.  String is suppoed to be from the following
  grammar:
 
  <pre>
  !(foo) | !foo | foo,bar | IP/mask | IP |  DEFINE
  </pre>
  
  Note: we should not have whitespace anywhere.
  
  There is exactly one string in the ruleset that looks like
  [232.0.0.0/8,233.0.0.0/8,239.0.0.0/8]. For now, we're going
  to treat it by simply removing the leading and trailing brackets
  using the clearBrackets function call.
  
  */

Rlp_Formula_t *
Rlp_ComputeIpFormulaFromString (char *ipString)
{

  char *tmpString = ipString;
  char *checkString;
  int length;

  if (util_strequal (ipString, "any"))
    {
      return new_node (Rlp_Any_c, NIL (Rlp_Formula_t), NIL (Rlp_Formula_t));
    }

  Rlp_Formula_t *result;
  Rlp_Formula_t *nextFormula;
  Rlp_Formula_t *subFormula;

  char tmpBuf[1000];
  int leftParensCount;

  tmpString = ipString;
  if (*tmpString == '!')
    {
      if (*(tmpString + 1) == '(')
    {
      leftParensCount = 1;
      checkString = tmpString + 2;
      leftParensCount = 1;
      while (1)
        {
          if (*checkString == ')')
        {
          leftParensCount--;
        }
          if (*checkString == '(')
        {
          leftParensCount++;
        }
          if (leftParensCount == 0)
        {
          break;
        }
          checkString++;
        }
      length = checkString - (tmpString + 2);
      strncpy (tmpBuf, tmpString + 2, length);
      tmpBuf[length] = '\0';
    }
      else
    {
      checkString = strchr (tmpString, ',');
      if (checkString == NIL (char))
        {
          checkString = strchr (tmpString, '\0');
        }
      length = checkString - tmpString;
      strncpy (tmpBuf, tmpString + 1, length);
    }
      subFormula = Rlp_ComputeIpFormulaFromString (tmpBuf);
      result = new_node (Rlp_Negation_c, subFormula, NIL (Rlp_Formula_t));
      if (*checkString == '\0')
    {
      return result;
    }
      else
    {
      nextFormula = Rlp_ComputeIpFormulaFromString (checkString);
      Rlp_Formula_t *list =
        new_node (Rlp_List_c, result, NIL (Rlp_Formula_t));
      list->rchild =
        new_node (Rlp_List_c, nextFormula, NIL (Rlp_Formula_t));
      return list;
    }
    }
  else
    {
      // don't have a neg formula
      if (!strchr (tmpString, ','))
    {
      // reached last component
      return processLeafIpFormula (tmpString);
    }
      else
    {
      // recursion takes gobs of memory on long defined strings
      // in part because of the 1000 bytes tmpBuf
      return createIpFormulaFromList (tmpString);
      /* 
         checkString = strchr( tmpString, ',' );
         length = checkString - tmpString;
         strncpy( tmpBuf, tmpString, length );
         tmpBuf[length] = '\0';
         result = processLeafIpFormula( tmpBuf );
         nextFormula = Rlp_ComputeIpFormulaFromString( checkString + 1 );
         Rlp_Formula_t *list = new_node(  Rlp_List_c, result, NIL( Rlp_Formula_t ) );
         list->rchild = new_node( Rlp_List_c, nextFormula, NIL( Rlp_Formula_t ) );
         return list; 
       */
    }
    }
}


/**
  * \brief Iterative code to create ip formula for a string assumed
  * to be of the form foo,bar.
  */

static Rlp_Formula_t *
createIpFormulaFromList (char *aString)
{
  char *iterString = aString;
  Rlp_Formula_t *result =
    new_node (Rlp_List_c, NIL (Rlp_Formula_t), NIL (Rlp_Formula_t));
  Rlp_Formula_t *lastNode = result;
  char tmpBuf[1000];
  while (1)
    {

      char *commaString = strchr (iterString, ',');
      if (commaString == NIL (char))
    {
      lastNode->lchild = Rlp_ComputeIpFormulaFromString (iterString);
      return result;
    }
      int length = commaString - iterString;
      strncpy (tmpBuf, iterString, length);
      tmpBuf[length] = '\0';
      // had processLeafIpFormula here, but list element could be more general
      lastNode->lchild = Rlp_ComputeIpFormulaFromString (tmpBuf);
      lastNode->rchild =
    new_node (Rlp_List_c, NIL (Rlp_Formula_t), NIL (Rlp_Formula_t));
      lastNode = lastNode->rchild;
      iterString = commaString + 1;
    }
}


/**
  * \brief  Process an IP formula that's a leaf formula:
  * ip/mask | ip | DEFINE
  * 
  */

static Rlp_Formula_t *
processLeafIpFormula (char *leafString)
{
  char tmpBuf[1000];
  int length;
  u_int32_t ip;
  u_int32_t mask;
  int maskAmount;

  if (strchr (leafString, '.') && strchr (leafString, '/'))
    {
      // it's of the form 192.168.1.1/24 or 192.168.1.1/255.255.255.0
      char *endOfIp = strchr (leafString, '/');
      length = endOfIp - leafString;
      strncpy (tmpBuf, leafString, length);
      tmpBuf[length] = '\0';
      ip = Rlp_DotToInt (tmpBuf);
      char *beginningOfMask = endOfIp + 1;
      if (!strchr (beginningOfMask, '.'))
    {
      // it's of the form 192.168.1.1/24
      sscanf (beginningOfMask, "%u", &maskAmount);
      assert (maskAmount < 33);
      // 192.168.1.1/24 -> we're masking the last 8 bits, 
      // so the mask has to have the last ( 32 - 24 ) bits set to zero
      mask = (~0x0) << (32 - maskAmount);
    }
      else
    {
      mask = Rlp_DotToInt (beginningOfMask);
    }
      return new_node (Rlp_IpEntry_c, (Rlp_Formula_t *) ip,
               (Rlp_Formula_t *) mask);
    }
  if (strchr (leafString, '.'))
    {
      // it's of the form 192.168.1.1
      ip = Rlp_DotToInt (leafString);
      mask = (~0x0);        // all 1s
      return new_node (Rlp_IpEntry_c, (Rlp_Formula_t *) ip,
               (Rlp_Formula_t *) mask);
    }
  // it's got to be a macro
  return new_node (Rlp_Define_c, (Rlp_Formula_t *) strdup (leafString),
           NIL (Rlp_Formula_t));

}


/**
  * \brief  Convert a string in dotted decimal notation to an unsigned 32 bit int
  * 
  */

u_int32_t
Rlp_DotToInt (char *dotString)
{
  // dotString assumed to be of the form "123.23.12.191"
  int i;
  unsigned int ipAddress = 0;

  char *dupDotString = strdup (dotString);
  char *tmpString = dupDotString;
  char *freeString = dupDotString;

  for (i = 0; i < 4; i++)
    {
      while ((*tmpString != '.') && (*tmpString != '\0'))
    {
      tmpString++;
    }
      *tmpString = '\0';
      unsigned int tmpInt = atoi (dupDotString);
      dupDotString = &(tmpString[1]);   // go to the next 8-bit int
      tmpString = dupDotString;
      ipAddress = ipAddress * 256 + tmpInt;
    }
  free (freeString);
  return ipAddress;
}


/**
  \brief  Parse a raw string representing a set of ports into
  an Rlp_Formula_t
  
 Parse a raw string representing a set of ports into
 an Rlp_Formula_t.  String is supposed to be from the following
 grammar:
  
  <pre>
  !foo | 10:100  | 10: | :100 | DEFINE
  </pre>
  
  Note: we should not have whitespace anywhere.
  */


Rlp_Formula_t *
Rlp_ComputePortFormulaFromString (char *portString)
{
  Rlp_Formula_t *result;
  int highPort;
  int lowPort;

  if (util_strequal ("any", portString))
    {
      return new_node (Rlp_Any_c, NIL (Rlp_Formula_t), NIL (Rlp_Formula_t));
    }

  char *tmpString = portString;
  while (*tmpString != '\0')
    {
      if (isspace (*tmpString))
    {
      assert (0);
    }
      tmpString++;
    }

  bool negFlag = false;
  tmpString = portString;
  if (*tmpString == '!')
    {
      negFlag = true;
      tmpString++;
      while (isspace (*tmpString))
    {
      tmpString++;
    }
    }

  bool isSinglePort = true;
  int i;
  for (i = 0; i < (int) strlen (tmpString); i++)
    {
      if (!isdigit (tmpString[i]))
    {
      // not a single port, may be range or define
      isSinglePort = false;
      break;
    }
    }

  if (isSinglePort == true)
    {
      sscanf (tmpString, "%d", &lowPort);
      highPort = lowPort;
      Rlp_Formula_t *singlePort =
    new_node (Rlp_PortRange_c, (Rlp_Formula_t *) lowPort,
          (Rlp_Formula_t *) highPort);
      if (negFlag)
    {
      result = new_node (Rlp_Negation_c, singlePort, NIL (Rlp_Formula_t));
    }
      else
    {
      result = singlePort;
    }
      return result;
    }

  int length = strlen (tmpString);
  if (strchr (tmpString, ':'))
    {
      // it's a range
      if (tmpString[0] == ':')
    {
      // it's a range of the form :1024
      lowPort = 0;
      sscanf (tmpString + 1, "%d", &highPort);
    }
      else if (tmpString[length - 1] == ':')
    {
      // it's a range of the form 1024:
      highPort = 65535;
      sscanf (tmpString, "%d", &lowPort);
    }
      else
    {
      //  it's a range of the form 6000:6006
      sscanf (tmpString, "%d", &lowPort);
      tmpString = strchr (tmpString, ':');
      tmpString++;
      sscanf (tmpString, "%d", &highPort);
    }
      Rlp_Formula_t *rangeFormula =
    new_node (Rlp_PortRange_c, (Rlp_Formula_t *) lowPort,
          (Rlp_Formula_t *) highPort);
      if (negFlag)
    {
      result =
        new_node (Rlp_Negation_c, rangeFormula, NIL (Rlp_Formula_t));
    }
      else
    {
      result = rangeFormula;
    }
    }
  else
    {
      // it's a define
      result =
    new_node (Rlp_Define_c, (Rlp_Formula_t *) strdup (tmpString),
          NIL (Rlp_Formula_t));
      if (negFlag)
    {
      result = new_node (Rlp_Negation_c, result, NIL (Rlp_Formula_t));
    }
    }
  return result;
}


/** \brief  Take a string that potentially starts with [ and ends with
  ] and return a fresh string that does not include the brackets.
*/

static char *
clearBrackets (char *text)
{
  char *firstBracket = strchr (text, '[');
  if (firstBracket == NIL (char))
    {
      assert (strchr (text, ']') == NIL (char));
      return text;
    }

  char *lastBracket = strchr (text, ']');
  assert (lastBracket != NIL (char));

  // "[abc]0" becomes "abc0"
  //  012345           0123
  int bytesNeeded = lastBracket - firstBracket;
  char *result = (char *) malloc ((sizeof (char) * bytesNeeded));
  strncpy (result, (firstBracket + 1), (bytesNeeded - 1));
  result[bytesNeeded - 1] = '\0';

  free (text);

  return result;
}