1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright (C) 1993-2001, 2003 by Darren Reed. 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 5*0Sstevel@tonic-gate * 6*0Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 7*0Sstevel@tonic-gate * Use is subject to license terms. 8*0Sstevel@tonic-gate */ 9*0Sstevel@tonic-gate 10*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 11*0Sstevel@tonic-gate 12*0Sstevel@tonic-gate #ifdef __FreeBSD__ 13*0Sstevel@tonic-gate # ifndef __FreeBSD_cc_version 14*0Sstevel@tonic-gate # include <osreldate.h> 15*0Sstevel@tonic-gate # else 16*0Sstevel@tonic-gate # if __FreeBSD_cc_version < 430000 17*0Sstevel@tonic-gate # include <osreldate.h> 18*0Sstevel@tonic-gate # endif 19*0Sstevel@tonic-gate # endif 20*0Sstevel@tonic-gate #endif 21*0Sstevel@tonic-gate #include <sys/ioctl.h> 22*0Sstevel@tonic-gate #include <fcntl.h> 23*0Sstevel@tonic-gate #include <nlist.h> 24*0Sstevel@tonic-gate #include <ctype.h> 25*0Sstevel@tonic-gate #include <stddef.h> 26*0Sstevel@tonic-gate #include "ipf.h" 27*0Sstevel@tonic-gate #include "ipl.h" 28*0Sstevel@tonic-gate #if defined(STATETOP) 29*0Sstevel@tonic-gate # if defined(_BSDI_VERSION) 30*0Sstevel@tonic-gate # undef STATETOP) 31*0Sstevel@tonic-gate # endif 32*0Sstevel@tonic-gate # if defined(__FreeBSD__) && \ 33*0Sstevel@tonic-gate (!defined(__FreeBSD_version) || (__FreeBSD_version < 430000)) 34*0Sstevel@tonic-gate # undef STATETOP 35*0Sstevel@tonic-gate # endif 36*0Sstevel@tonic-gate # if defined(__NetBSD_Version__) && (__NetBSD_Version__ < 105000000) 37*0Sstevel@tonic-gate # undef STATETOP 38*0Sstevel@tonic-gate # endif 39*0Sstevel@tonic-gate # if defined(sun) 40*0Sstevel@tonic-gate # if defined(__svr4__) || defined(__SVR4) 41*0Sstevel@tonic-gate # include <sys/select.h> 42*0Sstevel@tonic-gate # else 43*0Sstevel@tonic-gate # undef STATETOP /* NOT supported on SunOS4 */ 44*0Sstevel@tonic-gate # endif 45*0Sstevel@tonic-gate # endif 46*0Sstevel@tonic-gate #endif 47*0Sstevel@tonic-gate #if defined(STATETOP) && !defined(linux) 48*0Sstevel@tonic-gate # include <netinet/ip_var.h> 49*0Sstevel@tonic-gate # include <netinet/tcp_fsm.h> 50*0Sstevel@tonic-gate #endif 51*0Sstevel@tonic-gate #ifdef STATETOP 52*0Sstevel@tonic-gate #if SOLARIS2 >= 10 53*0Sstevel@tonic-gate # include "ipl.h" 54*0Sstevel@tonic-gate #else 55*0Sstevel@tonic-gate # include "netinet/ipl.h" 56*0Sstevel@tonic-gate #endif 57*0Sstevel@tonic-gate # if SOLARIS || defined(__NetBSD__) || defined(_BSDI_VERSION) || \ 58*0Sstevel@tonic-gate defined(__sgi) 59*0Sstevel@tonic-gate # ifdef ERR 60*0Sstevel@tonic-gate # undef ERR 61*0Sstevel@tonic-gate # endif 62*0Sstevel@tonic-gate # include <curses.h> 63*0Sstevel@tonic-gate # else /* SOLARIS */ 64*0Sstevel@tonic-gate # include <ncurses.h> 65*0Sstevel@tonic-gate # endif /* SOLARIS */ 66*0Sstevel@tonic-gate #endif /* STATETOP */ 67*0Sstevel@tonic-gate #include "kmem.h" 68*0Sstevel@tonic-gate #if defined(__NetBSD__) || (__OpenBSD__) 69*0Sstevel@tonic-gate # include <paths.h> 70*0Sstevel@tonic-gate #endif 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate #if !defined(lint) 73*0Sstevel@tonic-gate static const char sccsid[] = "@(#)fils.c 1.21 4/20/96 (C) 1993-2000 Darren Reed"; 74*0Sstevel@tonic-gate static const char rcsid[] = "@(#)$Id: ipfstat.c,v 1.28 2003/07/01 01:03:04 darrenr Exp $"; 75*0Sstevel@tonic-gate #endif 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate #ifdef __hpux 78*0Sstevel@tonic-gate # define nlist nlist64 79*0Sstevel@tonic-gate #endif 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate extern char *optarg; 82*0Sstevel@tonic-gate extern int optind; 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate #define PRINTF (void)printf 85*0Sstevel@tonic-gate #define FPRINTF (void)fprintf 86*0Sstevel@tonic-gate #define F_IN 0 87*0Sstevel@tonic-gate #define F_OUT 1 88*0Sstevel@tonic-gate #define F_ACIN 2 89*0Sstevel@tonic-gate #define F_ACOUT 3 90*0Sstevel@tonic-gate static char *filters[4] = { "ipfilter(in)", "ipfilter(out)", 91*0Sstevel@tonic-gate "ipacct(in)", "ipacct(out)" }; 92*0Sstevel@tonic-gate static int state_logging = -1; 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate int opts = 0; 95*0Sstevel@tonic-gate int use_inet6 = 0; 96*0Sstevel@tonic-gate int live_kernel = 1; 97*0Sstevel@tonic-gate int state_fd = -1; 98*0Sstevel@tonic-gate int ipf_fd = -1; 99*0Sstevel@tonic-gate 100*0Sstevel@tonic-gate #ifdef STATETOP 101*0Sstevel@tonic-gate #define STSTRSIZE 80 102*0Sstevel@tonic-gate #define STGROWSIZE 16 103*0Sstevel@tonic-gate #define HOSTNMLEN 40 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate #define STSORT_PR 0 106*0Sstevel@tonic-gate #define STSORT_PKTS 1 107*0Sstevel@tonic-gate #define STSORT_BYTES 2 108*0Sstevel@tonic-gate #define STSORT_TTL 3 109*0Sstevel@tonic-gate #define STSORT_SRCIP 4 110*0Sstevel@tonic-gate #define STSORT_DSTIP 5 111*0Sstevel@tonic-gate #define STSORT_MAX STSORT_DSTIP 112*0Sstevel@tonic-gate #define STSORT_DEFAULT STSORT_BYTES 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate typedef struct statetop { 116*0Sstevel@tonic-gate i6addr_t st_src; 117*0Sstevel@tonic-gate i6addr_t st_dst; 118*0Sstevel@tonic-gate u_short st_sport; 119*0Sstevel@tonic-gate u_short st_dport; 120*0Sstevel@tonic-gate u_char st_p; 121*0Sstevel@tonic-gate u_char st_state[2]; 122*0Sstevel@tonic-gate U_QUAD_T st_pkts; 123*0Sstevel@tonic-gate U_QUAD_T st_bytes; 124*0Sstevel@tonic-gate u_long st_age; 125*0Sstevel@tonic-gate } statetop_t; 126*0Sstevel@tonic-gate #endif 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate extern int main __P((int, char *[])); 129*0Sstevel@tonic-gate static void showstats __P((friostat_t *, u_32_t)); 130*0Sstevel@tonic-gate static void showfrstates __P((ipfrstat_t *)); 131*0Sstevel@tonic-gate static void showlist __P((friostat_t *)); 132*0Sstevel@tonic-gate static void showipstates __P((ips_stat_t *)); 133*0Sstevel@tonic-gate static void showauthstates __P((fr_authstat_t *)); 134*0Sstevel@tonic-gate static void showgroups __P((friostat_t *)); 135*0Sstevel@tonic-gate static void Usage __P((char *)); 136*0Sstevel@tonic-gate static void printlist __P((frentry_t *, char *)); 137*0Sstevel@tonic-gate static void parse_ipportstr __P((const char *, struct in_addr *, int *)); 138*0Sstevel@tonic-gate static void ipfstate_live __P((char *, friostat_t **, ips_stat_t **, 139*0Sstevel@tonic-gate ipfrstat_t **, fr_authstat_t **, u_32_t *)); 140*0Sstevel@tonic-gate static void ipfstate_dead __P((char *, friostat_t **, ips_stat_t **, 141*0Sstevel@tonic-gate ipfrstat_t **, fr_authstat_t **, u_32_t *)); 142*0Sstevel@tonic-gate #ifdef STATETOP 143*0Sstevel@tonic-gate static void topipstates __P((struct in_addr, struct in_addr, int, int, int, int, int)); 144*0Sstevel@tonic-gate static char *ttl_to_string __P((long)); 145*0Sstevel@tonic-gate static int sort_p __P((const void *, const void *)); 146*0Sstevel@tonic-gate static int sort_pkts __P((const void *, const void *)); 147*0Sstevel@tonic-gate static int sort_bytes __P((const void *, const void *)); 148*0Sstevel@tonic-gate static int sort_ttl __P((const void *, const void *)); 149*0Sstevel@tonic-gate static int sort_srcip __P((const void *, const void *)); 150*0Sstevel@tonic-gate static int sort_dstip __P((const void *, const void *)); 151*0Sstevel@tonic-gate #endif 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate static void Usage(name) 155*0Sstevel@tonic-gate char *name; 156*0Sstevel@tonic-gate { 157*0Sstevel@tonic-gate #ifdef USE_INET6 158*0Sstevel@tonic-gate fprintf(stderr, "Usage: %s [-6aAfhIinosv] [-d <device>]\n", name); 159*0Sstevel@tonic-gate #else 160*0Sstevel@tonic-gate fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name); 161*0Sstevel@tonic-gate #endif 162*0Sstevel@tonic-gate fprintf(stderr, "\t\t[-M corefile] [-N symbol-list]\n"); 163*0Sstevel@tonic-gate fprintf(stderr, " %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name); 164*0Sstevel@tonic-gate exit(1); 165*0Sstevel@tonic-gate } 166*0Sstevel@tonic-gate 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate int main(argc,argv) 169*0Sstevel@tonic-gate int argc; 170*0Sstevel@tonic-gate char *argv[]; 171*0Sstevel@tonic-gate { 172*0Sstevel@tonic-gate fr_authstat_t frauthst; 173*0Sstevel@tonic-gate fr_authstat_t *frauthstp = &frauthst; 174*0Sstevel@tonic-gate friostat_t fio; 175*0Sstevel@tonic-gate friostat_t *fiop = &fio; 176*0Sstevel@tonic-gate ips_stat_t ipsst; 177*0Sstevel@tonic-gate ips_stat_t *ipsstp = &ipsst; 178*0Sstevel@tonic-gate ipfrstat_t ifrst; 179*0Sstevel@tonic-gate ipfrstat_t *ifrstp = &ifrst; 180*0Sstevel@tonic-gate char *device = IPL_NAME, *memf = NULL; 181*0Sstevel@tonic-gate char *kern = NULL; 182*0Sstevel@tonic-gate int c, myoptind; 183*0Sstevel@tonic-gate struct protoent *proto; 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate int protocol = -1; /* -1 = wild card for any protocol */ 186*0Sstevel@tonic-gate int refreshtime = 1; /* default update time */ 187*0Sstevel@tonic-gate int sport = -1; /* -1 = wild card for any source port */ 188*0Sstevel@tonic-gate int dport = -1; /* -1 = wild card for any dest port */ 189*0Sstevel@tonic-gate int topclosed = 0; /* do not show closed tcp sessions */ 190*0Sstevel@tonic-gate struct in_addr saddr, daddr; 191*0Sstevel@tonic-gate u_32_t frf; 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate saddr.s_addr = INADDR_ANY; /* default any source addr */ 194*0Sstevel@tonic-gate daddr.s_addr = INADDR_ANY; /* default any dest addr */ 195*0Sstevel@tonic-gate 196*0Sstevel@tonic-gate /* 197*0Sstevel@tonic-gate * Parse these two arguments now lest there be any buffer overflows 198*0Sstevel@tonic-gate * in the parsing of the rest. 199*0Sstevel@tonic-gate */ 200*0Sstevel@tonic-gate myoptind = optind; 201*0Sstevel@tonic-gate while ((c = getopt(argc, argv, "6aACdfghIilnostvD:M:N:P:S:T:")) != -1) 202*0Sstevel@tonic-gate switch (c) 203*0Sstevel@tonic-gate { 204*0Sstevel@tonic-gate case 'M' : 205*0Sstevel@tonic-gate memf = optarg; 206*0Sstevel@tonic-gate live_kernel = 0; 207*0Sstevel@tonic-gate break; 208*0Sstevel@tonic-gate case 'N' : 209*0Sstevel@tonic-gate kern = optarg; 210*0Sstevel@tonic-gate live_kernel = 0; 211*0Sstevel@tonic-gate break; 212*0Sstevel@tonic-gate } 213*0Sstevel@tonic-gate optind = myoptind; 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate if (live_kernel == 1) { 216*0Sstevel@tonic-gate if ((state_fd = open(IPSTATE_NAME, O_RDONLY)) == -1) { 217*0Sstevel@tonic-gate perror("open"); 218*0Sstevel@tonic-gate exit(-1); 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate if ((ipf_fd = open(device, O_RDONLY)) == -1) { 221*0Sstevel@tonic-gate perror("open"); 222*0Sstevel@tonic-gate exit(-1); 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate } 225*0Sstevel@tonic-gate 226*0Sstevel@tonic-gate if (kern != NULL || memf != NULL) 227*0Sstevel@tonic-gate { 228*0Sstevel@tonic-gate (void)setgid(getgid()); 229*0Sstevel@tonic-gate (void)setreuid(getuid(), getuid()); 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate if (openkmem(kern, memf) == -1) 233*0Sstevel@tonic-gate exit(-1); 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate (void)setgid(getgid()); 236*0Sstevel@tonic-gate (void)setreuid(getuid(), getuid()); 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate while ((c = getopt(argc, argv, "6aACdfghIilnostvD:M:N:P:S:T:")) != -1) 239*0Sstevel@tonic-gate { 240*0Sstevel@tonic-gate switch (c) 241*0Sstevel@tonic-gate { 242*0Sstevel@tonic-gate #ifdef USE_INET6 243*0Sstevel@tonic-gate case '6' : 244*0Sstevel@tonic-gate use_inet6 = 1; 245*0Sstevel@tonic-gate break; 246*0Sstevel@tonic-gate #endif 247*0Sstevel@tonic-gate case 'a' : 248*0Sstevel@tonic-gate opts |= OPT_ACCNT|OPT_SHOWLIST; 249*0Sstevel@tonic-gate break; 250*0Sstevel@tonic-gate case 'A' : 251*0Sstevel@tonic-gate opts |= OPT_AUTHSTATS; 252*0Sstevel@tonic-gate break; 253*0Sstevel@tonic-gate case 'C' : 254*0Sstevel@tonic-gate topclosed = 1; 255*0Sstevel@tonic-gate break; 256*0Sstevel@tonic-gate case 'd' : 257*0Sstevel@tonic-gate opts |= OPT_DEBUG; 258*0Sstevel@tonic-gate break; 259*0Sstevel@tonic-gate case 'D' : 260*0Sstevel@tonic-gate parse_ipportstr(optarg, &daddr, &dport); 261*0Sstevel@tonic-gate break; 262*0Sstevel@tonic-gate case 'f' : 263*0Sstevel@tonic-gate opts |= OPT_FRSTATES; 264*0Sstevel@tonic-gate break; 265*0Sstevel@tonic-gate case 'g' : 266*0Sstevel@tonic-gate opts |= OPT_GROUPS; 267*0Sstevel@tonic-gate break; 268*0Sstevel@tonic-gate case 'h' : 269*0Sstevel@tonic-gate opts |= OPT_HITS; 270*0Sstevel@tonic-gate break; 271*0Sstevel@tonic-gate case 'i' : 272*0Sstevel@tonic-gate opts |= OPT_INQUE|OPT_SHOWLIST; 273*0Sstevel@tonic-gate break; 274*0Sstevel@tonic-gate case 'I' : 275*0Sstevel@tonic-gate opts |= OPT_INACTIVE; 276*0Sstevel@tonic-gate break; 277*0Sstevel@tonic-gate case 'l' : 278*0Sstevel@tonic-gate opts |= OPT_SHOWLIST; 279*0Sstevel@tonic-gate break; 280*0Sstevel@tonic-gate case 'M' : 281*0Sstevel@tonic-gate break; 282*0Sstevel@tonic-gate case 'N' : 283*0Sstevel@tonic-gate break; 284*0Sstevel@tonic-gate case 'n' : 285*0Sstevel@tonic-gate opts |= OPT_SHOWLINENO; 286*0Sstevel@tonic-gate break; 287*0Sstevel@tonic-gate case 'o' : 288*0Sstevel@tonic-gate opts |= OPT_OUTQUE|OPT_SHOWLIST; 289*0Sstevel@tonic-gate break; 290*0Sstevel@tonic-gate case 'P' : 291*0Sstevel@tonic-gate if ((proto = getprotobyname(optarg)) != NULL) { 292*0Sstevel@tonic-gate protocol = proto->p_proto; 293*0Sstevel@tonic-gate } else if (!sscanf(optarg, "%d", &protocol) || 294*0Sstevel@tonic-gate (protocol < 0)) { 295*0Sstevel@tonic-gate fprintf(stderr, "%s : Invalid protocol: %s\n", 296*0Sstevel@tonic-gate argv[0], optarg); 297*0Sstevel@tonic-gate exit(-2); 298*0Sstevel@tonic-gate } 299*0Sstevel@tonic-gate break; 300*0Sstevel@tonic-gate case 's' : 301*0Sstevel@tonic-gate opts |= OPT_IPSTATES; 302*0Sstevel@tonic-gate break; 303*0Sstevel@tonic-gate case 'S' : 304*0Sstevel@tonic-gate parse_ipportstr(optarg, &saddr, &sport); 305*0Sstevel@tonic-gate break; 306*0Sstevel@tonic-gate case 't' : 307*0Sstevel@tonic-gate #ifdef STATETOP 308*0Sstevel@tonic-gate opts |= OPT_STATETOP; 309*0Sstevel@tonic-gate break; 310*0Sstevel@tonic-gate #else 311*0Sstevel@tonic-gate fprintf(stderr, 312*0Sstevel@tonic-gate "%s : state top facility not compiled in\n", 313*0Sstevel@tonic-gate argv[0]); 314*0Sstevel@tonic-gate exit(-2); 315*0Sstevel@tonic-gate #endif 316*0Sstevel@tonic-gate case 'T' : 317*0Sstevel@tonic-gate if (!sscanf(optarg, "%d", &refreshtime) || 318*0Sstevel@tonic-gate (refreshtime <= 0)) { 319*0Sstevel@tonic-gate fprintf(stderr, 320*0Sstevel@tonic-gate "%s : Invalid refreshtime < 1 : %s\n", 321*0Sstevel@tonic-gate argv[0], optarg); 322*0Sstevel@tonic-gate exit(-2); 323*0Sstevel@tonic-gate } 324*0Sstevel@tonic-gate break; 325*0Sstevel@tonic-gate case 'v' : 326*0Sstevel@tonic-gate opts |= OPT_VERBOSE; 327*0Sstevel@tonic-gate opts |= OPT_UNDEF; 328*0Sstevel@tonic-gate break; 329*0Sstevel@tonic-gate default : 330*0Sstevel@tonic-gate Usage(argv[0]); 331*0Sstevel@tonic-gate break; 332*0Sstevel@tonic-gate } 333*0Sstevel@tonic-gate } 334*0Sstevel@tonic-gate 335*0Sstevel@tonic-gate if (live_kernel == 1) { 336*0Sstevel@tonic-gate bzero((char *)&fio, sizeof(fio)); 337*0Sstevel@tonic-gate bzero((char *)&ipsst, sizeof(ipsst)); 338*0Sstevel@tonic-gate bzero((char *)&ifrst, sizeof(ifrst)); 339*0Sstevel@tonic-gate 340*0Sstevel@tonic-gate ipfstate_live(device, &fiop, &ipsstp, &ifrstp, 341*0Sstevel@tonic-gate &frauthstp, &frf); 342*0Sstevel@tonic-gate } else 343*0Sstevel@tonic-gate ipfstate_dead(kern, &fiop, &ipsstp, &ifrstp, &frauthstp, &frf); 344*0Sstevel@tonic-gate 345*0Sstevel@tonic-gate if (opts & OPT_IPSTATES) { 346*0Sstevel@tonic-gate showipstates(ipsstp); 347*0Sstevel@tonic-gate } else if (opts & OPT_SHOWLIST) { 348*0Sstevel@tonic-gate showlist(fiop); 349*0Sstevel@tonic-gate if ((opts & OPT_OUTQUE) && (opts & OPT_INQUE)){ 350*0Sstevel@tonic-gate opts &= ~OPT_OUTQUE; 351*0Sstevel@tonic-gate showlist(fiop); 352*0Sstevel@tonic-gate } 353*0Sstevel@tonic-gate } else { 354*0Sstevel@tonic-gate if (opts & OPT_FRSTATES) 355*0Sstevel@tonic-gate showfrstates(ifrstp); 356*0Sstevel@tonic-gate #ifdef STATETOP 357*0Sstevel@tonic-gate else if (opts & OPT_STATETOP) 358*0Sstevel@tonic-gate topipstates(saddr, daddr, sport, dport, 359*0Sstevel@tonic-gate protocol, refreshtime, topclosed); 360*0Sstevel@tonic-gate #endif 361*0Sstevel@tonic-gate else if (opts & OPT_AUTHSTATS) 362*0Sstevel@tonic-gate showauthstates(frauthstp); 363*0Sstevel@tonic-gate else if (opts & OPT_GROUPS) 364*0Sstevel@tonic-gate showgroups(fiop); 365*0Sstevel@tonic-gate else 366*0Sstevel@tonic-gate showstats(fiop, frf); 367*0Sstevel@tonic-gate } 368*0Sstevel@tonic-gate return 0; 369*0Sstevel@tonic-gate } 370*0Sstevel@tonic-gate 371*0Sstevel@tonic-gate 372*0Sstevel@tonic-gate /* 373*0Sstevel@tonic-gate * Fill in the stats structures from the live kernel, using a combination 374*0Sstevel@tonic-gate * of ioctl's and copying directly from kernel memory. 375*0Sstevel@tonic-gate */ 376*0Sstevel@tonic-gate static void ipfstate_live(device, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp) 377*0Sstevel@tonic-gate char *device; 378*0Sstevel@tonic-gate friostat_t **fiopp; 379*0Sstevel@tonic-gate ips_stat_t **ipsstpp; 380*0Sstevel@tonic-gate ipfrstat_t **ifrstpp; 381*0Sstevel@tonic-gate fr_authstat_t **frauthstpp; 382*0Sstevel@tonic-gate u_32_t *frfp; 383*0Sstevel@tonic-gate { 384*0Sstevel@tonic-gate ipfobj_t ipfo; 385*0Sstevel@tonic-gate 386*0Sstevel@tonic-gate if (checkrev(device) == -1) { 387*0Sstevel@tonic-gate fprintf(stderr, "User/kernel version check failed\n"); 388*0Sstevel@tonic-gate exit(1); 389*0Sstevel@tonic-gate } 390*0Sstevel@tonic-gate 391*0Sstevel@tonic-gate if ((opts & OPT_AUTHSTATS) == 0) { 392*0Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo)); 393*0Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION; 394*0Sstevel@tonic-gate ipfo.ipfo_size = sizeof(friostat_t); 395*0Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)*fiopp; 396*0Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_IPFSTAT; 397*0Sstevel@tonic-gate 398*0Sstevel@tonic-gate if (ioctl(ipf_fd, SIOCGETFS, &ipfo) == -1) { 399*0Sstevel@tonic-gate perror("ioctl(ipf:SIOCGETFS)"); 400*0Sstevel@tonic-gate exit(-1); 401*0Sstevel@tonic-gate } 402*0Sstevel@tonic-gate 403*0Sstevel@tonic-gate if (ioctl(ipf_fd, SIOCGETFF, frfp) == -1) 404*0Sstevel@tonic-gate perror("ioctl(SIOCGETFF)"); 405*0Sstevel@tonic-gate } 406*0Sstevel@tonic-gate 407*0Sstevel@tonic-gate if ((opts & OPT_IPSTATES) != 0) { 408*0Sstevel@tonic-gate 409*0Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo)); 410*0Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION; 411*0Sstevel@tonic-gate ipfo.ipfo_size = sizeof(ips_stat_t); 412*0Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)*ipsstpp; 413*0Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_STATESTAT; 414*0Sstevel@tonic-gate 415*0Sstevel@tonic-gate if ((ioctl(state_fd, SIOCGETFS, &ipfo) == -1)) { 416*0Sstevel@tonic-gate perror("ioctl(state:SIOCGETFS)"); 417*0Sstevel@tonic-gate exit(-1); 418*0Sstevel@tonic-gate } 419*0Sstevel@tonic-gate if (ioctl(state_fd, SIOCGETLG, &state_logging) == -1) { 420*0Sstevel@tonic-gate perror("ioctl(state:SIOCGETLG)"); 421*0Sstevel@tonic-gate exit(-1); 422*0Sstevel@tonic-gate } 423*0Sstevel@tonic-gate } 424*0Sstevel@tonic-gate 425*0Sstevel@tonic-gate if ((opts & OPT_FRSTATES) != 0) { 426*0Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo)); 427*0Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION; 428*0Sstevel@tonic-gate ipfo.ipfo_size = sizeof(ipfrstat_t); 429*0Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)*ifrstpp; 430*0Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_FRAGSTAT; 431*0Sstevel@tonic-gate 432*0Sstevel@tonic-gate if (ioctl(ipf_fd, SIOCGFRST, &ipfo) == -1) { 433*0Sstevel@tonic-gate perror("ioctl(SIOCGFRST)"); 434*0Sstevel@tonic-gate exit(-1); 435*0Sstevel@tonic-gate } 436*0Sstevel@tonic-gate } 437*0Sstevel@tonic-gate 438*0Sstevel@tonic-gate if (opts & OPT_VERBOSE) 439*0Sstevel@tonic-gate PRINTF("opts %#x name %s\n", opts, device); 440*0Sstevel@tonic-gate 441*0Sstevel@tonic-gate if ((opts & OPT_AUTHSTATS) != 0) { 442*0Sstevel@tonic-gate if (ipf_fd >= 0) { 443*0Sstevel@tonic-gate close(ipf_fd); 444*0Sstevel@tonic-gate ipf_fd = -1; 445*0Sstevel@tonic-gate } 446*0Sstevel@tonic-gate device = IPAUTH_NAME; 447*0Sstevel@tonic-gate if ((ipf_fd = open(device, O_RDONLY)) == -1) { 448*0Sstevel@tonic-gate perror("open"); 449*0Sstevel@tonic-gate exit(-1); 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate 452*0Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo)); 453*0Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION; 454*0Sstevel@tonic-gate ipfo.ipfo_size = sizeof(fr_authstat_t); 455*0Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)*frauthstpp; 456*0Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_AUTHSTAT; 457*0Sstevel@tonic-gate 458*0Sstevel@tonic-gate if (ioctl(ipf_fd, SIOCATHST, &ipfo) == -1) { 459*0Sstevel@tonic-gate perror("ioctl(SIOCATHST)"); 460*0Sstevel@tonic-gate exit(-1); 461*0Sstevel@tonic-gate } 462*0Sstevel@tonic-gate } 463*0Sstevel@tonic-gate } 464*0Sstevel@tonic-gate 465*0Sstevel@tonic-gate 466*0Sstevel@tonic-gate /* 467*0Sstevel@tonic-gate * Build up the stats structures from data held in the "core" memory. 468*0Sstevel@tonic-gate * This is mainly useful when looking at data in crash dumps and ioctl's 469*0Sstevel@tonic-gate * just won't work any more. 470*0Sstevel@tonic-gate */ 471*0Sstevel@tonic-gate static void ipfstate_dead(kernel, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp) 472*0Sstevel@tonic-gate char *kernel; 473*0Sstevel@tonic-gate friostat_t **fiopp; 474*0Sstevel@tonic-gate ips_stat_t **ipsstpp; 475*0Sstevel@tonic-gate ipfrstat_t **ifrstpp; 476*0Sstevel@tonic-gate fr_authstat_t **frauthstpp; 477*0Sstevel@tonic-gate u_32_t *frfp; 478*0Sstevel@tonic-gate { 479*0Sstevel@tonic-gate static fr_authstat_t frauthst, *frauthstp; 480*0Sstevel@tonic-gate static ips_stat_t ipsst, *ipsstp; 481*0Sstevel@tonic-gate static ipfrstat_t ifrst, *ifrstp; 482*0Sstevel@tonic-gate static friostat_t fio, *fiop; 483*0Sstevel@tonic-gate int temp; 484*0Sstevel@tonic-gate 485*0Sstevel@tonic-gate void *rules[2][2]; 486*0Sstevel@tonic-gate struct nlist deadlist[43] = { 487*0Sstevel@tonic-gate { "fr_authstats" }, /* 0 */ 488*0Sstevel@tonic-gate { "fae_list" }, 489*0Sstevel@tonic-gate { "ipauth" }, 490*0Sstevel@tonic-gate { "fr_authlist" }, 491*0Sstevel@tonic-gate { "fr_authstart" }, 492*0Sstevel@tonic-gate { "fr_authend" }, /* 5 */ 493*0Sstevel@tonic-gate { "fr_authnext" }, 494*0Sstevel@tonic-gate { "fr_auth" }, 495*0Sstevel@tonic-gate { "fr_authused" }, 496*0Sstevel@tonic-gate { "fr_authsize" }, 497*0Sstevel@tonic-gate { "fr_defaultauthage" }, /* 10 */ 498*0Sstevel@tonic-gate { "fr_authpkts" }, 499*0Sstevel@tonic-gate { "fr_auth_lock" }, 500*0Sstevel@tonic-gate { "frstats" }, 501*0Sstevel@tonic-gate { "ips_stats" }, 502*0Sstevel@tonic-gate { "ips_num" }, /* 15 */ 503*0Sstevel@tonic-gate { "ips_wild" }, 504*0Sstevel@tonic-gate { "ips_list" }, 505*0Sstevel@tonic-gate { "ips_table" }, 506*0Sstevel@tonic-gate { "fr_statemax" }, 507*0Sstevel@tonic-gate { "fr_statesize" }, /* 20 */ 508*0Sstevel@tonic-gate { "fr_state_doflush" }, 509*0Sstevel@tonic-gate { "fr_state_lock" }, 510*0Sstevel@tonic-gate { "ipfr_heads" }, 511*0Sstevel@tonic-gate { "ipfr_nattab" }, 512*0Sstevel@tonic-gate { "ipfr_stats" }, /* 25 */ 513*0Sstevel@tonic-gate { "ipfr_inuse" }, 514*0Sstevel@tonic-gate { "fr_ipfrttl" }, 515*0Sstevel@tonic-gate { "fr_frag_lock" }, 516*0Sstevel@tonic-gate { "ipfr_timer_id" }, 517*0Sstevel@tonic-gate { "fr_nat_lock" }, /* 30 */ 518*0Sstevel@tonic-gate { "ipfilter" }, 519*0Sstevel@tonic-gate { "ipfilter6" }, 520*0Sstevel@tonic-gate { "ipacct" }, 521*0Sstevel@tonic-gate { "ipacct6" }, 522*0Sstevel@tonic-gate { "ipl_frouteok" }, /* 35 */ 523*0Sstevel@tonic-gate { "fr_running" }, 524*0Sstevel@tonic-gate { "ipfgroups" }, 525*0Sstevel@tonic-gate { "fr_active" }, 526*0Sstevel@tonic-gate { "fr_pass" }, 527*0Sstevel@tonic-gate { "fr_flags" }, /* 40 */ 528*0Sstevel@tonic-gate { "ipstate_logging" }, 529*0Sstevel@tonic-gate { NULL } 530*0Sstevel@tonic-gate }; 531*0Sstevel@tonic-gate 532*0Sstevel@tonic-gate 533*0Sstevel@tonic-gate frauthstp = &frauthst; 534*0Sstevel@tonic-gate ipsstp = &ipsst; 535*0Sstevel@tonic-gate ifrstp = &ifrst; 536*0Sstevel@tonic-gate fiop = &fio; 537*0Sstevel@tonic-gate 538*0Sstevel@tonic-gate *frfp = 0; 539*0Sstevel@tonic-gate *fiopp = fiop; 540*0Sstevel@tonic-gate *ipsstpp = ipsstp; 541*0Sstevel@tonic-gate *ifrstpp = ifrstp; 542*0Sstevel@tonic-gate *frauthstpp = frauthstp; 543*0Sstevel@tonic-gate 544*0Sstevel@tonic-gate bzero((char *)fiop, sizeof(*fiop)); 545*0Sstevel@tonic-gate bzero((char *)ipsstp, sizeof(*ipsstp)); 546*0Sstevel@tonic-gate bzero((char *)ifrstp, sizeof(*ifrstp)); 547*0Sstevel@tonic-gate bzero((char *)frauthstp, sizeof(*frauthstp)); 548*0Sstevel@tonic-gate 549*0Sstevel@tonic-gate if (nlist(kernel, deadlist) == -1) { 550*0Sstevel@tonic-gate fprintf(stderr, "nlist error\n"); 551*0Sstevel@tonic-gate return; 552*0Sstevel@tonic-gate } 553*0Sstevel@tonic-gate 554*0Sstevel@tonic-gate /* 555*0Sstevel@tonic-gate * This is for SIOCGETFF. 556*0Sstevel@tonic-gate */ 557*0Sstevel@tonic-gate kmemcpy((char *)frfp, (u_long)deadlist[40].n_value, sizeof(*frfp)); 558*0Sstevel@tonic-gate 559*0Sstevel@tonic-gate /* 560*0Sstevel@tonic-gate * f_locks is a combination of the lock variable from each part of 561*0Sstevel@tonic-gate * ipfilter (state, auth, nat, fragments). 562*0Sstevel@tonic-gate */ 563*0Sstevel@tonic-gate kmemcpy((char *)fiop, (u_long)deadlist[13].n_value, sizeof(*fiop)); 564*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[22].n_value, 565*0Sstevel@tonic-gate sizeof(fiop->f_locks[0])); 566*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[30].n_value, 567*0Sstevel@tonic-gate sizeof(fiop->f_locks[1])); 568*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_locks[2], (u_long)deadlist[28].n_value, 569*0Sstevel@tonic-gate sizeof(fiop->f_locks[2])); 570*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_locks[3], (u_long)deadlist[12].n_value, 571*0Sstevel@tonic-gate sizeof(fiop->f_locks[3])); 572*0Sstevel@tonic-gate 573*0Sstevel@tonic-gate /* 574*0Sstevel@tonic-gate * Get pointers to each list of rules (active, inactive, in, out) 575*0Sstevel@tonic-gate */ 576*0Sstevel@tonic-gate kmemcpy((char *)&rules, (u_long)deadlist[31].n_value, sizeof(rules)); 577*0Sstevel@tonic-gate fiop->f_fin[0] = rules[0][0]; 578*0Sstevel@tonic-gate fiop->f_fin[1] = rules[0][1]; 579*0Sstevel@tonic-gate fiop->f_fout[0] = rules[1][0]; 580*0Sstevel@tonic-gate fiop->f_fout[1] = rules[1][1]; 581*0Sstevel@tonic-gate 582*0Sstevel@tonic-gate /* 583*0Sstevel@tonic-gate * Same for IPv6, except make them null if support for it is not 584*0Sstevel@tonic-gate * being compiled in. 585*0Sstevel@tonic-gate */ 586*0Sstevel@tonic-gate #ifdef USE_INET6 587*0Sstevel@tonic-gate kmemcpy((char *)&rules, (u_long)deadlist[32].n_value, sizeof(rules)); 588*0Sstevel@tonic-gate fiop->f_fin6[0] = rules[0][0]; 589*0Sstevel@tonic-gate fiop->f_fin6[1] = rules[0][1]; 590*0Sstevel@tonic-gate fiop->f_fout6[0] = rules[1][0]; 591*0Sstevel@tonic-gate fiop->f_fout6[1] = rules[1][1]; 592*0Sstevel@tonic-gate #else 593*0Sstevel@tonic-gate fiop->f_fin6[0] = NULL; 594*0Sstevel@tonic-gate fiop->f_fin6[1] = NULL; 595*0Sstevel@tonic-gate fiop->f_fout6[0] = NULL; 596*0Sstevel@tonic-gate fiop->f_fout6[1] = NULL; 597*0Sstevel@tonic-gate #endif 598*0Sstevel@tonic-gate 599*0Sstevel@tonic-gate /* 600*0Sstevel@tonic-gate * Now get accounting rules pointers. 601*0Sstevel@tonic-gate */ 602*0Sstevel@tonic-gate kmemcpy((char *)&rules, (u_long)deadlist[33].n_value, sizeof(rules)); 603*0Sstevel@tonic-gate fiop->f_acctin[0] = rules[0][0]; 604*0Sstevel@tonic-gate fiop->f_acctin[1] = rules[0][1]; 605*0Sstevel@tonic-gate fiop->f_acctout[0] = rules[1][0]; 606*0Sstevel@tonic-gate fiop->f_acctout[1] = rules[1][1]; 607*0Sstevel@tonic-gate 608*0Sstevel@tonic-gate #ifdef USE_INET6 609*0Sstevel@tonic-gate kmemcpy((char *)&rules, (u_long)deadlist[34].n_value, sizeof(rules)); 610*0Sstevel@tonic-gate fiop->f_acctin6[0] = rules[0][0]; 611*0Sstevel@tonic-gate fiop->f_acctin6[1] = rules[0][1]; 612*0Sstevel@tonic-gate fiop->f_acctout6[0] = rules[1][0]; 613*0Sstevel@tonic-gate fiop->f_acctout6[1] = rules[1][1]; 614*0Sstevel@tonic-gate #else 615*0Sstevel@tonic-gate fiop->f_acctin6[0] = NULL; 616*0Sstevel@tonic-gate fiop->f_acctin6[1] = NULL; 617*0Sstevel@tonic-gate fiop->f_acctout6[0] = NULL; 618*0Sstevel@tonic-gate fiop->f_acctout6[1] = NULL; 619*0Sstevel@tonic-gate #endif 620*0Sstevel@tonic-gate 621*0Sstevel@tonic-gate /* 622*0Sstevel@tonic-gate * A collection of "global" variables used inside the kernel which 623*0Sstevel@tonic-gate * are all collected in friostat_t via ioctl. 624*0Sstevel@tonic-gate */ 625*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_froute, (u_long)deadlist[35].n_value, 626*0Sstevel@tonic-gate sizeof(fiop->f_froute)); 627*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_running, (u_long)deadlist[36].n_value, 628*0Sstevel@tonic-gate sizeof(fiop->f_running)); 629*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_groups, (u_long)deadlist[37].n_value, 630*0Sstevel@tonic-gate sizeof(fiop->f_groups)); 631*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_active, (u_long)deadlist[38].n_value, 632*0Sstevel@tonic-gate sizeof(fiop->f_active)); 633*0Sstevel@tonic-gate kmemcpy((char *)&fiop->f_defpass, (u_long)deadlist[39].n_value, 634*0Sstevel@tonic-gate sizeof(fiop->f_defpass)); 635*0Sstevel@tonic-gate 636*0Sstevel@tonic-gate /* 637*0Sstevel@tonic-gate * Build up the state information stats structure. 638*0Sstevel@tonic-gate */ 639*0Sstevel@tonic-gate kmemcpy((char *)ipsstp, (u_long)deadlist[14].n_value, sizeof(*ipsstp)); 640*0Sstevel@tonic-gate kmemcpy((char *)&temp, (u_long)deadlist[15].n_value, sizeof(temp)); 641*0Sstevel@tonic-gate ipsstp->iss_active = temp; 642*0Sstevel@tonic-gate ipsstp->iss_table = (void *)deadlist[18].n_value; 643*0Sstevel@tonic-gate ipsstp->iss_list = (void *)deadlist[17].n_value; 644*0Sstevel@tonic-gate 645*0Sstevel@tonic-gate /* 646*0Sstevel@tonic-gate * Build up the authentiation information stats structure. 647*0Sstevel@tonic-gate */ 648*0Sstevel@tonic-gate kmemcpy((char *)frauthstp, (u_long)deadlist[0].n_value, 649*0Sstevel@tonic-gate sizeof(*frauthstp)); 650*0Sstevel@tonic-gate frauthstp->fas_faelist = (void *)deadlist[1].n_value; 651*0Sstevel@tonic-gate 652*0Sstevel@tonic-gate /* 653*0Sstevel@tonic-gate * Build up the fragment information stats structure. 654*0Sstevel@tonic-gate */ 655*0Sstevel@tonic-gate kmemcpy((char *)ifrstp, (u_long)deadlist[25].n_value, 656*0Sstevel@tonic-gate sizeof(*ifrstp)); 657*0Sstevel@tonic-gate ifrstp->ifs_table = (void *)deadlist[23].n_value; 658*0Sstevel@tonic-gate ifrstp->ifs_nattab = (void *)deadlist[24].n_value; 659*0Sstevel@tonic-gate kmemcpy((char *)&ifrstp->ifs_inuse, (u_long)deadlist[26].n_value, 660*0Sstevel@tonic-gate sizeof(ifrstp->ifs_inuse)); 661*0Sstevel@tonic-gate 662*0Sstevel@tonic-gate /* 663*0Sstevel@tonic-gate * Get logging on/off switches 664*0Sstevel@tonic-gate */ 665*0Sstevel@tonic-gate kmemcpy((char *)&state_logging, (u_long)deadlist[41].n_value, 666*0Sstevel@tonic-gate sizeof(state_logging)); 667*0Sstevel@tonic-gate } 668*0Sstevel@tonic-gate 669*0Sstevel@tonic-gate 670*0Sstevel@tonic-gate /* 671*0Sstevel@tonic-gate * Display the kernel stats for packets blocked and passed and other 672*0Sstevel@tonic-gate * associated running totals which are kept. 673*0Sstevel@tonic-gate */ 674*0Sstevel@tonic-gate static void showstats(fp, frf) 675*0Sstevel@tonic-gate struct friostat *fp; 676*0Sstevel@tonic-gate u_32_t frf; 677*0Sstevel@tonic-gate { 678*0Sstevel@tonic-gate 679*0Sstevel@tonic-gate PRINTF("bad packets:\t\tin %lu\tout %lu\n", 680*0Sstevel@tonic-gate fp->f_st[0].fr_bad, fp->f_st[1].fr_bad); 681*0Sstevel@tonic-gate #ifdef USE_INET6 682*0Sstevel@tonic-gate PRINTF(" IPv6 packets:\t\tin %lu out %lu\n", 683*0Sstevel@tonic-gate fp->f_st[0].fr_ipv6, fp->f_st[1].fr_ipv6); 684*0Sstevel@tonic-gate #endif 685*0Sstevel@tonic-gate PRINTF(" input packets:\t\tblocked %lu passed %lu nomatch %lu", 686*0Sstevel@tonic-gate fp->f_st[0].fr_block, fp->f_st[0].fr_pass, 687*0Sstevel@tonic-gate fp->f_st[0].fr_nom); 688*0Sstevel@tonic-gate PRINTF(" counted %lu short %lu\n", 689*0Sstevel@tonic-gate fp->f_st[0].fr_acct, fp->f_st[0].fr_short); 690*0Sstevel@tonic-gate PRINTF("output packets:\t\tblocked %lu passed %lu nomatch %lu", 691*0Sstevel@tonic-gate fp->f_st[1].fr_block, fp->f_st[1].fr_pass, 692*0Sstevel@tonic-gate fp->f_st[1].fr_nom); 693*0Sstevel@tonic-gate PRINTF(" counted %lu short %lu\n", 694*0Sstevel@tonic-gate fp->f_st[1].fr_acct, fp->f_st[1].fr_short); 695*0Sstevel@tonic-gate PRINTF(" input packets logged:\tblocked %lu passed %lu\n", 696*0Sstevel@tonic-gate fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl); 697*0Sstevel@tonic-gate PRINTF("output packets logged:\tblocked %lu passed %lu\n", 698*0Sstevel@tonic-gate fp->f_st[1].fr_bpkl, fp->f_st[1].fr_ppkl); 699*0Sstevel@tonic-gate PRINTF(" packets logged:\tinput %lu output %lu\n", 700*0Sstevel@tonic-gate fp->f_st[0].fr_pkl, fp->f_st[1].fr_pkl); 701*0Sstevel@tonic-gate PRINTF(" log failures:\t\tinput %lu output %lu\n", 702*0Sstevel@tonic-gate fp->f_st[0].fr_skip, fp->f_st[1].fr_skip); 703*0Sstevel@tonic-gate PRINTF("fragment state(in):\tkept %lu\tlost %lu\n", 704*0Sstevel@tonic-gate fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr); 705*0Sstevel@tonic-gate PRINTF("fragment state(out):\tkept %lu\tlost %lu\n", 706*0Sstevel@tonic-gate fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr); 707*0Sstevel@tonic-gate PRINTF("packet state(in):\tkept %lu\tlost %lu\n", 708*0Sstevel@tonic-gate fp->f_st[0].fr_ads, fp->f_st[0].fr_bads); 709*0Sstevel@tonic-gate PRINTF("packet state(out):\tkept %lu\tlost %lu\n", 710*0Sstevel@tonic-gate fp->f_st[1].fr_ads, fp->f_st[1].fr_bads); 711*0Sstevel@tonic-gate PRINTF("ICMP replies:\t%lu\tTCP RSTs sent:\t%lu\n", 712*0Sstevel@tonic-gate fp->f_st[0].fr_ret, fp->f_st[1].fr_ret); 713*0Sstevel@tonic-gate PRINTF("Invalid source(in):\t%lu\n", fp->f_st[0].fr_badsrc); 714*0Sstevel@tonic-gate PRINTF("Result cache hits(in):\t%lu\t(out):\t%lu\n", 715*0Sstevel@tonic-gate fp->f_st[0].fr_chit, fp->f_st[1].fr_chit); 716*0Sstevel@tonic-gate PRINTF("IN Pullups succeeded:\t%lu\tfailed:\t%lu\n", 717*0Sstevel@tonic-gate fp->f_st[0].fr_pull[0], fp->f_st[0].fr_pull[1]); 718*0Sstevel@tonic-gate PRINTF("OUT Pullups succeeded:\t%lu\tfailed:\t%lu\n", 719*0Sstevel@tonic-gate fp->f_st[1].fr_pull[0], fp->f_st[1].fr_pull[1]); 720*0Sstevel@tonic-gate PRINTF("Fastroute successes:\t%lu\tfailures:\t%lu\n", 721*0Sstevel@tonic-gate fp->f_froute[0], fp->f_froute[1]); 722*0Sstevel@tonic-gate PRINTF("TCP cksum fails(in):\t%lu\t(out):\t%lu\n", 723*0Sstevel@tonic-gate fp->f_st[0].fr_tcpbad, fp->f_st[1].fr_tcpbad); 724*0Sstevel@tonic-gate PRINTF("IPF Ticks:\t%lu\n", fp->f_ticks); 725*0Sstevel@tonic-gate 726*0Sstevel@tonic-gate PRINTF("Packet log flags set: (%#x)\n", frf); 727*0Sstevel@tonic-gate if (frf & FF_LOGPASS) 728*0Sstevel@tonic-gate PRINTF("\tpackets passed through filter\n"); 729*0Sstevel@tonic-gate if (frf & FF_LOGBLOCK) 730*0Sstevel@tonic-gate PRINTF("\tpackets blocked by filter\n"); 731*0Sstevel@tonic-gate if (frf & FF_LOGNOMATCH) 732*0Sstevel@tonic-gate PRINTF("\tpackets not matched by filter\n"); 733*0Sstevel@tonic-gate if (!frf) 734*0Sstevel@tonic-gate PRINTF("\tnone\n"); 735*0Sstevel@tonic-gate } 736*0Sstevel@tonic-gate 737*0Sstevel@tonic-gate 738*0Sstevel@tonic-gate /* 739*0Sstevel@tonic-gate * Print out a list of rules from the kernel, starting at the one passed. 740*0Sstevel@tonic-gate */ 741*0Sstevel@tonic-gate static void printlist(fp, comment) 742*0Sstevel@tonic-gate frentry_t *fp; 743*0Sstevel@tonic-gate char *comment; 744*0Sstevel@tonic-gate { 745*0Sstevel@tonic-gate struct frentry fb, *fg; 746*0Sstevel@tonic-gate char *data; 747*0Sstevel@tonic-gate u_32_t type; 748*0Sstevel@tonic-gate int n; 749*0Sstevel@tonic-gate 750*0Sstevel@tonic-gate for (n = 1; fp; n++) { 751*0Sstevel@tonic-gate if (kmemcpy((char *)&fb, (u_long)fp, sizeof(fb)) == -1) { 752*0Sstevel@tonic-gate perror("kmemcpy"); 753*0Sstevel@tonic-gate return; 754*0Sstevel@tonic-gate } 755*0Sstevel@tonic-gate fp = &fb; 756*0Sstevel@tonic-gate if (opts & (OPT_HITS|OPT_VERBOSE)) 757*0Sstevel@tonic-gate #ifdef USE_QUAD_T 758*0Sstevel@tonic-gate PRINTF("%qu ", (unsigned long long) fp->fr_hits); 759*0Sstevel@tonic-gate #else 760*0Sstevel@tonic-gate PRINTF("%lu ", fp->fr_hits); 761*0Sstevel@tonic-gate #endif 762*0Sstevel@tonic-gate if (opts & (OPT_ACCNT|OPT_VERBOSE)) 763*0Sstevel@tonic-gate #ifdef USE_QUAD_T 764*0Sstevel@tonic-gate PRINTF("%qu ", (unsigned long long) fp->fr_bytes); 765*0Sstevel@tonic-gate #else 766*0Sstevel@tonic-gate PRINTF("%lu ", fp->fr_bytes); 767*0Sstevel@tonic-gate #endif 768*0Sstevel@tonic-gate if (opts & OPT_SHOWLINENO) 769*0Sstevel@tonic-gate PRINTF("@%d ", n); 770*0Sstevel@tonic-gate data = NULL; 771*0Sstevel@tonic-gate type = fp->fr_type & ~FR_T_BUILTIN; 772*0Sstevel@tonic-gate if (type == FR_T_IPF || type == FR_T_BPFOPC) { 773*0Sstevel@tonic-gate if (fp->fr_dsize) { 774*0Sstevel@tonic-gate data = malloc(fp->fr_dsize); 775*0Sstevel@tonic-gate 776*0Sstevel@tonic-gate if (kmemcpy(data, (u_long)fp->fr_data, 777*0Sstevel@tonic-gate fp->fr_dsize) == -1) { 778*0Sstevel@tonic-gate perror("kmemcpy"); 779*0Sstevel@tonic-gate return; 780*0Sstevel@tonic-gate } 781*0Sstevel@tonic-gate fp->fr_data = data; 782*0Sstevel@tonic-gate } 783*0Sstevel@tonic-gate } 784*0Sstevel@tonic-gate 785*0Sstevel@tonic-gate printfr(fp, ioctl); 786*0Sstevel@tonic-gate if (opts & OPT_VERBOSE) { 787*0Sstevel@tonic-gate binprint(fp, sizeof(*fp)); 788*0Sstevel@tonic-gate if (fp->fr_data != NULL && fp->fr_dsize > 0) 789*0Sstevel@tonic-gate binprint(fp->fr_data, fp->fr_dsize); 790*0Sstevel@tonic-gate } 791*0Sstevel@tonic-gate if (data != NULL) 792*0Sstevel@tonic-gate free(data); 793*0Sstevel@tonic-gate if (fp->fr_grp != NULL) { 794*0Sstevel@tonic-gate if (!kmemcpy((char *)&fg, (u_long)fp->fr_grp, 795*0Sstevel@tonic-gate sizeof(fg))) 796*0Sstevel@tonic-gate printlist(fg, comment); 797*0Sstevel@tonic-gate } 798*0Sstevel@tonic-gate if (type == FR_T_CALLFUNC) { 799*0Sstevel@tonic-gate printlist(fp->fr_data, "# callfunc: "); 800*0Sstevel@tonic-gate } 801*0Sstevel@tonic-gate fp = fp->fr_next; 802*0Sstevel@tonic-gate } 803*0Sstevel@tonic-gate } 804*0Sstevel@tonic-gate 805*0Sstevel@tonic-gate /* 806*0Sstevel@tonic-gate * print out all of the asked for rule sets, using the stats struct as 807*0Sstevel@tonic-gate * the base from which to get the pointers. 808*0Sstevel@tonic-gate */ 809*0Sstevel@tonic-gate static void showlist(fiop) 810*0Sstevel@tonic-gate struct friostat *fiop; 811*0Sstevel@tonic-gate { 812*0Sstevel@tonic-gate struct frentry *fp = NULL; 813*0Sstevel@tonic-gate int i, set; 814*0Sstevel@tonic-gate 815*0Sstevel@tonic-gate set = fiop->f_active; 816*0Sstevel@tonic-gate if (opts & OPT_INACTIVE) 817*0Sstevel@tonic-gate set = 1 - set; 818*0Sstevel@tonic-gate if (opts & OPT_ACCNT) { 819*0Sstevel@tonic-gate #ifdef USE_INET6 820*0Sstevel@tonic-gate if ((use_inet6) && (opts & OPT_OUTQUE)) { 821*0Sstevel@tonic-gate i = F_ACOUT; 822*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_acctout6[set]; 823*0Sstevel@tonic-gate } else if ((use_inet6) && (opts & OPT_INQUE)) { 824*0Sstevel@tonic-gate i = F_ACIN; 825*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_acctin6[set]; 826*0Sstevel@tonic-gate } else 827*0Sstevel@tonic-gate #endif 828*0Sstevel@tonic-gate if (opts & OPT_OUTQUE) { 829*0Sstevel@tonic-gate i = F_ACOUT; 830*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_acctout[set]; 831*0Sstevel@tonic-gate } else if (opts & OPT_INQUE) { 832*0Sstevel@tonic-gate i = F_ACIN; 833*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_acctin[set]; 834*0Sstevel@tonic-gate } else { 835*0Sstevel@tonic-gate FPRINTF(stderr, "No -i or -o given with -a\n"); 836*0Sstevel@tonic-gate return; 837*0Sstevel@tonic-gate } 838*0Sstevel@tonic-gate } else { 839*0Sstevel@tonic-gate #ifdef USE_INET6 840*0Sstevel@tonic-gate if ((use_inet6) && (opts & OPT_OUTQUE)) { 841*0Sstevel@tonic-gate i = F_OUT; 842*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_fout6[set]; 843*0Sstevel@tonic-gate } else if ((use_inet6) && (opts & OPT_INQUE)) { 844*0Sstevel@tonic-gate i = F_IN; 845*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_fin6[set]; 846*0Sstevel@tonic-gate } else 847*0Sstevel@tonic-gate #endif 848*0Sstevel@tonic-gate if (opts & OPT_OUTQUE) { 849*0Sstevel@tonic-gate i = F_OUT; 850*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_fout[set]; 851*0Sstevel@tonic-gate } else if (opts & OPT_INQUE) { 852*0Sstevel@tonic-gate i = F_IN; 853*0Sstevel@tonic-gate fp = (struct frentry *)fiop->f_fin[set]; 854*0Sstevel@tonic-gate } else 855*0Sstevel@tonic-gate return; 856*0Sstevel@tonic-gate } 857*0Sstevel@tonic-gate if (opts & OPT_VERBOSE) 858*0Sstevel@tonic-gate FPRINTF(stderr, "showlist:opts %#x i %d\n", opts, i); 859*0Sstevel@tonic-gate 860*0Sstevel@tonic-gate if (opts & OPT_VERBOSE) 861*0Sstevel@tonic-gate PRINTF("fp %p set %d\n", fp, set); 862*0Sstevel@tonic-gate if (!fp) { 863*0Sstevel@tonic-gate FPRINTF(stderr, "empty list for %s%s\n", 864*0Sstevel@tonic-gate (opts & OPT_INACTIVE) ? "inactive " : "", filters[i]); 865*0Sstevel@tonic-gate return; 866*0Sstevel@tonic-gate } 867*0Sstevel@tonic-gate printlist(fp, NULL); 868*0Sstevel@tonic-gate } 869*0Sstevel@tonic-gate 870*0Sstevel@tonic-gate 871*0Sstevel@tonic-gate /* 872*0Sstevel@tonic-gate * Display ipfilter stateful filtering information 873*0Sstevel@tonic-gate */ 874*0Sstevel@tonic-gate static void showipstates(ipsp) 875*0Sstevel@tonic-gate ips_stat_t *ipsp; 876*0Sstevel@tonic-gate { 877*0Sstevel@tonic-gate u_long minlen, maxlen, totallen, *buckets; 878*0Sstevel@tonic-gate int i, sz; 879*0Sstevel@tonic-gate 880*0Sstevel@tonic-gate sz = sizeof(*buckets) * ipsp->iss_statesize; 881*0Sstevel@tonic-gate buckets = (u_long *)malloc(sz); 882*0Sstevel@tonic-gate if (kmemcpy((char *)buckets, (u_long)ipsp->iss_bucketlen, sz)) { 883*0Sstevel@tonic-gate free(buckets); 884*0Sstevel@tonic-gate return; 885*0Sstevel@tonic-gate } 886*0Sstevel@tonic-gate 887*0Sstevel@tonic-gate /* 888*0Sstevel@tonic-gate * If a list of states hasn't been asked for, only print out stats 889*0Sstevel@tonic-gate */ 890*0Sstevel@tonic-gate if (!(opts & OPT_SHOWLIST)) { 891*0Sstevel@tonic-gate PRINTF("IP states added:\n\t%lu TCP\n\t%lu UDP\n\t%lu ICMP\n", 892*0Sstevel@tonic-gate ipsp->iss_tcp, ipsp->iss_udp, ipsp->iss_icmp); 893*0Sstevel@tonic-gate PRINTF("\t%lu hits\n\t%lu misses\n", ipsp->iss_hits, 894*0Sstevel@tonic-gate ipsp->iss_miss); 895*0Sstevel@tonic-gate PRINTF("\t%lu maximum\n\t%lu no memory\n\t%lu max bucket\n", 896*0Sstevel@tonic-gate ipsp->iss_max, ipsp->iss_nomem, ipsp->iss_bucketfull); 897*0Sstevel@tonic-gate PRINTF("\t%lu active\n\t%lu expired\n\t%lu closed\n", 898*0Sstevel@tonic-gate ipsp->iss_active, ipsp->iss_expire, ipsp->iss_fin); 899*0Sstevel@tonic-gate 900*0Sstevel@tonic-gate PRINTF("State logging %sabled\n", 901*0Sstevel@tonic-gate state_logging ? "en" : "dis"); 902*0Sstevel@tonic-gate 903*0Sstevel@tonic-gate PRINTF("\nState table bucket statistics:\n"); 904*0Sstevel@tonic-gate PRINTF("\t%lu in use\t\n", ipsp->iss_inuse); 905*0Sstevel@tonic-gate 906*0Sstevel@tonic-gate minlen = ipsp->iss_max; 907*0Sstevel@tonic-gate totallen = 0; 908*0Sstevel@tonic-gate maxlen = 0; 909*0Sstevel@tonic-gate 910*0Sstevel@tonic-gate for (i = 0; i < ipsp->iss_statesize; i++) { 911*0Sstevel@tonic-gate if (buckets[i] > maxlen) 912*0Sstevel@tonic-gate maxlen = buckets[i]; 913*0Sstevel@tonic-gate if (buckets[i] < minlen) 914*0Sstevel@tonic-gate minlen = buckets[i]; 915*0Sstevel@tonic-gate totallen += buckets[i]; 916*0Sstevel@tonic-gate } 917*0Sstevel@tonic-gate 918*0Sstevel@tonic-gate PRINTF("\t%2.2f%% bucket usage\n\t%lu minimal length\n", 919*0Sstevel@tonic-gate ((float)ipsp->iss_inuse / ipsp->iss_statesize) * 100.0, 920*0Sstevel@tonic-gate minlen); 921*0Sstevel@tonic-gate PRINTF("\t%lu maximal length\n\t%.3f average length\n", 922*0Sstevel@tonic-gate maxlen, 923*0Sstevel@tonic-gate ipsp->iss_inuse ? (float) totallen/ ipsp->iss_inuse : 924*0Sstevel@tonic-gate 0.0); 925*0Sstevel@tonic-gate 926*0Sstevel@tonic-gate #define ENTRIES_PER_LINE 5 927*0Sstevel@tonic-gate 928*0Sstevel@tonic-gate if (opts & OPT_VERBOSE) { 929*0Sstevel@tonic-gate PRINTF("\nCurrent bucket sizes :\n"); 930*0Sstevel@tonic-gate for (i = 0; i < ipsp->iss_statesize; i++) { 931*0Sstevel@tonic-gate if ((i % ENTRIES_PER_LINE) == 0) 932*0Sstevel@tonic-gate PRINTF("\t"); 933*0Sstevel@tonic-gate PRINTF("%4d -> %4lu", i, buckets[i]); 934*0Sstevel@tonic-gate if ((i % ENTRIES_PER_LINE) == 935*0Sstevel@tonic-gate (ENTRIES_PER_LINE - 1)) 936*0Sstevel@tonic-gate PRINTF("\n"); 937*0Sstevel@tonic-gate else 938*0Sstevel@tonic-gate PRINTF(" "); 939*0Sstevel@tonic-gate } 940*0Sstevel@tonic-gate PRINTF("\n"); 941*0Sstevel@tonic-gate } 942*0Sstevel@tonic-gate PRINTF("\n"); 943*0Sstevel@tonic-gate 944*0Sstevel@tonic-gate free(buckets); 945*0Sstevel@tonic-gate return; 946*0Sstevel@tonic-gate } 947*0Sstevel@tonic-gate 948*0Sstevel@tonic-gate /* 949*0Sstevel@tonic-gate * Print out all the state information currently held in the kernel. 950*0Sstevel@tonic-gate */ 951*0Sstevel@tonic-gate while (ipsp->iss_list != NULL) { 952*0Sstevel@tonic-gate ipsp->iss_list = printstate(ipsp->iss_list, opts); 953*0Sstevel@tonic-gate } 954*0Sstevel@tonic-gate 955*0Sstevel@tonic-gate free(buckets); 956*0Sstevel@tonic-gate } 957*0Sstevel@tonic-gate 958*0Sstevel@tonic-gate 959*0Sstevel@tonic-gate #ifdef STATETOP 960*0Sstevel@tonic-gate static void topipstates(saddr, daddr, sport, dport, protocol, 961*0Sstevel@tonic-gate refreshtime, topclosed) 962*0Sstevel@tonic-gate struct in_addr saddr; 963*0Sstevel@tonic-gate struct in_addr daddr; 964*0Sstevel@tonic-gate int sport; 965*0Sstevel@tonic-gate int dport; 966*0Sstevel@tonic-gate int protocol; 967*0Sstevel@tonic-gate int refreshtime; 968*0Sstevel@tonic-gate int topclosed; 969*0Sstevel@tonic-gate { 970*0Sstevel@tonic-gate char str1[STSTRSIZE], str2[STSTRSIZE], str3[STSTRSIZE], str4[STSTRSIZE]; 971*0Sstevel@tonic-gate int maxtsentries = 0, reverse = 0, sorting = STSORT_DEFAULT; 972*0Sstevel@tonic-gate int i, j, winx, tsentry, maxx, maxy, redraw = 0; 973*0Sstevel@tonic-gate ips_stat_t ipsst, *ipsstp = &ipsst; 974*0Sstevel@tonic-gate statetop_t *tstable = NULL, *tp; 975*0Sstevel@tonic-gate ipstate_t ips; 976*0Sstevel@tonic-gate ipfobj_t ipfo; 977*0Sstevel@tonic-gate struct timeval selecttimeout; 978*0Sstevel@tonic-gate char hostnm[HOSTNMLEN]; 979*0Sstevel@tonic-gate struct protoent *proto; 980*0Sstevel@tonic-gate fd_set readfd; 981*0Sstevel@tonic-gate int c = 0; 982*0Sstevel@tonic-gate time_t t; 983*0Sstevel@tonic-gate 984*0Sstevel@tonic-gate /* init ncurses stuff */ 985*0Sstevel@tonic-gate initscr(); 986*0Sstevel@tonic-gate cbreak(); 987*0Sstevel@tonic-gate noecho(); 988*0Sstevel@tonic-gate 989*0Sstevel@tonic-gate /* init hostname */ 990*0Sstevel@tonic-gate gethostname(hostnm, sizeof(hostnm) - 1); 991*0Sstevel@tonic-gate hostnm[sizeof(hostnm) - 1] = '\0'; 992*0Sstevel@tonic-gate 993*0Sstevel@tonic-gate /* init ipfobj_t stuff */ 994*0Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo)); 995*0Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION; 996*0Sstevel@tonic-gate ipfo.ipfo_size = sizeof(*ipsstp); 997*0Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)ipsstp; 998*0Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_STATESTAT; 999*0Sstevel@tonic-gate 1000*0Sstevel@tonic-gate /* repeat until user aborts */ 1001*0Sstevel@tonic-gate while ( 1 ) { 1002*0Sstevel@tonic-gate 1003*0Sstevel@tonic-gate /* get state table */ 1004*0Sstevel@tonic-gate bzero((char *)&ipsst, sizeof(ipsst)); 1005*0Sstevel@tonic-gate if ((ioctl(state_fd, SIOCGETFS, &ipfo) == -1)) { 1006*0Sstevel@tonic-gate perror("ioctl(SIOCGETFS)"); 1007*0Sstevel@tonic-gate exit(-1); 1008*0Sstevel@tonic-gate } 1009*0Sstevel@tonic-gate 1010*0Sstevel@tonic-gate /* clear the history */ 1011*0Sstevel@tonic-gate tsentry = -1; 1012*0Sstevel@tonic-gate 1013*0Sstevel@tonic-gate /* read the state table and store in tstable */ 1014*0Sstevel@tonic-gate while (ipsstp->iss_list) { 1015*0Sstevel@tonic-gate if (kmemcpy((char *)&ips, (u_long)ipsstp->iss_list, 1016*0Sstevel@tonic-gate sizeof(ips))) 1017*0Sstevel@tonic-gate break; 1018*0Sstevel@tonic-gate ipsstp->iss_list = ips.is_next; 1019*0Sstevel@tonic-gate 1020*0Sstevel@tonic-gate if (((saddr.s_addr == INADDR_ANY) || 1021*0Sstevel@tonic-gate (saddr.s_addr == ips.is_saddr)) && 1022*0Sstevel@tonic-gate ((daddr.s_addr == INADDR_ANY) || 1023*0Sstevel@tonic-gate (daddr.s_addr == ips.is_daddr)) && 1024*0Sstevel@tonic-gate ((protocol < 0) || (protocol == ips.is_p)) && 1025*0Sstevel@tonic-gate (((ips.is_p != IPPROTO_TCP) && 1026*0Sstevel@tonic-gate (ips.is_p != IPPROTO_UDP)) || 1027*0Sstevel@tonic-gate (((sport < 0) || 1028*0Sstevel@tonic-gate (htons(sport) == ips.is_sport)) && 1029*0Sstevel@tonic-gate ((dport < 0) || 1030*0Sstevel@tonic-gate (htons(dport) == ips.is_dport)))) && 1031*0Sstevel@tonic-gate (topclosed || (ips.is_p != IPPROTO_TCP) || 1032*0Sstevel@tonic-gate (ips.is_state[0] < TCPS_LAST_ACK) || 1033*0Sstevel@tonic-gate (ips.is_state[1] < TCPS_LAST_ACK))) { 1034*0Sstevel@tonic-gate /* 1035*0Sstevel@tonic-gate * if necessary make room for this state 1036*0Sstevel@tonic-gate * entry 1037*0Sstevel@tonic-gate */ 1038*0Sstevel@tonic-gate tsentry++; 1039*0Sstevel@tonic-gate if (!maxtsentries || 1040*0Sstevel@tonic-gate (tsentry == maxtsentries)) { 1041*0Sstevel@tonic-gate 1042*0Sstevel@tonic-gate maxtsentries += STGROWSIZE; 1043*0Sstevel@tonic-gate tstable = realloc(tstable, maxtsentries * sizeof(statetop_t)); 1044*0Sstevel@tonic-gate if (!tstable) { 1045*0Sstevel@tonic-gate perror("malloc"); 1046*0Sstevel@tonic-gate exit(-1); 1047*0Sstevel@tonic-gate } 1048*0Sstevel@tonic-gate } 1049*0Sstevel@tonic-gate 1050*0Sstevel@tonic-gate /* fill structure */ 1051*0Sstevel@tonic-gate tp = tstable + tsentry; 1052*0Sstevel@tonic-gate tp->st_src = ips.is_src; 1053*0Sstevel@tonic-gate tp->st_dst = ips.is_dst; 1054*0Sstevel@tonic-gate tp->st_p = ips.is_p; 1055*0Sstevel@tonic-gate tp->st_state[0] = ips.is_state[0]; 1056*0Sstevel@tonic-gate tp->st_state[1] = ips.is_state[1]; 1057*0Sstevel@tonic-gate tp->st_pkts = ips.is_pkts[0] + ips.is_pkts[1]; 1058*0Sstevel@tonic-gate tp->st_bytes = ips.is_bytes[0] + 1059*0Sstevel@tonic-gate ips.is_bytes[1]; 1060*0Sstevel@tonic-gate if ((ips.is_p == IPPROTO_TCP) || 1061*0Sstevel@tonic-gate (ips.is_p == IPPROTO_UDP)) { 1062*0Sstevel@tonic-gate tp->st_sport = ips.is_sport; 1063*0Sstevel@tonic-gate tp->st_dport = ips.is_dport; 1064*0Sstevel@tonic-gate } 1065*0Sstevel@tonic-gate 1066*0Sstevel@tonic-gate } 1067*0Sstevel@tonic-gate } 1068*0Sstevel@tonic-gate 1069*0Sstevel@tonic-gate 1070*0Sstevel@tonic-gate /* sort the array */ 1071*0Sstevel@tonic-gate if (tsentry != -1) 1072*0Sstevel@tonic-gate switch (sorting) 1073*0Sstevel@tonic-gate { 1074*0Sstevel@tonic-gate case STSORT_PR: 1075*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1076*0Sstevel@tonic-gate sizeof(statetop_t), sort_p); 1077*0Sstevel@tonic-gate break; 1078*0Sstevel@tonic-gate case STSORT_PKTS: 1079*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1080*0Sstevel@tonic-gate sizeof(statetop_t), sort_pkts); 1081*0Sstevel@tonic-gate break; 1082*0Sstevel@tonic-gate case STSORT_BYTES: 1083*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1084*0Sstevel@tonic-gate sizeof(statetop_t), sort_bytes); 1085*0Sstevel@tonic-gate break; 1086*0Sstevel@tonic-gate case STSORT_TTL: 1087*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1088*0Sstevel@tonic-gate sizeof(statetop_t), sort_ttl); 1089*0Sstevel@tonic-gate break; 1090*0Sstevel@tonic-gate case STSORT_SRCIP: 1091*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1092*0Sstevel@tonic-gate sizeof(statetop_t), sort_srcip); 1093*0Sstevel@tonic-gate break; 1094*0Sstevel@tonic-gate case STSORT_DSTIP: 1095*0Sstevel@tonic-gate qsort(tstable, tsentry + 1, 1096*0Sstevel@tonic-gate sizeof(statetop_t), sort_dstip); 1097*0Sstevel@tonic-gate break; 1098*0Sstevel@tonic-gate default: 1099*0Sstevel@tonic-gate break; 1100*0Sstevel@tonic-gate } 1101*0Sstevel@tonic-gate 1102*0Sstevel@tonic-gate /* print title */ 1103*0Sstevel@tonic-gate erase(); 1104*0Sstevel@tonic-gate getmaxyx(stdscr, maxy, maxx); 1105*0Sstevel@tonic-gate attron(A_BOLD); 1106*0Sstevel@tonic-gate winx = 0; 1107*0Sstevel@tonic-gate move(winx,0); 1108*0Sstevel@tonic-gate sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION); 1109*0Sstevel@tonic-gate for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++) 1110*0Sstevel@tonic-gate printw(" "); 1111*0Sstevel@tonic-gate printw("%s", str1); 1112*0Sstevel@tonic-gate attroff(A_BOLD); 1113*0Sstevel@tonic-gate 1114*0Sstevel@tonic-gate /* just for fun add a clock */ 1115*0Sstevel@tonic-gate move(winx, maxx - 8); 1116*0Sstevel@tonic-gate t = time(NULL); 1117*0Sstevel@tonic-gate strftime(str1, 80, "%T", localtime(&t)); 1118*0Sstevel@tonic-gate printw("%s\n", str1); 1119*0Sstevel@tonic-gate 1120*0Sstevel@tonic-gate /* 1121*0Sstevel@tonic-gate * print the display filters, this is placed in the loop, 1122*0Sstevel@tonic-gate * because someday I might add code for changing these 1123*0Sstevel@tonic-gate * while the programming is running :-) 1124*0Sstevel@tonic-gate */ 1125*0Sstevel@tonic-gate if (sport >= 0) 1126*0Sstevel@tonic-gate sprintf(str1, "%s,%d", inet_ntoa(saddr), sport); 1127*0Sstevel@tonic-gate else 1128*0Sstevel@tonic-gate sprintf(str1, "%s", inet_ntoa(saddr)); 1129*0Sstevel@tonic-gate 1130*0Sstevel@tonic-gate if (dport >= 0) 1131*0Sstevel@tonic-gate sprintf(str2, "%s,%d", inet_ntoa(daddr), dport); 1132*0Sstevel@tonic-gate else 1133*0Sstevel@tonic-gate sprintf(str2, "%s", inet_ntoa(daddr)); 1134*0Sstevel@tonic-gate 1135*0Sstevel@tonic-gate if (protocol < 0) 1136*0Sstevel@tonic-gate strcpy(str3, "any"); 1137*0Sstevel@tonic-gate else if ((proto = getprotobynumber(protocol)) != NULL) 1138*0Sstevel@tonic-gate sprintf(str3, "%s", proto->p_name); 1139*0Sstevel@tonic-gate else 1140*0Sstevel@tonic-gate sprintf(str3, "%d", protocol); 1141*0Sstevel@tonic-gate 1142*0Sstevel@tonic-gate switch (sorting) 1143*0Sstevel@tonic-gate { 1144*0Sstevel@tonic-gate case STSORT_PR: 1145*0Sstevel@tonic-gate sprintf(str4, "proto"); 1146*0Sstevel@tonic-gate break; 1147*0Sstevel@tonic-gate case STSORT_PKTS: 1148*0Sstevel@tonic-gate sprintf(str4, "# pkts"); 1149*0Sstevel@tonic-gate break; 1150*0Sstevel@tonic-gate case STSORT_BYTES: 1151*0Sstevel@tonic-gate sprintf(str4, "# bytes"); 1152*0Sstevel@tonic-gate break; 1153*0Sstevel@tonic-gate case STSORT_TTL: 1154*0Sstevel@tonic-gate sprintf(str4, "ttl"); 1155*0Sstevel@tonic-gate break; 1156*0Sstevel@tonic-gate case STSORT_SRCIP: 1157*0Sstevel@tonic-gate sprintf(str4, "srcip"); 1158*0Sstevel@tonic-gate break; 1159*0Sstevel@tonic-gate case STSORT_DSTIP: 1160*0Sstevel@tonic-gate sprintf(str4, "dstip"); 1161*0Sstevel@tonic-gate break; 1162*0Sstevel@tonic-gate default: 1163*0Sstevel@tonic-gate sprintf(str4, "unknown"); 1164*0Sstevel@tonic-gate break; 1165*0Sstevel@tonic-gate } 1166*0Sstevel@tonic-gate 1167*0Sstevel@tonic-gate if (reverse) 1168*0Sstevel@tonic-gate strcat(str4, " (reverse)"); 1169*0Sstevel@tonic-gate 1170*0Sstevel@tonic-gate winx += 2; 1171*0Sstevel@tonic-gate move(winx,0); 1172*0Sstevel@tonic-gate printw("Src = %s Dest = %s Proto = %s Sorted by = %s\n\n", 1173*0Sstevel@tonic-gate str1, str2, str3, str4); 1174*0Sstevel@tonic-gate 1175*0Sstevel@tonic-gate /* print column description */ 1176*0Sstevel@tonic-gate winx += 2; 1177*0Sstevel@tonic-gate move(winx,0); 1178*0Sstevel@tonic-gate attron(A_BOLD); 1179*0Sstevel@tonic-gate printw("%-21s %-21s %3s %4s %7s %9s %9s\n", "Source IP", 1180*0Sstevel@tonic-gate "Destination IP", "ST", "PR", "#pkts", "#bytes", "ttl"); 1181*0Sstevel@tonic-gate attroff(A_BOLD); 1182*0Sstevel@tonic-gate 1183*0Sstevel@tonic-gate /* print all the entries */ 1184*0Sstevel@tonic-gate tp = tstable; 1185*0Sstevel@tonic-gate if (reverse) 1186*0Sstevel@tonic-gate tp += tsentry; 1187*0Sstevel@tonic-gate 1188*0Sstevel@tonic-gate if (tsentry > maxy - 6) 1189*0Sstevel@tonic-gate tsentry = maxy - 6; 1190*0Sstevel@tonic-gate for (i = 0; i <= tsentry; i++) { 1191*0Sstevel@tonic-gate /* print src/dest and port */ 1192*0Sstevel@tonic-gate if ((tp->st_p == IPPROTO_TCP) || 1193*0Sstevel@tonic-gate (tp->st_p == IPPROTO_UDP)) { 1194*0Sstevel@tonic-gate sprintf(str1, "%s,%hu", 1195*0Sstevel@tonic-gate inet_ntoa(tp->st_src.in4), 1196*0Sstevel@tonic-gate ntohs(tp->st_sport)); 1197*0Sstevel@tonic-gate sprintf(str2, "%s,%hu", 1198*0Sstevel@tonic-gate inet_ntoa(tp->st_dst.in4), 1199*0Sstevel@tonic-gate ntohs(tp->st_dport)); 1200*0Sstevel@tonic-gate } else { 1201*0Sstevel@tonic-gate sprintf(str1, "%s", inet_ntoa(tp->st_src.in4)); 1202*0Sstevel@tonic-gate sprintf(str2, "%s", inet_ntoa(tp->st_dst.in4)); 1203*0Sstevel@tonic-gate } 1204*0Sstevel@tonic-gate winx++; 1205*0Sstevel@tonic-gate move(winx, 0); 1206*0Sstevel@tonic-gate printw("%-21s %-21s", str1, str2); 1207*0Sstevel@tonic-gate 1208*0Sstevel@tonic-gate /* print state */ 1209*0Sstevel@tonic-gate sprintf(str1, "%X/%X", tp->st_state[0], 1210*0Sstevel@tonic-gate tp->st_state[1]); 1211*0Sstevel@tonic-gate printw(" %3s", str1); 1212*0Sstevel@tonic-gate 1213*0Sstevel@tonic-gate /* print proto */ 1214*0Sstevel@tonic-gate proto = getprotobynumber(tp->st_p); 1215*0Sstevel@tonic-gate if (proto) { 1216*0Sstevel@tonic-gate strncpy(str1, proto->p_name, 4); 1217*0Sstevel@tonic-gate str1[4] = '\0'; 1218*0Sstevel@tonic-gate } else { 1219*0Sstevel@tonic-gate sprintf(str1, "%d", tp->st_p); 1220*0Sstevel@tonic-gate } 1221*0Sstevel@tonic-gate printw(" %4s", str1); 1222*0Sstevel@tonic-gate /* print #pkt/#bytes */ 1223*0Sstevel@tonic-gate #ifdef USE_QUAD_T 1224*0Sstevel@tonic-gate printw(" %7qu %9qu", (unsigned long long) tp->st_pkts, 1225*0Sstevel@tonic-gate (unsigned long long) tp->st_bytes); 1226*0Sstevel@tonic-gate #else 1227*0Sstevel@tonic-gate printw(" %7lu %9lu", tp->st_pkts, tp->st_bytes); 1228*0Sstevel@tonic-gate #endif 1229*0Sstevel@tonic-gate printw(" %9s", ttl_to_string(tp->st_age)); 1230*0Sstevel@tonic-gate 1231*0Sstevel@tonic-gate if (reverse) 1232*0Sstevel@tonic-gate tp--; 1233*0Sstevel@tonic-gate else 1234*0Sstevel@tonic-gate tp++; 1235*0Sstevel@tonic-gate } 1236*0Sstevel@tonic-gate 1237*0Sstevel@tonic-gate /* screen data structure is filled, now update the screen */ 1238*0Sstevel@tonic-gate if (redraw) 1239*0Sstevel@tonic-gate clearok(stdscr,1); 1240*0Sstevel@tonic-gate 1241*0Sstevel@tonic-gate refresh(); 1242*0Sstevel@tonic-gate if (redraw) { 1243*0Sstevel@tonic-gate clearok(stdscr,0); 1244*0Sstevel@tonic-gate redraw = 0; 1245*0Sstevel@tonic-gate } 1246*0Sstevel@tonic-gate 1247*0Sstevel@tonic-gate /* wait for key press or a 1 second time out period */ 1248*0Sstevel@tonic-gate selecttimeout.tv_sec = refreshtime; 1249*0Sstevel@tonic-gate selecttimeout.tv_usec = 0; 1250*0Sstevel@tonic-gate FD_ZERO(&readfd); 1251*0Sstevel@tonic-gate FD_SET(0, &readfd); 1252*0Sstevel@tonic-gate select(1, &readfd, NULL, NULL, &selecttimeout); 1253*0Sstevel@tonic-gate 1254*0Sstevel@tonic-gate /* if key pressed, read all waiting keys */ 1255*0Sstevel@tonic-gate if (FD_ISSET(0, &readfd)) { 1256*0Sstevel@tonic-gate c = wgetch(stdscr); 1257*0Sstevel@tonic-gate if (c == ERR) 1258*0Sstevel@tonic-gate continue; 1259*0Sstevel@tonic-gate 1260*0Sstevel@tonic-gate if (tolower(c) == 'l') { 1261*0Sstevel@tonic-gate redraw = 1; 1262*0Sstevel@tonic-gate } else if (tolower(c) == 'q') { 1263*0Sstevel@tonic-gate nocbreak(); 1264*0Sstevel@tonic-gate endwin(); 1265*0Sstevel@tonic-gate exit(0); 1266*0Sstevel@tonic-gate } else if (tolower(c) == 'r') { 1267*0Sstevel@tonic-gate reverse = !reverse; 1268*0Sstevel@tonic-gate } else if (tolower(c) == 's') { 1269*0Sstevel@tonic-gate sorting++; 1270*0Sstevel@tonic-gate if (sorting > STSORT_MAX) 1271*0Sstevel@tonic-gate sorting = 0; 1272*0Sstevel@tonic-gate } 1273*0Sstevel@tonic-gate } 1274*0Sstevel@tonic-gate } /* while */ 1275*0Sstevel@tonic-gate 1276*0Sstevel@tonic-gate printw("\n"); 1277*0Sstevel@tonic-gate nocbreak(); 1278*0Sstevel@tonic-gate endwin(); 1279*0Sstevel@tonic-gate 1280*0Sstevel@tonic-gate free(tstable); 1281*0Sstevel@tonic-gate } 1282*0Sstevel@tonic-gate #endif 1283*0Sstevel@tonic-gate 1284*0Sstevel@tonic-gate 1285*0Sstevel@tonic-gate /* 1286*0Sstevel@tonic-gate * Show fragment cache information that's held in the kernel. 1287*0Sstevel@tonic-gate */ 1288*0Sstevel@tonic-gate static void showfrstates(ifsp) 1289*0Sstevel@tonic-gate ipfrstat_t *ifsp; 1290*0Sstevel@tonic-gate { 1291*0Sstevel@tonic-gate struct ipfr *ipfrtab[IPFT_SIZE], ifr; 1292*0Sstevel@tonic-gate frentry_t fr; 1293*0Sstevel@tonic-gate int i; 1294*0Sstevel@tonic-gate 1295*0Sstevel@tonic-gate /* 1296*0Sstevel@tonic-gate * print out the numeric statistics 1297*0Sstevel@tonic-gate */ 1298*0Sstevel@tonic-gate PRINTF("IP fragment states:\n\t%lu new\n\t%lu expired\n\t%lu hits\n", 1299*0Sstevel@tonic-gate ifsp->ifs_new, ifsp->ifs_expire, ifsp->ifs_hits); 1300*0Sstevel@tonic-gate PRINTF("\t%lu retrans\n\t%lu too short\n", ifsp->ifs_retrans0, ifsp->ifs_short); 1301*0Sstevel@tonic-gate PRINTF("\t%lu no memory\n\t%lu already exist\n", 1302*0Sstevel@tonic-gate ifsp->ifs_nomem, ifsp->ifs_exists); 1303*0Sstevel@tonic-gate PRINTF("\t%lu inuse\n", ifsp->ifs_inuse); 1304*0Sstevel@tonic-gate if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_table, sizeof(ipfrtab))) 1305*0Sstevel@tonic-gate return; 1306*0Sstevel@tonic-gate 1307*0Sstevel@tonic-gate /* 1308*0Sstevel@tonic-gate * Print out the contents (if any) of the fragment cache table. 1309*0Sstevel@tonic-gate */ 1310*0Sstevel@tonic-gate for (i = 0; i < IPFT_SIZE; i++) 1311*0Sstevel@tonic-gate while (ipfrtab[i]) { 1312*0Sstevel@tonic-gate if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i], 1313*0Sstevel@tonic-gate sizeof(ifr)) == -1) 1314*0Sstevel@tonic-gate break; 1315*0Sstevel@tonic-gate PRINTF("%s -> ", hostname(4, &ifr.ipfr_src)); 1316*0Sstevel@tonic-gate if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule, 1317*0Sstevel@tonic-gate sizeof(fr)) == -1) 1318*0Sstevel@tonic-gate break; 1319*0Sstevel@tonic-gate PRINTF("%s %d %d %d %#02x = %#x\n", 1320*0Sstevel@tonic-gate hostname(4, &ifr.ipfr_dst), ifr.ipfr_id, 1321*0Sstevel@tonic-gate ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_tos, 1322*0Sstevel@tonic-gate fr.fr_flags); 1323*0Sstevel@tonic-gate ipfrtab[i] = ifr.ipfr_next; 1324*0Sstevel@tonic-gate } 1325*0Sstevel@tonic-gate if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_nattab,sizeof(ipfrtab))) 1326*0Sstevel@tonic-gate return; 1327*0Sstevel@tonic-gate for (i = 0; i < IPFT_SIZE; i++) 1328*0Sstevel@tonic-gate while (ipfrtab[i]) { 1329*0Sstevel@tonic-gate if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i], 1330*0Sstevel@tonic-gate sizeof(ifr)) == -1) 1331*0Sstevel@tonic-gate break; 1332*0Sstevel@tonic-gate PRINTF("NAT: %s -> ", hostname(4, &ifr.ipfr_src)); 1333*0Sstevel@tonic-gate if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule, 1334*0Sstevel@tonic-gate sizeof(fr)) == -1) 1335*0Sstevel@tonic-gate break; 1336*0Sstevel@tonic-gate PRINTF("%s %d %d %d %#02x = %#x\n", 1337*0Sstevel@tonic-gate hostname(4, &ifr.ipfr_dst), ifr.ipfr_id, 1338*0Sstevel@tonic-gate ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_tos, 1339*0Sstevel@tonic-gate fr.fr_flags); 1340*0Sstevel@tonic-gate ipfrtab[i] = ifr.ipfr_next; 1341*0Sstevel@tonic-gate } 1342*0Sstevel@tonic-gate } 1343*0Sstevel@tonic-gate 1344*0Sstevel@tonic-gate 1345*0Sstevel@tonic-gate /* 1346*0Sstevel@tonic-gate * Show stats on how auth within IPFilter has been used 1347*0Sstevel@tonic-gate */ 1348*0Sstevel@tonic-gate static void showauthstates(asp) 1349*0Sstevel@tonic-gate fr_authstat_t *asp; 1350*0Sstevel@tonic-gate { 1351*0Sstevel@tonic-gate frauthent_t *frap, fra; 1352*0Sstevel@tonic-gate 1353*0Sstevel@tonic-gate #ifdef USE_QUAD_T 1354*0Sstevel@tonic-gate printf("Authorisation hits: %qu\tmisses %qu\n", 1355*0Sstevel@tonic-gate (unsigned long long) asp->fas_hits, 1356*0Sstevel@tonic-gate (unsigned long long) asp->fas_miss); 1357*0Sstevel@tonic-gate #else 1358*0Sstevel@tonic-gate printf("Authorisation hits: %ld\tmisses %ld\n", asp->fas_hits, 1359*0Sstevel@tonic-gate asp->fas_miss); 1360*0Sstevel@tonic-gate #endif 1361*0Sstevel@tonic-gate printf("nospace %ld\nadded %ld\nsendfail %ld\nsendok %ld\n", 1362*0Sstevel@tonic-gate asp->fas_nospace, asp->fas_added, asp->fas_sendfail, 1363*0Sstevel@tonic-gate asp->fas_sendok); 1364*0Sstevel@tonic-gate printf("queok %ld\nquefail %ld\nexpire %ld\n", 1365*0Sstevel@tonic-gate asp->fas_queok, asp->fas_quefail, asp->fas_expire); 1366*0Sstevel@tonic-gate 1367*0Sstevel@tonic-gate frap = asp->fas_faelist; 1368*0Sstevel@tonic-gate while (frap) { 1369*0Sstevel@tonic-gate if (kmemcpy((char *)&fra, (u_long)frap, sizeof(fra)) == -1) 1370*0Sstevel@tonic-gate break; 1371*0Sstevel@tonic-gate 1372*0Sstevel@tonic-gate printf("age %ld\t", fra.fae_age); 1373*0Sstevel@tonic-gate printfr(&fra.fae_fr, ioctl); 1374*0Sstevel@tonic-gate frap = fra.fae_next; 1375*0Sstevel@tonic-gate } 1376*0Sstevel@tonic-gate } 1377*0Sstevel@tonic-gate 1378*0Sstevel@tonic-gate 1379*0Sstevel@tonic-gate /* 1380*0Sstevel@tonic-gate * Display groups used for each of filter rules, accounting rules and 1381*0Sstevel@tonic-gate * authentication, separately. 1382*0Sstevel@tonic-gate */ 1383*0Sstevel@tonic-gate static void showgroups(fiop) 1384*0Sstevel@tonic-gate struct friostat *fiop; 1385*0Sstevel@tonic-gate { 1386*0Sstevel@tonic-gate static char *gnames[3] = { "Filter", "Accounting", "Authentication" }; 1387*0Sstevel@tonic-gate frgroup_t *fp, grp; 1388*0Sstevel@tonic-gate int on, off, i; 1389*0Sstevel@tonic-gate 1390*0Sstevel@tonic-gate on = fiop->f_active; 1391*0Sstevel@tonic-gate off = 1 - on; 1392*0Sstevel@tonic-gate 1393*0Sstevel@tonic-gate for (i = 0; i < 3; i++) { 1394*0Sstevel@tonic-gate printf("%s groups (active):\n", gnames[i]); 1395*0Sstevel@tonic-gate for (fp = fiop->f_groups[i][on]; fp; fp = grp.fg_next) 1396*0Sstevel@tonic-gate if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp))) 1397*0Sstevel@tonic-gate break; 1398*0Sstevel@tonic-gate else 1399*0Sstevel@tonic-gate printf("%s\n", grp.fg_name); 1400*0Sstevel@tonic-gate printf("%s groups (inactive):\n", gnames[i]); 1401*0Sstevel@tonic-gate for (fp = fiop->f_groups[i][off]; fp; fp = grp.fg_next) 1402*0Sstevel@tonic-gate if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp))) 1403*0Sstevel@tonic-gate break; 1404*0Sstevel@tonic-gate else 1405*0Sstevel@tonic-gate printf("%s\n", grp.fg_name); 1406*0Sstevel@tonic-gate } 1407*0Sstevel@tonic-gate } 1408*0Sstevel@tonic-gate 1409*0Sstevel@tonic-gate static void parse_ipportstr(argument, ip, port) 1410*0Sstevel@tonic-gate const char *argument; 1411*0Sstevel@tonic-gate struct in_addr *ip; 1412*0Sstevel@tonic-gate int *port; 1413*0Sstevel@tonic-gate { 1414*0Sstevel@tonic-gate 1415*0Sstevel@tonic-gate char *s, *comma; 1416*0Sstevel@tonic-gate 1417*0Sstevel@tonic-gate /* make working copy of argument, Theoretically you must be able 1418*0Sstevel@tonic-gate * to write to optarg, but that seems very ugly to me.... 1419*0Sstevel@tonic-gate */ 1420*0Sstevel@tonic-gate s = strdup(argument); 1421*0Sstevel@tonic-gate if (s == NULL) 1422*0Sstevel@tonic-gate return; 1423*0Sstevel@tonic-gate 1424*0Sstevel@tonic-gate /* get port */ 1425*0Sstevel@tonic-gate if ((comma = strchr(s, ',')) != NULL) { 1426*0Sstevel@tonic-gate if (!strcasecmp(comma + 1, "any")) { 1427*0Sstevel@tonic-gate *port = -1; 1428*0Sstevel@tonic-gate } else if (!sscanf(comma + 1, "%d", port) || 1429*0Sstevel@tonic-gate (*port < 0) || (*port > 65535)) { 1430*0Sstevel@tonic-gate fprintf(stderr, "Invalid port specfication in %s\n", 1431*0Sstevel@tonic-gate argument); 1432*0Sstevel@tonic-gate free(s); 1433*0Sstevel@tonic-gate exit(-2); 1434*0Sstevel@tonic-gate } 1435*0Sstevel@tonic-gate *comma = '\0'; 1436*0Sstevel@tonic-gate } 1437*0Sstevel@tonic-gate 1438*0Sstevel@tonic-gate 1439*0Sstevel@tonic-gate /* get ip address */ 1440*0Sstevel@tonic-gate if (!strcasecmp(s, "any")) { 1441*0Sstevel@tonic-gate ip->s_addr = INADDR_ANY; 1442*0Sstevel@tonic-gate } else if (!inet_aton(s, ip)) { 1443*0Sstevel@tonic-gate fprintf(stderr, "Invalid IP address: %s\n", s); 1444*0Sstevel@tonic-gate free(s); 1445*0Sstevel@tonic-gate exit(-2); 1446*0Sstevel@tonic-gate } 1447*0Sstevel@tonic-gate 1448*0Sstevel@tonic-gate /* free allocated memory */ 1449*0Sstevel@tonic-gate free(s); 1450*0Sstevel@tonic-gate } 1451*0Sstevel@tonic-gate 1452*0Sstevel@tonic-gate 1453*0Sstevel@tonic-gate #ifdef STATETOP 1454*0Sstevel@tonic-gate static char ttlbuf[STSTRSIZE]; 1455*0Sstevel@tonic-gate 1456*0Sstevel@tonic-gate static char *ttl_to_string(ttl) 1457*0Sstevel@tonic-gate long int ttl; 1458*0Sstevel@tonic-gate { 1459*0Sstevel@tonic-gate 1460*0Sstevel@tonic-gate int hours, minutes, seconds; 1461*0Sstevel@tonic-gate 1462*0Sstevel@tonic-gate /* ttl is in half seconds */ 1463*0Sstevel@tonic-gate ttl /= 2; 1464*0Sstevel@tonic-gate 1465*0Sstevel@tonic-gate hours = ttl / 3600; 1466*0Sstevel@tonic-gate ttl = ttl % 3600; 1467*0Sstevel@tonic-gate minutes = ttl / 60; 1468*0Sstevel@tonic-gate seconds = ttl % 60; 1469*0Sstevel@tonic-gate 1470*0Sstevel@tonic-gate if (hours > 0 ) 1471*0Sstevel@tonic-gate sprintf(ttlbuf, "%2d:%02d:%02d", hours, minutes, seconds); 1472*0Sstevel@tonic-gate else 1473*0Sstevel@tonic-gate sprintf(ttlbuf, "%2d:%02d", minutes, seconds); 1474*0Sstevel@tonic-gate return ttlbuf; 1475*0Sstevel@tonic-gate } 1476*0Sstevel@tonic-gate 1477*0Sstevel@tonic-gate 1478*0Sstevel@tonic-gate static int sort_pkts(a, b) 1479*0Sstevel@tonic-gate const void *a; 1480*0Sstevel@tonic-gate const void *b; 1481*0Sstevel@tonic-gate { 1482*0Sstevel@tonic-gate 1483*0Sstevel@tonic-gate register const statetop_t *ap = a; 1484*0Sstevel@tonic-gate register const statetop_t *bp = b; 1485*0Sstevel@tonic-gate 1486*0Sstevel@tonic-gate if (ap->st_pkts == bp->st_pkts) 1487*0Sstevel@tonic-gate return 0; 1488*0Sstevel@tonic-gate else if (ap->st_pkts < bp->st_pkts) 1489*0Sstevel@tonic-gate return 1; 1490*0Sstevel@tonic-gate return -1; 1491*0Sstevel@tonic-gate } 1492*0Sstevel@tonic-gate 1493*0Sstevel@tonic-gate 1494*0Sstevel@tonic-gate static int sort_bytes(a, b) 1495*0Sstevel@tonic-gate const void *a; 1496*0Sstevel@tonic-gate const void *b; 1497*0Sstevel@tonic-gate { 1498*0Sstevel@tonic-gate register const statetop_t *ap = a; 1499*0Sstevel@tonic-gate register const statetop_t *bp = b; 1500*0Sstevel@tonic-gate 1501*0Sstevel@tonic-gate if (ap->st_bytes == bp->st_bytes) 1502*0Sstevel@tonic-gate return 0; 1503*0Sstevel@tonic-gate else if (ap->st_bytes < bp->st_bytes) 1504*0Sstevel@tonic-gate return 1; 1505*0Sstevel@tonic-gate return -1; 1506*0Sstevel@tonic-gate } 1507*0Sstevel@tonic-gate 1508*0Sstevel@tonic-gate 1509*0Sstevel@tonic-gate static int sort_p(a, b) 1510*0Sstevel@tonic-gate const void *a; 1511*0Sstevel@tonic-gate const void *b; 1512*0Sstevel@tonic-gate { 1513*0Sstevel@tonic-gate register const statetop_t *ap = a; 1514*0Sstevel@tonic-gate register const statetop_t *bp = b; 1515*0Sstevel@tonic-gate 1516*0Sstevel@tonic-gate if (ap->st_p == bp->st_p) 1517*0Sstevel@tonic-gate return 0; 1518*0Sstevel@tonic-gate else if (ap->st_p < bp->st_p) 1519*0Sstevel@tonic-gate return 1; 1520*0Sstevel@tonic-gate return -1; 1521*0Sstevel@tonic-gate } 1522*0Sstevel@tonic-gate 1523*0Sstevel@tonic-gate 1524*0Sstevel@tonic-gate static int sort_ttl(a, b) 1525*0Sstevel@tonic-gate const void *a; 1526*0Sstevel@tonic-gate const void *b; 1527*0Sstevel@tonic-gate { 1528*0Sstevel@tonic-gate register const statetop_t *ap = a; 1529*0Sstevel@tonic-gate register const statetop_t *bp = b; 1530*0Sstevel@tonic-gate 1531*0Sstevel@tonic-gate if (ap->st_age == bp->st_age) 1532*0Sstevel@tonic-gate return 0; 1533*0Sstevel@tonic-gate else if (ap->st_age < bp->st_age) 1534*0Sstevel@tonic-gate return 1; 1535*0Sstevel@tonic-gate return -1; 1536*0Sstevel@tonic-gate } 1537*0Sstevel@tonic-gate 1538*0Sstevel@tonic-gate static int sort_srcip(a, b) 1539*0Sstevel@tonic-gate const void *a; 1540*0Sstevel@tonic-gate const void *b; 1541*0Sstevel@tonic-gate { 1542*0Sstevel@tonic-gate register const statetop_t *ap = a; 1543*0Sstevel@tonic-gate register const statetop_t *bp = b; 1544*0Sstevel@tonic-gate 1545*0Sstevel@tonic-gate if (ntohl(ap->st_src.in4.s_addr) == ntohl(bp->st_src.in4.s_addr)) 1546*0Sstevel@tonic-gate return 0; 1547*0Sstevel@tonic-gate else if (ntohl(ap->st_src.in4.s_addr) > ntohl(bp->st_src.in4.s_addr)) 1548*0Sstevel@tonic-gate return 1; 1549*0Sstevel@tonic-gate return -1; 1550*0Sstevel@tonic-gate } 1551*0Sstevel@tonic-gate 1552*0Sstevel@tonic-gate static int sort_dstip(a, b) 1553*0Sstevel@tonic-gate const void *a; 1554*0Sstevel@tonic-gate const void *b; 1555*0Sstevel@tonic-gate { 1556*0Sstevel@tonic-gate register const statetop_t *ap = a; 1557*0Sstevel@tonic-gate register const statetop_t *bp = b; 1558*0Sstevel@tonic-gate 1559*0Sstevel@tonic-gate if (ntohl(ap->st_dst.in4.s_addr) == ntohl(bp->st_dst.in4.s_addr)) 1560*0Sstevel@tonic-gate return 0; 1561*0Sstevel@tonic-gate else if (ntohl(ap->st_dst.in4.s_addr) > ntohl(bp->st_dst.in4.s_addr)) 1562*0Sstevel@tonic-gate return 1; 1563*0Sstevel@tonic-gate return -1; 1564*0Sstevel@tonic-gate } 1565*0Sstevel@tonic-gate #endif 1566