1 /* $OpenBSD: print-pflog.c,v 1.14 2003/06/21 21:01:15 dhartmei Exp $ */ 2 3 /* 4 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 */ 23 24 #ifndef lint 25 static const char rcsid[] = 26 "@(#) $Header: /home/cvs/src/usr.sbin/tcpdump/print-pflog.c,v 1.14 2003/06/21 21:01:15 dhartmei Exp $ (LBL)"; 27 #endif 28 29 #include <sys/param.h> 30 #include <sys/time.h> 31 #include <sys/socket.h> 32 #include <sys/file.h> 33 #include <sys/ioctl.h> 34 #include <sys/mbuf.h> 35 36 struct rtentry; 37 #include <net/if.h> 38 #include <net/if_pflog.h> 39 40 #include <netinet/in.h> 41 #include <netinet/in_systm.h> 42 #include <netinet/ip.h> 43 44 #include <net/pfvar.h> 45 46 #include <ctype.h> 47 #include <netdb.h> 48 #include <pcap.h> 49 #include <signal.h> 50 #include <stdio.h> 51 52 #include "interface.h" 53 #include "addrtoname.h" 54 55 char *pf_reasons[PFRES_MAX+2] = PFRES_NAMES; 56 57 void 58 pflog_if_print(u_char *user, const struct pcap_pkthdr *h, 59 register const u_char *p) 60 { 61 u_int length = h->len; 62 u_int hdrlen; 63 u_int caplen = h->caplen; 64 const struct ip *ip; 65 #ifdef INET6 66 const struct ip6_hdr *ip6; 67 #endif 68 const struct pfloghdr *hdr; 69 u_int32_t res; 70 char reason[128], *why; 71 u_int8_t af; 72 73 ts_print(&h->ts); 74 75 // check length 76 if (caplen < sizeof(u_int8_t)) { 77 printf("[|pflog]"); 78 goto out; 79 } 80 81 #define MIN_PFLOG_HDRLEN 45 82 hdr = (struct pfloghdr *)p; 83 if (hdr->length < MIN_PFLOG_HDRLEN) { 84 printf("[pflog: invalid header length!]"); 85 goto out; 86 } 87 hdrlen = BPF_WORDALIGN(hdr->length); 88 89 if (caplen < hdrlen) { 90 printf("[|pflog]"); 91 goto out; 92 } 93 94 /* 95 * Some printers want to get back at the link level addresses, 96 * and/or check that they're not walking off the end of the packet. 97 * Rather than pass them all the way down, we set these globals. 98 */ 99 packetp = p; 100 snapend = p + caplen; 101 102 hdr = (struct pfloghdr *)p; 103 if (eflag) { 104 res = hdr->reason; 105 why = (res < PFRES_MAX) ? pf_reasons[res] : "unkn"; 106 107 snprintf(reason, sizeof(reason), "%d(%s)", res, why); 108 109 if (ntohl(hdr->subrulenr) == (u_int32_t) -1) 110 printf("rule %u/%s: ", 111 ntohl(hdr->rulenr), reason); 112 else 113 printf("rule %u.%s.%u/%s: ", ntohl(hdr->rulenr), 114 hdr->ruleset, ntohl(hdr->subrulenr), reason); 115 116 switch (hdr->action) { 117 case PF_SCRUB: 118 printf("scrub"); 119 break; 120 case PF_PASS: 121 printf("pass"); 122 break; 123 case PF_DROP: 124 printf("block"); 125 break; 126 case PF_NAT: 127 case PF_NONAT: 128 printf("nat"); 129 break; 130 case PF_BINAT: 131 case PF_NOBINAT: 132 printf("binat"); 133 break; 134 case PF_RDR: 135 case PF_NORDR: 136 printf("rdr"); 137 break; 138 } 139 printf(" %s on %s: ", 140 hdr->dir == PF_OUT ? "out" : "in", 141 hdr->ifname); 142 } 143 af = hdr->af; 144 length -= hdrlen; 145 if (af == AF_INET) { 146 ip = (struct ip *)(p + hdrlen); 147 ip_print((const u_char *)ip, length); 148 if (xflag) 149 default_print((const u_char *)ip, 150 caplen - hdrlen); 151 } else { 152 #ifdef INET6 153 ip6 = (struct ip6_hdr *)(p + hdrlen); 154 ip6_print((const u_char *)ip6, length); 155 if (xflag) 156 default_print((const u_char *)ip6, 157 caplen - hdrlen); 158 #endif 159 } 160 161 out: 162 putchar('\n'); 163 } 164 165 166 void 167 pflog_old_if_print(u_char *user, const struct pcap_pkthdr *h, 168 register const u_char *p) 169 { 170 u_int length = h->len; 171 u_int caplen = h->caplen; 172 const struct ip *ip; 173 #ifdef INET6 174 const struct ip6_hdr *ip6; 175 #endif 176 const struct old_pfloghdr *hdr; 177 u_short res; 178 char reason[128], *why; 179 u_int8_t af; 180 181 ts_print(&h->ts); 182 183 if (caplen < OLD_PFLOG_HDRLEN) { 184 printf("[|pflog]"); 185 goto out; 186 } 187 188 /* 189 * Some printers want to get back at the link level addresses, 190 * and/or check that they're not walking off the end of the packet. 191 * Rather than pass them all the way down, we set these globals. 192 */ 193 packetp = p; 194 snapend = p + caplen; 195 196 hdr = (struct old_pfloghdr *)p; 197 if (eflag) { 198 res = ntohs(hdr->reason); 199 why = (res < PFRES_MAX) ? pf_reasons[res] : "unkn"; 200 201 snprintf(reason, sizeof(reason), "%d(%s)", res, why); 202 203 printf("rule %d/%s: ", 204 (short)ntohs(hdr->rnr), reason); 205 switch (ntohs(hdr->action)) { 206 case PF_SCRUB: 207 printf("scrub"); 208 break; 209 case PF_PASS: 210 printf("pass"); 211 break; 212 case PF_DROP: 213 printf("block"); 214 break; 215 case PF_NAT: 216 case PF_NONAT: 217 printf("nat"); 218 break; 219 case PF_BINAT: 220 case PF_NOBINAT: 221 printf("binat"); 222 break; 223 case PF_RDR: 224 case PF_NORDR: 225 printf("rdr"); 226 break; 227 } 228 printf(" %s on %s: ", 229 ntohs(hdr->dir) == PF_OUT ? "out" : "in", 230 hdr->ifname); 231 } 232 af = ntohl(hdr->af); 233 length -= OLD_PFLOG_HDRLEN; 234 if (af == AF_INET) { 235 ip = (struct ip *)(p + OLD_PFLOG_HDRLEN); 236 ip_print((const u_char *)ip, length); 237 if (xflag) 238 default_print((const u_char *)ip, 239 caplen - OLD_PFLOG_HDRLEN); 240 } else { 241 #ifdef INET6 242 ip6 = (struct ip6_hdr *)(p + OLD_PFLOG_HDRLEN); 243 ip6_print((const u_char *)ip6, length); 244 if (xflag) 245 default_print((const u_char *)ip6, 246 caplen - OLD_PFLOG_HDRLEN); 247 #endif 248 } 249 250 out: 251 putchar('\n'); 252 } 253