1 /* $OpenBSD: print-pfsync.c,v 1.41 2015/11/16 00:16:39 mmcc Exp $ */ 2 3 /* 4 * Copyright (c) 2002 Michael Shalayeff 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 26 * THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/time.h> 30 #include <sys/socket.h> 31 #include <sys/file.h> 32 #include <sys/ioctl.h> 33 34 #ifdef __STDC__ 35 struct rtentry; 36 #endif 37 #include <net/if.h> 38 39 #include <netinet/in.h> 40 #include <netinet/ip.h> 41 42 #include <net/pfvar.h> 43 #include <net/if_pfsync.h> 44 45 #include <ctype.h> 46 #include <netdb.h> 47 #include <pcap.h> 48 #include <signal.h> 49 #include <stdio.h> 50 #include <string.h> 51 52 #include "interface.h" 53 #include "addrtoname.h" 54 #include "pfctl_parser.h" 55 #include "pfctl.h" 56 57 void pfsync_print(struct pfsync_header *, const u_char *, int); 58 59 void 60 pfsync_if_print(u_char *user, const struct pcap_pkthdr *h, 61 const u_char *p) 62 { 63 u_int caplen = h->caplen; 64 65 ts_print(&h->ts); 66 67 if (caplen < PFSYNC_HDRLEN) { 68 printf("[|pfsync]"); 69 goto out; 70 } 71 72 pfsync_print((struct pfsync_header *)p, 73 p + sizeof(struct pfsync_header), 74 caplen - sizeof(struct pfsync_header)); 75 out: 76 if (xflag) { 77 default_print((const u_char *)p, caplen); 78 } 79 putchar('\n'); 80 } 81 82 void 83 pfsync_ip_print(const u_char *bp, u_int len, const u_char *bp2) 84 { 85 struct pfsync_header *hdr = (struct pfsync_header *)bp; 86 struct ip *ip = (struct ip *)bp2; 87 88 if (vflag) 89 printf("%s > %s: ", ipaddr_string(&ip->ip_src), 90 ipaddr_string(&ip->ip_dst)); 91 else 92 printf("%s: ", ipaddr_string(&ip->ip_src)); 93 94 if (len < PFSYNC_HDRLEN) 95 printf("[|pfsync]"); 96 else 97 pfsync_print(hdr, bp + sizeof(struct pfsync_header), 98 len - sizeof(struct pfsync_header)); 99 putchar('\n'); 100 } 101 102 const char *actnames[] = { PFSYNC_ACTIONS }; 103 104 struct pfsync_actions { 105 size_t len; 106 int (*print)(int, const void *); 107 }; 108 109 int pfsync_print_clr(int, const void *); 110 int pfsync_print_state(int, const void *); 111 int pfsync_print_ins_ack(int, const void *); 112 int pfsync_print_upd_c(int, const void *); 113 int pfsync_print_upd_req(int, const void *); 114 int pfsync_print_del_c(int, const void *); 115 int pfsync_print_bus(int, const void *); 116 int pfsync_print_tdb(int, const void *); 117 int pfsync_print_eof(int, const void *); 118 119 struct pfsync_actions actions[] = { 120 { sizeof(struct pfsync_clr), pfsync_print_clr }, 121 { 0, NULL }, 122 { sizeof(struct pfsync_ins_ack), pfsync_print_ins_ack }, 123 { 0, NULL }, 124 { sizeof(struct pfsync_upd_c), pfsync_print_upd_c }, 125 { sizeof(struct pfsync_upd_req), pfsync_print_upd_req }, 126 { sizeof(struct pfsync_state), pfsync_print_state }, 127 { sizeof(struct pfsync_del_c), pfsync_print_del_c }, 128 { 0, NULL }, 129 { 0, NULL }, 130 { sizeof(struct pfsync_bus), pfsync_print_bus }, 131 { 0, NULL }, 132 { 0, pfsync_print_eof }, 133 { sizeof(struct pfsync_state), pfsync_print_state }, 134 { sizeof(struct pfsync_state), pfsync_print_state }, 135 { sizeof(struct pfsync_tdb), pfsync_print_tdb }, 136 }; 137 138 void 139 pfsync_print(struct pfsync_header *hdr, const u_char *bp, int len) 140 { 141 struct pfsync_subheader *subh; 142 int count, plen, alen, flags = 0; 143 int i; 144 145 plen = ntohs(hdr->len); 146 147 printf("PFSYNCv%d len %d", hdr->version, plen); 148 149 if (hdr->version != PFSYNC_VERSION) 150 return; 151 152 plen -= sizeof(*hdr); 153 154 if (vflag) 155 flags |= PF_OPT_VERBOSE; 156 if (vflag > 1) 157 flags |= PF_OPT_VERBOSE2; 158 if (!nflag) 159 flags |= PF_OPT_USEDNS; 160 161 while (plen > 0) { 162 if (len < sizeof(*subh)) 163 break; 164 165 subh = (struct pfsync_subheader *)bp; 166 bp += sizeof(*subh); 167 len -= sizeof(*subh); 168 plen -= sizeof(*subh); 169 170 if (subh->action >= PFSYNC_ACT_MAX) { 171 printf("\n act UNKNOWN id %d", subh->action); 172 return; 173 } 174 175 count = ntohs(subh->count); 176 printf("\n act %s count %d", actnames[subh->action], count); 177 alen = actions[subh->action].len; 178 179 if (actions[subh->action].print == NULL) { 180 printf("\n unimplemented action"); 181 return; 182 } 183 184 for (i = 0; i < count; i++) { 185 if (len < alen) { 186 len = 0; 187 break; 188 } 189 190 if (actions[subh->action].print(flags, bp) != 0) 191 return; 192 193 bp += alen; 194 len -= alen; 195 plen -= alen; 196 } 197 } 198 199 if (plen > 0) { 200 printf("\n ..."); 201 return; 202 } 203 if (plen < 0) { 204 printf("\n invalid header length"); 205 return; 206 } 207 if (len > 0) 208 printf("\n invalid packet length"); 209 } 210 211 int 212 pfsync_print_clr(int flags, const void *bp) 213 { 214 const struct pfsync_clr *clr = bp; 215 216 printf("\n\tcreatorid: %08x", htonl(clr->creatorid)); 217 if (clr->ifname[0] != '\0') 218 printf(" interface: %s", clr->ifname); 219 220 return (0); 221 } 222 223 int 224 pfsync_print_state(int flags, const void *bp) 225 { 226 struct pfsync_state *st = (struct pfsync_state *)bp; 227 putchar('\n'); 228 print_state(st, flags); 229 return (0); 230 } 231 232 int 233 pfsync_print_ins_ack(int flags, const void *bp) 234 { 235 const struct pfsync_ins_ack *iack = bp; 236 237 printf("\n\tid: %016llx creatorid: %08x", betoh64(iack->id), 238 ntohl(iack->creatorid)); 239 240 return (0); 241 } 242 243 int 244 pfsync_print_upd_c(int flags, const void *bp) 245 { 246 const struct pfsync_upd_c *u = bp; 247 248 printf("\n\tid: %016llx creatorid: %08x", betoh64(u->id), 249 ntohl(u->creatorid)); 250 251 return (0); 252 } 253 254 int 255 pfsync_print_upd_req(int flags, const void *bp) 256 { 257 const struct pfsync_upd_req *ur = bp; 258 259 printf("\n\tid: %016llx creatorid: %08x", betoh64(ur->id), 260 ntohl(ur->creatorid)); 261 262 return (0); 263 } 264 265 int 266 pfsync_print_del_c(int flags, const void *bp) 267 { 268 const struct pfsync_del_c *d = bp; 269 270 printf("\n\tid: %016llx creatorid: %08x", betoh64(d->id), 271 ntohl(d->creatorid)); 272 273 return (0); 274 } 275 276 int 277 pfsync_print_bus(int flags, const void *bp) 278 { 279 const struct pfsync_bus *b = bp; 280 u_int32_t endtime; 281 int min, sec; 282 const char *status; 283 284 endtime = ntohl(b->endtime); 285 sec = endtime % 60; 286 endtime /= 60; 287 min = endtime % 60; 288 endtime /= 60; 289 290 switch (b->status) { 291 case PFSYNC_BUS_START: 292 status = "start"; 293 break; 294 case PFSYNC_BUS_END: 295 status = "end"; 296 break; 297 default: 298 status = "UNKNOWN"; 299 break; 300 } 301 302 printf("\n\tcreatorid: %08x age: %.2u:%.2u:%.2u status: %s", 303 htonl(b->creatorid), endtime, min, sec, status); 304 305 return (0); 306 } 307 308 int 309 pfsync_print_tdb(int flags, const void *bp) 310 { 311 const struct pfsync_tdb *t = bp; 312 313 printf("\n\tspi: 0x%08x rpl: %llu cur_bytes: %llu", 314 ntohl(t->spi), betoh64(t->rpl), betoh64(t->cur_bytes)); 315 316 return (0); 317 } 318 319 int 320 pfsync_print_eof(int flags, const void *bp) 321 { 322 return (1); 323 } 324