1 /* $OpenBSD: print-pfsync.c,v 1.39 2014/08/14 12:44:44 mpi Exp $ */ 2 3 /* 4 * Copyright (c) 2002 Michael Shalayeff 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 26 * THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/param.h> 30 #include <sys/time.h> 31 #include <sys/socket.h> 32 #include <sys/file.h> 33 #include <sys/ioctl.h> 34 #include <sys/mbuf.h> 35 36 #ifdef __STDC__ 37 struct rtentry; 38 #endif 39 #include <net/if.h> 40 41 #include <netinet/in.h> 42 #include <netinet/ip.h> 43 44 #include <net/pfvar.h> 45 #include <net/if_pfsync.h> 46 47 #include <ctype.h> 48 #include <netdb.h> 49 #include <pcap.h> 50 #include <signal.h> 51 #include <stdio.h> 52 #include <string.h> 53 54 #include "interface.h" 55 #include "addrtoname.h" 56 #include "pfctl_parser.h" 57 #include "pfctl.h" 58 59 void pfsync_print(struct pfsync_header *, const u_char *, int); 60 61 void 62 pfsync_if_print(u_char *user, const struct pcap_pkthdr *h, 63 register const u_char *p) 64 { 65 u_int caplen = h->caplen; 66 67 ts_print(&h->ts); 68 69 if (caplen < PFSYNC_HDRLEN) { 70 printf("[|pfsync]"); 71 goto out; 72 } 73 74 pfsync_print((struct pfsync_header *)p, 75 p + sizeof(struct pfsync_header), 76 caplen - sizeof(struct pfsync_header)); 77 out: 78 if (xflag) { 79 default_print((const u_char *)p, caplen); 80 } 81 putchar('\n'); 82 } 83 84 void 85 pfsync_ip_print(const u_char *bp, u_int len, const u_char *bp2) 86 { 87 struct pfsync_header *hdr = (struct pfsync_header *)bp; 88 struct ip *ip = (struct ip *)bp2; 89 90 if (vflag) 91 printf("%s > %s: ", ipaddr_string(&ip->ip_src), 92 ipaddr_string(&ip->ip_dst)); 93 else 94 printf("%s: ", ipaddr_string(&ip->ip_src)); 95 96 if (len < PFSYNC_HDRLEN) 97 printf("[|pfsync]"); 98 else 99 pfsync_print(hdr, bp + sizeof(struct pfsync_header), 100 len - sizeof(struct pfsync_header)); 101 putchar('\n'); 102 } 103 104 const char *actnames[] = { PFSYNC_ACTIONS }; 105 106 struct pfsync_actions { 107 size_t len; 108 int (*print)(int, const void *); 109 }; 110 111 int pfsync_print_clr(int, const void *); 112 int pfsync_print_state(int, const void *); 113 int pfsync_print_ins_ack(int, const void *); 114 int pfsync_print_upd_c(int, const void *); 115 int pfsync_print_upd_req(int, const void *); 116 int pfsync_print_del_c(int, const void *); 117 int pfsync_print_bus(int, const void *); 118 int pfsync_print_tdb(int, const void *); 119 int pfsync_print_eof(int, const void *); 120 121 struct pfsync_actions actions[] = { 122 { sizeof(struct pfsync_clr), pfsync_print_clr }, 123 { 0, NULL }, 124 { sizeof(struct pfsync_ins_ack), pfsync_print_ins_ack }, 125 { 0, NULL }, 126 { sizeof(struct pfsync_upd_c), pfsync_print_upd_c }, 127 { sizeof(struct pfsync_upd_req), pfsync_print_upd_req }, 128 { sizeof(struct pfsync_state), pfsync_print_state }, 129 { sizeof(struct pfsync_del_c), pfsync_print_del_c }, 130 { 0, NULL }, 131 { 0, NULL }, 132 { sizeof(struct pfsync_bus), pfsync_print_bus }, 133 { 0, NULL }, 134 { 0, pfsync_print_eof }, 135 { sizeof(struct pfsync_state), pfsync_print_state }, 136 { sizeof(struct pfsync_state), pfsync_print_state }, 137 { sizeof(struct pfsync_tdb), pfsync_print_tdb }, 138 }; 139 140 void 141 pfsync_print(struct pfsync_header *hdr, const u_char *bp, int len) 142 { 143 struct pfsync_subheader *subh; 144 int count, plen, alen, flags = 0; 145 int i; 146 147 plen = ntohs(hdr->len); 148 149 printf("PFSYNCv%d len %d", hdr->version, plen); 150 151 if (hdr->version != PFSYNC_VERSION) 152 return; 153 154 plen -= sizeof(*hdr); 155 156 if (vflag) 157 flags |= PF_OPT_VERBOSE; 158 if (vflag > 1) 159 flags |= PF_OPT_VERBOSE2; 160 if (!nflag) 161 flags |= PF_OPT_USEDNS; 162 163 while (plen > 0) { 164 if (len < sizeof(*subh)) 165 break; 166 167 subh = (struct pfsync_subheader *)bp; 168 bp += sizeof(*subh); 169 len -= sizeof(*subh); 170 plen -= sizeof(*subh); 171 172 if (subh->action >= PFSYNC_ACT_MAX) { 173 printf("\n act UNKNOWN id %d", subh->action); 174 return; 175 } 176 177 count = ntohs(subh->count); 178 printf("\n act %s count %d", actnames[subh->action], count); 179 alen = actions[subh->action].len; 180 181 if (actions[subh->action].print == NULL) { 182 printf("\n unimplemented action"); 183 return; 184 } 185 186 for (i = 0; i < count; i++) { 187 if (len < alen) { 188 len = 0; 189 break; 190 } 191 192 if (actions[subh->action].print(flags, bp) != 0) 193 return; 194 195 bp += alen; 196 len -= alen; 197 plen -= alen; 198 } 199 } 200 201 if (plen > 0) { 202 printf("\n ..."); 203 return; 204 } 205 if (plen < 0) { 206 printf("\n invalid header length"); 207 return; 208 } 209 if (len > 0) 210 printf("\n invalid packet length"); 211 } 212 213 int 214 pfsync_print_clr(int flags, const void *bp) 215 { 216 const struct pfsync_clr *clr = bp; 217 218 printf("\n\tcreatorid: %08x", htonl(clr->creatorid)); 219 if (clr->ifname[0] != '\0') 220 printf(" interface: %s", clr->ifname); 221 222 return (0); 223 } 224 225 int 226 pfsync_print_state(int flags, const void *bp) 227 { 228 struct pfsync_state *st = (struct pfsync_state *)bp; 229 putchar('\n'); 230 print_state(st, flags); 231 return (0); 232 } 233 234 int 235 pfsync_print_ins_ack(int flags, const void *bp) 236 { 237 const struct pfsync_ins_ack *iack = bp; 238 239 printf("\n\tid: %016llx creatorid: %08x", betoh64(iack->id), 240 ntohl(iack->creatorid)); 241 242 return (0); 243 } 244 245 int 246 pfsync_print_upd_c(int flags, const void *bp) 247 { 248 const struct pfsync_upd_c *u = bp; 249 250 printf("\n\tid: %016llx creatorid: %08x", betoh64(u->id), 251 ntohl(u->creatorid)); 252 253 return (0); 254 } 255 256 int 257 pfsync_print_upd_req(int flags, const void *bp) 258 { 259 const struct pfsync_upd_req *ur = bp; 260 261 printf("\n\tid: %016llx creatorid: %08x", betoh64(ur->id), 262 ntohl(ur->creatorid)); 263 264 return (0); 265 } 266 267 int 268 pfsync_print_del_c(int flags, const void *bp) 269 { 270 const struct pfsync_del_c *d = bp; 271 272 printf("\n\tid: %016llx creatorid: %08x", betoh64(d->id), 273 ntohl(d->creatorid)); 274 275 return (0); 276 } 277 278 int 279 pfsync_print_bus(int flags, const void *bp) 280 { 281 const struct pfsync_bus *b = bp; 282 u_int32_t endtime; 283 int min, sec; 284 const char *status; 285 286 endtime = ntohl(b->endtime); 287 sec = endtime % 60; 288 endtime /= 60; 289 min = endtime % 60; 290 endtime /= 60; 291 292 switch (b->status) { 293 case PFSYNC_BUS_START: 294 status = "start"; 295 break; 296 case PFSYNC_BUS_END: 297 status = "end"; 298 break; 299 default: 300 status = "UNKNOWN"; 301 break; 302 } 303 304 printf("\n\tcreatorid: %08x age: %.2u:%.2u:%.2u status: %s", 305 htonl(b->creatorid), endtime, min, sec, status); 306 307 return (0); 308 } 309 310 int 311 pfsync_print_tdb(int flags, const void *bp) 312 { 313 const struct pfsync_tdb *t = bp; 314 315 printf("\n\tspi: 0x%08x rpl: %llu cur_bytes: %llu", 316 ntohl(t->spi), betoh64(t->rpl), betoh64(t->cur_bytes)); 317 318 return (0); 319 } 320 321 int 322 pfsync_print_eof(int flags, const void *bp) 323 { 324 return (1); 325 } 326