dist/tcpdump/print-pflog.c

   1 /*      $NetBSD: print-pflog.c,v 1.6 2004/09/27 23:04:24 dyoung Exp $   */
   2 /*      $OpenBSD: print-pflog.c,v 1.14 2003/06/21 21:01:15 dhartmei Exp $       */
   3
   4 /*
   5  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
   6  *      The Regents of the University of California.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that: (1) source code distributions
  10  * retain the above copyright notice and this paragraph in its entirety, (2)
  11  * distributions including binary code include the above copyright notice and
  12  * this paragraph in its entirety in the documentation or other materials
  13  * provided with the distribution, and (3) all advertising materials mentioning
  14  * features or use of this software display the following acknowledgement:
  15  * ``This product includes software developed by the University of California,
  16  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  17  * the University nor the names of its contributors may be used to endorse
  18  * or promote products derived from this software without specific prior
  19  * written permission.
  20  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  21  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  22  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  23  */
  24
  25 #include <sys/cdefs.h>
  26 #ifndef lint
  27 #if 0
  28 static const char rcsid[] _U_ =
  29     "@(#) Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.13.2.2 2006/10/25 22:13:30 guy Exp (LBL)";
  30 #else
  31 __RCSID("$NetBSD: tcpdump2rcsid.ex,v 1.1 2001/06/25 20:09:58 itojun Exp $");
  32 #endif
  33 #endif
  34
  35 #ifdef HAVE_CONFIG_H
  36 #include "config.h"
  37 #endif
  38
  39 #include <tcpdump-stdinc.h>
  40 #include <sys/file.h>
  41 #include <sys/ioctl.h>
  42 #include <sys/mbuf.h>
  43
  44 #include <netinet/in_systm.h>
  45 #include <netinet/ip.h>
  46
  47 #include <net/if.h>
  48 #include <net/pfvar.h>
  49 #include <net/if_pflog.h>
  50
  51 #include <ctype.h>
  52 #include <netdb.h>
  53 #include <pcap.h>
  54 #include <signal.h>
  55 #include <stdio.h>
  56
  57 #include "interface.h"
  58 #include "addrtoname.h"
  59
  60
  61 static struct tok pf_reasons[] = {
  62         { 0,    "0(match)" },
  63         { 1,    "1(bad-offset)" },
  64         { 2,    "2(fragment)" },
  65         { 3,    "3(short)" },
  66         { 4,    "4(normalize)" },
  67         { 5,    "5(memory)" },
  68         { 6,    "6(bad-timestamp)" },
  69         { 7,    "7(congestion)" },
  70         { 8,    "8(ip-option)" },
  71         { 9,    "9(proto-cksum)" },
  72         { 10,   "10(state-mismatch)" },
  73         { 11,   "11(state-insert)" },
  74         { 12,   "12(state-limit)" },
  75         { 13,   "13(src-limit)" },
  76         { 14,   "14(synproxy)" },
  77         { 0,    NULL }
  78 };
  79
  80 static struct tok pf_actions[] = {
  81         { PF_PASS,              "pass" },
  82         { PF_DROP,              "block" },
  83         { PF_SCRUB,             "scrub" },
  84         { PF_NAT,               "nat" },
  85         { PF_NONAT,             "nat" },
  86         { PF_BINAT,             "binat" },
  87         { PF_NOBINAT,           "binat" },
  88         { PF_RDR,               "rdr" },
  89         { PF_NORDR,             "rdr" },
  90         { PF_SYNPROXY_DROP,     "synproxy-drop" },
  91         { 0,                    NULL }
  92 };
  93
  94 static struct tok pf_directions[] = {
  95         { PF_INOUT,     "in/out" },
  96         { PF_IN,        "in" },
  97         { PF_OUT,       "out" },
  98         { 0,            NULL }
  99 };
 100
 101 /* For reading capture files on other systems */
 102 #define OPENBSD_AF_INET         2
 103 #define OPENBSD_AF_INET6        24
 104
 105 static void
 106 pflog_print(const struct pfloghdr *hdr)
 107 {
 108         u_int32_t rulenr, subrulenr;
 109
 110         rulenr = ntohl(hdr->rulenr);
 111         subrulenr = ntohl(hdr->subrulenr);
 112         if (subrulenr == (u_int32_t)-1)
 113                 printf("rule %u/", rulenr);
 114         else
 115                 printf("rule %u.%s.%u/", rulenr, hdr->ruleset, subrulenr);
 116
 117         printf("%s: %s %s on %s: ",
 118             tok2str(pf_reasons, "unkn(%u)", hdr->reason),
 119             tok2str(pf_actions, "unkn(%u)", hdr->action),
 120             tok2str(pf_directions, "unkn(%u)", hdr->dir),
 121             hdr->ifname);
 122 }
 123
 124 u_int
 125 pflog_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 126 {
 127         u_int length = h->len;
 128         u_int hdrlen;
 129         u_int caplen = h->caplen;
 130         const struct pfloghdr *hdr;
 131         u_int8_t af;
 132
 133         /* check length */
 134         if (caplen < sizeof(u_int8_t)) {
 135                 printf("[|pflog]");
 136                 return (caplen);
 137         }
 138
 139 #define MIN_PFLOG_HDRLEN        45
 140         hdr = (struct pfloghdr *)p;
 141         if (hdr->length < MIN_PFLOG_HDRLEN) {
 142                 printf("[pflog: invalid header length!]");
 143                 return (hdr->length);   /* XXX: not really */
 144         }
 145         hdrlen = BPF_WORDALIGN(hdr->length);
 146
 147         if (caplen < hdrlen) {
 148                 printf("[|pflog]");
 149                 return (hdrlen);        /* XXX: true? */
 150         }
 151
 152         /* print what we know */
 153         hdr = (struct pfloghdr *)p;
 154         TCHECK(*hdr);
 155         if (eflag)
 156                 pflog_print(hdr);
 157
 158         /* skip to the real packet */
 159         af = hdr->af;
 160         length -= hdrlen;
 161         caplen -= hdrlen;
 162         p += hdrlen;
 163         switch (af) {
 164
 165                 case AF_INET:
 166 #if OPENBSD_AF_INET != AF_INET
 167                 case OPENBSD_AF_INET:           /* XXX: read pcap files */
 168 #endif
 169                         ip_print(gndo, p, length);
 170                         break;
 171
 172 #ifdef INET6
 173                 case AF_INET6:
 174 #if OPENBSD_AF_INET6 != AF_INET6
 175                 case OPENBSD_AF_INET6:          /* XXX: read pcap files */
 176 #endif
 177                         ip6_print(p, length);
 178                         break;
 179 #endif
 180
 181         default:
 182                 /* address family not handled, print raw packet */
 183                 if (!eflag)
 184                         pflog_print(hdr);
 185                 if (!suppress_default_print)
 186                         default_print(p, caplen);
 187         }
 188
 189         return (hdrlen);
 190 trunc:
 191         printf("[|pflog]");
 192         return (hdrlen);
 193 }
 194
 195 /*
 196  * Local Variables:
 197  * c-style: whitesmith
 198  * c-basic-offset: 8
 199  * End:
 200  */