File: [local] / src / usr.sbin / tcpdump / print-pflog.c (download)
Revision 1.35, Tue Feb 22 17:35:01 2022 UTC (2 years, 3 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE, OPENBSD_7_5, OPENBSD_7_4_BASE, OPENBSD_7_4, OPENBSD_7_3_BASE, OPENBSD_7_3, OPENBSD_7_2_BASE, OPENBSD_7_2, OPENBSD_7_1_BASE, OPENBSD_7_1, HEAD Changes since 1.34: +2 -2 lines
MAXCOMLEN is no longer needed in these programs, so remove the annotation
from sys/param.h include lines, or remove the include lines entirely if
it this was the least requirement.
ok millert
|
/* $OpenBSD: print-pflog.c,v 1.35 2022/02/22 17:35:01 deraadt Exp $ */
/*
* Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/file.h>
#include <sys/ioctl.h>
#include <sys/queue.h>
#ifndef NO_PID
#define NO_PID (99999+1)
#endif
#include <netinet/in.h>
#include <netinet/ip.h>
#include <net/if.h>
#include <net/pfvar.h>
#include <net/if_pflog.h>
#include <arpa/inet.h>
#include <ctype.h>
#include <netdb.h>
#include <pcap.h>
#include <signal.h>
#include <stdio.h>
#include "interface.h"
#include "addrtoname.h"
char *pf_reasons[PFRES_MAX+2] = PFRES_NAMES;
void
pflog_if_print(u_char *user, const struct pcap_pkthdr *h,
const u_char *p)
{
u_int length = h->len;
u_int hdrlen;
u_int caplen = h->caplen;
const struct ip *ip;
const struct ip6_hdr *ip6;
const struct pfloghdr *hdr;
ts_print(&h->ts);
/* check length */
if (caplen < sizeof(u_int8_t)) {
printf("[|pflog]");
goto out;
}
#define MIN_PFLOG_HDRLEN 45
hdr = (struct pfloghdr *)p;
if (hdr->length < MIN_PFLOG_HDRLEN) {
printf("[pflog: invalid header length!]");
goto out;
}
hdrlen = (hdr->length + 3) & 0xfc;
if (caplen < hdrlen) {
printf("[|pflog]");
goto out;
}
/*
* Some printers want to get back at the link level addresses,
* and/or check that they're not walking off the end of the packet.
* Rather than pass them all the way down, we set these globals.
*/
packetp = p;
snapend = p + caplen;
hdr = (struct pfloghdr *)p;
if (eflag) {
printf("rule ");
if (ntohl(hdr->rulenr) == (u_int32_t) -1)
printf("def");
else {
printf("%u", ntohl(hdr->rulenr));
if (hdr->ruleset[0]) {
printf(".%s", hdr->ruleset);
if (ntohl(hdr->subrulenr) == (u_int32_t) -1)
printf(".def");
else
printf(".%u", ntohl(hdr->subrulenr));
}
}
if (hdr->reason < PFRES_MAX)
printf("/(%s) ", pf_reasons[hdr->reason]);
else
printf("/(unkn %u) ", (unsigned)hdr->reason);
if (vflag)
printf("[uid %u, pid %u] ", (unsigned)hdr->rule_uid,
(unsigned)hdr->rule_pid);
switch (hdr->action) {
case PF_MATCH:
printf("match");
break;
case PF_SCRUB:
printf("scrub");
break;
case PF_PASS:
printf("pass");
break;
case PF_DROP:
printf("block");
break;
case PF_NAT:
case PF_NONAT:
printf("nat");
break;
case PF_BINAT:
case PF_NOBINAT:
printf("binat");
break;
case PF_RDR:
case PF_NORDR:
printf("rdr");
break;
}
printf(" %s on %s: ",
hdr->dir == PF_OUT ? "out" : "in",
hdr->ifname);
if (vflag && hdr->pid != NO_PID)
printf("[uid %u, pid %u] ", (unsigned)hdr->uid,
(unsigned)hdr->pid);
if (vflag && hdr->rewritten) {
char buf[48];
printf("[rewritten: ");
if (inet_ntop(hdr->naf, &hdr->saddr, buf,
sizeof(buf)) == NULL)
printf("src ?");
else
printf("src %s:%u", buf, ntohs(hdr->sport));
printf(", ");
if (inet_ntop(hdr->naf, &hdr->daddr, buf,
sizeof(buf)) == NULL)
printf("dst ?");
else
printf("dst %s:%u", buf, ntohs(hdr->dport));
printf("] ");
}
}
length -= hdrlen;
switch(hdr->af) {
case AF_INET:
ip = (struct ip *)(p + hdrlen);
ip_print((const u_char *)ip, length);
if (xflag)
default_print((const u_char *)ip,
caplen - hdrlen);
break;
case AF_INET6:
ip6 = (struct ip6_hdr *)(p + hdrlen);
ip6_print((const u_char *)ip6, length);
if (xflag)
default_print((const u_char *)ip6,
caplen - hdrlen);
break;
default:
printf("unknown-af %d", hdr->af);
break;
}
out:
putchar('\n');
}