File: [local] / src / usr.sbin / tcpdump / print-pfsync.c (download)
Revision 1.44, Wed Dec 1 18:28:46 2021 UTC (2 years, 6 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE, OPENBSD_7_5, OPENBSD_7_4_BASE, OPENBSD_7_4, OPENBSD_7_3_BASE, OPENBSD_7_3, OPENBSD_7_2_BASE, OPENBSD_7_2, OPENBSD_7_1_BASE, OPENBSD_7_1, HEAD Changes since 1.43: +1 -4 lines
we do not need 'struct mbuf; struct rtentry;' to satisfy some ancient unix
variant that made a header file mistake.
ok jsg
|
/* $OpenBSD: print-pfsync.c,v 1.44 2021/12/01 18:28:46 deraadt Exp $ */
/*
* Copyright (c) 2002 Michael Shalayeff
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/file.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_ipsp.h>
#include <net/pfvar.h>
#include <net/if_pfsync.h>
#include <ctype.h>
#include <netdb.h>
#include <pcap.h>
#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <vis.h>
#include "interface.h"
#include "addrtoname.h"
#include "pfctl_parser.h"
#include "pfctl.h"
void pfsync_print(struct pfsync_header *, const u_char *, int);
void
pfsync_if_print(u_char *user, const struct pcap_pkthdr *h,
const u_char *p)
{
u_int caplen = h->caplen;
ts_print(&h->ts);
if (caplen < PFSYNC_HDRLEN) {
printf("[|pfsync]");
goto out;
}
pfsync_print((struct pfsync_header *)p,
p + sizeof(struct pfsync_header),
caplen - sizeof(struct pfsync_header));
out:
if (xflag) {
default_print((const u_char *)p, caplen);
}
putchar('\n');
}
void
pfsync_ip_print(const u_char *bp, u_int len, const u_char *bp2)
{
struct pfsync_header *hdr = (struct pfsync_header *)bp;
struct ip *ip = (struct ip *)bp2;
if (vflag)
printf("%s > %s: ", ipaddr_string(&ip->ip_src),
ipaddr_string(&ip->ip_dst));
else
printf("%s: ", ipaddr_string(&ip->ip_src));
if (len < PFSYNC_HDRLEN)
printf("[|pfsync]");
else
pfsync_print(hdr, bp + sizeof(struct pfsync_header),
len - sizeof(struct pfsync_header));
putchar('\n');
}
const char *actnames[] = { PFSYNC_ACTIONS };
struct pfsync_actions {
size_t len;
int (*print)(int, const void *);
};
int pfsync_print_clr(int, const void *);
int pfsync_print_state(int, const void *);
int pfsync_print_ins_ack(int, const void *);
int pfsync_print_upd_c(int, const void *);
int pfsync_print_upd_req(int, const void *);
int pfsync_print_del_c(int, const void *);
int pfsync_print_bus(int, const void *);
int pfsync_print_tdb(int, const void *);
int pfsync_print_eof(int, const void *);
struct pfsync_actions actions[] = {
{ sizeof(struct pfsync_clr), pfsync_print_clr },
{ 0, NULL },
{ sizeof(struct pfsync_ins_ack), pfsync_print_ins_ack },
{ 0, NULL },
{ sizeof(struct pfsync_upd_c), pfsync_print_upd_c },
{ sizeof(struct pfsync_upd_req), pfsync_print_upd_req },
{ sizeof(struct pfsync_state), pfsync_print_state },
{ sizeof(struct pfsync_del_c), pfsync_print_del_c },
{ 0, NULL },
{ 0, NULL },
{ sizeof(struct pfsync_bus), pfsync_print_bus },
{ 0, NULL },
{ 0, pfsync_print_eof },
{ sizeof(struct pfsync_state), pfsync_print_state },
{ sizeof(struct pfsync_state), pfsync_print_state },
{ sizeof(struct pfsync_tdb), pfsync_print_tdb },
};
void
pfsync_print(struct pfsync_header *hdr, const u_char *bp, int len)
{
struct pfsync_subheader *subh;
int count, plen, alen, flags = 0;
int i;
plen = ntohs(hdr->len);
printf("PFSYNCv%d len %d", hdr->version, plen);
if (hdr->version != PFSYNC_VERSION)
return;
plen -= sizeof(*hdr);
if (vflag)
flags |= PF_OPT_VERBOSE;
if (vflag > 1)
flags |= PF_OPT_VERBOSE2;
if (!nflag)
flags |= PF_OPT_USEDNS;
while (plen > 0) {
if (len < sizeof(*subh))
break;
subh = (struct pfsync_subheader *)bp;
bp += sizeof(*subh);
len -= sizeof(*subh);
plen -= sizeof(*subh);
if (subh->action >= PFSYNC_ACT_MAX) {
printf("\n act UNKNOWN id %d", subh->action);
return;
}
count = ntohs(subh->count);
printf("\n act %s count %d", actnames[subh->action], count);
alen = actions[subh->action].len;
if (actions[subh->action].print == NULL) {
printf("\n unimplemented action");
return;
}
for (i = 0; i < count; i++) {
if (len < alen) {
len = 0;
break;
}
if (actions[subh->action].print(flags, bp) != 0)
return;
bp += alen;
len -= alen;
plen -= alen;
}
}
if (plen > 0) {
printf("\n ...");
return;
}
if (plen < 0) {
printf("\n invalid header length");
return;
}
if (len > 0)
printf("\n invalid packet length");
}
int
pfsync_print_clr(int flags, const void *bp)
{
const struct pfsync_clr *clr = bp;
char ifname[IFNAMSIZ * 4 + 1];
char *cp = ifname;
int i;
printf("\n\tcreatorid: %08x", htonl(clr->creatorid));
if (clr->ifname[0] != '\0') {
/* Treat clr->ifname as untrusted input. */
for (i = 0; i < IFNAMSIZ && clr->ifname[i] != '\0'; i++)
cp = vis(cp, clr->ifname[i], VIS_WHITE, 0);
printf(" interface: %s", ifname);
}
return (0);
}
int
pfsync_print_state(int flags, const void *bp)
{
struct pfsync_state *st = (struct pfsync_state *)bp;
putchar('\n');
print_state(st, flags);
return (0);
}
int
pfsync_print_ins_ack(int flags, const void *bp)
{
const struct pfsync_ins_ack *iack = bp;
printf("\n\tid: %016llx creatorid: %08x", betoh64(iack->id),
ntohl(iack->creatorid));
return (0);
}
int
pfsync_print_upd_c(int flags, const void *bp)
{
const struct pfsync_upd_c *u = bp;
printf("\n\tid: %016llx creatorid: %08x", betoh64(u->id),
ntohl(u->creatorid));
return (0);
}
int
pfsync_print_upd_req(int flags, const void *bp)
{
const struct pfsync_upd_req *ur = bp;
printf("\n\tid: %016llx creatorid: %08x", betoh64(ur->id),
ntohl(ur->creatorid));
return (0);
}
int
pfsync_print_del_c(int flags, const void *bp)
{
const struct pfsync_del_c *d = bp;
printf("\n\tid: %016llx creatorid: %08x", betoh64(d->id),
ntohl(d->creatorid));
return (0);
}
int
pfsync_print_bus(int flags, const void *bp)
{
const struct pfsync_bus *b = bp;
u_int32_t endtime;
int min, sec;
const char *status;
endtime = ntohl(b->endtime);
sec = endtime % 60;
endtime /= 60;
min = endtime % 60;
endtime /= 60;
switch (b->status) {
case PFSYNC_BUS_START:
status = "start";
break;
case PFSYNC_BUS_END:
status = "end";
break;
default:
status = "UNKNOWN";
break;
}
printf("\n\tcreatorid: %08x age: %.2u:%.2u:%.2u status: %s",
htonl(b->creatorid), endtime, min, sec, status);
return (0);
}
int
pfsync_print_tdb(int flags, const void *bp)
{
const struct pfsync_tdb *t = bp;
printf("\n\tspi: 0x%08x rpl: %llu cur_bytes: %llu",
ntohl(t->spi), betoh64(t->rpl), betoh64(t->cur_bytes));
return (0);
}
int
pfsync_print_eof(int flags, const void *bp)
{
return (1);
}