1 /** $MirOS: src/sbin/pfctl/pf_print_state.c,v 1.4 2005/12/20 19:41:06 tg Exp $ */
2 /* $OpenBSD: pf_print_state.c,v 1.39 2004/02/10 17:48:08 henning Exp $ */
3
4 /*
5 * Copyright (c) 2001 Daniel Hartmeier
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 *
32 */
33
34 #include <sys/types.h>
35 #include <sys/socket.h>
36 #include <net/if.h>
37 #define TCPSTATES
38 #include <netinet/tcp_fsm.h>
39 #include <net/pfvar.h>
40 #include <arpa/inet.h>
41 #include <netdb.h>
42
43 #include <stdio.h>
44 #include <string.h>
45
46 #include "pfctl_parser.h"
47 #include "pfctl.h"
48
49 __RCSID("$MirOS: src/sbin/pfctl/pf_print_state.c,v 1.4 2005/12/20 19:41:06 tg Exp $");
50
51 void print_name(struct pf_addr *, sa_family_t);
52
53 void
print_addr(struct pf_addr_wrap * addr,sa_family_t af,int verbose)54 print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
55 {
56 switch (addr->type) {
57 case PF_ADDR_TABLE:
58 if (verbose)
59 if (addr->p.tblcnt == -1)
60 printf("<%s:*>", addr->v.tblname);
61 else
62 printf("<%s:%d>", addr->v.tblname,
63 addr->p.tblcnt);
64 else
65 printf("<%s>", addr->v.tblname);
66 return;
67 case PF_ADDR_ADDRMASK:
68 if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
69 PF_AZERO(&addr->v.a.mask, AF_INET6))
70 printf("any");
71 else {
72 char buf[48];
73
74 if (inet_ntop(af, &addr->v.a.addr, buf,
75 sizeof(buf)) == NULL)
76 printf("?");
77 else
78 printf("%s", buf);
79 }
80 break;
81 case PF_ADDR_NOROUTE:
82 printf("no-route");
83 return;
84 default:
85 printf("?");
86 return;
87 }
88
89 /* mask if not _both_ address and mask are zero */
90 if (!(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
91 PF_AZERO(&addr->v.a.mask, AF_INET6))) {
92 int bits = unmask(&addr->v.a.mask, af);
93
94 if (bits != (af == AF_INET ? 32 : 128))
95 printf("/%d", bits);
96 }
97 }
98
99 void
print_name(struct pf_addr * addr,sa_family_t af)100 print_name(struct pf_addr *addr, sa_family_t af)
101 {
102 char host[NI_MAXHOST];
103
104 strlcpy(host, "?", sizeof(host));
105 switch (af) {
106 case AF_INET: {
107 struct sockaddr_in sin;
108
109 memset(&sin, 0, sizeof(sin));
110 sin.sin_len = sizeof(sin);
111 sin.sin_family = AF_INET;
112 sin.sin_addr = addr->v4;
113 getnameinfo((struct sockaddr *)&sin, sin.sin_len,
114 host, sizeof(host), NULL, 0, NI_NOFQDN);
115 break;
116 }
117 case AF_INET6: {
118 struct sockaddr_in6 sin6;
119
120 memset(&sin6, 0, sizeof(sin6));
121 sin6.sin6_len = sizeof(sin6);
122 sin6.sin6_family = AF_INET6;
123 sin6.sin6_addr = addr->v6;
124 getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
125 host, sizeof(host), NULL, 0, NI_NOFQDN);
126 break;
127 }
128 }
129 printf("%s", host);
130 }
131
132 void
print_host(struct pf_state_host * h,sa_family_t af,int opts)133 print_host(struct pf_state_host *h, sa_family_t af, int opts)
134 {
135 u_int16_t p = ntohs(h->port);
136
137 if (opts & PF_OPT_USEDNS)
138 print_name(&h->addr, af);
139 else {
140 struct pf_addr_wrap aw;
141
142 memset(&aw, 0, sizeof(aw));
143 aw.v.a.addr = h->addr;
144 if (af == AF_INET)
145 aw.v.a.mask.addr32[0] = 0xffffffff;
146 else {
147 memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
148 af = AF_INET6;
149 }
150 print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
151 }
152
153 if (p) {
154 if (af == AF_INET)
155 printf(":%u", p);
156 else
157 printf("[%u]", p);
158 }
159 }
160
161 void
print_seq(struct pf_state_peer * p)162 print_seq(struct pf_state_peer *p)
163 {
164 if (p->seqdiff)
165 printf("[%u + %u](+%u)", p->seqlo, p->seqhi - p->seqlo,
166 p->seqdiff);
167 else
168 printf("[%u + %u]", p->seqlo, p->seqhi - p->seqlo);
169 }
170
171 void
print_state(struct pf_state * s,int opts)172 print_state(struct pf_state *s, int opts)
173 {
174 struct pf_state_peer *src, *dst;
175 struct protoent *p;
176 int min, sec;
177
178 if (s->direction == PF_OUT) {
179 src = &s->src;
180 dst = &s->dst;
181 } else {
182 src = &s->dst;
183 dst = &s->src;
184 }
185 printf("%s ", s->u.ifname);
186 if ((p = getprotobynumber(s->proto)) != NULL)
187 printf("%s ", p->p_name);
188 else
189 printf("%u ", s->proto);
190 if (PF_ANEQ(&s->lan.addr, &s->gwy.addr, s->af) ||
191 (s->lan.port != s->gwy.port)) {
192 print_host(&s->lan, s->af, opts);
193 if (s->direction == PF_OUT)
194 printf(" -> ");
195 else
196 printf(" <- ");
197 }
198 print_host(&s->gwy, s->af, opts);
199 if (s->direction == PF_OUT)
200 printf(" -> ");
201 else
202 printf(" <- ");
203 print_host(&s->ext, s->af, opts);
204
205 printf(" ");
206 if (s->proto == IPPROTO_TCP) {
207 if (src->state <= TCPS_TIME_WAIT &&
208 dst->state <= TCPS_TIME_WAIT)
209 printf(" %s:%s\n", tcpstates[src->state],
210 tcpstates[dst->state]);
211 else if (src->state == PF_TCPS_PROXY_SRC ||
212 dst->state == PF_TCPS_PROXY_SRC)
213 printf(" PROXY:SRC\n");
214 else if (src->state == PF_TCPS_PROXY_DST ||
215 dst->state == PF_TCPS_PROXY_DST)
216 printf(" PROXY:DST\n");
217 else
218 printf(" <BAD STATE LEVELS %u:%u>\n",
219 src->state, dst->state);
220 if (opts & PF_OPT_VERBOSE) {
221 printf(" ");
222 print_seq(src);
223 if (src->wscale && dst->wscale)
224 printf(" wscale %u",
225 src->wscale & PF_WSCALE_MASK);
226 printf(" ");
227 print_seq(dst);
228 if (src->wscale && dst->wscale)
229 printf(" wscale %u",
230 dst->wscale & PF_WSCALE_MASK);
231 printf("\n");
232 }
233 } else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
234 dst->state < PFUDPS_NSTATES) {
235 const char *states[] = PFUDPS_NAMES;
236
237 printf(" %s:%s\n", states[src->state], states[dst->state]);
238 } else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
239 dst->state < PFOTHERS_NSTATES) {
240 /* XXX ICMP doesn't really have state levels */
241 const char *states[] = PFOTHERS_NAMES;
242
243 printf(" %s:%s\n", states[src->state], states[dst->state]);
244 } else {
245 printf(" %u:%u\n", src->state, dst->state);
246 }
247
248 if (opts & PF_OPT_VERBOSE) {
249 sec = s->creation % 60;
250 s->creation /= 60;
251 min = s->creation % 60;
252 s->creation /= 60;
253 printf(" age %.2u:%.2u:%.2u", s->creation, min, sec);
254 sec = s->expire % 60;
255 s->expire /= 60;
256 min = s->expire % 60;
257 s->expire /= 60;
258 printf(", expires in %.2u:%.2u:%.2u", s->expire, min, sec);
259 printf(", %u:%u pkts, %u:%u bytes",
260 s->packets[0], s->packets[1], s->bytes[0], s->bytes[1]);
261 if (s->anchor.nr != -1)
262 printf(", anchor %u", s->anchor.nr);
263 if (s->rule.nr != -1)
264 printf(", rule %u", s->rule.nr);
265 if (s->src_node != NULL)
266 printf(", source-track");
267 if (s->nat_src_node != NULL)
268 printf(", sticky-address");
269 printf("\n");
270 }
271 if (opts & PF_OPT_VERBOSE2) {
272 printf(" id: %016llx creatorid: %08x\n",
273 betoh64(s->id), ntohl(s->creatorid));
274 }
275 }
276
277 int
unmask(struct pf_addr * m,sa_family_t af)278 unmask(struct pf_addr *m, sa_family_t af)
279 {
280 int i = 31, j = 0, b = 0;
281 u_int32_t tmp;
282
283 while (j < 4 && m->addr32[j] == 0xffffffff) {
284 b += 32;
285 j++;
286 }
287 if (j < 4) {
288 tmp = ntohl(m->addr32[j]);
289 for (i = 31; tmp & (1 << i); --i)
290 b++;
291 }
292 return (b);
293 }
294