Uesrland part of PF
[dragonfly.git] / usr.sbin / pfctl / pf_print_state.c
CommitLineData
95cc27f0
JS
1/* $OpenBSD: pf_print_state.c,v 1.39 2004/02/10 17:48:08 henning Exp $ */
2/* $DragonFly: src/usr.sbin/pfctl/pf_print_state.c,v 1.1 2004/09/21 21:25:28 joerg Exp $ */
3
4/*
5 * Copyright (c) 2001 Daniel Hartmeier
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 *
32 */
33
34#include <sys/param.h>
35#include <sys/endian.h>
36#include <sys/socket.h>
37#include <net/if.h>
38#define TCPSTATES
39#include <netinet/tcp_fsm.h>
40#include <net/pf/pfvar.h>
41#include <arpa/inet.h>
42#include <netdb.h>
43
44#include <stdio.h>
45#include <string.h>
46
47#include "pfctl_parser.h"
48#include "pfctl.h"
49
50void print_name(struct pf_addr *, sa_family_t);
51
52void
53print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
54{
55 switch (addr->type) {
56 case PF_ADDR_DYNIFTL:
57 printf("(%s", addr->v.ifname);
58 if (addr->iflags & PFI_AFLAG_NETWORK)
59 printf(":network");
60 if (addr->iflags & PFI_AFLAG_BROADCAST)
61 printf(":broadcast");
62 if (addr->iflags & PFI_AFLAG_PEER)
63 printf(":peer");
64 if (addr->iflags & PFI_AFLAG_NOALIAS)
65 printf(":0");
66 if (verbose) {
67 if (addr->p.dyncnt <= 0)
68 printf(":*");
69 else
70 printf(":%d", addr->p.dyncnt);
71 }
72 printf(")");
73 break;
74 case PF_ADDR_TABLE:
75 if (verbose)
76 if (addr->p.tblcnt == -1)
77 printf("<%s:*>", addr->v.tblname);
78 else
79 printf("<%s:%d>", addr->v.tblname,
80 addr->p.tblcnt);
81 else
82 printf("<%s>", addr->v.tblname);
83 return;
84 case PF_ADDR_ADDRMASK:
85 if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
86 PF_AZERO(&addr->v.a.mask, AF_INET6))
87 printf("any");
88 else {
89 char buf[48];
90
91 if (inet_ntop(af, &addr->v.a.addr, buf,
92 sizeof(buf)) == NULL)
93 printf("?");
94 else
95 printf("%s", buf);
96 }
97 break;
98 case PF_ADDR_NOROUTE:
99 printf("no-route");
100 return;
101 default:
102 printf("?");
103 return;
104 }
105
106 /* mask if not _both_ address and mask are zero */
107 if (!(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
108 PF_AZERO(&addr->v.a.mask, AF_INET6))) {
109 int bits = unmask(&addr->v.a.mask, af);
110
111 if (bits != (af == AF_INET ? 32 : 128))
112 printf("/%d", bits);
113 }
114}
115
116void
117print_name(struct pf_addr *addr, sa_family_t af)
118{
119 char hostname[NI_MAXHOST];
120
121 strlcpy(hostname, "?", sizeof(hostname));
122 switch (af) {
123 case AF_INET: {
124 struct sockaddr_in sin;
125
126 memset(&sin, 0, sizeof(sin));
127 sin.sin_len = sizeof(sin);
128 sin.sin_family = AF_INET;
129 sin.sin_addr = addr->v4;
130 getnameinfo((struct sockaddr *)&sin, sin.sin_len,
131 hostname, sizeof(hostname), NULL, 0, NI_NOFQDN);
132 break;
133 }
134 case AF_INET6: {
135 struct sockaddr_in6 sin6;
136
137 memset(&sin6, 0, sizeof(sin6));
138 sin6.sin6_len = sizeof(sin6);
139 sin6.sin6_family = AF_INET6;
140 sin6.sin6_addr = addr->v6;
141 getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
142 hostname, sizeof(hostname), NULL, 0, NI_NOFQDN);
143 break;
144 }
145 }
146 printf("%s", hostname);
147}
148
149void
150print_host(struct pf_state_host *h, sa_family_t af, int opts)
151{
152 u_int16_t p = ntohs(h->port);
153
154 if (opts & PF_OPT_USEDNS)
155 print_name(&h->addr, af);
156 else {
157 struct pf_addr_wrap aw;
158
159 memset(&aw, 0, sizeof(aw));
160 aw.v.a.addr = h->addr;
161 if (af == AF_INET)
162 aw.v.a.mask.addr32[0] = 0xffffffff;
163 else {
164 memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
165 af = AF_INET6;
166 }
167 print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
168 }
169
170 if (p) {
171 if (af == AF_INET)
172 printf(":%u", p);
173 else
174 printf("[%u]", p);
175 }
176}
177
178void
179print_seq(struct pf_state_peer *p)
180{
181 if (p->seqdiff)
182 printf("[%u + %u](+%u)", p->seqlo, p->seqhi - p->seqlo,
183 p->seqdiff);
184 else
185 printf("[%u + %u]", p->seqlo, p->seqhi - p->seqlo);
186}
187
188void
189print_state(struct pf_state *s, int opts)
190{
191 struct pf_state_peer *src, *dst;
192 struct protoent *p;
193 int min, sec;
194
195 if (s->direction == PF_OUT) {
196 src = &s->src;
197 dst = &s->dst;
198 } else {
199 src = &s->dst;
200 dst = &s->src;
201 }
202 printf("%s ", s->u.ifname);
203 if ((p = getprotobynumber(s->proto)) != NULL)
204 printf("%s ", p->p_name);
205 else
206 printf("%u ", s->proto);
207 if (PF_ANEQ(&s->lan.addr, &s->gwy.addr, s->af) ||
208 (s->lan.port != s->gwy.port)) {
209 print_host(&s->lan, s->af, opts);
210 if (s->direction == PF_OUT)
211 printf(" -> ");
212 else
213 printf(" <- ");
214 }
215 print_host(&s->gwy, s->af, opts);
216 if (s->direction == PF_OUT)
217 printf(" -> ");
218 else
219 printf(" <- ");
220 print_host(&s->ext, s->af, opts);
221
222 printf(" ");
223 if (s->proto == IPPROTO_TCP) {
224 if (src->state <= TCPS_TIME_WAIT &&
225 dst->state <= TCPS_TIME_WAIT)
226 printf(" %s:%s\n", tcpstates[src->state],
227 tcpstates[dst->state]);
228 else if (src->state == PF_TCPS_PROXY_SRC ||
229 dst->state == PF_TCPS_PROXY_SRC)
230 printf(" PROXY:SRC\n");
231 else if (src->state == PF_TCPS_PROXY_DST ||
232 dst->state == PF_TCPS_PROXY_DST)
233 printf(" PROXY:DST\n");
234 else
235 printf(" <BAD STATE LEVELS %u:%u>\n",
236 src->state, dst->state);
237 if (opts & PF_OPT_VERBOSE) {
238 printf(" ");
239 print_seq(src);
240 if (src->wscale && dst->wscale)
241 printf(" wscale %u",
242 src->wscale & PF_WSCALE_MASK);
243 printf(" ");
244 print_seq(dst);
245 if (src->wscale && dst->wscale)
246 printf(" wscale %u",
247 dst->wscale & PF_WSCALE_MASK);
248 printf("\n");
249 }
250 } else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
251 dst->state < PFUDPS_NSTATES) {
252 const char *states[] = PFUDPS_NAMES;
253
254 printf(" %s:%s\n", states[src->state], states[dst->state]);
255 } else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
256 dst->state < PFOTHERS_NSTATES) {
257 /* XXX ICMP doesn't really have state levels */
258 const char *states[] = PFOTHERS_NAMES;
259
260 printf(" %s:%s\n", states[src->state], states[dst->state]);
261 } else {
262 printf(" %u:%u\n", src->state, dst->state);
263 }
264
265 if (opts & PF_OPT_VERBOSE) {
266 sec = s->creation % 60;
267 s->creation /= 60;
268 min = s->creation % 60;
269 s->creation /= 60;
270 printf(" age %.2u:%.2u:%.2u", s->creation, min, sec);
271 sec = s->expire % 60;
272 s->expire /= 60;
273 min = s->expire % 60;
274 s->expire /= 60;
275 printf(", expires in %.2u:%.2u:%.2u", s->expire, min, sec);
276 printf(", %u:%u pkts, %u:%u bytes",
277 s->packets[0], s->packets[1], s->bytes[0], s->bytes[1]);
278 if (s->anchor.nr != (uint32_t)(-1))
279 printf(", anchor %u", s->anchor.nr);
280 if (s->rule.nr != (uint32_t)(-1))
281 printf(", rule %u", s->rule.nr);
282 if (s->src_node != NULL)
283 printf(", source-track");
284 if (s->nat_src_node != NULL)
285 printf(", sticky-address");
286 printf("\n");
287 }
288 if (opts & PF_OPT_VERBOSE2) {
289 printf(" id: %016llx creatorid: %08x\n",
290 be64toh(s->id), ntohl(s->creatorid));
291 }
292}
293
294int
295unmask(struct pf_addr *m, sa_family_t af __unused)
296{
297 int i = 31, j = 0, b = 0;
298 u_int32_t tmp;
299
300 while (j < 4 && m->addr32[j] == 0xffffffff) {
301 b += 32;
302 j++;
303 }
304 if (j < 4) {
305 tmp = ntohl(m->addr32[j]);
306 for (i = 31; tmp & (1 << i); --i)
307 b++;
308 }
309 return (b);
310}