usr.sbin/pfctl/pf_print_state.c

   1 /*      $OpenBSD: pf_print_state.c,v 1.39 2004/02/10 17:48:08 henning Exp $     */
   2 /*      $DragonFly: src/usr.sbin/pfctl/pf_print_state.c,v 1.3 2008/04/11 18:21:49 dillon Exp $ */
   3
   4 /*
   5  * Copyright (c) 2001 Daniel Hartmeier
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  *    - Redistributions of source code must retain the above copyright
  13  *      notice, this list of conditions and the following disclaimer.
  14  *    - Redistributions in binary form must reproduce the above
  15  *      copyright notice, this list of conditions and the following
  16  *      disclaimer in the documentation and/or other materials provided
  17  *      with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #include <sys/types.h>
  35 #include <sys/endian.h>
  36 #include <sys/socket.h>
  37 #include <net/if.h>
  38 #define TCPSTATES
  39 #include <netinet/tcp_fsm.h>
  40 #include <net/pf/pfvar.h>
  41 #include <arpa/inet.h>
  42 #include <netdb.h>
  43
  44 #include <stdio.h>
  45 #include <string.h>
  46
  47 #include "pfctl_parser.h"
  48 #include "pfctl.h"
  49
  50 void    print_name(struct pf_addr *, sa_family_t);
  51
  52 void
  53 print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
  54 {
  55         switch (addr->type) {
  56         case PF_ADDR_DYNIFTL:
  57                 printf("(%s", addr->v.ifname);
  58                 if (addr->iflags & PFI_AFLAG_NETWORK)
  59                         printf(":network");
  60                 if (addr->iflags & PFI_AFLAG_BROADCAST)
  61                         printf(":broadcast");
  62                 if (addr->iflags & PFI_AFLAG_PEER)
  63                         printf(":peer");
  64                 if (addr->iflags & PFI_AFLAG_NOALIAS)
  65                         printf(":0");
  66                 if (verbose) {
  67                         if (addr->p.dyncnt <= 0)
  68                                 printf(":*");
  69                         else
  70                                 printf(":%d", addr->p.dyncnt);
  71                 }
  72                 printf(")");
  73                 break;
  74         case PF_ADDR_TABLE:
  75                 if (verbose)
  76                         if (addr->p.tblcnt == -1)
  77                                 printf("<%s:*>", addr->v.tblname);
  78                         else
  79                                 printf("<%s:%d>", addr->v.tblname,
  80                                     addr->p.tblcnt);
  81                 else
  82                         printf("<%s>", addr->v.tblname);
  83                 return;
  84         case PF_ADDR_ADDRMASK:
  85                 if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
  86                     PF_AZERO(&addr->v.a.mask, AF_INET6))
  87                         printf("any");
  88                 else {
  89                         char buf[48];
  90
  91                         if (inet_ntop(af, &addr->v.a.addr, buf,
  92                             sizeof(buf)) == NULL)
  93                                 printf("?");
  94                         else
  95                                 printf("%s", buf);
  96                 }
  97                 break;
  98         case PF_ADDR_NOROUTE:
  99                 printf("no-route");
 100                 return;
 101         default:
 102                 printf("?");
 103                 return;
 104         }
 105
 106         /* mask if not _both_ address and mask are zero */
 107         if (!(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
 108             PF_AZERO(&addr->v.a.mask, AF_INET6))) {
 109                 int bits = unmask(&addr->v.a.mask, af);
 110
 111                 if (bits != (af == AF_INET ? 32 : 128))
 112                         printf("/%d", bits);
 113         }
 114 }
 115
 116 void
 117 print_name(struct pf_addr *addr, sa_family_t af)
 118 {
 119         char hostname[NI_MAXHOST];
 120
 121         strlcpy(hostname, "?", sizeof(hostname));
 122         switch (af) {
 123         case AF_INET: {
 124                 struct sockaddr_in loc_sin;
 125
 126                 memset(&loc_sin, 0, sizeof(loc_sin));
 127                 loc_sin.sin_len = sizeof(loc_sin);
 128                 loc_sin.sin_family = AF_INET;
 129                 loc_sin.sin_addr = addr->v4;
 130                 getnameinfo((struct sockaddr *)&loc_sin, loc_sin.sin_len,
 131                     hostname, sizeof(hostname), NULL, 0, NI_NOFQDN);
 132                 break;
 133         }
 134         case AF_INET6: {
 135                 struct sockaddr_in6 sin6;
 136
 137                 memset(&sin6, 0, sizeof(sin6));
 138                 sin6.sin6_len = sizeof(sin6);
 139                 sin6.sin6_family = AF_INET6;
 140                 sin6.sin6_addr = addr->v6;
 141                 getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
 142                     hostname, sizeof(hostname), NULL, 0, NI_NOFQDN);
 143                 break;
 144         }
 145         }
 146         printf("%s", hostname);
 147 }
 148
 149 void
 150 print_host(struct pf_state_host *h, sa_family_t af, int opts)
 151 {
 152         u_int16_t p = ntohs(h->port);
 153
 154         if (opts & PF_OPT_USEDNS)
 155                 print_name(&h->addr, af);
 156         else {
 157                 struct pf_addr_wrap aw;
 158
 159                 memset(&aw, 0, sizeof(aw));
 160                 aw.v.a.addr = h->addr;
 161                 if (af == AF_INET)
 162                         aw.v.a.mask.addr32[0] = 0xffffffff;
 163                 else {
 164                         memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
 165                         af = AF_INET6;
 166                 }
 167                 print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
 168         }
 169
 170         if (p) {
 171                 if (af == AF_INET)
 172                         printf(":%u", p);
 173                 else
 174                         printf("[%u]", p);
 175         }
 176 }
 177
 178 void
 179 print_seq(struct pf_state_peer *p)
 180 {
 181         if (p->seqdiff)
 182                 printf("[%u + %u](+%u)", p->seqlo, p->seqhi - p->seqlo,
 183                     p->seqdiff);
 184         else
 185                 printf("[%u + %u]", p->seqlo, p->seqhi - p->seqlo);
 186 }
 187
 188 void
 189 print_state(struct pf_state *s, int opts)
 190 {
 191         struct pf_state_peer *src, *dst;
 192         struct protoent *p;
 193         int min, sec;
 194
 195         if (s->direction == PF_OUT) {
 196                 src = &s->src;
 197                 dst = &s->dst;
 198         } else {
 199                 src = &s->dst;
 200                 dst = &s->src;
 201         }
 202         printf("%s ", s->u.ifname);
 203         if ((p = getprotobynumber(s->proto)) != NULL)
 204                 printf("%s ", p->p_name);
 205         else
 206                 printf("%u ", s->proto);
 207         if (PF_ANEQ(&s->lan.addr, &s->gwy.addr, s->af) ||
 208             (s->lan.port != s->gwy.port)) {
 209                 print_host(&s->lan, s->af, opts);
 210                 if (s->direction == PF_OUT)
 211                         printf(" -> ");
 212                 else
 213                         printf(" <- ");
 214         }
 215         print_host(&s->gwy, s->af, opts);
 216         if (s->direction == PF_OUT)
 217                 printf(" -> ");
 218         else
 219                 printf(" <- ");
 220         print_host(&s->ext, s->af, opts);
 221
 222         printf("    ");
 223         if (s->proto == IPPROTO_TCP) {
 224                 if (src->state <= TCPS_TIME_WAIT &&
 225                     dst->state <= TCPS_TIME_WAIT)
 226                         printf("   %s:%s\n", tcpstates[src->state],
 227                             tcpstates[dst->state]);
 228                 else if (src->state == PF_TCPS_PROXY_SRC ||
 229                     dst->state == PF_TCPS_PROXY_SRC)
 230                         printf("   PROXY:SRC\n");
 231                 else if (src->state == PF_TCPS_PROXY_DST ||
 232                     dst->state == PF_TCPS_PROXY_DST)
 233                         printf("   PROXY:DST\n");
 234                 else
 235                         printf("   <BAD STATE LEVELS %u:%u>\n",
 236                             src->state, dst->state);
 237                 if (opts & PF_OPT_VERBOSE) {
 238                         printf("   ");
 239                         print_seq(src);
 240                         if (src->wscale && dst->wscale)
 241                                 printf(" wscale %u",
 242                                     src->wscale & PF_WSCALE_MASK);
 243                         printf("  ");
 244                         print_seq(dst);
 245                         if (src->wscale && dst->wscale)
 246                                 printf(" wscale %u",
 247                                     dst->wscale & PF_WSCALE_MASK);
 248                         printf("\n");
 249                 }
 250         } else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
 251             dst->state < PFUDPS_NSTATES) {
 252                 const char *states[] = PFUDPS_NAMES;
 253
 254                 printf("   %s:%s\n", states[src->state], states[dst->state]);
 255         } else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
 256             dst->state < PFOTHERS_NSTATES) {
 257                 /* XXX ICMP doesn't really have state levels */
 258                 const char *states[] = PFOTHERS_NAMES;
 259
 260                 printf("   %s:%s\n", states[src->state], states[dst->state]);
 261         } else {
 262                 printf("   %u:%u\n", src->state, dst->state);
 263         }
 264
 265         if (opts & PF_OPT_VERBOSE) {
 266                 sec = s->creation % 60;
 267                 s->creation /= 60;
 268                 min = s->creation % 60;
 269                 s->creation /= 60;
 270                 printf("   age %.2u:%.2u:%.2u", s->creation, min, sec);
 271                 sec = s->expire % 60;
 272                 s->expire /= 60;
 273                 min = s->expire % 60;
 274                 s->expire /= 60;
 275                 printf(", expires in %.2u:%.2u:%.2u", s->expire, min, sec);
 276                 printf(", %u:%u pkts, %u:%u bytes",
 277                     s->packets[0], s->packets[1], s->bytes[0], s->bytes[1]);
 278                 if (s->anchor.nr != (uint32_t)(-1))
 279                         printf(", anchor %u", s->anchor.nr);
 280                 if (s->rule.nr != (uint32_t)(-1))
 281                         printf(", rule %u", s->rule.nr);
 282                 if (s->src_node != NULL)
 283                         printf(", source-track");
 284                 if (s->nat_src_node != NULL)
 285                         printf(", sticky-address");
 286                 printf("\n");
 287         }
 288         if (opts & PF_OPT_VERBOSE2) {
 289                 printf("   id: %016llx creatorid: %08x",
 290                     be64toh(s->id), ntohl(s->creatorid));
 291
 292                 printf(" synchronization: ");
 293                 if ((s->sync_flags & PFSTATE_GOT_SYN_MASK) ==
 294                     PFSTATE_GOT_SYN_MASK) {
 295                         printf("good");
 296                 } else if (s->sync_flags & PFSTATE_GOT_SYN_MASK) {
 297                         printf("incomplete");
 298                 } else {
 299                         printf("indeterminate");
 300                 }
 301                 printf("\n");
 302         }
 303 }
 304
 305 int
 306 unmask(struct pf_addr *m, sa_family_t af __unused)
 307 {
 308         int i = 31, j = 0, b = 0;
 309         u_int32_t tmp;
 310
 311         while (j < 4 && m->addr32[j] == 0xffffffff) {
 312                 b += 32;
 313                 j++;
 314         }
 315         if (j < 4) {
 316                 tmp = ntohl(m->addr32[j]);
 317                 for (i = 31; tmp & (1 << i); --i)
 318                         b++;
 319         }
 320         return (b);
 321 }