contrib/ipfilter/fils.c

   1 /*
   2  * Copyright (C) 1993-2001 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  */
   6 #ifdef __FreeBSD__
   7 # ifndef __FreeBSD_cc_version
   8 #  include <osreldate.h>
   9 # else
  10 #  if __FreeBSD_cc_version < 430000
  11 #   include <osreldate.h>
  12 #  endif
  13 # endif
  14 #endif
  15 #if defined(__sgi) && (IRIX > 602)
  16 # include <sys/ptimers.h>
  17 #endif
  18 #include <stdio.h>
  19 #include <string.h>
  20 #if !defined(__SVR4) && !defined(__svr4__)
  21 # include <strings.h>
  22 #endif
  23 #include <sys/types.h>
  24 #include <sys/time.h>
  25 #include <sys/param.h>
  26 #include <sys/file.h>
  27 #if defined(STATETOP)
  28 # if defined(_BSDI_VERSION)
  29 #  undef STATETOP)
  30 # endif
  31 # if defined(__FreeBSD__) && \
  32      (!defined(__FreeBSD_version) || (__FreeBSD_version < 430000))
  33 #  undef STATETOP
  34 # endif
  35 # if defined(__NetBSD_Version__)
  36 #  if (__NetBSD_Version__ < 105000000)
  37 #   undef STATETOP
  38 #  else
  39 #   include <poll.h>
  40 #   define USE_POLL
  41 #  endif
  42 # endif
  43 # if defined(sun)
  44 #  if defined(__svr4__) || defined(__SVR4)
  45 #   include <sys/select.h>
  46 #  else
  47 #   undef STATETOP      /* NOT supported on SunOS4 */
  48 #  endif
  49 # endif
  50 #endif
  51 #include <stdlib.h>
  52 #include <unistd.h>
  53 #include <fcntl.h>
  54 #include <stddef.h>
  55 #include <nlist.h>
  56 #include <sys/socket.h>
  57 #include <sys/ioctl.h>
  58 #include <netinet/in.h>
  59 #include <arpa/inet.h>
  60 #include <netinet/in_systm.h>
  61 #include <netinet/ip.h>
  62 #include <net/if.h>
  63 #if __FreeBSD_version >= 300000
  64 # include <net/if_var.h>
  65 #endif
  66 #include <netdb.h>
  67 #include <arpa/nameser.h>
  68 #include <resolv.h>
  69 #include <netinet/tcp.h>
  70 #if defined(STATETOP) && !defined(linux)
  71 # include <netinet/ip_var.h>
  72 # include <netinet/tcp_fsm.h>
  73 #endif
  74 #include "netinet/ip_compat.h"
  75 #include "netinet/ip_fil.h"
  76 #include "ipf.h"
  77 #include "netinet/ip_nat.h"
  78 #include "netinet/ip_frag.h"
  79 #include "netinet/ip_state.h"
  80 #include "netinet/ip_proxy.h"
  81 #include "netinet/ip_auth.h"
  82 #ifdef STATETOP
  83 # include "netinet/ipl.h"
  84 # include <ctype.h>
  85 # if SOLARIS || defined(__NetBSD__) || defined(_BSDI_VERSION) || \
  86      defined(__sgi)
  87 #  ifdef ERR
  88 #   undef ERR
  89 #  endif
  90 #  include <curses.h>
  91 # else /* SOLARIS */
  92 #  include <ncurses.h>
  93 # endif /* SOLARIS */
  94 #endif /* STATETOP */
  95 #include "kmem.h"
  96 #if defined(__NetBSD__) || (__OpenBSD__)
  97 # include <paths.h>
  98 #endif
  99
 100 #if !defined(lint)
 101 static const char sccsid[] = "@(#)fils.c        1.21 4/20/96 (C) 1993-2000 Darren Reed";
 102 static const char rcsid[] = "@(#)$Id: fils.c,v 2.21.2.45 2004/04/10 11:45:48 darrenr Exp $";
 103 #endif
 104
 105 extern  char    *optarg;
 106 extern  int     optind;
 107
 108 #define PRINTF  (void)printf
 109 #define FPRINTF (void)fprintf
 110 #define F_IN    0
 111 #define F_OUT   1
 112 #define F_ACIN  2
 113 #define F_ACOUT 3
 114 static  char    *filters[4] = { "ipfilter(in)", "ipfilter(out)",
 115                                 "ipacct(in)", "ipacct(out)" };
 116
 117 int     opts = 0;
 118 int     use_inet6 = 0;
 119 int     live_kernel = 1;
 120 int     state_fd = -1;
 121 int     auth_fd = -1;
 122 int     ipf_fd = -1;
 123
 124 #ifdef STATETOP
 125 #define STSTRSIZE       80
 126 #define STGROWSIZE      16
 127 #define HOSTNMLEN       40
 128
 129 #define STSORT_PR       0
 130 #define STSORT_PKTS     1
 131 #define STSORT_BYTES    2
 132 #define STSORT_TTL      3
 133 #define STSORT_SRCIP    4
 134 #define STSORT_DSTIP    5
 135 #define STSORT_MAX      STSORT_DSTIP
 136 #define STSORT_DEFAULT  STSORT_BYTES
 137
 138
 139 typedef struct statetop {
 140         union i6addr    st_src;
 141         union i6addr    st_dst;
 142         u_short         st_sport;
 143         u_short         st_dport;
 144         u_char          st_p;
 145         u_char          st_state[2];
 146         U_QUAD_T        st_pkts;
 147         U_QUAD_T        st_bytes;
 148         u_long          st_age;
 149 } statetop_t;
 150 #endif
 151
 152 extern  int     main __P((int, char *[]));
 153 static  void    showstats __P((friostat_t *, u_32_t));
 154 static  void    showfrstates __P((ipfrstat_t *));
 155 static  void    showlist __P((friostat_t *));
 156 static  void    showipstates __P((ips_stat_t *));
 157 static  void    showauthstates __P((fr_authstat_t *));
 158 static  void    showgroups __P((friostat_t *));
 159 static  void    Usage __P((char *));
 160 static  void    printlist __P((frentry_t *));
 161 static  void    parse_ipportstr __P((const char *, struct in_addr *, int *));
 162 static  int     ipfstate_live __P((char *, friostat_t **, ips_stat_t **,
 163                                    ipfrstat_t **, fr_authstat_t **, u_32_t *));
 164 static  void    ipfstate_dead __P((char *, friostat_t **, ips_stat_t **,
 165                                    ipfrstat_t **, fr_authstat_t **, u_32_t *));
 166 #ifdef STATETOP
 167 static  void    topipstates __P((struct in_addr, struct in_addr, int, int, int, int, int));
 168 static  char    *ttl_to_string __P((long));
 169 static  int     sort_p __P((const void *, const void *));
 170 static  int     sort_pkts __P((const void *, const void *));
 171 static  int     sort_bytes __P((const void *, const void *));
 172 static  int     sort_ttl __P((const void *, const void *));
 173 static  int     sort_srcip __P((const void *, const void *));
 174 static  int     sort_dstip __P((const void *, const void *));
 175 #endif
 176 #if SOLARIS
 177 void showqiflist __P((char *));
 178 #endif
 179
 180
 181 static void Usage(name)
 182 char *name;
 183 {
 184 #ifdef  USE_INET6
 185         fprintf(stderr, "Usage: %s [-6aAfhIinosv] [-d <device>]\n", name);
 186 #else
 187         fprintf(stderr, "Usage: %s [-aAfhIinosv] [-d <device>]\n", name);
 188 #endif
 189         fprintf(stderr, "\t\t[-M corefile] [-N symbol-list]\n");
 190         fprintf(stderr, "       %s -t [-S source address] [-D destination address] [-P protocol] [-T refreshtime] [-C] [-d <device>]\n", name);
 191         exit(1);
 192 }
 193
 194
 195 int main(argc,argv)
 196 int argc;
 197 char *argv[];
 198 {
 199         fr_authstat_t   frauthst;
 200         fr_authstat_t   *frauthstp = &frauthst;
 201         friostat_t fio;
 202         friostat_t *fiop = &fio;
 203         ips_stat_t ipsst;
 204         ips_stat_t *ipsstp = &ipsst;
 205         ipfrstat_t ifrst;
 206         ipfrstat_t *ifrstp = &ifrst;
 207         char    *device = IPL_NAME, *memf = NULL;
 208         char    *kern = NULL;
 209         int     c, myoptind;
 210         struct protoent *proto;
 211
 212         int protocol = -1;              /* -1 = wild card for any protocol */
 213         int refreshtime = 1;            /* default update time */
 214         int sport = -1;                 /* -1 = wild card for any source port */
 215         int dport = -1;                 /* -1 = wild card for any dest port */
 216         int topclosed = 0;              /* do not show closed tcp sessions */
 217         struct in_addr saddr, daddr;
 218         u_32_t frf;
 219
 220         saddr.s_addr = INADDR_ANY;      /* default any source addr */
 221         daddr.s_addr = INADDR_ANY;      /* default any dest addr */
 222
 223         /*
 224          * Parse these two arguments now lest there be any buffer overflows
 225          * in the parsing of the rest.
 226          */
 227         myoptind = optind;
 228         while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
 229                 switch (c)
 230                 {
 231                 case 'M' :
 232                         memf = optarg;
 233                         live_kernel = 0;
 234                         break;
 235                 case 'N' :
 236                         kern = optarg;
 237                         live_kernel = 0;
 238                         break;
 239                 }
 240         optind = myoptind;
 241
 242         if (live_kernel == 1) {
 243                 if ((state_fd = open(IPL_STATE, O_RDONLY)) == -1) {
 244                         perror("open");
 245                         exit(-1);
 246                 }
 247                 if ((auth_fd = open(IPL_AUTH, O_RDONLY)) == -1) {
 248                         perror("open");
 249                         exit(-1);
 250                 }
 251                 if ((ipf_fd = open(device, O_RDONLY)) == -1) {
 252                         perror("open");
 253                         exit(-1);
 254                 }
 255         }
 256
 257         if (kern != NULL || memf != NULL)
 258         {
 259                 (void)setuid(getuid());
 260                 (void)setgid(getgid());
 261         }
 262
 263         if (openkmem(kern, memf) == -1)
 264                 exit(-1);
 265
 266         (void)setuid(getuid());
 267         (void)setgid(getgid());
 268
 269         while ((c = getopt(argc, argv, "6aACfghIilnoqstvd:D:M:N:P:S:T:")) != -1)
 270         {
 271                 switch (c)
 272                 {
 273 #ifdef  USE_INET6
 274                 case '6' :
 275                         use_inet6 = 1;
 276                         break;
 277 #endif
 278                 case 'a' :
 279                         opts |= OPT_ACCNT|OPT_SHOWLIST;
 280                         break;
 281                 case 'A' :
 282                         device = IPAUTH_NAME;
 283                         opts |= OPT_AUTHSTATS;
 284                         break;
 285                 case 'C' :
 286                         topclosed = 1;
 287                         break;
 288                 case 'd' :
 289                         device = optarg;
 290                         break;
 291                 case 'D' :
 292                         parse_ipportstr(optarg, &daddr, &dport);
 293                         break;
 294                 case 'f' :
 295                         opts |= OPT_FRSTATES;
 296                         break;
 297                 case 'g' :
 298                         opts |= OPT_GROUPS;
 299                         break;
 300                 case 'h' :
 301                         opts |= OPT_HITS;
 302                         break;
 303                 case 'i' :
 304                         opts |= OPT_INQUE|OPT_SHOWLIST;
 305                         break;
 306                 case 'I' :
 307                         opts |= OPT_INACTIVE;
 308                         break;
 309                 case 'l' :
 310                         opts |= OPT_SHOWLIST;
 311                         break;
 312                 case 'M' :
 313                         break;
 314                 case 'N' :
 315                         break;
 316                 case 'n' :
 317                         opts |= OPT_SHOWLINENO;
 318                         break;
 319                 case 'o' :
 320                         opts |= OPT_OUTQUE|OPT_SHOWLIST;
 321                         break;
 322                 case 'P' :
 323                         if ((proto = getprotobyname(optarg)) != NULL) {
 324                                 protocol = proto->p_proto;
 325                         } else if (!sscanf(optarg, "%ud", &protocol) ||
 326                                            (protocol < 0)) {
 327                                 fprintf(stderr, "%s : Invalid protocol: %s\n",
 328                                         argv[0], optarg);
 329                                 exit(-2);
 330                         }
 331                         break;
 332                 case 'q' :
 333 #if     SOLARIS
 334                         showqiflist(kern);
 335                         exit(0);
 336                         break;
 337 #else
 338                         fprintf(stderr, "-q only availble on Solaris\n");
 339                         exit(1);
 340                         break;
 341 #endif
 342                 case 's' :
 343                         opts |= OPT_IPSTATES;
 344                         break;
 345                 case 'S' :
 346                         parse_ipportstr(optarg, &saddr, &sport);
 347                         break;
 348                 case 't' :
 349 #ifdef STATETOP
 350                         opts |= OPT_STATETOP;
 351                         break;
 352 #else
 353                         fprintf(stderr,
 354                                 "%s : state top facility not compiled in\n",
 355                                 argv[0]);
 356                         exit(-2);
 357 #endif
 358                 case 'T' :
 359                         if (!sscanf(optarg, "%d", &refreshtime) ||
 360                                     (refreshtime <= 0)) {
 361                                 fprintf(stderr,
 362                                         "%s : Invalid refreshtime < 1 : %s\n",
 363                                         argv[0], optarg);
 364                                 exit(-2);
 365                         }
 366                         break;
 367                 case 'v' :
 368                         opts |= OPT_VERBOSE;
 369                         break;
 370                 default :
 371                         Usage(argv[0]);
 372                         break;
 373                 }
 374         }
 375
 376         if (live_kernel == 1) {
 377                 bzero((char *)&fio, sizeof(fio));
 378                 bzero((char *)&ipsst, sizeof(ipsst));
 379                 bzero((char *)&ifrst, sizeof(ifrst));
 380
 381                 ipfstate_live(device, &fiop, &ipsstp, &ifrstp,
 382                               &frauthstp, &frf);
 383         } else
 384                 ipfstate_dead(kern, &fiop, &ipsstp, &ifrstp, &frauthstp, &frf);
 385
 386         if (opts & OPT_IPSTATES) {
 387                 showipstates(ipsstp);
 388         } else if (opts & OPT_SHOWLIST) {
 389                 showlist(fiop);
 390                 if ((opts & OPT_OUTQUE) && (opts & OPT_INQUE)){
 391                         opts &= ~OPT_OUTQUE;
 392                         showlist(fiop);
 393                 }
 394         } else {
 395                 if (opts & OPT_FRSTATES)
 396                         showfrstates(ifrstp);
 397 #ifdef STATETOP
 398                 else if (opts & OPT_STATETOP)
 399                         topipstates(saddr, daddr, sport, dport,
 400                                     protocol, refreshtime, topclosed);
 401 #endif
 402                 else if (opts & OPT_AUTHSTATS)
 403                         showauthstates(frauthstp);
 404                 else if (opts & OPT_GROUPS)
 405                         showgroups(fiop);
 406                 else
 407                         showstats(fiop, frf);
 408         }
 409         return 0;
 410 }
 411
 412
 413 /*
 414  * Fill in the stats structures from the live kernel, using a combination
 415  * of ioctl's and copying directly from kernel memory.
 416  */
 417 int ipfstate_live(device, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
 418 char *device;
 419 friostat_t **fiopp;
 420 ips_stat_t **ipsstpp;
 421 ipfrstat_t **ifrstpp;
 422 fr_authstat_t **frauthstpp;
 423 u_32_t *frfp;
 424 {
 425
 426         if (!(opts & OPT_AUTHSTATS) && ioctl(ipf_fd, SIOCGETFS, fiopp) == -1) {
 427                 perror("ioctl(ipf:SIOCGETFS)");
 428                 exit(-1);
 429         }
 430
 431         if ((opts & OPT_IPSTATES)) {
 432                 if ((ioctl(state_fd, SIOCGETFS, ipsstpp) == -1)) {
 433                         perror("ioctl(state:SIOCGETFS)");
 434                         exit(-1);
 435                 }
 436         }
 437         if ((opts & OPT_FRSTATES) &&
 438             (ioctl(ipf_fd, SIOCGFRST, ifrstpp) == -1)) {
 439                 perror("ioctl(SIOCGFRST)");
 440                 exit(-1);
 441         }
 442
 443         if (opts & OPT_VERBOSE)
 444                 PRINTF("opts %#x name %s\n", opts, device);
 445
 446         if ((opts & OPT_AUTHSTATS) &&
 447             (ioctl(auth_fd, SIOCATHST, frauthstpp) == -1)) {
 448                 perror("ioctl(SIOCATHST)");
 449                 exit(-1);
 450         }
 451
 452         if (ioctl(ipf_fd, SIOCGETFF, frfp) == -1)
 453                 perror("ioctl(SIOCGETFF)");
 454
 455         return ipf_fd;
 456 }
 457
 458
 459 /*
 460  * Build up the stats structures from data held in the "core" memory.
 461  * This is mainly useful when looking at data in crash dumps and ioctl's
 462  * just won't work any more.
 463  */
 464 void ipfstate_dead(kernel, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
 465 char *kernel;
 466 friostat_t **fiopp;
 467 ips_stat_t **ipsstpp;
 468 ipfrstat_t **ifrstpp;
 469 fr_authstat_t **frauthstpp;
 470 u_32_t *frfp;
 471 {
 472         static fr_authstat_t frauthst, *frauthstp;
 473         static ips_stat_t ipsst, *ipsstp;
 474         static ipfrstat_t ifrst, *ifrstp;
 475         static friostat_t fio, *fiop;
 476
 477         void *rules[2][2];
 478         struct nlist deadlist[42] = {
 479                 { "fr_authstats" },             /* 0 */
 480                 { "fae_list" },
 481                 { "ipauth" },
 482                 { "fr_authlist" },
 483                 { "fr_authstart" },
 484                 { "fr_authend" },               /* 5 */
 485                 { "fr_authnext" },
 486                 { "fr_auth" },
 487                 { "fr_authused" },
 488                 { "fr_authsize" },
 489                 { "fr_defaultauthage" },        /* 10 */
 490                 { "fr_authpkts" },
 491                 { "fr_auth_lock" },
 492                 { "frstats" },
 493                 { "ips_stats" },
 494                 { "ips_num" },                  /* 15 */
 495                 { "ips_wild" },
 496                 { "ips_list" },
 497                 { "ips_table" },
 498                 { "fr_statemax" },
 499                 { "fr_statesize" },             /* 20 */
 500                 { "fr_state_doflush" },
 501                 { "fr_state_lock" },
 502                 { "ipfr_heads" },
 503                 { "ipfr_nattab" },
 504                 { "ipfr_stats" },               /* 25 */
 505                 { "ipfr_inuse" },
 506                 { "fr_ipfrttl" },
 507                 { "fr_frag_lock" },
 508                 { "ipfr_timer_id" },
 509                 { "fr_nat_lock" },              /* 30 */
 510                 { "ipfilter" },
 511                 { "ipfilter6" },
 512                 { "ipacct" },
 513                 { "ipacct6" },
 514                 { "ipl_frouteok" },             /* 35 */
 515                 { "fr_running" },
 516                 { "ipfgroups" },
 517                 { "fr_active" },
 518                 { "fr_pass" },
 519                 { "fr_flags" },                 /* 40 */
 520                 { NULL }
 521         };
 522
 523
 524         frauthstp = &frauthst;
 525         ipsstp = &ipsst;
 526         ifrstp = &ifrst;
 527         fiop = &fio;
 528
 529         *frfp = 0;
 530         *fiopp = fiop;
 531         *ipsstpp = ipsstp;
 532         *ifrstpp = ifrstp;
 533         *frauthstpp = frauthstp;
 534
 535         bzero((char *)fiop, sizeof(*fiop));
 536         bzero((char *)ipsstp, sizeof(*ipsstp));
 537         bzero((char *)ifrstp, sizeof(*ifrstp));
 538         bzero((char *)frauthstp, sizeof(*frauthstp));
 539
 540         if (nlist(kernel, deadlist) == -1) {
 541                 fprintf(stderr, "nlist error\n");
 542                 return;
 543         }
 544
 545         /*
 546          * This is for SIOCGETFF.
 547          */
 548         kmemcpy((char *)frfp, (u_long)deadlist[40].n_value, sizeof(*frfp));
 549
 550         /*
 551          * f_locks is a combination of the lock variable from each part of
 552          * ipfilter (state, auth, nat, fragments).
 553          */
 554         kmemcpy((char *)fiop, (u_long)deadlist[13].n_value, sizeof(*fiop));
 555         kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[22].n_value,
 556                 sizeof(fiop->f_locks[0]));
 557         kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[30].n_value,
 558                 sizeof(fiop->f_locks[1]));
 559         kmemcpy((char *)&fiop->f_locks[2], (u_long)deadlist[28].n_value,
 560                 sizeof(fiop->f_locks[2]));
 561         kmemcpy((char *)&fiop->f_locks[3], (u_long)deadlist[12].n_value,
 562                 sizeof(fiop->f_locks[3]));
 563
 564         /*
 565          * Get pointers to each list of rules (active, inactive, in, out)
 566          */
 567         kmemcpy((char *)&rules, (u_long)deadlist[31].n_value, sizeof(rules));
 568         fiop->f_fin[0] = rules[0][0];
 569         fiop->f_fin[1] = rules[0][1];
 570         fiop->f_fout[0] = rules[1][0];
 571         fiop->f_fout[1] = rules[1][1];
 572
 573         /*
 574          * Same for IPv6, except make them null if support for it is not
 575          * being compiled in.
 576          */
 577 #ifdef  USE_INET6
 578         kmemcpy((char *)&rules, (u_long)deadlist[32].n_value, sizeof(rules));
 579         fiop->f_fin6[0] = rules[0][0];
 580         fiop->f_fin6[1] = rules[0][1];
 581         fiop->f_fout6[0] = rules[1][0];
 582         fiop->f_fout6[1] = rules[1][1];
 583 #else
 584         fiop->f_fin6[0] = NULL;
 585         fiop->f_fin6[1] = NULL;
 586         fiop->f_fout6[0] = NULL;
 587         fiop->f_fout6[1] = NULL;
 588 #endif
 589
 590         /*
 591          * Now get accounting rules pointers.
 592          */
 593         kmemcpy((char *)&rules, (u_long)deadlist[33].n_value, sizeof(rules));
 594         fiop->f_acctin[0] = rules[0][0];
 595         fiop->f_acctin[1] = rules[0][1];
 596         fiop->f_acctout[0] = rules[1][0];
 597         fiop->f_acctout[1] = rules[1][1];
 598
 599 #ifdef  USE_INET6
 600         kmemcpy((char *)&rules, (u_long)deadlist[34].n_value, sizeof(rules));
 601         fiop->f_acctin6[0] = rules[0][0];
 602         fiop->f_acctin6[1] = rules[0][1];
 603         fiop->f_acctout6[0] = rules[1][0];
 604         fiop->f_acctout6[1] = rules[1][1];
 605 #else
 606         fiop->f_acctin6[0] = NULL;
 607         fiop->f_acctin6[1] = NULL;
 608         fiop->f_acctout6[0] = NULL;
 609         fiop->f_acctout6[1] = NULL;
 610 #endif
 611
 612         /*
 613          * A collection of "global" variables used inside the kernel which
 614          * are all collected in friostat_t via ioctl.
 615          */
 616         kmemcpy((char *)&fiop->f_froute, (u_long)deadlist[35].n_value,
 617                 sizeof(fiop->f_froute));
 618         kmemcpy((char *)&fiop->f_running, (u_long)deadlist[36].n_value,
 619                 sizeof(fiop->f_running));
 620         kmemcpy((char *)&fiop->f_groups, (u_long)deadlist[37].n_value,
 621                 sizeof(fiop->f_groups));
 622         kmemcpy((char *)&fiop->f_active, (u_long)deadlist[38].n_value,
 623                 sizeof(fiop->f_active));
 624         kmemcpy((char *)&fiop->f_defpass, (u_long)deadlist[39].n_value,
 625                 sizeof(fiop->f_defpass));
 626
 627         /*
 628          * Build up the state information stats structure.
 629          */
 630         kmemcpy((char *)ipsstp, (u_long)deadlist[14].n_value, sizeof(*ipsstp));
 631         kmemcpy((char *)&ipsstp->iss_active, (u_long)deadlist[15].n_value,
 632                 sizeof(ipsstp->iss_active));
 633         ipsstp->iss_table = (void *)deadlist[18].n_value;
 634         ipsstp->iss_list = (void *)deadlist[17].n_value;
 635
 636         /*
 637          * Build up the authentiation information stats structure.
 638          */
 639         kmemcpy((char *)frauthstp, (u_long)deadlist[0].n_value,
 640                 sizeof(*frauthstp));
 641         frauthstp->fas_faelist = (void *)deadlist[1].n_value;
 642
 643         /*
 644          * Build up the fragment information stats structure.
 645          */
 646         kmemcpy((char *)ifrstp, (u_long)deadlist[25].n_value,
 647                 sizeof(*ifrstp));
 648         ifrstp->ifs_table = (void *)deadlist[23].n_value;
 649         ifrstp->ifs_nattab = (void *)deadlist[24].n_value;
 650         kmemcpy((char *)&ifrstp->ifs_inuse, (u_long)deadlist[26].n_value,
 651                 sizeof(ifrstp->ifs_inuse));
 652 }
 653
 654
 655 /*
 656  * Display the kernel stats for packets blocked and passed and other
 657  * associated running totals which are kept.
 658  */
 659 static  void    showstats(fp, frf)
 660 struct  friostat        *fp;
 661 u_32_t frf;
 662 {
 663
 664 #if SOLARIS
 665         PRINTF("dropped packets:\tin %lu\tout %lu\n",
 666                         fp->f_st[0].fr_drop, fp->f_st[1].fr_drop);
 667         PRINTF("non-data packets:\tin %lu\tout %lu\n",
 668                         fp->f_st[0].fr_notdata, fp->f_st[1].fr_notdata);
 669         PRINTF("no-data packets:\tin %lu\tout %lu\n",
 670                         fp->f_st[0].fr_nodata, fp->f_st[1].fr_nodata);
 671         PRINTF("non-ip packets:\t\tin %lu\tout %lu\n",
 672                         fp->f_st[0].fr_notip, fp->f_st[1].fr_notip);
 673         PRINTF("   bad packets:\t\tin %lu\tout %lu\n",
 674                         fp->f_st[0].fr_bad, fp->f_st[1].fr_bad);
 675         PRINTF("copied messages:\tin %lu\tout %lu\n",
 676                         fp->f_st[0].fr_copy, fp->f_st[1].fr_copy);
 677 #endif
 678 #ifdef  USE_INET6
 679         PRINTF(" IPv6 packets:\t\tin %lu out %lu\n",
 680                         fp->f_st[0].fr_ipv6[0], fp->f_st[0].fr_ipv6[1]);
 681 #endif
 682         PRINTF(" input packets:\t\tblocked %lu passed %lu nomatch %lu",
 683                         fp->f_st[0].fr_block, fp->f_st[0].fr_pass,
 684                         fp->f_st[0].fr_nom);
 685         PRINTF(" counted %lu short %lu\n",
 686                         fp->f_st[0].fr_acct, fp->f_st[0].fr_short);
 687         PRINTF("output packets:\t\tblocked %lu passed %lu nomatch %lu",
 688                         fp->f_st[1].fr_block, fp->f_st[1].fr_pass,
 689                         fp->f_st[1].fr_nom);
 690         PRINTF(" counted %lu short %lu\n",
 691                         fp->f_st[1].fr_acct, fp->f_st[1].fr_short);
 692         PRINTF(" input packets logged:\tblocked %lu passed %lu\n",
 693                         fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl);
 694         PRINTF("output packets logged:\tblocked %lu passed %lu\n",
 695                         fp->f_st[1].fr_bpkl, fp->f_st[1].fr_ppkl);
 696         PRINTF(" packets logged:\tinput %lu output %lu\n",
 697                         fp->f_st[0].fr_pkl, fp->f_st[1].fr_pkl);
 698         PRINTF(" log failures:\t\tinput %lu output %lu\n",
 699                         fp->f_st[0].fr_skip, fp->f_st[1].fr_skip);
 700         PRINTF("fragment state(in):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
 701                         fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr, fp->f_st[0].fr_cfr);
 702         PRINTF("fragment state(out):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
 703                         fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr, fp->f_st[1].fr_cfr);
 704         PRINTF("packet state(in):\tkept %lu\tlost %lu\n",
 705                         fp->f_st[0].fr_ads, fp->f_st[0].fr_bads);
 706         PRINTF("packet state(out):\tkept %lu\tlost %lu\n",
 707                         fp->f_st[1].fr_ads, fp->f_st[1].fr_bads);
 708         PRINTF("ICMP replies:\t%lu\tTCP RSTs sent:\t%lu\n",
 709                         fp->f_st[0].fr_ret, fp->f_st[1].fr_ret);
 710         PRINTF("Invalid source(in):\t%lu\n", fp->f_st[0].fr_badsrc);
 711         PRINTF("Result cache hits(in):\t%lu\t(out):\t%lu\n",
 712                         fp->f_st[0].fr_chit, fp->f_st[1].fr_chit);
 713         PRINTF("IN Pullups succeeded:\t%lu\tfailed:\t%lu\n",
 714                         fp->f_st[0].fr_pull[0], fp->f_st[0].fr_pull[1]);
 715         PRINTF("OUT Pullups succeeded:\t%lu\tfailed:\t%lu\n",
 716                         fp->f_st[1].fr_pull[0], fp->f_st[1].fr_pull[1]);
 717         PRINTF("Fastroute successes:\t%lu\tfailures:\t%lu\n",
 718                         fp->f_froute[0], fp->f_froute[1]);
 719         PRINTF("TCP cksum fails(in):\t%lu\t(out):\t%lu\n",
 720                         fp->f_st[0].fr_tcpbad, fp->f_st[1].fr_tcpbad);
 721
 722         PRINTF("Packet log flags set: (%#x)\n", frf);
 723         if (frf & FF_LOGPASS)
 724                 PRINTF("\tpackets passed through filter\n");
 725         if (frf & FF_LOGBLOCK)
 726                 PRINTF("\tpackets blocked by filter\n");
 727         if (frf & FF_LOGNOMATCH)
 728                 PRINTF("\tpackets not matched by filter\n");
 729         if (!frf)
 730                 PRINTF("\tnone\n");
 731 }
 732
 733
 734 /*
 735  * Print out a list of rules from the kernel, starting at the one passed.
 736  */
 737 static void printlist(fp)
 738 frentry_t *fp;
 739 {
 740         struct  frentry fb;
 741         int     n;
 742
 743         for (n = 1; fp; n++) {
 744                 if (kmemcpy((char *)&fb, (u_long)fp, sizeof(fb)) == -1) {
 745                         perror("kmemcpy");
 746                         return;
 747                 }
 748                 fp = &fb;
 749                 if (opts & OPT_OUTQUE)
 750                         fp->fr_flags |= FR_OUTQUE;
 751                 if (opts & (OPT_HITS|OPT_VERBOSE))
 752 #ifdef  USE_QUAD_T
 753                         PRINTF("%qu ", (unsigned long long) fp->fr_hits);
 754 #else
 755                         PRINTF("%lu ", fp->fr_hits);
 756 #endif
 757                 if (opts & (OPT_ACCNT|OPT_VERBOSE))
 758 #ifdef  USE_QUAD_T
 759                         PRINTF("%qu ", (unsigned long long) fp->fr_bytes);
 760 #else
 761                         PRINTF("%lu ", fp->fr_bytes);
 762 #endif
 763                 if (opts & OPT_SHOWLINENO)
 764                         PRINTF("@%d ", n);
 765                 printfr(fp);
 766                 if (opts & OPT_VERBOSE)
 767                         binprint(fp);
 768                 if (fp->fr_grp)
 769                         printlist(fp->fr_grp);
 770                 fp = fp->fr_next;
 771         }
 772 }
 773
 774 /*
 775  * print out all of the asked for rule sets, using the stats struct as
 776  * the base from which to get the pointers.
 777  */
 778 static  void    showlist(fiop)
 779 struct  friostat        *fiop;
 780 {
 781         struct  frentry *fp = NULL;
 782         int     i, set;
 783
 784         set = fiop->f_active;
 785         if (opts & OPT_INACTIVE)
 786                 set = 1 - set;
 787         if (opts & OPT_ACCNT) {
 788 #ifdef USE_INET6
 789                 if ((use_inet6) && (opts & OPT_OUTQUE)) {
 790                         i = F_ACOUT;
 791                         fp = (struct frentry *)fiop->f_acctout6[set];
 792                 } else if ((use_inet6) && (opts & OPT_INQUE)) {
 793                         i = F_ACIN;
 794                         fp = (struct frentry *)fiop->f_acctin6[set];
 795                 } else
 796 #endif
 797                 if (opts & OPT_OUTQUE) {
 798                         i = F_ACOUT;
 799                         fp = (struct frentry *)fiop->f_acctout[set];
 800                 } else if (opts & OPT_INQUE) {
 801                         i = F_ACIN;
 802                         fp = (struct frentry *)fiop->f_acctin[set];
 803                 } else {
 804                         FPRINTF(stderr, "No -i or -o given with -a\n");
 805                         return;
 806                 }
 807         } else {
 808 #ifdef  USE_INET6
 809                 if ((use_inet6) && (opts & OPT_OUTQUE)) {
 810                         i = F_OUT;
 811                         fp = (struct frentry *)fiop->f_fout6[set];
 812                 } else if ((use_inet6) && (opts & OPT_INQUE)) {
 813                         i = F_IN;
 814                         fp = (struct frentry *)fiop->f_fin6[set];
 815                 } else
 816 #endif
 817                 if (opts & OPT_OUTQUE) {
 818                         i = F_OUT;
 819                         fp = (struct frentry *)fiop->f_fout[set];
 820                 } else if (opts & OPT_INQUE) {
 821                         i = F_IN;
 822                         fp = (struct frentry *)fiop->f_fin[set];
 823                 } else
 824                         return;
 825         }
 826         if (opts & OPT_VERBOSE)
 827                 FPRINTF(stderr, "showlist:opts %#x i %d\n", opts, i);
 828
 829         if (opts & OPT_VERBOSE)
 830                 PRINTF("fp %p set %d\n", fp, set);
 831         if (fp == NULL) {
 832                 FPRINTF(stderr, "empty list for %s%s\n",
 833                         (opts & OPT_INACTIVE) ? "inactive " : "", filters[i]);
 834                 return;
 835         }
 836         printlist(fp);
 837 }
 838
 839
 840 /*
 841  * Display ipfilter stateful filtering information
 842  */
 843 static void showipstates(ipsp)
 844 ips_stat_t *ipsp;
 845 {
 846         ipstate_t *istab[IPSTATE_SIZE];
 847
 848         /*
 849          * If a list of states hasn't been asked for, only print out stats
 850          */
 851         if (!(opts & OPT_SHOWLIST)) {
 852                 PRINTF("IP states added:\n\t%lu TCP\n\t%lu UDP\n\t%lu ICMP\n",
 853                         ipsp->iss_tcp, ipsp->iss_udp, ipsp->iss_icmp);
 854                 PRINTF("\t%lu hits\n\t%lu misses\n", ipsp->iss_hits,
 855                         ipsp->iss_miss);
 856                 PRINTF("\t%lu maximum\n\t%lu no memory\n\t%lu bkts in use\n",
 857                         ipsp->iss_max, ipsp->iss_nomem, ipsp->iss_inuse);
 858                 PRINTF("\t%lu logged\n\t%lu log failures\n",
 859                         ipsp->iss_logged, ipsp->iss_logfail);
 860                 PRINTF("\t%lu active\n\t%lu expired\n\t%lu closed\n",
 861                         ipsp->iss_active, ipsp->iss_expire, ipsp->iss_fin);
 862                 return;
 863         }
 864
 865         if (kmemcpy((char *)istab, (u_long)ipsp->iss_table, sizeof(istab)))
 866                 return;
 867
 868         /*
 869          * Print out all the state information currently held in the kernel.
 870          */
 871         while (ipsp->iss_list != NULL) {
 872                 ipsp->iss_list = printstate(ipsp->iss_list, opts);
 873         }
 874 }
 875
 876
 877 #if SOLARIS
 878 /*
 879  * Displays the list of interfaces of which IPFilter has taken control in
 880  * Solaris.
 881  */
 882 void showqiflist(kern)
 883 char *kern;
 884 {
 885         struct nlist qifnlist[2] = {
 886                 { "_qif_head" },
 887                 { NULL }
 888         };
 889         qif_t qif, *qf;
 890         ill_t ill;
 891
 892         if (kern == NULL)
 893                 kern = "/dev/ksyms";
 894
 895         if (nlist(kern, qifnlist) == -1) {
 896                 fprintf(stderr, "nlist error\n");
 897                 return;
 898         }
 899
 900         printf("List of interfaces bound by IPFilter:\n");
 901         if (kmemcpy((char *)&qf, (u_long)qifnlist[0].n_value, sizeof(qf)))
 902                 return;
 903         while (qf) {
 904                 if (kmemcpy((char *)&qif, (u_long)qf, sizeof(qif)))
 905                         break;
 906                 if (kmemcpy((char *)&ill, (u_long)qif.qf_ill, sizeof(ill)))
 907                         ill.ill_ppa = -1;
 908                 printf("Name: %-8s Header Length: %2d SAP: %s (%04x) PPA %d",
 909                         qif.qf_name, qif.qf_hl,
 910 #ifdef  IP6_DL_SAP
 911                         (qif.qf_sap == IP6_DL_SAP) ? "IPv6" : "IPv4"
 912 #else
 913                         "IPv4"
 914 #endif
 915                         , qif.qf_sap, ill.ill_ppa);
 916                 printf(" %ld %ld", qif.qf_incnt, qif.qf_outcnt);
 917                 qf = qif.qf_next;
 918                 putchar('\n');
 919         }
 920 }
 921 #endif
 922
 923
 924 #ifdef STATETOP
 925 static void topipstates(saddr, daddr, sport, dport, protocol,
 926                         refreshtime, topclosed)
 927 struct in_addr saddr;
 928 struct in_addr daddr;
 929 int sport;
 930 int dport;
 931 int protocol;
 932 int refreshtime;
 933 int topclosed;
 934 {
 935         char str1[STSTRSIZE], str2[STSTRSIZE], str3[STSTRSIZE], str4[STSTRSIZE];
 936         int maxtsentries = 0, reverse = 0, sorting = STSORT_DEFAULT;
 937         int i, j, winx, tsentry, maxx, maxy, redraw = 0;
 938         ipstate_t *istab[IPSTATE_SIZE], ips;
 939         ips_stat_t ipsst, *ipsstp = &ipsst;
 940         statetop_t *tstable = NULL, *tp;
 941         char hostnm[HOSTNMLEN];
 942         struct protoent *proto;
 943         int c = 0;
 944         time_t t;
 945 #ifdef USE_POLL
 946         struct pollfd set[1];
 947 #else
 948         struct timeval selecttimeout;
 949         fd_set readfd;
 950 #endif
 951
 952         /* init ncurses stuff */
 953         initscr();
 954         cbreak();
 955         noecho();
 956
 957         /* init hostname */
 958         gethostname(hostnm, sizeof(hostnm) - 1);
 959         hostnm[sizeof(hostnm) - 1] = '\0';
 960
 961         /* repeat until user aborts */
 962         while ( 1 ) {
 963
 964                 /* get state table */
 965                 bzero((char *)&ipsst, sizeof(&ipsst));
 966                 if ((ioctl(state_fd, SIOCGETFS, &ipsstp) == -1)) {
 967                         perror("ioctl(SIOCGETFS)");
 968                         exit(-1);
 969                 }
 970                 if (kmemcpy((char *)istab, (u_long)ipsstp->iss_table,
 971                             sizeof(ips)))
 972                         return;
 973
 974                 /* clear the history */
 975                 tsentry = -1;
 976
 977                 /* read the state table and store in tstable */
 978                 while (ipsstp->iss_list) {
 979                         if (kmemcpy((char *)&ips, (u_long)ipsstp->iss_list,
 980                                     sizeof(ips)))
 981                                 break;
 982                         ipsstp->iss_list = ips.is_next;
 983
 984                         if (((saddr.s_addr == INADDR_ANY) ||
 985                              (saddr.s_addr == ips.is_saddr)) &&
 986                             ((daddr.s_addr == INADDR_ANY) ||
 987                              (daddr.s_addr == ips.is_daddr)) &&
 988                             ((protocol < 0) || (protocol == ips.is_p)) &&
 989                             (((ips.is_p != IPPROTO_TCP) &&
 990                              (ips.is_p != IPPROTO_UDP)) ||
 991                              (((sport < 0) ||
 992                                (htons(sport) == ips.is_sport)) &&
 993                               ((dport < 0) ||
 994                                (htons(dport) == ips.is_dport)))) &&
 995                              (topclosed || (ips.is_p != IPPROTO_TCP) ||
 996                              (ips.is_state[0] < TCPS_LAST_ACK) ||
 997                              (ips.is_state[1] < TCPS_LAST_ACK))) {
 998                                 /*
 999                                  * if necessary make room for this state
1000                                  * entry
1001                                  */
1002                                 tsentry++;
1003                                 if (!maxtsentries ||
1004                                     (tsentry == maxtsentries)) {
1005
1006                                         maxtsentries += STGROWSIZE;
1007                                         tstable = realloc(tstable, maxtsentries * sizeof(statetop_t));
1008                                         if (!tstable) {
1009                                                 perror("malloc");
1010                                                 exit(-1);
1011                                         }
1012                                 }
1013
1014                                 /* fill structure */
1015                                 tp = tstable + tsentry;
1016                                 tp->st_src = ips.is_src;
1017                                 tp->st_dst = ips.is_dst;
1018                                 tp->st_p = ips.is_p;
1019                                 tp->st_state[0] = ips.is_state[0];
1020                                 tp->st_state[1] = ips.is_state[1];
1021                                 tp->st_pkts = ips.is_pkts;
1022                                 tp->st_bytes = ips.is_bytes;
1023                                 tp->st_age = ips.is_age;
1024                                 if ((ips.is_p == IPPROTO_TCP) ||
1025                                     (ips.is_p == IPPROTO_UDP)) {
1026                                         tp->st_sport = ips.is_sport;
1027                                         tp->st_dport = ips.is_dport;
1028                                 }
1029
1030                         }
1031                 }
1032
1033
1034                 /* sort the array */
1035                 if (tsentry != -1)
1036                         switch (sorting)
1037                         {
1038                         case STSORT_PR:
1039                                 qsort(tstable, tsentry + 1,
1040                                       sizeof(statetop_t), sort_p);
1041                                 break;
1042                         case STSORT_PKTS:
1043                                 qsort(tstable, tsentry + 1,
1044                                       sizeof(statetop_t), sort_pkts);
1045                                 break;
1046                         case STSORT_BYTES:
1047                                 qsort(tstable, tsentry + 1,
1048                                       sizeof(statetop_t), sort_bytes);
1049                                 break;
1050                         case STSORT_TTL:
1051                                 qsort(tstable, tsentry + 1,
1052                                       sizeof(statetop_t), sort_ttl);
1053                                 break;
1054                         case STSORT_SRCIP:
1055                                 qsort(tstable, tsentry + 1,
1056                                       sizeof(statetop_t), sort_srcip);
1057                                 break;
1058                         case STSORT_DSTIP:
1059                                 qsort(tstable, tsentry + 1,
1060                                       sizeof(statetop_t), sort_dstip);
1061                                 break;
1062                         default:
1063                                 break;
1064                         }
1065
1066                 /* print title */
1067                 erase();
1068                 getmaxyx(stdscr, maxy, maxx);
1069                 attron(A_BOLD);
1070                 winx = 0;
1071                 move(winx,0);
1072                 sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION);
1073                 for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
1074                         printw(" ");
1075                 printw("%s", str1);
1076                 attroff(A_BOLD);
1077
1078                 /* just for fun add a clock */
1079                 move(winx, maxx - 8);
1080                 t = time(NULL);
1081                 strftime(str1, 80, "%T", localtime(&t));
1082                 printw("%s\n", str1);
1083
1084                 /*
1085                  * print the display filters, this is placed in the loop,
1086                  * because someday I might add code for changing these
1087                  * while the programming is running :-)
1088                  */
1089                 if (sport >= 0)
1090                         sprintf(str1, "%s,%d", inet_ntoa(saddr), sport);
1091                 else
1092                         sprintf(str1, "%s", inet_ntoa(saddr));
1093
1094                 if (dport >= 0)
1095                         sprintf(str2, "%s,%d", inet_ntoa(daddr), dport);
1096                 else
1097                         sprintf(str2, "%s", inet_ntoa(daddr));
1098
1099                 if (protocol < 0)
1100                         strcpy(str3, "any");
1101                 else if ((proto = getprotobynumber(protocol)) != NULL)
1102                         sprintf(str3, "%s", proto->p_name);
1103                 else
1104                         sprintf(str3, "%d", protocol);
1105
1106                 switch (sorting)
1107                 {
1108                 case STSORT_PR:
1109                         sprintf(str4, "proto");
1110                         break;
1111                 case STSORT_PKTS:
1112                         sprintf(str4, "# pkts");
1113                         break;
1114                 case STSORT_BYTES:
1115                         sprintf(str4, "# bytes");
1116                         break;
1117                 case STSORT_TTL:
1118                         sprintf(str4, "ttl");
1119                         break;
1120                 case STSORT_SRCIP:
1121                         sprintf(str4, "srcip");
1122                         break;
1123                 case STSORT_DSTIP:
1124                         sprintf(str4, "dstip");
1125                         break;
1126                 default:
1127                         sprintf(str4, "unknown");
1128                         break;
1129                 }
1130
1131                 if (reverse)
1132                         strcat(str4, " (reverse)");
1133
1134                 winx += 2;
1135                 move(winx,0);
1136                 printw("Src = %s  Dest = %s  Proto = %s  Sorted by = %s\n\n",
1137                        str1, str2, str3, str4);
1138
1139                 /* print column description */
1140                 winx += 2;
1141                 move(winx,0);
1142                 attron(A_BOLD);
1143                 printw("%-21s %-21s %3s %4s %7s %9s %9s\n", "Source IP",
1144                        "Destination IP", "ST", "PR", "#pkts", "#bytes", "ttl");
1145                 attroff(A_BOLD);
1146
1147                 /* print all the entries */
1148                 tp = tstable;
1149                 if (reverse)
1150                         tp += tsentry;
1151
1152                 if (tsentry > maxy - 6)
1153                         tsentry = maxy - 6;
1154                 for (i = 0; i <= tsentry; i++) {
1155                         /* print src/dest and port */
1156                         if ((tp->st_p == IPPROTO_TCP) ||
1157                             (tp->st_p == IPPROTO_UDP)) {
1158                                 sprintf(str1, "%s,%hu",
1159                                         inet_ntoa(tp->st_src.in4),
1160                                         ntohs(tp->st_sport));
1161                                 sprintf(str2, "%s,%hu",
1162                                         inet_ntoa(tp->st_dst.in4),
1163                                         ntohs(tp->st_dport));
1164                         } else {
1165                                 sprintf(str1, "%s", inet_ntoa(tp->st_src.in4));
1166                                 sprintf(str2, "%s", inet_ntoa(tp->st_dst.in4));
1167                         }
1168                         winx++;
1169                         move(winx, 0);
1170                         printw("%-21s %-21s", str1, str2);
1171
1172                         /* print state */
1173                         sprintf(str1, "%X/%X", tp->st_state[0],
1174                                 tp->st_state[1]);
1175                         printw(" %3s", str1);
1176
1177                         /* print proto */
1178                         proto = getprotobynumber(tp->st_p);
1179                         if (proto) {
1180                                 strncpy(str1, proto->p_name, 4);
1181                                 str1[4] = '\0';
1182                         } else {
1183                                 sprintf(str1, "%d", tp->st_p);
1184                         }
1185                         printw(" %4s", str1);
1186                                 /* print #pkt/#bytes */
1187 #ifdef  USE_QUAD_T
1188                         printw(" %7qu %9qu", (unsigned long long) tp->st_pkts,
1189                                 (unsigned long long) tp->st_bytes);
1190 #else
1191                         printw(" %7lu %9lu", tp->st_pkts, tp->st_bytes);
1192 #endif
1193                         printw(" %9s", ttl_to_string(tp->st_age));
1194
1195                         if (reverse)
1196                                 tp--;
1197                         else
1198                                 tp++;
1199                 }
1200
1201                 /* screen data structure is filled, now update the screen */
1202                 if (redraw)
1203                         clearok(stdscr,1);
1204
1205                 refresh();
1206                 if (redraw) {
1207                         clearok(stdscr,0);
1208                         redraw = 0;
1209                 }
1210
1211                 /* wait for key press or a 1 second time out period */
1212 #ifdef USE_POLL
1213                 set[0].fd = 0;
1214                 set[0].events = POLLIN;
1215                 poll(set, 1, refreshtime * 1000);
1216
1217                 /* if key pressed, read all waiting keys */
1218                 if (set[0].revents & POLLIN)
1219 #else
1220                 selecttimeout.tv_sec = refreshtime;
1221                 selecttimeout.tv_usec = 0;
1222                 FD_ZERO(&readfd);
1223                 FD_SET(0, &readfd);
1224                 select(1, &readfd, NULL, NULL, &selecttimeout);
1225
1226                 /* if key pressed, read all waiting keys */
1227                 if (FD_ISSET(0, &readfd))
1228 #endif
1229
1230                 {
1231                         c = wgetch(stdscr);
1232                         if (c == ERR)
1233                                 continue;
1234
1235                         if (isalpha(c) && isupper(c))
1236                                 c = tolower(c);
1237                         if (c == 'l') {
1238                                 redraw = 1;
1239                         } else if (c == 'q') {
1240                                 break;  /* exits while() loop */
1241                         } else if (c == 'r') {
1242                                 reverse = !reverse;
1243                         } else if (c == 's') {
1244                                 sorting++;
1245                                 if (sorting > STSORT_MAX)
1246                                         sorting = 0;
1247                         }
1248                 }
1249         } /* while */
1250
1251         printw("\n");
1252         nocbreak();
1253         endwin();
1254 }
1255 #endif
1256
1257
1258 /*
1259  * Show fragment cache information that's held in the kernel.
1260  */
1261 static void showfrstates(ifsp)
1262 ipfrstat_t *ifsp;
1263 {
1264         struct ipfr *ipfrtab[IPFT_SIZE], ifr;
1265         frentry_t fr;
1266         int i;
1267
1268         /*
1269          * print out the numeric statistics
1270          */
1271         PRINTF("IP fragment states:\n\t%lu new\n\t%lu expired\n\t%lu hits\n",
1272                 ifsp->ifs_new, ifsp->ifs_expire, ifsp->ifs_hits);
1273         PRINTF("\t%lu no memory\n\t%lu already exist\n",
1274                 ifsp->ifs_nomem, ifsp->ifs_exists);
1275         PRINTF("\t%lu inuse\n", ifsp->ifs_inuse);
1276         if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_table, sizeof(ipfrtab)))
1277                 return;
1278
1279         /*
1280          * Print out the contents (if any) of the fragment cache table.
1281          */
1282         PRINTF("\n");
1283         for (i = 0; i < IPFT_SIZE; i++)
1284                 while (ipfrtab[i]) {
1285                         if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
1286                                     sizeof(ifr)) == -1)
1287                                 break;
1288                         PRINTF("%s -> ", hostname(4, &ifr.ipfr_src));
1289                         if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule,
1290                                     sizeof(fr)) == -1)
1291                                 break;
1292                         PRINTF("%s id %d ttl %d pr %d seen0 %d ifp %p tos %#02x = fl %#x\n",
1293                                 hostname(4, &ifr.ipfr_dst), ntohs(ifr.ipfr_id),
1294                                 ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_seen0,
1295                                 ifr.ipfr_ifp, ifr.ipfr_tos, fr.fr_flags);
1296                         ipfrtab[i] = ifr.ipfr_next;
1297                 }
1298         if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_nattab,sizeof(ipfrtab)))
1299                 return;
1300         for (i = 0; i < IPFT_SIZE; i++)
1301                 while (ipfrtab[i]) {
1302                         if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
1303                                     sizeof(ifr)) == -1)
1304                                 break;
1305                         PRINTF("NAT: %s -> ", hostname(4, &ifr.ipfr_src));
1306                         if (kmemcpy((char *)&fr, (u_long)ifr.ipfr_rule,
1307                                     sizeof(fr)) == -1)
1308                                 break;
1309                         PRINTF("%s %d %d %d %#02x = %#x\n",
1310                                 hostname(4, &ifr.ipfr_dst), ifr.ipfr_id,
1311                                 ifr.ipfr_ttl, ifr.ipfr_p, ifr.ipfr_tos,
1312                                 fr.fr_flags);
1313                         ipfrtab[i] = ifr.ipfr_next;
1314                 }
1315 }
1316
1317
1318 /*
1319  * Show stats on how auth within IPFilter has been used
1320  */
1321 static void showauthstates(asp)
1322 fr_authstat_t *asp;
1323 {
1324         frauthent_t *frap, fra;
1325
1326 #ifdef  USE_QUAD_T
1327         printf("Authorisation hits: %qu\tmisses %qu\n",
1328                 (unsigned long long) asp->fas_hits,
1329                 (unsigned long long) asp->fas_miss);
1330 #else
1331         printf("Authorisation hits: %ld\tmisses %ld\n", asp->fas_hits,
1332                 asp->fas_miss);
1333 #endif
1334         printf("nospace %ld\nadded %ld\nsendfail %ld\nsendok %ld\n",
1335                 asp->fas_nospace, asp->fas_added, asp->fas_sendfail,
1336                 asp->fas_sendok);
1337         printf("queok %ld\nquefail %ld\nexpire %ld\n",
1338                 asp->fas_queok, asp->fas_quefail, asp->fas_expire);
1339
1340         frap = asp->fas_faelist;
1341         while (frap) {
1342                 if (kmemcpy((char *)&fra, (u_long)frap, sizeof(fra)) == -1)
1343                         break;
1344
1345                 printf("age %ld\t", fra.fae_age);
1346                 printfr(&fra.fae_fr);
1347                 frap = fra.fae_next;
1348         }
1349 }
1350
1351
1352 /*
1353  * Display groups used for each of filter rules, accounting rules and
1354  * authentication, separately.
1355  */
1356 static void showgroups(fiop)
1357 struct friostat *fiop;
1358 {
1359         static char *gnames[3] = { "Filter", "Accounting", "Authentication" };
1360         frgroup_t *fp, grp;
1361         int on, off, i;
1362
1363         on = fiop->f_active;
1364         off = 1 - on;
1365
1366         for (i = 0; i < 3; i++) {
1367                 printf("%s groups (active):\n", gnames[i]);
1368                 for (fp = fiop->f_groups[i][on]; fp; fp = grp.fg_next)
1369                         if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
1370                                 break;
1371                         else
1372                                 printf("%hu\n", grp.fg_num);
1373                 printf("%s groups (inactive):\n", gnames[i]);
1374                 for (fp = fiop->f_groups[i][off]; fp; fp = grp.fg_next)
1375                         if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
1376                                 break;
1377                         else
1378                                 printf("%hu\n", grp.fg_num);
1379         }
1380 }
1381
1382 static void parse_ipportstr(argument, ip, port)
1383 const char *argument;
1384 struct in_addr *ip;
1385 int *port;
1386 {
1387
1388         char *s, *comma;
1389
1390         /* make working copy of argument, Theoretically you must be able
1391          * to write to optarg, but that seems very ugly to me....
1392          */
1393         if ((s = malloc(strlen(argument) + 1)) == NULL)
1394                 perror("malloc");
1395         strcpy(s, argument);
1396
1397         /* get port */
1398         if ((comma = strchr(s, ',')) != NULL) {
1399                 if (!strcasecmp(s, "any")) {
1400                         *port = -1;
1401                 } else if (!sscanf(comma + 1, "%d", port) ||
1402                            (*port < 0) || (*port > 65535)) {
1403                         fprintf(stderr, "Invalid port specfication in %s\n",
1404                                 argument);
1405                         exit(-2);
1406                 }
1407                 *comma = '\0';
1408         }
1409
1410
1411         /* get ip address */
1412         if (!strcasecmp(s, "any")) {
1413                 ip->s_addr = INADDR_ANY;
1414         } else  if (!inet_aton(s, ip)) {
1415                 fprintf(stderr, "Invalid IP address: %s\n", s);
1416                 exit(-2);
1417         }
1418
1419         /* free allocated memory */
1420         free(s);
1421 }
1422
1423
1424 #ifdef STATETOP
1425 static char ttlbuf[STSTRSIZE];
1426
1427 static char *ttl_to_string(ttl)
1428 long int ttl;
1429 {
1430
1431         int hours, minutes, seconds;
1432
1433         /* ttl is in half seconds */
1434         ttl /= 2;
1435
1436         hours = ttl / 3600;
1437         ttl = ttl % 3600;
1438         minutes = ttl / 60;
1439         seconds = ttl % 60;
1440
1441         if (hours > 0 )
1442                 sprintf(ttlbuf, "%2d:%02d:%02d", hours, minutes, seconds);
1443         else
1444                 sprintf(ttlbuf, "%2d:%02d", minutes, seconds);
1445         return ttlbuf;
1446 }
1447
1448
1449 static int sort_pkts(a, b)
1450 const void *a;
1451 const void *b;
1452 {
1453
1454         register const statetop_t *ap = a;
1455         register const statetop_t *bp = b;
1456
1457         if (ap->st_pkts == bp->st_pkts)
1458                 return 0;
1459         else if (ap->st_pkts < bp->st_pkts)
1460                 return 1;
1461         return -1;
1462 }
1463
1464
1465 static int sort_bytes(a, b)
1466 const void *a;
1467 const void *b;
1468 {
1469         register const statetop_t *ap = a;
1470         register const statetop_t *bp = b;
1471
1472         if (ap->st_bytes == bp->st_bytes)
1473                 return 0;
1474         else if (ap->st_bytes < bp->st_bytes)
1475                 return 1;
1476         return -1;
1477 }
1478
1479
1480 static int sort_p(a, b)
1481 const void *a;
1482 const void *b;
1483 {
1484         register const statetop_t *ap = a;
1485         register const statetop_t *bp = b;
1486
1487         if (ap->st_p == bp->st_p)
1488                 return 0;
1489         else if (ap->st_p < bp->st_p)
1490                 return 1;
1491         return -1;
1492 }
1493
1494
1495 static int sort_ttl(a, b)
1496 const void *a;
1497 const void *b;
1498 {
1499         register const statetop_t *ap = a;
1500         register const statetop_t *bp = b;
1501
1502         if (ap->st_age == bp->st_age)
1503                 return 0;
1504         else if (ap->st_age < bp->st_age)
1505                 return 1;
1506         return -1;
1507 }
1508
1509 static int sort_srcip(a, b)
1510 const void *a;
1511 const void *b;
1512 {
1513         register const statetop_t *ap = a;
1514         register const statetop_t *bp = b;
1515
1516         if (ntohl(ap->st_src.in4.s_addr) == ntohl(bp->st_src.in4.s_addr))
1517                 return 0;
1518         else if (ntohl(ap->st_src.in4.s_addr) > ntohl(bp->st_src.in4.s_addr))
1519                 return 1;
1520         return -1;
1521 }
1522
1523 static int sort_dstip(a, b)
1524 const void *a;
1525 const void *b;
1526 {
1527         register const statetop_t *ap = a;
1528         register const statetop_t *bp = b;
1529
1530         if (ntohl(ap->st_dst.in4.s_addr) == ntohl(bp->st_dst.in4.s_addr))
1531                 return 0;
1532         else if (ntohl(ap->st_dst.in4.s_addr) > ntohl(bp->st_dst.in4.s_addr))
1533                 return 1;
1534         return -1;
1535 }
1536 #endif