freebsd-dev/contrib/tcpdump/print-pflog.c

186 lines
4.8 KiB
C
Raw Normal View History

/*
* Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
2017-01-31 19:17:06 +00:00
/* \summary: OpenBSD packet filter log file printer */
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
2007-10-16 02:20:42 +00:00
#ifndef HAVE_NET_PFVAR_H
#error "No pf headers available"
#endif
#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>
#include <net/pfvar.h>
#include <net/if_pflog.h>
2017-01-31 19:17:06 +00:00
#include <netdissect-stdinc.h>
2017-01-31 19:17:06 +00:00
#include "netdissect.h"
2015-01-06 19:03:11 +00:00
#include "extract.h"
static const char tstr[] = "[|pflog]";
2015-01-06 19:03:11 +00:00
static const struct tok pf_reasons[] = {
{ 0, "0(match)" },
{ 1, "1(bad-offset)" },
{ 2, "2(fragment)" },
{ 3, "3(short)" },
{ 4, "4(normalize)" },
{ 5, "5(memory)" },
2007-10-16 02:20:42 +00:00
{ 6, "6(bad-timestamp)" },
{ 7, "7(congestion)" },
{ 8, "8(ip-option)" },
{ 9, "9(proto-cksum)" },
{ 10, "10(state-mismatch)" },
{ 11, "11(state-insert)" },
{ 12, "12(state-limit)" },
{ 13, "13(src-limit)" },
{ 14, "14(synproxy)" },
{ 0, NULL }
};
2015-01-06 19:03:11 +00:00
static const struct tok pf_actions[] = {
{ PF_PASS, "pass" },
{ PF_DROP, "block" },
{ PF_SCRUB, "scrub" },
{ PF_NAT, "nat" },
{ PF_NONAT, "nat" },
{ PF_BINAT, "binat" },
{ PF_NOBINAT, "binat" },
{ PF_RDR, "rdr" },
{ PF_NORDR, "rdr" },
{ PF_SYNPROXY_DROP, "synproxy-drop" },
{ 0, NULL }
};
2015-01-06 19:03:11 +00:00
static const struct tok pf_directions[] = {
{ PF_INOUT, "in/out" },
{ PF_IN, "in" },
{ PF_OUT, "out" },
{ 0, NULL }
};
/* For reading capture files on other systems */
#define OPENBSD_AF_INET 2
#define OPENBSD_AF_INET6 24
static void
2015-01-06 19:03:11 +00:00
pflog_print(netdissect_options *ndo, const struct pfloghdr *hdr)
{
2015-01-06 19:03:11 +00:00
uint32_t rulenr, subrulenr;
Update tcpdump to 4.1.1. Changes: Thu. April 1, 2010. guy@alum.mit.edu. Summary for 4.1.1 tcpdump release Fix build on systems with PF, such as FreeBSD and OpenBSD. Don't blow up if a zero-length link-layer address is passed to linkaddr_string(). Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu. Summary for 4.1.0 tcpdump release Fix printing of MAC addresses for VLAN frames with a length field Add some additional bounds checks and use the EXTRACT_ macros more Add a -b flag to print the AS number in BGP packets in ASDOT notation rather than ASPLAIN notation Add ICMPv6 RFC 5006 support Decode the access flags in NFS access requests Handle the new DLT_ for memory-mapped USB captures on Linux Make the default snapshot (-s) the maximum Print name of device (when -L is used) Support for OpenSolaris (and SXCE build 125 and later) Print new TCP flags Add support for RPL DIO Add support for TCP User Timeout (UTO) Add support for non-standard Ethertypes used by 3com PPPoE gear Add support for 802.11n and 802.11s Add support for Transparent Ethernet Bridge ethertype in GRE Add 4 byte AS support for BGP printer Add support for the MDT SAFI 66 BG printer Add basic IPv6 support to print-olsr Add USB printer Add printer for ForCES Handle frames with an FCS Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames Fix TCP sequence number printing Report 802.2 packets as 802.2 instead of 802.3 Don't include -L/usr/lib in LDFLAGS On x86_64 Linux, look in lib64 directory too Lots of code clean ups Autoconf clean ups Update testcases to make output changes Fix compiling with/out smi (--with{,out}-smi) Fix compiling without IPv6 support (--disable-ipv6)
2010-10-28 16:23:25 +00:00
rulenr = EXTRACT_32BITS(&hdr->rulenr);
subrulenr = EXTRACT_32BITS(&hdr->subrulenr);
2015-01-06 19:03:11 +00:00
if (subrulenr == (uint32_t)-1)
ND_PRINT((ndo, "rule %u/", rulenr));
else
2015-01-06 19:03:11 +00:00
ND_PRINT((ndo, "rule %u.%s.%u/", rulenr, hdr->ruleset, subrulenr));
2015-01-06 19:03:11 +00:00
ND_PRINT((ndo, "%s: %s %s on %s: ",
tok2str(pf_reasons, "unkn(%u)", hdr->reason),
tok2str(pf_actions, "unkn(%u)", hdr->action),
tok2str(pf_directions, "unkn(%u)", hdr->dir),
2015-01-06 19:03:11 +00:00
hdr->ifname));
}
u_int
2015-01-06 19:03:11 +00:00
pflog_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
register const u_char *p)
{
u_int length = h->len;
u_int hdrlen;
u_int caplen = h->caplen;
const struct pfloghdr *hdr;
2015-01-06 19:03:11 +00:00
uint8_t af;
/* check length */
2015-01-06 19:03:11 +00:00
if (caplen < sizeof(uint8_t)) {
ND_PRINT((ndo, "%s", tstr));
return (caplen);
}
#define MIN_PFLOG_HDRLEN 45
2017-01-31 19:17:06 +00:00
hdr = (const struct pfloghdr *)p;
if (hdr->length < MIN_PFLOG_HDRLEN) {
2015-01-06 19:03:11 +00:00
ND_PRINT((ndo, "[pflog: invalid header length!]"));
return (hdr->length); /* XXX: not really */
}
hdrlen = BPF_WORDALIGN(hdr->length);
if (caplen < hdrlen) {
2015-01-06 19:03:11 +00:00
ND_PRINT((ndo, "%s", tstr));
return (hdrlen); /* XXX: true? */
}
/* print what we know */
2015-01-06 19:03:11 +00:00
ND_TCHECK(*hdr);
if (ndo->ndo_eflag)
pflog_print(ndo, hdr);
/* skip to the real packet */
af = hdr->af;
length -= hdrlen;
caplen -= hdrlen;
p += hdrlen;
switch (af) {
case AF_INET:
#if OPENBSD_AF_INET != AF_INET
case OPENBSD_AF_INET: /* XXX: read pcap files */
#endif
2015-01-06 19:03:11 +00:00
ip_print(ndo, p, length);
break;
#if defined(AF_INET6) || defined(OPENBSD_AF_INET6)
#ifdef AF_INET6
case AF_INET6:
#endif /* AF_INET6 */
#if !defined(AF_INET6) || OPENBSD_AF_INET6 != AF_INET6
case OPENBSD_AF_INET6: /* XXX: read pcap files */
#endif /* !defined(AF_INET6) || OPENBSD_AF_INET6 != AF_INET6 */
2015-01-06 19:03:11 +00:00
ip6_print(ndo, p, length);
break;
#endif /* defined(AF_INET6) || defined(OPENBSD_AF_INET6) */
default:
/* address family not handled, print raw packet */
2015-01-06 19:03:11 +00:00
if (!ndo->ndo_eflag)
pflog_print(ndo, hdr);
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
2015-01-06 19:03:11 +00:00
return (hdrlen);
trunc:
2015-01-06 19:03:11 +00:00
ND_PRINT((ndo, "%s", tstr));
return (hdrlen);
}
/*
* Local Variables:
* c-style: whitesmith
* c-basic-offset: 8
* End:
*/