print-pflog.c revision 146773 
1/*
2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22#ifndef lint
23static const char rcsid[] _U_ =
24    "@(#) $Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.13 2005/04/06 21:32:41 mcr Exp $ (LBL)";
25#endif
26
27#ifdef HAVE_CONFIG_H
28#include "config.h"
29#endif
30
31#include <tcpdump-stdinc.h>
32
33#include <stdio.h>
34#include <pcap.h>
35
36#include "interface.h"
37#include "addrtoname.h"
38#include "pf.h"
39
40static struct tok pf_reasons[] = {
41	{ 0,	"0(match)" },
42	{ 1,	"1(bad-offset)" },
43	{ 2,	"2(fragment)" },
44	{ 3,	"3(short)" },
45	{ 4,	"4(normalize)" },
46	{ 5,	"5(memory)" },
47	{ 0,	NULL }
48};
49
50static struct tok pf_actions[] = {
51	{ PF_PASS,		"pass" },
52	{ PF_DROP,		"block" },
53	{ PF_SCRUB,		"scrub" },
54	{ PF_NAT,		"nat" },
55	{ PF_NONAT,		"nat" },
56	{ PF_BINAT,		"binat" },
57	{ PF_NOBINAT,		"binat" },
58	{ PF_RDR,		"rdr" },
59	{ PF_NORDR,		"rdr" },
60	{ PF_SYNPROXY_DROP,	"synproxy-drop" },
61	{ 0,			NULL }
62};
63
64static struct tok pf_directions[] = {
65	{ PF_INOUT,	"in/out" },
66	{ PF_IN,	"in" },
67	{ PF_OUT,	"out" },
68	{ 0,		NULL }
69};
70
71/* For reading capture files on other systems */
72#define	OPENBSD_AF_INET		2
73#define	OPENBSD_AF_INET6	24
74
75static void
76pflog_print(const struct pfloghdr *hdr)
77{
78	u_int32_t rulenr, subrulenr;
79
80	rulenr = ntohl(hdr->rulenr);
81	subrulenr = ntohl(hdr->subrulenr);
82	if (subrulenr == (u_int32_t)-1)
83		printf("rule %u/", rulenr);
84	else
85		printf("rule %u.%s.%u/", rulenr, hdr->ruleset, subrulenr);
86
87	printf("%s: %s %s on %s: ",
88	    tok2str(pf_reasons, "unkn(%u)", hdr->reason),
89	    tok2str(pf_actions, "unkn(%u)", hdr->action),
90	    tok2str(pf_directions, "unkn(%u)", hdr->dir),
91	    hdr->ifname);
92}
93
94u_int
95pflog_if_print(const struct pcap_pkthdr *h, register const u_char *p)
96{
97	u_int length = h->len;
98	u_int hdrlen;
99	u_int caplen = h->caplen;
100	const struct pfloghdr *hdr;
101	u_int8_t af;
102
103	/* check length */
104	if (caplen < sizeof(u_int8_t)) {
105		printf("[|pflog]");
106		return (caplen);
107	}
108
109#define MIN_PFLOG_HDRLEN	45
110	hdr = (struct pfloghdr *)p;
111	if (hdr->length < MIN_PFLOG_HDRLEN) {
112		printf("[pflog: invalid header length!]");
113		return (hdr->length);	/* XXX: not really */
114	}
115	hdrlen = BPF_WORDALIGN(hdr->length);
116
117	if (caplen < hdrlen) {
118		printf("[|pflog]");
119		return (hdrlen);	/* XXX: true? */
120	}
121
122	/* print what we know */
123	hdr = (struct pfloghdr *)p;
124	TCHECK(*hdr);
125	if (eflag)
126		pflog_print(hdr);
127
128	/* skip to the real packet */
129	af = hdr->af;
130	length -= hdrlen;
131	caplen -= hdrlen;
132	p += hdrlen;
133	switch (af) {
134
135		case AF_INET:
136#if OPENBSD_AF_INET != AF_INET
137		case OPENBSD_AF_INET:		/* XXX: read pcap files */
138#endif
139		        ip_print(gndo, p, length);
140			break;
141
142#ifdef INET6
143		case AF_INET6:
144#if OPENBSD_AF_INET6 != AF_INET6
145		case OPENBSD_AF_INET6:		/* XXX: read pcap files */
146#endif
147			ip6_print(p, length);
148			break;
149#endif
150
151	default:
152		/* address family not handled, print raw packet */
153		if (!eflag)
154			pflog_print(hdr);
155		if (!xflag && !qflag)
156			default_print(p, caplen);
157	}
158
159	return (hdrlen);
160trunc:
161	printf("[|pflog]");
162	return (hdrlen);
163}
164
165/*
166 * Local Variables:
167 * c-style: whitesmith
168 * c-basic-offset: 8
169 * End:
170 */
171