141c99275SPeter Avalos /*
241c99275SPeter Avalos * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
341c99275SPeter Avalos * The Regents of the University of California. All rights reserved.
441c99275SPeter Avalos *
541c99275SPeter Avalos * Redistribution and use in source and binary forms, with or without
641c99275SPeter Avalos * modification, are permitted provided that: (1) source code distributions
741c99275SPeter Avalos * retain the above copyright notice and this paragraph in its entirety, (2)
841c99275SPeter Avalos * distributions including binary code include the above copyright notice and
941c99275SPeter Avalos * this paragraph in its entirety in the documentation or other materials
1041c99275SPeter Avalos * provided with the distribution, and (3) all advertising materials mentioning
1141c99275SPeter Avalos * features or use of this software display the following acknowledgement:
1241c99275SPeter Avalos * ``This product includes software developed by the University of California,
1341c99275SPeter Avalos * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
1441c99275SPeter Avalos * the University nor the names of its contributors may be used to endorse
1541c99275SPeter Avalos * or promote products derived from this software without specific prior
1641c99275SPeter Avalos * written permission.
1741c99275SPeter Avalos * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
1841c99275SPeter Avalos * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
1941c99275SPeter Avalos * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
2041c99275SPeter Avalos */
2141c99275SPeter Avalos
22411677aeSAaron LI /* \summary: OpenBSD packet filter log file printer */
2341c99275SPeter Avalos
2441c99275SPeter Avalos #ifdef HAVE_CONFIG_H
25*ed775ee7SAntonio Huete Jimenez #include <config.h>
2641c99275SPeter Avalos #endif
2741c99275SPeter Avalos
2841c99275SPeter Avalos #ifndef HAVE_NET_PFVAR_H
2941c99275SPeter Avalos #error "No pf headers available"
3041c99275SPeter Avalos #endif
3141c99275SPeter Avalos #include <sys/types.h>
3241c99275SPeter Avalos #include <sys/socket.h>
3341c99275SPeter Avalos #include <net/if.h>
3441c99275SPeter Avalos #include <net/pf/pfvar.h>
3541c99275SPeter Avalos #include <net/pf/if_pflog.h>
3641c99275SPeter Avalos
37*ed775ee7SAntonio Huete Jimenez #include "netdissect-stdinc.h"
3841c99275SPeter Avalos
39411677aeSAaron LI #include "netdissect.h"
4027bfbee1SPeter Avalos #include "extract.h"
4141c99275SPeter Avalos
42411677aeSAaron LI
43411677aeSAaron LI static const struct tok pf_reasons[] = {
4441c99275SPeter Avalos { 0, "0(match)" },
4541c99275SPeter Avalos { 1, "1(bad-offset)" },
4641c99275SPeter Avalos { 2, "2(fragment)" },
4741c99275SPeter Avalos { 3, "3(short)" },
4841c99275SPeter Avalos { 4, "4(normalize)" },
4941c99275SPeter Avalos { 5, "5(memory)" },
5041c99275SPeter Avalos { 6, "6(bad-timestamp)" },
5141c99275SPeter Avalos { 7, "7(congestion)" },
5241c99275SPeter Avalos { 8, "8(ip-option)" },
5341c99275SPeter Avalos { 9, "9(proto-cksum)" },
5441c99275SPeter Avalos { 10, "10(state-mismatch)" },
5541c99275SPeter Avalos { 11, "11(state-insert)" },
5641c99275SPeter Avalos { 12, "12(state-limit)" },
5741c99275SPeter Avalos { 13, "13(src-limit)" },
5841c99275SPeter Avalos { 14, "14(synproxy)" },
5941c99275SPeter Avalos { 0, NULL }
6041c99275SPeter Avalos };
6141c99275SPeter Avalos
62411677aeSAaron LI static const struct tok pf_actions[] = {
6341c99275SPeter Avalos { PF_PASS, "pass" },
6441c99275SPeter Avalos { PF_DROP, "block" },
6541c99275SPeter Avalos { PF_SCRUB, "scrub" },
6641c99275SPeter Avalos { PF_NAT, "nat" },
6741c99275SPeter Avalos { PF_NONAT, "nat" },
6841c99275SPeter Avalos { PF_BINAT, "binat" },
6941c99275SPeter Avalos { PF_NOBINAT, "binat" },
7041c99275SPeter Avalos { PF_RDR, "rdr" },
7141c99275SPeter Avalos { PF_NORDR, "rdr" },
7241c99275SPeter Avalos { PF_SYNPROXY_DROP, "synproxy-drop" },
7341c99275SPeter Avalos { 0, NULL }
7441c99275SPeter Avalos };
7541c99275SPeter Avalos
76411677aeSAaron LI static const struct tok pf_directions[] = {
7741c99275SPeter Avalos { PF_INOUT, "in/out" },
7841c99275SPeter Avalos { PF_IN, "in" },
7941c99275SPeter Avalos { PF_OUT, "out" },
8041c99275SPeter Avalos { 0, NULL }
8141c99275SPeter Avalos };
8241c99275SPeter Avalos
8341c99275SPeter Avalos /* For reading capture files on other systems */
8441c99275SPeter Avalos #define OPENBSD_AF_INET 2
8541c99275SPeter Avalos #define OPENBSD_AF_INET6 24
8641c99275SPeter Avalos
8741c99275SPeter Avalos static void
pflog_print(netdissect_options * ndo,const struct pfloghdr * hdr)88411677aeSAaron LI pflog_print(netdissect_options *ndo, const struct pfloghdr *hdr)
8941c99275SPeter Avalos {
90411677aeSAaron LI uint32_t rulenr, subrulenr;
9141c99275SPeter Avalos
92*ed775ee7SAntonio Huete Jimenez ndo->ndo_protocol = "pflog";
93*ed775ee7SAntonio Huete Jimenez rulenr = GET_BE_U_4(&hdr->rulenr);
94*ed775ee7SAntonio Huete Jimenez subrulenr = GET_BE_U_4(&hdr->subrulenr);
95411677aeSAaron LI if (subrulenr == (uint32_t)-1)
96*ed775ee7SAntonio Huete Jimenez ND_PRINT("rule %u/", rulenr);
97*ed775ee7SAntonio Huete Jimenez else {
98*ed775ee7SAntonio Huete Jimenez ND_PRINT("rule %u.", rulenr);
99*ed775ee7SAntonio Huete Jimenez nd_printjnp(ndo, (const u_char*)hdr->ruleset, PFLOG_RULESET_NAME_SIZE);
100*ed775ee7SAntonio Huete Jimenez ND_PRINT(".%u/", subrulenr);
10141c99275SPeter Avalos }
10241c99275SPeter Avalos
103*ed775ee7SAntonio Huete Jimenez ND_PRINT("%s: %s %s on ",
104*ed775ee7SAntonio Huete Jimenez tok2str(pf_reasons, "unkn(%u)", GET_U_1(&hdr->reason)),
105*ed775ee7SAntonio Huete Jimenez tok2str(pf_actions, "unkn(%u)", GET_U_1(&hdr->action)),
106*ed775ee7SAntonio Huete Jimenez tok2str(pf_directions, "unkn(%u)", GET_U_1(&hdr->dir)));
107*ed775ee7SAntonio Huete Jimenez nd_printjnp(ndo, (const u_char*)hdr->ifname, IFNAMSIZ);
108*ed775ee7SAntonio Huete Jimenez ND_PRINT(": ");
109*ed775ee7SAntonio Huete Jimenez }
110*ed775ee7SAntonio Huete Jimenez
111*ed775ee7SAntonio Huete Jimenez void
pflog_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)112411677aeSAaron LI pflog_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
113*ed775ee7SAntonio Huete Jimenez const u_char *p)
11441c99275SPeter Avalos {
11541c99275SPeter Avalos u_int length = h->len;
11641c99275SPeter Avalos u_int hdrlen;
11741c99275SPeter Avalos u_int caplen = h->caplen;
11841c99275SPeter Avalos const struct pfloghdr *hdr;
119411677aeSAaron LI uint8_t af;
12041c99275SPeter Avalos
121*ed775ee7SAntonio Huete Jimenez ndo->ndo_protocol = "pflog";
12241c99275SPeter Avalos /* check length */
123411677aeSAaron LI if (caplen < sizeof(uint8_t)) {
124*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
125*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += h->caplen;
126*ed775ee7SAntonio Huete Jimenez return;
12741c99275SPeter Avalos }
12841c99275SPeter Avalos
12941c99275SPeter Avalos #define MIN_PFLOG_HDRLEN 45
130411677aeSAaron LI hdr = (const struct pfloghdr *)p;
131*ed775ee7SAntonio Huete Jimenez if (GET_U_1(&hdr->length) < MIN_PFLOG_HDRLEN) {
132*ed775ee7SAntonio Huete Jimenez ND_PRINT("[pflog: invalid header length!]");
133*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += GET_U_1(&hdr->length); /* XXX: not really */
134*ed775ee7SAntonio Huete Jimenez return;
13541c99275SPeter Avalos }
13641c99275SPeter Avalos hdrlen = BPF_WORDALIGN(hdr->length);
13741c99275SPeter Avalos
13841c99275SPeter Avalos if (caplen < hdrlen) {
139*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
140*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += hdrlen; /* XXX: true? */
141*ed775ee7SAntonio Huete Jimenez return;
14241c99275SPeter Avalos }
14341c99275SPeter Avalos
14441c99275SPeter Avalos /* print what we know */
145*ed775ee7SAntonio Huete Jimenez ND_TCHECK_SIZE(hdr);
146411677aeSAaron LI if (ndo->ndo_eflag)
147411677aeSAaron LI pflog_print(ndo, hdr);
14841c99275SPeter Avalos
14941c99275SPeter Avalos /* skip to the real packet */
150*ed775ee7SAntonio Huete Jimenez af = GET_U_1(&hdr->af);
15141c99275SPeter Avalos length -= hdrlen;
15241c99275SPeter Avalos caplen -= hdrlen;
15341c99275SPeter Avalos p += hdrlen;
15441c99275SPeter Avalos switch (af) {
15541c99275SPeter Avalos
15641c99275SPeter Avalos case AF_INET:
15741c99275SPeter Avalos #if OPENBSD_AF_INET != AF_INET
15841c99275SPeter Avalos case OPENBSD_AF_INET: /* XXX: read pcap files */
15941c99275SPeter Avalos #endif
160411677aeSAaron LI ip_print(ndo, p, length);
16141c99275SPeter Avalos break;
16241c99275SPeter Avalos
163411677aeSAaron LI #if defined(AF_INET6) || defined(OPENBSD_AF_INET6)
164411677aeSAaron LI #ifdef AF_INET6
16541c99275SPeter Avalos case AF_INET6:
166411677aeSAaron LI #endif /* AF_INET6 */
167411677aeSAaron LI #if !defined(AF_INET6) || OPENBSD_AF_INET6 != AF_INET6
16841c99275SPeter Avalos case OPENBSD_AF_INET6: /* XXX: read pcap files */
169411677aeSAaron LI #endif /* !defined(AF_INET6) || OPENBSD_AF_INET6 != AF_INET6 */
170411677aeSAaron LI ip6_print(ndo, p, length);
17141c99275SPeter Avalos break;
172411677aeSAaron LI #endif /* defined(AF_INET6) || defined(OPENBSD_AF_INET6) */
17341c99275SPeter Avalos
17441c99275SPeter Avalos default:
17541c99275SPeter Avalos /* address family not handled, print raw packet */
176411677aeSAaron LI if (!ndo->ndo_eflag)
177411677aeSAaron LI pflog_print(ndo, hdr);
178411677aeSAaron LI if (!ndo->ndo_suppress_default_print)
179411677aeSAaron LI ND_DEFAULTPRINT(p, caplen);
18041c99275SPeter Avalos }
18141c99275SPeter Avalos
182*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += hdrlen;
183*ed775ee7SAntonio Huete Jimenez return;
18441c99275SPeter Avalos trunc:
185*ed775ee7SAntonio Huete Jimenez nd_print_trunc(ndo);
186*ed775ee7SAntonio Huete Jimenez ndo->ndo_ll_hdr_len += hdrlen;
18741c99275SPeter Avalos }
188