xref: /freebsd/sbin/pfctl/pf_print_state.c (revision c7d813a93eeb447470734c9bc0c140d90a54c271) 
1 /*	$OpenBSD: pf_print_state.c,v 1.52 2008/08/12 16:40:18 david Exp $	*/
2 
3 /*
4  * Copyright (c) 2001 Daniel Hartmeier
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <sys/types.h>
37 #include <sys/socket.h>
38 #include <sys/endian.h>
39 #include <net/if.h>
40 #define TCPSTATES
41 #include <netinet/tcp_fsm.h>
42 #include <net/pfvar.h>
43 #include <arpa/inet.h>
44 #include <netdb.h>
45 
46 #include <stdint.h>
47 #include <stdio.h>
48 #include <string.h>
49 
50 #include "pfctl_parser.h"
51 #include "pfctl.h"
52 
53 void	print_name(struct pf_addr *, sa_family_t);
54 
55 void
56 print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
57 {
58 	switch (addr->type) {
59 	case PF_ADDR_DYNIFTL:
60 		printf("(%s", addr->v.ifname);
61 		if (addr->iflags & PFI_AFLAG_NETWORK)
62 			printf(":network");
63 		if (addr->iflags & PFI_AFLAG_BROADCAST)
64 			printf(":broadcast");
65 		if (addr->iflags & PFI_AFLAG_PEER)
66 			printf(":peer");
67 		if (addr->iflags & PFI_AFLAG_NOALIAS)
68 			printf(":0");
69 		if (verbose) {
70 			if (addr->p.dyncnt <= 0)
71 				printf(":*");
72 			else
73 				printf(":%d", addr->p.dyncnt);
74 		}
75 		printf(")");
76 		break;
77 	case PF_ADDR_TABLE:
78 		if (verbose)
79 			if (addr->p.tblcnt == -1)
80 				printf("<%s:*>", addr->v.tblname);
81 			else
82 				printf("<%s:%d>", addr->v.tblname,
83 				    addr->p.tblcnt);
84 		else
85 			printf("<%s>", addr->v.tblname);
86 		return;
87 	case PF_ADDR_RANGE: {
88 		char buf[48];
89 
90 		if (inet_ntop(af, &addr->v.a.addr, buf, sizeof(buf)) == NULL)
91 			printf("?");
92 		else
93 			printf("%s", buf);
94 		if (inet_ntop(af, &addr->v.a.mask, buf, sizeof(buf)) == NULL)
95 			printf(" - ?");
96 		else
97 			printf(" - %s", buf);
98 		break;
99 	}
100 	case PF_ADDR_ADDRMASK:
101 		if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
102 		    PF_AZERO(&addr->v.a.mask, AF_INET6))
103 			printf("any");
104 		else {
105 			char buf[48];
106 
107 			if (inet_ntop(af, &addr->v.a.addr, buf,
108 			    sizeof(buf)) == NULL)
109 				printf("?");
110 			else
111 				printf("%s", buf);
112 		}
113 		break;
114 	case PF_ADDR_NOROUTE:
115 		printf("no-route");
116 		return;
117 	case PF_ADDR_URPFFAILED:
118 		printf("urpf-failed");
119 		return;
120 	default:
121 		printf("?");
122 		return;
123 	}
124 
125 	/* mask if not _both_ address and mask are zero */
126 	if (addr->type != PF_ADDR_RANGE &&
127 	    !(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
128 	    PF_AZERO(&addr->v.a.mask, AF_INET6))) {
129 		int bits = unmask(&addr->v.a.mask, af);
130 
131 		if (bits != (af == AF_INET ? 32 : 128))
132 			printf("/%d", bits);
133 	}
134 }
135 
136 void
137 print_name(struct pf_addr *addr, sa_family_t af)
138 {
139 	char host[NI_MAXHOST];
140 
141 	strlcpy(host, "?", sizeof(host));
142 	switch (af) {
143 	case AF_INET: {
144 		struct sockaddr_in sin;
145 
146 		memset(&sin, 0, sizeof(sin));
147 		sin.sin_len = sizeof(sin);
148 		sin.sin_family = AF_INET;
149 		sin.sin_addr = addr->v4;
150 		getnameinfo((struct sockaddr *)&sin, sin.sin_len,
151 		    host, sizeof(host), NULL, 0, NI_NOFQDN);
152 		break;
153 	}
154 	case AF_INET6: {
155 		struct sockaddr_in6 sin6;
156 
157 		memset(&sin6, 0, sizeof(sin6));
158 		sin6.sin6_len = sizeof(sin6);
159 		sin6.sin6_family = AF_INET6;
160 		sin6.sin6_addr = addr->v6;
161 		getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
162 		    host, sizeof(host), NULL, 0, NI_NOFQDN);
163 		break;
164 	}
165 	}
166 	printf("%s", host);
167 }
168 
169 void
170 print_host(struct pf_addr *addr, u_int16_t port, sa_family_t af, int opts)
171 {
172 	if (opts & PF_OPT_USEDNS)
173 		print_name(addr, af);
174 	else {
175 		struct pf_addr_wrap aw;
176 
177 		memset(&aw, 0, sizeof(aw));
178 		aw.v.a.addr = *addr;
179 		if (af == AF_INET)
180 			aw.v.a.mask.addr32[0] = 0xffffffff;
181 		else {
182 			memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
183 			af = AF_INET6;
184 		}
185 		print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
186 	}
187 
188 	if (port) {
189 		if (af == AF_INET)
190 			printf(":%u", ntohs(port));
191 		else
192 			printf("[%u]", ntohs(port));
193 	}
194 }
195 
196 void
197 print_seq(struct pfsync_state_peer *p)
198 {
199 	if (p->seqdiff)
200 		printf("[%u + %u](+%u)", ntohl(p->seqlo),
201 		    ntohl(p->seqhi) - ntohl(p->seqlo), ntohl(p->seqdiff));
202 	else
203 		printf("[%u + %u]", ntohl(p->seqlo),
204 		    ntohl(p->seqhi) - ntohl(p->seqlo));
205 }
206 
207 void
208 print_state(struct pfsync_state *s, int opts)
209 {
210 	struct pfsync_state_peer *src, *dst;
211 	struct pfsync_state_key *key, *sk, *nk;
212 	struct protoent *p;
213 	int min, sec;
214 #ifndef __NO_STRICT_ALIGNMENT
215 	struct pfsync_state_key aligned_key[2];
216 
217 	bcopy(&s->key, aligned_key, sizeof(aligned_key));
218 	key = aligned_key;
219 #else
220 	key = s->key;
221 #endif
222 
223 	if (s->direction == PF_OUT) {
224 		src = &s->src;
225 		dst = &s->dst;
226 		sk = &key[PF_SK_STACK];
227 		nk = &key[PF_SK_WIRE];
228 		if (s->proto == IPPROTO_ICMP || s->proto == IPPROTO_ICMPV6)
229 			sk->port[0] = nk->port[0];
230 	} else {
231 		src = &s->dst;
232 		dst = &s->src;
233 		sk = &key[PF_SK_WIRE];
234 		nk = &key[PF_SK_STACK];
235 		if (s->proto == IPPROTO_ICMP || s->proto == IPPROTO_ICMPV6)
236 			sk->port[1] = nk->port[1];
237 	}
238 	printf("%s ", s->ifname);
239 	if ((p = getprotobynumber(s->proto)) != NULL)
240 		printf("%s ", p->p_name);
241 	else
242 		printf("%u ", s->proto);
243 
244 	print_host(&nk->addr[1], nk->port[1], s->af, opts);
245 	if (PF_ANEQ(&nk->addr[1], &sk->addr[1], s->af) ||
246 	    nk->port[1] != sk->port[1]) {
247 		printf(" (");
248 		print_host(&sk->addr[1], sk->port[1], s->af, opts);
249 		printf(")");
250 	}
251 	if (s->direction == PF_OUT)
252 		printf(" -> ");
253 	else
254 		printf(" <- ");
255 	print_host(&nk->addr[0], nk->port[0], s->af, opts);
256 	if (PF_ANEQ(&nk->addr[0], &sk->addr[0], s->af) ||
257 	    nk->port[0] != sk->port[0]) {
258 		printf(" (");
259 		print_host(&sk->addr[0], sk->port[0], s->af, opts);
260 		printf(")");
261 	}
262 
263 	printf("    ");
264 	if (s->proto == IPPROTO_TCP) {
265 		if (src->state <= TCPS_TIME_WAIT &&
266 		    dst->state <= TCPS_TIME_WAIT)
267 			printf("   %s:%s\n", tcpstates[src->state],
268 			    tcpstates[dst->state]);
269 		else if (src->state == PF_TCPS_PROXY_SRC ||
270 		    dst->state == PF_TCPS_PROXY_SRC)
271 			printf("   PROXY:SRC\n");
272 		else if (src->state == PF_TCPS_PROXY_DST ||
273 		    dst->state == PF_TCPS_PROXY_DST)
274 			printf("   PROXY:DST\n");
275 		else
276 			printf("   <BAD STATE LEVELS %u:%u>\n",
277 			    src->state, dst->state);
278 		if (opts & PF_OPT_VERBOSE) {
279 			printf("   ");
280 			print_seq(src);
281 			if (src->wscale && dst->wscale)
282 				printf(" wscale %u",
283 				    src->wscale & PF_WSCALE_MASK);
284 			printf("  ");
285 			print_seq(dst);
286 			if (src->wscale && dst->wscale)
287 				printf(" wscale %u",
288 				    dst->wscale & PF_WSCALE_MASK);
289 			printf("\n");
290 		}
291 	} else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
292 	    dst->state < PFUDPS_NSTATES) {
293 		const char *states[] = PFUDPS_NAMES;
294 
295 		printf("   %s:%s\n", states[src->state], states[dst->state]);
296 #ifndef INET6
297 	} else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
298 	    dst->state < PFOTHERS_NSTATES) {
299 #else
300 	} else if (s->proto != IPPROTO_ICMP && s->proto != IPPROTO_ICMPV6 &&
301 	    src->state < PFOTHERS_NSTATES && dst->state < PFOTHERS_NSTATES) {
302 #endif
303 		/* XXX ICMP doesn't really have state levels */
304 		const char *states[] = PFOTHERS_NAMES;
305 
306 		printf("   %s:%s\n", states[src->state], states[dst->state]);
307 	} else {
308 		printf("   %u:%u\n", src->state, dst->state);
309 	}
310 
311 	if (opts & PF_OPT_VERBOSE) {
312 		u_int64_t packets[2];
313 		u_int64_t bytes[2];
314 		u_int32_t creation = ntohl(s->creation);
315 		u_int32_t expire = ntohl(s->expire);
316 
317 		sec = creation % 60;
318 		creation /= 60;
319 		min = creation % 60;
320 		creation /= 60;
321 		printf("   age %.2u:%.2u:%.2u", creation, min, sec);
322 		sec = expire % 60;
323 		expire /= 60;
324 		min = expire % 60;
325 		expire /= 60;
326 		printf(", expires in %.2u:%.2u:%.2u", expire, min, sec);
327 
328 		bcopy(s->packets[0], &packets[0], sizeof(u_int64_t));
329 		bcopy(s->packets[1], &packets[1], sizeof(u_int64_t));
330 		bcopy(s->bytes[0], &bytes[0], sizeof(u_int64_t));
331 		bcopy(s->bytes[1], &bytes[1], sizeof(u_int64_t));
332 		printf(", %ju:%ju pkts, %ju:%ju bytes",
333 		    (uintmax_t )be64toh(packets[0]),
334 		    (uintmax_t )be64toh(packets[1]),
335 		    (uintmax_t )be64toh(bytes[0]),
336 		    (uintmax_t )be64toh(bytes[1]));
337 		if (ntohl(s->anchor) != -1)
338 			printf(", anchor %u", ntohl(s->anchor));
339 		if (ntohl(s->rule) != -1)
340 			printf(", rule %u", ntohl(s->rule));
341 		if (s->state_flags & PFSTATE_SLOPPY)
342 			printf(", sloppy");
343 		if (s->sync_flags & PFSYNC_FLAG_SRCNODE)
344 			printf(", source-track");
345 		if (s->sync_flags & PFSYNC_FLAG_NATSRCNODE)
346 			printf(", sticky-address");
347 		printf("\n");
348 	}
349 	if (opts & PF_OPT_VERBOSE2) {
350 		u_int64_t id;
351 
352 		bcopy(&s->id, &id, sizeof(u_int64_t));
353 		printf("   id: %016jx creatorid: %08x",
354 		    (uintmax_t )be64toh(id), ntohl(s->creatorid));
355 		printf("\n");
356 	}
357 }
358 
359 int
360 unmask(struct pf_addr *m, sa_family_t af)
361 {
362 	int i = 31, j = 0, b = 0;
363 	u_int32_t tmp;
364 
365 	while (j < 4 && m->addr32[j] == 0xffffffff) {
366 		b += 32;
367 		j++;
368 	}
369 	if (j < 4) {
370 		tmp = ntohl(m->addr32[j]);
371 		for (i = 31; tmp & (1 << i); --i)
372 			b++;
373 	}
374 	return (b);
375 }
376