1 /* 2 * Copyright (C) 1993-2001 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) 7 * 8 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 9 * Use is subject to license terms. 10 */ 11 12 #pragma ident "%Z%%M% %I% %E% SMI" 13 14 #include "ipf.h" 15 #include "kmem.h" 16 17 18 #if !defined(lint) 19 static const char rcsid[] = "@(#)$Id: printnat.c,v 1.22.2.9 2005/06/12 07:18:43 darrenr Exp $"; 20 #endif 21 22 /* 23 * Print out a NAT rule 24 */ 25 void printnat(np, opts) 26 ipnat_t *np; 27 int opts; 28 { 29 struct protoent *pr; 30 int bits; 31 32 pr = getprotobynumber(np->in_p); 33 34 switch (np->in_redir) 35 { 36 case NAT_REDIRECT : 37 printf("rdr"); 38 break; 39 case NAT_MAP : 40 printf("map"); 41 break; 42 case NAT_MAPBLK : 43 printf("map-block"); 44 break; 45 case NAT_BIMAP : 46 printf("bimap"); 47 break; 48 default : 49 fprintf(stderr, "unknown value for in_redir: %#x\n", 50 np->in_redir); 51 break; 52 } 53 54 printf(" %s", np->in_ifnames[0]); 55 if ((np->in_ifnames[1][0] != '\0') && 56 (strncmp(np->in_ifnames[0], np->in_ifnames[1], LIFNAMSIZ) != 0)) { 57 printf(",%s ", np->in_ifnames[1]); 58 } 59 putchar(' '); 60 61 if (np->in_flags & IPN_FILTER) { 62 if (np->in_flags & IPN_NOTSRC) 63 printf("! "); 64 printf("from "); 65 if (np->in_redir == NAT_REDIRECT) { 66 printhostmask(4, (u_32_t *)&np->in_srcip, 67 (u_32_t *)&np->in_srcmsk); 68 } else { 69 printhostmask(4, (u_32_t *)&np->in_inip, 70 (u_32_t *)&np->in_inmsk); 71 } 72 if (np->in_scmp) 73 printportcmp(np->in_p, &np->in_tuc.ftu_src); 74 75 if (np->in_flags & IPN_NOTDST) 76 printf(" !"); 77 printf(" to "); 78 if (np->in_redir == NAT_REDIRECT) { 79 printhostmask(4, (u_32_t *)&np->in_outip, 80 (u_32_t *)&np->in_outmsk); 81 } else { 82 printhostmask(4, (u_32_t *)&np->in_srcip, 83 (u_32_t *)&np->in_srcmsk); 84 } 85 if (np->in_dcmp) 86 printportcmp(np->in_p, &np->in_tuc.ftu_dst); 87 } 88 89 if (np->in_redir == NAT_REDIRECT) { 90 if (!(np->in_flags & IPN_FILTER)) { 91 printf("%s", inet_ntoa(np->in_out[0].in4)); 92 bits = count4bits(np->in_outmsk); 93 if (bits != -1) 94 printf("/%d", bits); 95 else 96 printf("/%s", inet_ntoa(np->in_out[1].in4)); 97 if (np->in_flags & IPN_TCPUDP) { 98 printf(" port %d", ntohs(np->in_pmin)); 99 if (np->in_pmax != np->in_pmin) 100 printf("-%d", ntohs(np->in_pmax)); 101 } 102 } 103 printf(" -> %s", inet_ntoa(np->in_in[0].in4)); 104 if (np->in_flags & IPN_SPLIT) 105 printf(",%s", inet_ntoa(np->in_in[1].in4)); 106 if (np->in_inip == 0) { 107 bits = count4bits(np->in_inmsk); 108 printf("/%d", bits); 109 } 110 if (np->in_flags & IPN_TCPUDP) { 111 if ((np->in_flags & IPN_FIXEDDPORT) != 0) 112 printf(" port = %d", ntohs(np->in_pnext)); 113 else 114 printf(" port %d", ntohs(np->in_pnext)); 115 } 116 putchar(' '); 117 printproto(pr, np->in_p, np); 118 if (np->in_flags & IPN_ROUNDR) 119 printf(" round-robin"); 120 if (np->in_flags & IPN_FRAG) 121 printf(" frag"); 122 if (np->in_age[0] != 0 || np->in_age[1] != 0) { 123 printf(" age %d/%d", np->in_age[0], np->in_age[1]); 124 } 125 if (np->in_flags & IPN_STICKY) 126 printf(" sticky"); 127 if (np->in_mssclamp != 0) 128 printf(" mssclamp %d", np->in_mssclamp); 129 if (*np->in_plabel != '\0') 130 printf(" proxy %.*s", (int)sizeof(np->in_plabel), 131 np->in_plabel); 132 if (np->in_tag.ipt_tag[0] != '\0') 133 printf(" tag %-.*s", IPFTAG_LEN, np->in_tag.ipt_tag); 134 printf("\n"); 135 if (opts & OPT_DEBUG) 136 printf("\tpmax %u\n", np->in_pmax); 137 } else { 138 if (!(np->in_flags & IPN_FILTER)) { 139 printf("%s/", inet_ntoa(np->in_in[0].in4)); 140 bits = count4bits(np->in_inmsk); 141 if (bits != -1) 142 printf("%d", bits); 143 else 144 printf("%s", inet_ntoa(np->in_in[1].in4)); 145 } 146 printf(" -> "); 147 if (np->in_flags & IPN_IPRANGE) { 148 printf("range %s-", inet_ntoa(np->in_out[0].in4)); 149 printf("%s", inet_ntoa(np->in_out[1].in4)); 150 } else { 151 printf("%s/", inet_ntoa(np->in_out[0].in4)); 152 bits = count4bits(np->in_outmsk); 153 if (bits != -1) 154 printf("%d", bits); 155 else 156 printf("%s", inet_ntoa(np->in_out[1].in4)); 157 } 158 if (*np->in_plabel != '\0') { 159 printf(" proxy port "); 160 if (np->in_dcmp != 0) 161 np->in_dport = htons(np->in_dport); 162 if (np->in_dport != 0) { 163 char *s; 164 165 s = portname(np->in_p, ntohs(np->in_dport)); 166 if (s != NULL) 167 fputs(s, stdout); 168 else 169 fputs("???", stdout); 170 } 171 printf(" %.*s/", (int)sizeof(np->in_plabel), 172 np->in_plabel); 173 printproto(pr, np->in_p, NULL); 174 } else if (np->in_redir == NAT_MAPBLK) { 175 if ((np->in_pmin == 0) && 176 (np->in_flags & IPN_AUTOPORTMAP)) 177 printf(" ports auto"); 178 else 179 printf(" ports %d", np->in_pmin); 180 if (opts & OPT_DEBUG) 181 printf("\n\tip modulous %d", np->in_pmax); 182 } else if (np->in_pmin || np->in_pmax) { 183 if (np->in_flags & IPN_ICMPQUERY) { 184 printf(" icmpidmap "); 185 } else { 186 printf(" portmap "); 187 } 188 printproto(pr, np->in_p, np); 189 if (np->in_flags & IPN_AUTOPORTMAP) { 190 printf(" auto"); 191 if (opts & OPT_DEBUG) 192 printf(" [%d:%d %d %d]", 193 ntohs(np->in_pmin), 194 ntohs(np->in_pmax), 195 np->in_ippip, np->in_ppip); 196 } else { 197 printf(" %d:%d", ntohs(np->in_pmin), 198 ntohs(np->in_pmax)); 199 } 200 } else if (np->in_flags & IPN_TCPUDP || np->in_p) { 201 putchar(' '); 202 printproto(pr, np->in_p, np); 203 } 204 205 if (np->in_flags & IPN_FRAG) 206 printf(" frag"); 207 if (np->in_age[0] != 0 || np->in_age[1] != 0) { 208 printf(" age %d/%d", np->in_age[0], np->in_age[1]); 209 } 210 if (np->in_mssclamp != 0) 211 printf(" mssclamp %d", np->in_mssclamp); 212 if (np->in_tag.ipt_tag[0] != '\0') 213 printf(" tag %s", np->in_tag.ipt_tag); 214 printf("\n"); 215 if (opts & OPT_DEBUG) { 216 struct in_addr nip; 217 218 nip.s_addr = htonl(np->in_nextip.s_addr); 219 220 printf("\tnextip %s pnext %d\n", 221 inet_ntoa(nip), np->in_pnext); 222 } 223 } 224 225 if (opts & OPT_DEBUG) { 226 printf("\tspace %lu use %u hits %lu flags %#x proto %d hv %d\n", 227 np->in_space, np->in_use, np->in_hits, 228 np->in_flags, np->in_p, np->in_hv); 229 printf("\tifp[0] %p ifp[1] %p apr %p\n", 230 np->in_ifps[0], np->in_ifps[1], np->in_apr); 231 printf("\ttqehead %p/%p comment %p\n", 232 np->in_tqehead[0], np->in_tqehead[1], np->in_comment); 233 } 234 } 235