1 /* 2 * Copyright (C) 1993-2001 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com) 7 * 8 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 9 * Use is subject to license terms. 10 */ 11 12 #pragma ident "%Z%%M% %I% %E% SMI" 13 14 #include "ipf.h" 15 #include "kmem.h" 16 17 18 #if !defined(lint) 19 static const char rcsid[] = "@(#)$Id: printnat.c,v 1.22.2.9 2005/06/12 07:18:43 darrenr Exp $"; 20 #endif 21 22 /* 23 * Print out a NAT rule 24 */ 25 void printnat(np, opts) 26 ipnat_t *np; 27 int opts; 28 { 29 struct protoent *pr; 30 int bits; 31 32 pr = getprotobynumber(np->in_p); 33 34 switch (np->in_redir) 35 { 36 case NAT_REDIRECT : 37 printf("rdr"); 38 break; 39 case NAT_MAP : 40 printf("map"); 41 break; 42 case NAT_MAPBLK : 43 printf("map-block"); 44 break; 45 case NAT_BIMAP : 46 printf("bimap"); 47 break; 48 default : 49 fprintf(stderr, "unknown value for in_redir: %#x\n", 50 np->in_redir); 51 break; 52 } 53 54 printf(" %s", np->in_ifnames[0]); 55 if ((np->in_ifnames[1][0] != '\0') && 56 (strncmp(np->in_ifnames[0], np->in_ifnames[1], LIFNAMSIZ) != 0)) { 57 printf(",%s ", np->in_ifnames[1]); 58 } 59 putchar(' '); 60 61 if (np->in_flags & IPN_FILTER) { 62 if (np->in_flags & IPN_NOTSRC) 63 printf("! "); 64 printf("from "); 65 if (np->in_redir == NAT_REDIRECT) { 66 printhostmask(4, (u_32_t *)&np->in_srcip, 67 (u_32_t *)&np->in_srcmsk); 68 } else { 69 printhostmask(4, (u_32_t *)&np->in_inip, 70 (u_32_t *)&np->in_inmsk); 71 } 72 if (np->in_scmp) 73 printportcmp(np->in_p, &np->in_tuc.ftu_src); 74 75 if (np->in_flags & IPN_NOTDST) 76 printf(" !"); 77 printf(" to "); 78 if (np->in_redir == NAT_REDIRECT) { 79 printhostmask(4, (u_32_t *)&np->in_outip, 80 (u_32_t *)&np->in_outmsk); 81 } else { 82 printhostmask(4, (u_32_t *)&np->in_srcip, 83 (u_32_t *)&np->in_srcmsk); 84 } 85 if (np->in_dcmp) 86 printportcmp(np->in_p, &np->in_tuc.ftu_dst); 87 } 88 89 if (np->in_redir == NAT_REDIRECT) { 90 if (!(np->in_flags & IPN_FILTER)) { 91 printf("%s", inet_ntoa(np->in_out[0].in4)); 92 bits = count4bits(np->in_outmsk); 93 if (bits != -1) 94 printf("/%d", bits); 95 else 96 printf("/%s", inet_ntoa(np->in_out[1].in4)); 97 if (np->in_flags & IPN_TCPUDP) { 98 printf(" port %d", ntohs(np->in_pmin)); 99 if (np->in_pmax != np->in_pmin) 100 printf("-%d", ntohs(np->in_pmax)); 101 } 102 } 103 printf(" -> %s", inet_ntoa(np->in_in[0].in4)); 104 if (np->in_flags & IPN_SPLIT) 105 printf(",%s", inet_ntoa(np->in_in[1].in4)); 106 if (np->in_flags & IPN_TCPUDP) { 107 if ((np->in_flags & IPN_FIXEDDPORT) != 0) 108 printf(" port = %d", ntohs(np->in_pnext)); 109 else 110 printf(" port %d", ntohs(np->in_pnext)); 111 } 112 putchar(' '); 113 printproto(pr, np->in_p, np); 114 if (np->in_flags & IPN_ROUNDR) 115 printf(" round-robin"); 116 if (np->in_flags & IPN_FRAG) 117 printf(" frag"); 118 if (np->in_age[0] != 0 || np->in_age[1] != 0) { 119 printf(" age %d/%d", np->in_age[0], np->in_age[1]); 120 } 121 if (np->in_flags & IPN_STICKY) 122 printf(" sticky"); 123 if (np->in_mssclamp != 0) 124 printf(" mssclamp %d", np->in_mssclamp); 125 if (*np->in_plabel != '\0') 126 printf(" proxy %.*s", (int)sizeof(np->in_plabel), 127 np->in_plabel); 128 if (np->in_tag.ipt_tag[0] != '\0') 129 printf(" tag %-.*s", IPFTAG_LEN, np->in_tag.ipt_tag); 130 printf("\n"); 131 if (opts & OPT_DEBUG) 132 printf("\tpmax %u\n", np->in_pmax); 133 } else { 134 if (!(np->in_flags & IPN_FILTER)) { 135 printf("%s/", inet_ntoa(np->in_in[0].in4)); 136 bits = count4bits(np->in_inmsk); 137 if (bits != -1) 138 printf("%d", bits); 139 else 140 printf("%s", inet_ntoa(np->in_in[1].in4)); 141 } 142 printf(" -> "); 143 if (np->in_flags & IPN_IPRANGE) { 144 printf("range %s-", inet_ntoa(np->in_out[0].in4)); 145 printf("%s", inet_ntoa(np->in_out[1].in4)); 146 } else { 147 printf("%s/", inet_ntoa(np->in_out[0].in4)); 148 bits = count4bits(np->in_outmsk); 149 if (bits != -1) 150 printf("%d", bits); 151 else 152 printf("%s", inet_ntoa(np->in_out[1].in4)); 153 } 154 if (*np->in_plabel != '\0') { 155 printf(" proxy port "); 156 if (np->in_dcmp != 0) 157 np->in_dport = htons(np->in_dport); 158 if (np->in_dport != 0) { 159 char *s; 160 161 s = portname(np->in_p, ntohs(np->in_dport)); 162 if (s != NULL) 163 fputs(s, stdout); 164 else 165 fputs("???", stdout); 166 } 167 printf(" %.*s/", (int)sizeof(np->in_plabel), 168 np->in_plabel); 169 printproto(pr, np->in_p, NULL); 170 } else if (np->in_redir == NAT_MAPBLK) { 171 if ((np->in_pmin == 0) && 172 (np->in_flags & IPN_AUTOPORTMAP)) 173 printf(" ports auto"); 174 else 175 printf(" ports %d", np->in_pmin); 176 if (opts & OPT_DEBUG) 177 printf("\n\tip modulous %d", np->in_pmax); 178 } else if (np->in_pmin || np->in_pmax) { 179 if (np->in_flags & IPN_ICMPQUERY) { 180 printf(" icmpidmap "); 181 } else { 182 printf(" portmap "); 183 } 184 printproto(pr, np->in_p, np); 185 if (np->in_flags & IPN_AUTOPORTMAP) { 186 printf(" auto"); 187 if (opts & OPT_DEBUG) 188 printf(" [%d:%d %d %d]", 189 ntohs(np->in_pmin), 190 ntohs(np->in_pmax), 191 np->in_ippip, np->in_ppip); 192 } else { 193 printf(" %d:%d", ntohs(np->in_pmin), 194 ntohs(np->in_pmax)); 195 } 196 } else if (np->in_flags & IPN_TCPUDP || np->in_p) { 197 putchar(' '); 198 printproto(pr, np->in_p, np); 199 } 200 201 if (np->in_flags & IPN_FRAG) 202 printf(" frag"); 203 if (np->in_age[0] != 0 || np->in_age[1] != 0) { 204 printf(" age %d/%d", np->in_age[0], np->in_age[1]); 205 } 206 if (np->in_mssclamp != 0) 207 printf(" mssclamp %d", np->in_mssclamp); 208 if (np->in_tag.ipt_tag[0] != '\0') 209 printf(" tag %s", np->in_tag.ipt_tag); 210 printf("\n"); 211 if (opts & OPT_DEBUG) { 212 struct in_addr nip; 213 214 nip.s_addr = htonl(np->in_nextip.s_addr); 215 216 printf("\tnextip %s pnext %d\n", 217 inet_ntoa(nip), np->in_pnext); 218 } 219 } 220 221 if (opts & OPT_DEBUG) { 222 printf("\tspace %lu use %u hits %lu flags %#x proto %d hv %d\n", 223 np->in_space, np->in_use, np->in_hits, 224 np->in_flags, np->in_p, np->in_hv); 225 printf("\tifp[0] %p ifp[1] %p apr %p\n", 226 np->in_ifps[0], np->in_ifps[1], np->in_apr); 227 printf("\ttqehead %p/%p comment %p\n", 228 np->in_tqehead[0], np->in_tqehead[1], np->in_comment); 229 } 230 } 231