The Tcpdump Group git mirrors - tcpdump/blob - print-pflog.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 /* \summary: *BSD/Darwin packet filter log file printer */
  23
  24 #ifdef HAVE_CONFIG_H
  25 #include <config.h>
  26 #endif
  27
  28 #include "netdissect-stdinc.h"
  29
  30 #define ND_LONGJMP_FROM_TCHECK
  31 #include "netdissect.h"
  32 #include "extract.h"
  33 #include "af.h"
  34
  35 /*
  36  * pflog headers, at least as they exist now.
  37  */
  38 #define PFLOG_IFNAMSIZ          16
  39 #define PFLOG_RULESET_NAME_SIZE 16
  40
  41 struct pf_addr {
  42         union {
  43                 nd_ipv4         v4;
  44                 nd_ipv6         v6;
  45         } pfa;              /* 128-bit address */
  46 #define v4      pfa.v4
  47 #define v6      pfa.v6
  48 };
  49
  50 struct pfloghdr {
  51         nd_uint8_t      length;
  52         nd_uint8_t      af;
  53         nd_uint8_t      action;
  54         nd_uint8_t      reason;
  55         char            ifname[PFLOG_IFNAMSIZ];
  56         char            ruleset[PFLOG_RULESET_NAME_SIZE];
  57         nd_uint32_t     rulenr;
  58         nd_uint32_t     subrulenr;
  59         nd_uint32_t     uid;
  60         nd_int32_t      pid;
  61         nd_uint32_t     rule_uid;
  62         nd_int32_t      rule_pid;
  63         nd_uint8_t      dir;
  64 /* Minimum header length (without padding): 61 */
  65 #define MIN_PFLOG_HDRLEN 61
  66 #if defined(__OpenBSD__)
  67         nd_uint8_t      rewritten;
  68         nd_uint8_t      naf;
  69         nd_uint8_t      pad[1];
  70 #else
  71         nd_uint8_t      pad[3];
  72 #endif
  73 #if defined(__FreeBSD__)
  74         nd_uint32_t     ridentifier;
  75         nd_uint8_t      reserve;
  76         nd_uint8_t      pad2[3];
  77 #elif defined(__OpenBSD__)
  78         struct pf_addr  saddr;
  79         struct pf_addr  daddr;
  80         nd_uint16_t     sport;
  81         nd_uint16_t     dport;
  82 #endif
  83 };
  84 #define MAX_PFLOG_HDRLEN 100    /* 61 + 3 + 16 + 16 + 2 + 2 */
  85
  86 /*
  87  * Reason values.
  88  */
  89 #define PFRES_MATCH     0
  90 #define PFRES_BADOFF    1
  91 #define PFRES_FRAG      2
  92 #define PFRES_SHORT     3
  93 #define PFRES_NORM      4
  94 #define PFRES_MEMORY    5
  95 #define PFRES_TS        6
  96 #define PFRES_CONGEST   7
  97 #define PFRES_IPOPTIONS 8
  98 #define PFRES_PROTCKSUM 9
  99 #define PFRES_BADSTATE  10
 100 #define PFRES_STATEINS  11
 101 #define PFRES_MAXSTATES 12
 102 #define PFRES_SRCLIMIT  13
 103 #define PFRES_SYNPROXY  14
 104 #if defined(__FreeBSD__)
 105 #define PFRES_MAPFAILED 15
 106 #elif defined(__NetBSD__)
 107 #define PFRES_STATELOCKED 15
 108 #elif defined(__OpenBSD__)
 109 #define PFRES_TRANSLATE 15
 110 #define PFRES_NOROUTE   16
 111 #elif defined(__APPLE__)
 112 #define PFRES_DUMMYNET  15
 113 #endif
 114
 115 static const struct tok pf_reasons[] = {
 116         { PFRES_MATCH,          "0(match)" },
 117         { PFRES_BADOFF,         "1(bad-offset)" },
 118         { PFRES_FRAG,           "2(fragment)" },
 119         { PFRES_SHORT,          "3(short)" },
 120         { PFRES_NORM,           "4(normalize)" },
 121         { PFRES_MEMORY,         "5(memory)" },
 122         { PFRES_TS,             "6(bad-timestamp)" },
 123         { PFRES_CONGEST,        "7(congestion)" },
 124         { PFRES_IPOPTIONS,      "8(ip-option)" },
 125         { PFRES_PROTCKSUM,      "9(proto-cksum)" },
 126         { PFRES_BADSTATE,       "10(state-mismatch)" },
 127         { PFRES_STATEINS,       "11(state-insert)" },
 128         { PFRES_MAXSTATES,      "12(state-limit)" },
 129         { PFRES_SRCLIMIT,       "13(src-limit)" },
 130         { PFRES_SYNPROXY,       "14(synproxy)" },
 131 #if defined(__FreeBSD__)
 132         { PFRES_MAPFAILED,      "15(map-failed)" },
 133 #elif defined(__NetBSD__)
 134         { PFRES_STATELOCKED,    "15(state-locked)" },
 135 #elif defined(__OpenBSD__)
 136         { PFRES_TRANSLATE,      "15(translate)" },
 137         { PFRES_NOROUTE,        "16(no-route)" },
 138 #elif defined(__APPLE__)
 139         { PFRES_DUMMYNET,       "15(dummynet)" },
 140 #endif
 141         { 0,    NULL }
 142 };
 143
 144 /*
 145  * Action values.
 146  */
 147 #define PF_PASS                 0
 148 #define PF_DROP                 1
 149 #define PF_SCRUB                2
 150 #define PF_NOSCRUB              3
 151 #define PF_NAT                  4
 152 #define PF_NONAT                5
 153 #define PF_BINAT                6
 154 #define PF_NOBINAT              7
 155 #define PF_RDR                  8
 156 #define PF_NORDR                9
 157 #define PF_SYNPROXY_DROP        10
 158 #if defined(__FreeBSD__)
 159 #define PF_DEFER                11
 160 #elif defined(__OpenBSD__)
 161 #define PF_DEFER                11
 162 #define PF_MATCH                12
 163 #define PF_DIVERT               13
 164 #define PF_RT                   14
 165 #define PF_AFRT                 15
 166 #elif defined(__APPLE__)
 167 #define PF_DUMMYNET             11
 168 #define PF_NODUMMYNET           12
 169 #define PF_NAT64                13
 170 #define PF_NONAT64              14
 171 #endif
 172
 173 static const struct tok pf_actions[] = {
 174         { PF_PASS,              "pass" },
 175         { PF_DROP,              "block" },
 176         { PF_SCRUB,             "scrub" },
 177         { PF_NAT,               "nat" },
 178         { PF_NONAT,             "nonat" },
 179         { PF_BINAT,             "binat" },
 180         { PF_NOBINAT,           "nobinat" },
 181         { PF_RDR,               "rdr" },
 182         { PF_NORDR,             "nordr" },
 183         { PF_SYNPROXY_DROP,     "synproxy-drop" },
 184 #if defined(__FreeBSD__)
 185         { PF_DEFER,             "defer" },
 186 #elif defined(__OpenBSD__)
 187         { PF_DEFER,             "defer" },
 188         { PF_MATCH,             "match" },
 189         { PF_DIVERT,            "divert" },
 190         { PF_RT,                "rt" },
 191         { PF_AFRT,              "afrt" },
 192 #elif defined(__APPLE__)
 193         { PF_DUMMYNET,          "dummynet" },
 194         { PF_NODUMMYNET,        "nodummynet" },
 195         { PF_NAT64,             "nat64" },
 196         { PF_NONAT64,           "nonat64" },
 197 #endif
 198         { 0,                    NULL }
 199 };
 200
 201 /*
 202  * Direction values.
 203  */
 204 #define PF_INOUT        0
 205 #define PF_IN           1
 206 #define PF_OUT          2
 207 #if defined(__OpenBSD__)
 208 #define PF_FWD          3
 209 #endif
 210
 211 static const struct tok pf_directions[] = {
 212         { PF_INOUT,     "in/out" },
 213         { PF_IN,        "in" },
 214         { PF_OUT,       "out" },
 215 #if defined(__OpenBSD__)
 216         { PF_FWD,       "fwd" },
 217 #endif
 218         { 0,            NULL }
 219 };
 220
 221 static void
 222 pflog_print(netdissect_options *ndo, const struct pfloghdr *hdr)
 223 {
 224         uint32_t rulenr, subrulenr;
 225
 226         ndo->ndo_protocol = "pflog";
 227         rulenr = GET_BE_U_4(hdr->rulenr);
 228         subrulenr = GET_BE_U_4(hdr->subrulenr);
 229         if (subrulenr == (uint32_t)-1)
 230                 ND_PRINT("rule %u/", rulenr);
 231         else {
 232                 ND_PRINT("rule %u.", rulenr);
 233                 nd_printjnp(ndo, (const u_char*)hdr->ruleset, PFLOG_RULESET_NAME_SIZE);
 234                 ND_PRINT(".%u/", subrulenr);
 235         }
 236
 237         ND_PRINT("%s: %s %s on ",
 238             tok2str(pf_reasons, "unkn(%u)", GET_U_1(hdr->reason)),
 239             tok2str(pf_actions, "unkn(%u)", GET_U_1(hdr->action)),
 240             tok2str(pf_directions, "unkn(%u)", GET_U_1(hdr->dir)));
 241         nd_printjnp(ndo, (const u_char*)hdr->ifname, PFLOG_IFNAMSIZ);
 242         ND_PRINT(": ");
 243 }
 244
 245 void
 246 pflog_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
 247                const u_char *p)
 248 {
 249         u_int length = h->len;
 250         u_int hdrlen;
 251         u_int caplen = h->caplen;
 252         const struct pfloghdr *hdr;
 253         uint8_t af;
 254
 255         ndo->ndo_protocol = "pflog";
 256         /* check length */
 257         ND_ICHECK_U(length, <, MIN_PFLOG_HDRLEN);
 258
 259         hdr = (const struct pfloghdr *)p;
 260         hdrlen = GET_U_1(hdr->length);
 261         ND_ICHECK_U(hdrlen, <, MIN_PFLOG_HDRLEN);
 262         hdrlen = roundup2(hdrlen, 4);
 263         ND_ICHECK_U(hdrlen, >, MAX_PFLOG_HDRLEN);
 264
 265         /* print what we know */
 266         ND_TCHECK_LEN(hdr, hdrlen);
 267         ndo->ndo_ll_hdr_len += hdrlen;
 268         if (ndo->ndo_eflag)
 269                 pflog_print(ndo, hdr);
 270
 271         /* skip to the real packet */
 272         af = GET_U_1(hdr->af);
 273         length -= hdrlen;
 274         caplen -= hdrlen;
 275         p += hdrlen;
 276         switch (af) {
 277
 278                 /*
 279                  * If there's a system that doesn't use the AF_INET
 280                  * from 4.2BSD, feel free to add its value to af.h
 281                  * and use it here.
 282                  *
 283                  * Hopefully, there isn't.
 284                  */
 285                 case BSD_AF_INET:
 286                         ip_print(ndo, p, length);
 287                         break;
 288
 289                 /*
 290                  * Try all AF_INET6 values for all systems with pflog,
 291                  * including Darwin.
 292                  */
 293                 case BSD_AF_INET6_BSD:
 294                 case BSD_AF_INET6_FREEBSD:
 295                 case BSD_AF_INET6_DARWIN:
 296                         ip6_print(ndo, p, length);
 297                         break;
 298
 299         default:
 300                 /* address family not handled, print raw packet */
 301                 if (!ndo->ndo_eflag)
 302                         pflog_print(ndo, hdr);
 303                 if (!ndo->ndo_suppress_default_print)
 304                         ND_DEFAULTPRINT(p, caplen);
 305         }
 306
 307         return;
 308
 309 invalid:
 310         nd_print_invalid(ndo);
 311 }