X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/cfabfb053b4bf5b50f4d98d59053e1cc97ff5014..b78a4331417e5fdd8cb1535bf932307ab25badf8:/print-pflog.c

diff --git a/print-pflog.c b/print-pflog.c
index 61d5dc92..6cd004cc 100644
--- a/print-pflog.c
+++ b/print-pflog.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-pflog.c,v 1.9 2001/09/18 14:52:53 jakob Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.6 2002-12-18 09:41:17 guy Exp $ (LBL)";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.13 2005-04-06 21:32:41 mcr Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -37,114 +35,117 @@ static const char rcsid[] =
 
 #include "interface.h"
 #include "addrtoname.h"
-
-/* The header in OpenBSD pflog files. */
-
-struct pfloghdr {
-	u_int32_t af;
-	char	ifname[16];
-	int16_t rnr;
-	u_int16_t reason;
-	u_int16_t action;
-	u_int16_t dir;
-};
-#define PFLOG_HDRLEN    sizeof(struct pfloghdr)
-
-/* Actions */
-#define PF_PASS  0
-#define PF_DROP  1
-#define PF_SCRUB 2
-
-/* Directions */
-#define PF_IN  0
-#define PF_OUT 1
+#include "pf.h"
 
 static struct tok pf_reasons[] = {
-	{ 0,	"match" },
-	{ 1,	"bad-offset" },
-	{ 2,	"fragment" },
-	{ 3,	"short" },
-	{ 4,	"normalize" },
-	{ 5,	"memory" },
+	{ 0,	"0(match)" },
+	{ 1,	"1(bad-offset)" },
+	{ 2,	"2(fragment)" },
+	{ 3,	"3(short)" },
+	{ 4,	"4(normalize)" },
+	{ 5,	"5(memory)" },
 	{ 0,	NULL }
 };
 
 static struct tok pf_actions[] = {
-	{ PF_PASS,	"pass" },
-	{ PF_DROP,	"drop" },
-	{ PF_SCRUB,	"scrub" },
-	{ 0,		NULL }
+	{ PF_PASS,		"pass" },
+	{ PF_DROP,		"block" },
+	{ PF_SCRUB,		"scrub" },
+	{ PF_NAT,		"nat" },
+	{ PF_NONAT,		"nat" },
+	{ PF_BINAT,		"binat" },
+	{ PF_NOBINAT,		"binat" },
+	{ PF_RDR,		"rdr" },
+	{ PF_NORDR,		"rdr" },
+	{ PF_SYNPROXY_DROP,	"synproxy-drop" },
+	{ 0,			NULL }
 };
 
 static struct tok pf_directions[] = {
+	{ PF_INOUT,	"in/out" },
 	{ PF_IN,	"in" },
 	{ PF_OUT,	"out" },
 	{ 0,		NULL }
 };
 
-#define OPENBSD_AF_INET		2
-#define OPENBSD_AF_INET6	24
+/* For reading capture files on other systems */
+#define	OPENBSD_AF_INET		2
+#define	OPENBSD_AF_INET6	24
 
 static void
 pflog_print(const struct pfloghdr *hdr)
 {
-	printf("rule %d/%s: %s %s on %s: ",
-	    (short)ntohs(hdr->rnr),
-	    tok2str(pf_reasons, "unkn(%u)", ntohs(hdr->reason)),
-	    tok2str(pf_actions, "unkn(%u)", ntohs(hdr->action)),
-	    tok2str(pf_directions, "unkn(%u)", ntohs(hdr->dir)),
+	u_int32_t rulenr, subrulenr;
+
+	rulenr = ntohl(hdr->rulenr);
+	subrulenr = ntohl(hdr->subrulenr);
+	if (subrulenr == (u_int32_t)-1)
+		printf("rule %u/", rulenr);
+	else
+		printf("rule %u.%s.%u/", rulenr, hdr->ruleset, subrulenr);
+
+	printf("%s: %s %s on %s: ",
+	    tok2str(pf_reasons, "unkn(%u)", hdr->reason),
+	    tok2str(pf_actions, "unkn(%u)", hdr->action),
+	    tok2str(pf_directions, "unkn(%u)", hdr->dir),
 	    hdr->ifname);
 }
 
-void
-pflog_if_print(u_char *user _U_, const struct pcap_pkthdr *h,
-     register const u_char *p)
+u_int
+pflog_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 {
 	u_int length = h->len;
+	u_int hdrlen;
 	u_int caplen = h->caplen;
-	const u_char *orig_p;
-	u_int orig_caplen;
 	const struct pfloghdr *hdr;
 	u_int8_t af;
 
-	ts_print(&h->ts);
+	/* check length */
+	if (caplen < sizeof(u_int8_t)) {
+		printf("[|pflog]");
+		return (caplen);
+	}
 
-	if (caplen < PFLOG_HDRLEN) {
+#define MIN_PFLOG_HDRLEN	45
+	hdr = (struct pfloghdr *)p;
+	if (hdr->length < MIN_PFLOG_HDRLEN) {
+		printf("[pflog: invalid header length!]");
+		return (hdr->length);	/* XXX: not really */
+	}
+	hdrlen = BPF_WORDALIGN(hdr->length);
+
+	if (caplen < hdrlen) {
 		printf("[|pflog]");
-		goto out;
+		return (hdrlen);	/* XXX: true? */
 	}
 
-	/*
-	 * Some printers want to check that they're not walking off the
-	 * end of the packet.
-	 * Rather than pass it all the way down, we set this global.
-	 */
-	snapend = p + caplen;
-
-	/*
-	 * Save the information for the full packet, so we can print
-	 * everything if "-e" and "-x" are both specified.
-	 */
-	orig_p = p;
-	orig_caplen = caplen;
-
-	hdr = (const struct pfloghdr *)p;
+	/* print what we know */
+	hdr = (struct pfloghdr *)p;
+	TCHECK(*hdr);
 	if (eflag)
 		pflog_print(hdr);
-	af = ntohl(hdr->af);
-	length -= PFLOG_HDRLEN;
-	caplen -= PFLOG_HDRLEN;
-	p += PFLOG_HDRLEN;
+	
+	/* skip to the real packet */
+	af = hdr->af;
+	length -= hdrlen;
+	caplen -= hdrlen;
+	p += hdrlen;
 	switch (af) {
 
-	case OPENBSD_AF_INET:
-		ip_print(p, length);
-		break;
+		case AF_INET:
+#if OPENBSD_AF_INET != AF_INET
+		case OPENBSD_AF_INET:		/* XXX: read pcap files */
+#endif
+		        ip_print(gndo, p, length);
+			break;
 
 #ifdef INET6
-	case OPENBSD_AF_INET6:
-		ip6_print(p, length);
-		break;
+		case AF_INET6:
+#if OPENBSD_AF_INET6 != AF_INET6
+		case OPENBSD_AF_INET6:		/* XXX: read pcap files */
+#endif
+			ip6_print(p, length);
+			break;
 #endif
 
 	default:
@@ -154,12 +155,16 @@ pflog_if_print(u_char *user _U_, const struct pcap_pkthdr *h,
 		if (!xflag && !qflag)
 			default_print(p, caplen);
 	}
-
-	if (xflag)
-		default_print_packet(orig_p, orig_caplen, PFLOG_HDRLEN);
-out:
-	putchar('\n');
-	--infodelay;
-	if (infoprint)
-		info(0);
+	
+	return (hdrlen);
+trunc:
+	printf("[|pflog]");
+	return (hdrlen);
 }
+
+/*
+ * Local Variables:
+ * c-style: whitesmith
+ * c-basic-offset: 8
+ * End:
+ */