1/*	$OpenBSD: pf_print_state.c,v 1.52 2008/08/12 16:40:18 david Exp $	*/
2
3/*-
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2001 Daniel Hartmeier
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 *    - Redistributions of source code must retain the above copyright
14 *      notice, this list of conditions and the following disclaimer.
15 *    - Redistributions in binary form must reproduce the above
16 *      copyright notice, this list of conditions and the following
17 *      disclaimer in the documentation and/or other materials provided
18 *      with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <sys/endian.h>
38#include <net/if.h>
39#define TCPSTATES
40#include <netinet/tcp_fsm.h>
41#include <netinet/sctp.h>
42#include <net/pfvar.h>
43#include <arpa/inet.h>
44#include <netdb.h>
45
46#include <stdint.h>
47#include <stdio.h>
48#include <string.h>
49
50#include "pfctl_parser.h"
51#include "pfctl.h"
52
53void	print_name(struct pf_addr *, sa_family_t);
54
55void
56print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
57{
58	switch (addr->type) {
59	case PF_ADDR_DYNIFTL:
60		printf("(%s", addr->v.ifname);
61		if (addr->iflags & PFI_AFLAG_NETWORK)
62			printf(":network");
63		if (addr->iflags & PFI_AFLAG_BROADCAST)
64			printf(":broadcast");
65		if (addr->iflags & PFI_AFLAG_PEER)
66			printf(":peer");
67		if (addr->iflags & PFI_AFLAG_NOALIAS)
68			printf(":0");
69		if (verbose) {
70			if (addr->p.dyncnt <= 0)
71				printf(":*");
72			else
73				printf(":%d", addr->p.dyncnt);
74		}
75		printf(")");
76		break;
77	case PF_ADDR_TABLE:
78		if (verbose)
79			if (addr->p.tblcnt == -1)
80				printf("<%s:*>", addr->v.tblname);
81			else
82				printf("<%s:%d>", addr->v.tblname,
83				    addr->p.tblcnt);
84		else
85			printf("<%s>", addr->v.tblname);
86		return;
87	case PF_ADDR_RANGE: {
88		char buf[48];
89
90		if (inet_ntop(af, &addr->v.a.addr, buf, sizeof(buf)) == NULL)
91			printf("?");
92		else
93			printf("%s", buf);
94		if (inet_ntop(af, &addr->v.a.mask, buf, sizeof(buf)) == NULL)
95			printf(" - ?");
96		else
97			printf(" - %s", buf);
98		break;
99	}
100	case PF_ADDR_ADDRMASK:
101		if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
102		    PF_AZERO(&addr->v.a.mask, AF_INET6))
103			printf("any");
104		else {
105			char buf[48];
106
107			if (inet_ntop(af, &addr->v.a.addr, buf,
108			    sizeof(buf)) == NULL)
109				printf("?");
110			else
111				printf("%s", buf);
112		}
113		break;
114	case PF_ADDR_NOROUTE:
115		printf("no-route");
116		return;
117	case PF_ADDR_URPFFAILED:
118		printf("urpf-failed");
119		return;
120	default:
121		printf("?");
122		return;
123	}
124
125	/* mask if not _both_ address and mask are zero */
126	if (addr->type != PF_ADDR_RANGE &&
127	    !(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
128	    PF_AZERO(&addr->v.a.mask, AF_INET6))) {
129		int bits = unmask(&addr->v.a.mask, af);
130
131		if (bits != (af == AF_INET ? 32 : 128))
132			printf("/%d", bits);
133	}
134}
135
136void
137print_name(struct pf_addr *addr, sa_family_t af)
138{
139	char host[NI_MAXHOST];
140
141	strlcpy(host, "?", sizeof(host));
142	switch (af) {
143	case AF_INET: {
144		struct sockaddr_in sin;
145
146		memset(&sin, 0, sizeof(sin));
147		sin.sin_len = sizeof(sin);
148		sin.sin_family = AF_INET;
149		sin.sin_addr = addr->v4;
150		getnameinfo((struct sockaddr *)&sin, sin.sin_len,
151		    host, sizeof(host), NULL, 0, NI_NOFQDN);
152		break;
153	}
154	case AF_INET6: {
155		struct sockaddr_in6 sin6;
156
157		memset(&sin6, 0, sizeof(sin6));
158		sin6.sin6_len = sizeof(sin6);
159		sin6.sin6_family = AF_INET6;
160		sin6.sin6_addr = addr->v6;
161		getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
162		    host, sizeof(host), NULL, 0, NI_NOFQDN);
163		break;
164	}
165	}
166	printf("%s", host);
167}
168
169void
170print_host(struct pf_addr *addr, u_int16_t port, sa_family_t af, int opts)
171{
172	if (opts & PF_OPT_USEDNS)
173		print_name(addr, af);
174	else {
175		struct pf_addr_wrap aw;
176
177		memset(&aw, 0, sizeof(aw));
178		aw.v.a.addr = *addr;
179		if (af == AF_INET)
180			aw.v.a.mask.addr32[0] = 0xffffffff;
181		else {
182			memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
183			af = AF_INET6;
184		}
185		print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
186	}
187
188	if (port) {
189		if (af == AF_INET)
190			printf(":%u", ntohs(port));
191		else
192			printf("[%u]", ntohs(port));
193	}
194}
195
196void
197print_seq(struct pfctl_state_peer *p)
198{
199	if (p->seqdiff)
200		printf("[%u + %u](+%u)", p->seqlo,
201		    p->seqhi - p->seqlo, p->seqdiff);
202	else
203		printf("[%u + %u]", p->seqlo,
204		    p->seqhi - p->seqlo);
205}
206
207
208static const char *
209sctp_state_name(int state)
210{
211	switch (state) {
212	case SCTP_CLOSED:
213		return ("CLOSED");
214	case SCTP_BOUND:
215		return ("BOUND");
216	case SCTP_LISTEN:
217		return ("LISTEN");
218	case SCTP_COOKIE_WAIT:
219		return ("COOKIE_WAIT");
220	case SCTP_COOKIE_ECHOED:
221		return ("COOKIE_ECHOED");
222	case SCTP_ESTABLISHED:
223		return ("ESTABLISHED");
224	case SCTP_SHUTDOWN_SENT:
225		return ("SHUTDOWN_SENT");
226	case SCTP_SHUTDOWN_RECEIVED:
227		return ("SHUTDOWN_RECEIVED");
228	case SCTP_SHUTDOWN_ACK_SENT:
229		return ("SHUTDOWN_ACK_SENT");
230	case SCTP_SHUTDOWN_PENDING:
231		return ("SHUTDOWN_PENDING");
232	default:
233		return ("?");
234	}
235}
236
237void
238print_state(struct pfctl_state *s, int opts)
239{
240	struct pfctl_state_peer *src, *dst;
241	struct pfctl_state_key *key, *sk, *nk;
242	const char *protoname;
243	int min, sec;
244	sa_family_t af;
245	uint8_t proto;
246#ifndef __NO_STRICT_ALIGNMENT
247	struct pfctl_state_key aligned_key[2];
248
249	bcopy(&s->key, aligned_key, sizeof(aligned_key));
250	key = aligned_key;
251#else
252	key = s->key;
253#endif
254
255	af = s->key[PF_SK_WIRE].af;
256	proto = s->key[PF_SK_WIRE].proto;
257
258	if (s->direction == PF_OUT) {
259		src = &s->src;
260		dst = &s->dst;
261		sk = &key[PF_SK_STACK];
262		nk = &key[PF_SK_WIRE];
263		if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6)
264			sk->port[0] = nk->port[0];
265	} else {
266		src = &s->dst;
267		dst = &s->src;
268		sk = &key[PF_SK_WIRE];
269		nk = &key[PF_SK_STACK];
270		if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6)
271			sk->port[1] = nk->port[1];
272	}
273	printf("%s ", s->ifname);
274	if ((protoname = pfctl_proto2name(proto)) != NULL)
275		printf("%s ", protoname);
276	else
277		printf("%u ", proto);
278
279	print_host(&nk->addr[1], nk->port[1], af, opts);
280	if (PF_ANEQ(&nk->addr[1], &sk->addr[1], af) ||
281	    nk->port[1] != sk->port[1]) {
282		printf(" (");
283		print_host(&sk->addr[1], sk->port[1], af, opts);
284		printf(")");
285	}
286	if (s->direction == PF_OUT)
287		printf(" -> ");
288	else
289		printf(" <- ");
290	print_host(&nk->addr[0], nk->port[0], af, opts);
291	if (PF_ANEQ(&nk->addr[0], &sk->addr[0], af) ||
292	    nk->port[0] != sk->port[0]) {
293		printf(" (");
294		print_host(&sk->addr[0], sk->port[0], af, opts);
295		printf(")");
296	}
297
298	printf("    ");
299	if (proto == IPPROTO_TCP) {
300		if (src->state <= TCPS_TIME_WAIT &&
301		    dst->state <= TCPS_TIME_WAIT)
302			printf("   %s:%s\n", tcpstates[src->state],
303			    tcpstates[dst->state]);
304		else if (src->state == PF_TCPS_PROXY_SRC ||
305		    dst->state == PF_TCPS_PROXY_SRC)
306			printf("   PROXY:SRC\n");
307		else if (src->state == PF_TCPS_PROXY_DST ||
308		    dst->state == PF_TCPS_PROXY_DST)
309			printf("   PROXY:DST\n");
310		else
311			printf("   <BAD STATE LEVELS %u:%u>\n",
312			    src->state, dst->state);
313		if (opts & PF_OPT_VERBOSE) {
314			printf("   ");
315			print_seq(src);
316			if (src->wscale && dst->wscale)
317				printf(" wscale %u",
318				    src->wscale & PF_WSCALE_MASK);
319			printf("  ");
320			print_seq(dst);
321			if (src->wscale && dst->wscale)
322				printf(" wscale %u",
323				    dst->wscale & PF_WSCALE_MASK);
324			printf("\n");
325		}
326	} else if (proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
327	    dst->state < PFUDPS_NSTATES) {
328		const char *states[] = PFUDPS_NAMES;
329
330		printf("   %s:%s\n", states[src->state], states[dst->state]);
331	} else if (proto == IPPROTO_SCTP) {
332		printf("   %s:%s\n", sctp_state_name(src->state),
333		    sctp_state_name(dst->state));
334#ifndef INET6
335	} else if (proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
336	    dst->state < PFOTHERS_NSTATES) {
337#else
338	} else if (proto != IPPROTO_ICMP && proto != IPPROTO_ICMPV6 &&
339	    src->state < PFOTHERS_NSTATES && dst->state < PFOTHERS_NSTATES) {
340#endif
341		/* XXX ICMP doesn't really have state levels */
342		const char *states[] = PFOTHERS_NAMES;
343
344		printf("   %s:%s\n", states[src->state], states[dst->state]);
345	} else {
346		printf("   %u:%u\n", src->state, dst->state);
347	}
348
349	if (opts & PF_OPT_VERBOSE) {
350		u_int32_t creation = s->creation;
351		u_int32_t expire = s->expire;
352
353		sec = creation % 60;
354		creation /= 60;
355		min = creation % 60;
356		creation /= 60;
357		printf("   age %.2u:%.2u:%.2u", creation, min, sec);
358		sec = expire % 60;
359		expire /= 60;
360		min = expire % 60;
361		expire /= 60;
362		printf(", expires in %.2u:%.2u:%.2u", expire, min, sec);
363
364		printf(", %ju:%ju pkts, %ju:%ju bytes",
365		    s->packets[0],
366		    s->packets[1],
367		    s->bytes[0],
368		    s->bytes[1]);
369		if (s->anchor != -1)
370			printf(", anchor %u", s->anchor);
371		if (s->rule != -1)
372			printf(", rule %u", s->rule);
373		if (s->state_flags & PFSTATE_ALLOWOPTS)
374			printf(", allow-opts");
375		if (s->state_flags & PFSTATE_SLOPPY)
376			printf(", sloppy");
377		if (s->state_flags & PFSTATE_NOSYNC)
378			printf(", no-sync");
379		if (s->state_flags & PFSTATE_PFLOW)
380			printf(", pflow");
381		if (s->state_flags & PFSTATE_ACK)
382			printf(", psync-ack");
383		if (s->state_flags & PFSTATE_NODF)
384			printf(", no-df");
385		if (s->state_flags & PFSTATE_SETTOS)
386			printf(", set-tos 0x%2.2x", s->set_tos);
387		if (s->state_flags & PFSTATE_RANDOMID)
388			printf(", random-id");
389		if (s->state_flags & PFSTATE_SCRUB_TCP)
390			printf(", reassemble-tcp");
391		if (s->state_flags & PFSTATE_SETPRIO)
392			printf(", set-prio (0x%02x 0x%02x)",
393			    s->set_prio[0], s->set_prio[1]);
394		if (s->dnpipe || s->dnrpipe) {
395			if (s->state_flags & PFSTATE_DN_IS_PIPE)
396				printf(", dummynet pipe (%d %d)",
397				s->dnpipe, s->dnrpipe);
398			if (s->state_flags & PFSTATE_DN_IS_QUEUE)
399				printf(", dummynet queue (%d %d)",
400				s->dnpipe, s->dnrpipe);
401		}
402		if (s->sync_flags & PFSYNC_FLAG_SRCNODE)
403			printf(", source-track");
404		if (s->sync_flags & PFSYNC_FLAG_NATSRCNODE)
405			printf(", sticky-address");
406		if (s->log)
407			printf(", log");
408		if (s->log & PF_LOG_ALL)
409			printf(" (all)");
410		if (s->min_ttl)
411			printf(", min-ttl %d", s->min_ttl);
412		if (s->max_mss)
413			printf(", max-mss %d", s->max_mss);
414		printf("\n");
415	}
416	if (opts & PF_OPT_VERBOSE2) {
417		u_int64_t id;
418
419		bcopy(&s->id, &id, sizeof(u_int64_t));
420		printf("   id: %016jx creatorid: %08x", id, s->creatorid);
421		if (s->rt) {
422			switch (s->rt) {
423				case PF_ROUTETO:
424					printf(" route-to: ");
425					break;
426				case PF_DUPTO:
427					printf(" dup-to: ");
428					break;
429				case PF_REPLYTO:
430					printf(" reply-to: ");
431					break;
432				default:
433					printf(" gateway: ");
434			}
435			print_host(&s->rt_addr, 0, af, opts);
436			if (s->rt_ifname[0])
437				printf("@%s", s->rt_ifname);
438		}
439		if (s->rtableid != -1)
440			printf(" rtable: %d", s->rtableid);
441		printf("\n");
442
443		if (strcmp(s->ifname, s->orig_ifname) != 0)
444			printf("   origif: %s\n", s->orig_ifname);
445	}
446}
447
448int
449unmask(struct pf_addr *m, sa_family_t af)
450{
451	int i = 31, j = 0, b = 0;
452	u_int32_t tmp;
453
454	while (j < 4 && m->addr32[j] == 0xffffffff) {
455		b += 32;
456		j++;
457	}
458	if (j < 4) {
459		tmp = ntohl(m->addr32[j]);
460		for (i = 31; tmp & (1 << i); --i)
461			b++;
462	}
463	return (b);
464}
465