1 /* $FreeBSD$ */
2
3 /*
4 * Copyright (C) 2012 by Darren Reed.
5 *
6 * See the IPFILTER.LICENCE file for details on licencing.
7 */
8 #include "ipf.h"
9 #include "ipmon.h"
10 #include <sys/ioctl.h>
11 #include <sys/stat.h>
12 #include <syslog.h>
13 #include <ctype.h>
14 #include <fcntl.h>
15 #include <signal.h>
16
17 #if !defined(lint)
18 static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
19 static const char rcsid[] = "@(#)$Id$";
20 #endif
21
22
23 #define STRERROR(x) strerror(x)
24
25 extern int optind;
26 extern char *optarg;
27
28 extern ipmon_saver_t executesaver;
29 extern ipmon_saver_t filesaver;
30 extern ipmon_saver_t nothingsaver;
31 extern ipmon_saver_t snmpv1saver;
32 extern ipmon_saver_t snmpv2saver;
33 extern ipmon_saver_t syslogsaver;
34
35
36 struct flags {
37 int value;
38 char flag;
39 };
40
41 typedef struct logsource {
42 int fd;
43 int logtype;
44 char *file;
45 int regular;
46 size_t size;
47 } logsource_t;
48
49 typedef struct config {
50 int opts;
51 int maxfd;
52 logsource_t logsrc[3];
53 fd_set fdmr;
54 FILE *blog;
55 char *bfile;
56 FILE *log;
57 char *file;
58 char *cfile;
59 } config_t;
60
61 typedef struct icmp_subtype {
62 int ist_val;
63 char *ist_name;
64 } icmp_subtype_t;
65
66 typedef struct icmp_type {
67 int it_val;
68 struct icmp_subtype *it_subtable;
69 size_t it_stsize;
70 char *it_name;
71 } icmp_type_t;
72
73
74 #define IST_SZ(x) (sizeof(x)/sizeof(icmp_subtype_t))
75
76
77 struct flags tcpfl[] = {
78 { TH_ACK, 'A' },
79 { TH_RST, 'R' },
80 { TH_SYN, 'S' },
81 { TH_FIN, 'F' },
82 { TH_URG, 'U' },
83 { TH_PUSH,'P' },
84 { TH_ECN, 'E' },
85 { TH_CWR, 'C' },
86 { 0, '\0' }
87 };
88
89 char *reasons[] = {
90 "filter-rule",
91 "log-or-block_1",
92 "pps-rate",
93 "jumbogram",
94 "makefrip-fail",
95 "state_add-fail",
96 "updateipid-fail",
97 "log-or-block_2",
98 "decap-fail",
99 "auth_new-fail",
100 "auth_captured",
101 "coalesce-fail",
102 "pullup-fail",
103 "auth-feedback",
104 "bad-frag",
105 "natv4_out-fail",
106 "natv4_in-fail",
107 "natv6_out-fail",
108 "natv6_in-fail",
109 };
110
111 #ifdef MENTAT
112 static char *pidfile = "/etc/opt/ipf/ipmon.pid";
113 #else
114 static char *pidfile = "/var/run/ipmon.pid";
115 #endif
116
117 static char line[2048];
118 static int donehup = 0;
119 static void usage __P((char *));
120 static void handlehup __P((int));
121 static void flushlogs __P((char *, FILE *));
122 static void print_log __P((config_t *, logsource_t *, char *, int));
123 static void print_ipflog __P((config_t *, char *, int));
124 static void print_natlog __P((config_t *, char *, int));
125 static void print_statelog __P((config_t *, char *, int));
126 static int read_log __P((int, int *, char *, int));
127 static void write_pid __P((char *));
128 static char *icmpname __P((u_int, u_int));
129 static char *icmpname6 __P((u_int, u_int));
130 static icmp_type_t *find_icmptype __P((int, icmp_type_t *, size_t));
131 static icmp_subtype_t *find_icmpsubtype __P((int, icmp_subtype_t *, size_t));
132 static struct tm *get_tm __P((time_t));
133
134 char *portlocalname __P((int, char *, u_int));
135 int main __P((int, char *[]));
136
137 static void logopts __P((int, char *));
138 static void init_tabs __P((void));
139 static char *getlocalproto __P((u_int));
140 static void openlogs __P((config_t *conf));
141 static int read_loginfo __P((config_t *conf));
142 static void initconfig __P((config_t *conf));
143
144 static char **protocols = NULL;
145 static char **udp_ports = NULL;
146 static char **tcp_ports = NULL;
147
148
149 #define HOSTNAMEV4(b) hostname(AF_INET, (u_32_t *)&(b))
150
151 #ifndef LOGFAC
152 #define LOGFAC LOG_LOCAL0
153 #endif
154 int logfac = LOGFAC;
155 int ipmonopts = 0;
156 int opts = OPT_NORESOLVE;
157 int use_inet6 = 0;
158
159
160 static icmp_subtype_t icmpunreachnames[] = {
161 { ICMP_UNREACH_NET, "net" },
162 { ICMP_UNREACH_HOST, "host" },
163 { ICMP_UNREACH_PROTOCOL, "protocol" },
164 { ICMP_UNREACH_PORT, "port" },
165 { ICMP_UNREACH_NEEDFRAG, "needfrag" },
166 { ICMP_UNREACH_SRCFAIL, "srcfail" },
167 { ICMP_UNREACH_NET_UNKNOWN, "net_unknown" },
168 { ICMP_UNREACH_HOST_UNKNOWN, "host_unknown" },
169 { ICMP_UNREACH_NET, "isolated" },
170 { ICMP_UNREACH_NET_PROHIB, "net_prohib" },
171 { ICMP_UNREACH_NET_PROHIB, "host_prohib" },
172 { ICMP_UNREACH_TOSNET, "tosnet" },
173 { ICMP_UNREACH_TOSHOST, "toshost" },
174 { ICMP_UNREACH_ADMIN_PROHIBIT, "admin_prohibit" },
175 { -2, NULL }
176 };
177
178 static icmp_subtype_t redirectnames[] = {
179 { ICMP_REDIRECT_NET, "net" },
180 { ICMP_REDIRECT_HOST, "host" },
181 { ICMP_REDIRECT_TOSNET, "tosnet" },
182 { ICMP_REDIRECT_TOSHOST, "toshost" },
183 { -2, NULL }
184 };
185
186 static icmp_subtype_t timxceednames[] = {
187 { ICMP_TIMXCEED_INTRANS, "transit" },
188 { ICMP_TIMXCEED_REASS, "reassem" },
189 { -2, NULL }
190 };
191
192 static icmp_subtype_t paramnames[] = {
193 { ICMP_PARAMPROB_ERRATPTR, "errata_pointer" },
194 { ICMP_PARAMPROB_OPTABSENT, "optmissing" },
195 { ICMP_PARAMPROB_LENGTH, "length" },
196 { -2, NULL }
197 };
198
199 static icmp_type_t icmptypes4[] = {
200 { ICMP_ECHOREPLY, NULL, 0, "echoreply" },
201 { -1, NULL, 0, NULL },
202 { -1, NULL, 0, NULL },
203 { ICMP_UNREACH, icmpunreachnames,
204 IST_SZ(icmpunreachnames),"unreach" },
205 { ICMP_SOURCEQUENCH, NULL, 0, "sourcequench" },
206 { ICMP_REDIRECT, redirectnames,
207 IST_SZ(redirectnames), "redirect" },
208 { -1, NULL, 0, NULL },
209 { -1, NULL, 0, NULL },
210 { ICMP_ECHO, NULL, 0, "echo" },
211 { ICMP_ROUTERADVERT, NULL, 0, "routeradvert" },
212 { ICMP_ROUTERSOLICIT, NULL, 0, "routersolicit" },
213 { ICMP_TIMXCEED, timxceednames,
214 IST_SZ(timxceednames), "timxceed" },
215 { ICMP_PARAMPROB, paramnames,
216 IST_SZ(paramnames), "paramprob" },
217 { ICMP_TSTAMP, NULL, 0, "timestamp" },
218 { ICMP_TSTAMPREPLY, NULL, 0, "timestampreply" },
219 { ICMP_IREQ, NULL, 0, "inforeq" },
220 { ICMP_IREQREPLY, NULL, 0, "inforeply" },
221 { ICMP_MASKREQ, NULL, 0, "maskreq" },
222 { ICMP_MASKREPLY, NULL, 0, "maskreply" },
223 { -2, NULL, 0, NULL }
224 };
225
226 static icmp_subtype_t icmpredirect6[] = {
227 { ICMP6_DST_UNREACH_NOROUTE, "noroute" },
228 { ICMP6_DST_UNREACH_ADMIN, "admin" },
229 { ICMP6_DST_UNREACH_NOTNEIGHBOR, "neighbour" },
230 { ICMP6_DST_UNREACH_ADDR, "address" },
231 { ICMP6_DST_UNREACH_NOPORT, "noport" },
232 { -2, NULL }
233 };
234
235 static icmp_subtype_t icmptimexceed6[] = {
236 { ICMP6_TIME_EXCEED_TRANSIT, "intransit" },
237 { ICMP6_TIME_EXCEED_REASSEMBLY, "reassem" },
238 { -2, NULL }
239 };
240
241 static icmp_subtype_t icmpparamprob6[] = {
242 { ICMP6_PARAMPROB_HEADER, "header" },
243 { ICMP6_PARAMPROB_NEXTHEADER, "nextheader" },
244 { ICMP6_PARAMPROB_OPTION, "option" },
245 { -2, NULL }
246 };
247
248 static icmp_subtype_t icmpquerysubject6[] = {
249 { ICMP6_NI_SUBJ_IPV6, "ipv6" },
250 { ICMP6_NI_SUBJ_FQDN, "fqdn" },
251 { ICMP6_NI_SUBJ_IPV4, "ipv4" },
252 { -2, NULL },
253 };
254
255 static icmp_subtype_t icmpnodeinfo6[] = {
256 { ICMP6_NI_SUCCESS, "success" },
257 { ICMP6_NI_REFUSED, "refused" },
258 { ICMP6_NI_UNKNOWN, "unknown" },
259 { -2, NULL }
260 };
261
262 static icmp_subtype_t icmprenumber6[] = {
263 { ICMP6_ROUTER_RENUMBERING_COMMAND, "command" },
264 { ICMP6_ROUTER_RENUMBERING_RESULT, "result" },
265 { ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET, "seqnum_reset" },
266 { -2, NULL }
267 };
268
269 static icmp_type_t icmptypes6[] = {
270 { 0, NULL, 0, NULL },
271 { ICMP6_DST_UNREACH, icmpredirect6,
272 IST_SZ(icmpredirect6), "unreach" },
273 { ICMP6_PACKET_TOO_BIG, NULL, 0, "toobig" },
274 { ICMP6_TIME_EXCEEDED, icmptimexceed6,
275 IST_SZ(icmptimexceed6), "timxceed" },
276 { ICMP6_PARAM_PROB, icmpparamprob6,
277 IST_SZ(icmpparamprob6), "paramprob" },
278 { ICMP6_ECHO_REQUEST, NULL, 0, "echo" },
279 { ICMP6_ECHO_REPLY, NULL, 0, "echoreply" },
280 { ICMP6_MEMBERSHIP_QUERY, icmpquerysubject6,
281 IST_SZ(icmpquerysubject6), "groupmemberquery" },
282 { ICMP6_MEMBERSHIP_REPORT,NULL, 0, "groupmemberreport" },
283 { ICMP6_MEMBERSHIP_REDUCTION,NULL, 0, "groupmemberterm" },
284 { ND_ROUTER_SOLICIT, NULL, 0, "routersolicit" },
285 { ND_ROUTER_ADVERT, NULL, 0, "routeradvert" },
286 { ND_NEIGHBOR_SOLICIT, NULL, 0, "neighborsolicit" },
287 { ND_NEIGHBOR_ADVERT, NULL, 0, "neighboradvert" },
288 { ND_REDIRECT, NULL, 0, "redirect" },
289 { ICMP6_ROUTER_RENUMBERING, icmprenumber6,
290 IST_SZ(icmprenumber6), "routerrenumber" },
291 { ICMP6_WRUREQUEST, NULL, 0, "whoareyourequest" },
292 { ICMP6_WRUREPLY, NULL, 0, "whoareyoureply" },
293 { ICMP6_FQDN_QUERY, NULL, 0, "fqdnquery" },
294 { ICMP6_FQDN_REPLY, NULL, 0, "fqdnreply" },
295 { ICMP6_NI_QUERY, icmpnodeinfo6,
296 IST_SZ(icmpnodeinfo6), "nodeinforequest" },
297 { ICMP6_NI_REPLY, NULL, 0, "nodeinforeply" },
298 { MLD6_MTRACE_RESP, NULL, 0, "mtraceresponse" },
299 { MLD6_MTRACE, NULL, 0, "mtracerequest" },
300 { -2, NULL, 0, NULL }
301 };
302
find_icmpsubtype(type,table,tablesz)303 static icmp_subtype_t *find_icmpsubtype(type, table, tablesz)
304 int type;
305 icmp_subtype_t *table;
306 size_t tablesz;
307 {
308 icmp_subtype_t *ist;
309 int i;
310
311 if (tablesz < 2)
312 return NULL;
313
314 if ((type < 0) || (type > table[tablesz - 2].ist_val))
315 return NULL;
316
317 i = type;
318 if (table[type].ist_val == type)
319 return table + type;
320
321 for (i = 0, ist = table; ist->ist_val != -2; i++, ist++)
322 if (ist->ist_val == type)
323 return ist;
324 return NULL;
325 }
326
327
find_icmptype(type,table,tablesz)328 static icmp_type_t *find_icmptype(type, table, tablesz)
329 int type;
330 icmp_type_t *table;
331 size_t tablesz;
332 {
333 icmp_type_t *it;
334 int i;
335
336 if (tablesz < 2)
337 return NULL;
338
339 if ((type < 0) || (type > table[tablesz - 2].it_val))
340 return NULL;
341
342 i = type;
343 if (table[type].it_val == type)
344 return table + type;
345
346 for (i = 0, it = table; it->it_val != -2; i++, it++)
347 if (it->it_val == type)
348 return it;
349 return NULL;
350 }
351
352
handlehup(sig)353 static void handlehup(sig)
354 int sig;
355 {
356 signal(SIGHUP, handlehup);
357 donehup = 1;
358 }
359
360
init_tabs()361 static void init_tabs()
362 {
363 struct protoent *p;
364 struct servent *s;
365 char *name, **tab;
366 int port, i;
367
368 if (protocols != NULL) {
369 for (i = 0; i < 256; i++)
370 if (protocols[i] != NULL) {
371 free(protocols[i]);
372 protocols[i] = NULL;
373 }
374 free(protocols);
375 protocols = NULL;
376 }
377 protocols = (char **)malloc(256 * sizeof(*protocols));
378 if (protocols != NULL) {
379 bzero((char *)protocols, 256 * sizeof(*protocols));
380
381 setprotoent(1);
382 while ((p = getprotoent()) != NULL)
383 if (p->p_proto >= 0 && p->p_proto <= 255 &&
384 p->p_name != NULL && protocols[p->p_proto] == NULL)
385 protocols[p->p_proto] = strdup(p->p_name);
386 endprotoent();
387 if (protocols[0])
388 free(protocols[0]);
389 protocols[0] = strdup("ip");
390 }
391
392 if (udp_ports != NULL) {
393 for (i = 0; i < 65536; i++)
394 if (udp_ports[i] != NULL) {
395 free(udp_ports[i]);
396 udp_ports[i] = NULL;
397 }
398 free(udp_ports);
399 udp_ports = NULL;
400 }
401 udp_ports = (char **)malloc(65536 * sizeof(*udp_ports));
402 if (udp_ports != NULL)
403 bzero((char *)udp_ports, 65536 * sizeof(*udp_ports));
404
405 if (tcp_ports != NULL) {
406 for (i = 0; i < 65536; i++)
407 if (tcp_ports[i] != NULL) {
408 free(tcp_ports[i]);
409 tcp_ports[i] = NULL;
410 }
411 free(tcp_ports);
412 tcp_ports = NULL;
413 }
414 tcp_ports = (char **)malloc(65536 * sizeof(*tcp_ports));
415 if (tcp_ports != NULL)
416 bzero((char *)tcp_ports, 65536 * sizeof(*tcp_ports));
417
418 setservent(1);
419 while ((s = getservent()) != NULL) {
420 if (s->s_proto == NULL)
421 continue;
422 else if (!strcmp(s->s_proto, "tcp")) {
423 port = ntohs(s->s_port);
424 name = s->s_name;
425 tab = tcp_ports;
426 } else if (!strcmp(s->s_proto, "udp")) {
427 port = ntohs(s->s_port);
428 name = s->s_name;
429 tab = udp_ports;
430 } else
431 continue;
432 if ((port < 0 || port > 65535) || (name == NULL))
433 continue;
434 if (tab != NULL)
435 tab[port] = strdup(name);
436 }
437 endservent();
438 }
439
440
getlocalproto(p)441 static char *getlocalproto(p)
442 u_int p;
443 {
444 static char pnum[4];
445 char *s;
446
447 p &= 0xff;
448 s = protocols ? protocols[p] : NULL;
449 if (s == NULL) {
450 sprintf(pnum, "%u", p);
451 s = pnum;
452 }
453 return s;
454 }
455
456
read_log(fd,lenp,buf,bufsize)457 static int read_log(fd, lenp, buf, bufsize)
458 int fd, bufsize, *lenp;
459 char *buf;
460 {
461 int nr;
462
463 if (bufsize > IPFILTER_LOGSIZE)
464 bufsize = IPFILTER_LOGSIZE;
465
466 nr = read(fd, buf, bufsize);
467 if (!nr)
468 return 2;
469 if ((nr < 0) && (errno != EINTR))
470 return -1;
471 *lenp = nr;
472 return 0;
473 }
474
475
portlocalname(res,proto,port)476 char *portlocalname(res, proto, port)
477 int res;
478 char *proto;
479 u_int port;
480 {
481 static char pname[8];
482 char *s;
483
484 port = ntohs(port);
485 port &= 0xffff;
486 sprintf(pname, "%u", port);
487 if (!res || (ipmonopts & IPMON_PORTNUM))
488 return pname;
489 s = NULL;
490 if (!strcmp(proto, "tcp"))
491 s = tcp_ports[port];
492 else if (!strcmp(proto, "udp"))
493 s = udp_ports[port];
494 if (s == NULL)
495 s = pname;
496 return s;
497 }
498
499
icmpname(type,code)500 static char *icmpname(type, code)
501 u_int type;
502 u_int code;
503 {
504 static char name[80];
505 icmp_subtype_t *ist;
506 icmp_type_t *it;
507 char *s;
508
509 s = NULL;
510 it = find_icmptype(type, icmptypes4, sizeof(icmptypes4) / sizeof(*it));
511 if (it != NULL)
512 s = it->it_name;
513
514 if (s == NULL)
515 sprintf(name, "icmptype(%d)/", type);
516 else
517 sprintf(name, "%s/", s);
518
519 ist = NULL;
520 if (it != NULL && it->it_subtable != NULL)
521 ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
522
523 if (ist != NULL && ist->ist_name != NULL)
524 strcat(name, ist->ist_name);
525 else
526 sprintf(name + strlen(name), "%d", code);
527
528 return name;
529 }
530
icmpname6(type,code)531 static char *icmpname6(type, code)
532 u_int type;
533 u_int code;
534 {
535 static char name[80];
536 icmp_subtype_t *ist;
537 icmp_type_t *it;
538 char *s;
539
540 s = NULL;
541 it = find_icmptype(type, icmptypes6, sizeof(icmptypes6) / sizeof(*it));
542 if (it != NULL)
543 s = it->it_name;
544
545 if (s == NULL)
546 sprintf(name, "icmpv6type(%d)/", type);
547 else
548 sprintf(name, "%s/", s);
549
550 ist = NULL;
551 if (it != NULL && it->it_subtable != NULL)
552 ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
553
554 if (ist != NULL && ist->ist_name != NULL)
555 strcat(name, ist->ist_name);
556 else
557 sprintf(name + strlen(name), "%d", code);
558
559 return name;
560 }
561
562
dumphex(log,dopts,buf,len)563 void dumphex(log, dopts, buf, len)
564 FILE *log;
565 int dopts;
566 char *buf;
567 int len;
568 {
569 char hline[80];
570 int i, j, k;
571 u_char *s = (u_char *)buf, *t = (u_char *)hline;
572
573 if (buf == NULL || len == 0)
574 return;
575
576 *hline = '\0';
577
578 for (i = len, j = 0; i; i--, j++, s++) {
579 if (j && !(j & 0xf)) {
580 *t++ = '\n';
581 *t = '\0';
582 if ((dopts & IPMON_SYSLOG))
583 syslog(LOG_INFO, "%s", hline);
584 else if (log != NULL)
585 fputs(hline, log);
586 t = (u_char *)hline;
587 *t = '\0';
588 }
589 sprintf((char *)t, "%02x", *s & 0xff);
590 t += 2;
591 if (!((j + 1) & 0xf)) {
592 s -= 15;
593 sprintf((char *)t, " ");
594 t += 8;
595 for (k = 16; k; k--, s++)
596 *t++ = (isprint(*s) ? *s : '.');
597 s--;
598 }
599
600 if ((j + 1) & 0xf)
601 *t++ = ' ';;
602 }
603
604 if (j & 0xf) {
605 for (k = 16 - (j & 0xf); k; k--) {
606 *t++ = ' ';
607 *t++ = ' ';
608 *t++ = ' ';
609 }
610 sprintf((char *)t, " ");
611 t += 7;
612 s -= j & 0xf;
613 for (k = j & 0xf; k; k--, s++)
614 *t++ = (isprint(*s) ? *s : '.');
615 *t++ = '\n';
616 *t = '\0';
617 }
618 if ((dopts & IPMON_SYSLOG) != 0)
619 syslog(LOG_INFO, "%s", hline);
620 else if (log != NULL) {
621 fputs(hline, log);
622 fflush(log);
623 }
624 }
625
626
get_tm(sec)627 static struct tm *get_tm(sec)
628 time_t sec;
629 {
630 struct tm *tm;
631 time_t t;
632
633 t = sec;
634 tm = localtime(&t);
635 return tm;
636 }
637
print_natlog(conf,buf,blen)638 static void print_natlog(conf, buf, blen)
639 config_t *conf;
640 char *buf;
641 int blen;
642 {
643 static u_32_t seqnum = 0;
644 int res, i, len, family;
645 struct natlog *nl;
646 struct tm *tm;
647 iplog_t *ipl;
648 char *proto;
649 int simple;
650 char *t;
651
652 t = line;
653 simple = 0;
654 ipl = (iplog_t *)buf;
655 if (ipl->ipl_seqnum != seqnum) {
656 if ((ipmonopts & IPMON_SYSLOG) != 0) {
657 syslog(LOG_WARNING,
658 "missed %u NAT log entries: %u %u",
659 ipl->ipl_seqnum - seqnum, seqnum,
660 ipl->ipl_seqnum);
661 } else {
662 (void) fprintf(conf->log,
663 "missed %u NAT log entries: %u %u\n",
664 ipl->ipl_seqnum - seqnum, seqnum,
665 ipl->ipl_seqnum);
666 }
667 }
668 seqnum = ipl->ipl_seqnum + ipl->ipl_count;
669
670 nl = (struct natlog *)((char *)ipl + sizeof(*ipl));
671 res = (ipmonopts & IPMON_RESOLVE) ? 1 : 0;
672 tm = get_tm(ipl->ipl_sec);
673 len = sizeof(line);
674
675 if (!(ipmonopts & IPMON_SYSLOG)) {
676 (void) strftime(t, len, "%d/%m/%Y ", tm);
677 i = strlen(t);
678 len -= i;
679 t += i;
680 }
681 (void) strftime(t, len, "%T", tm);
682 t += strlen(t);
683 sprintf(t, ".%-.6ld @%hd ", (long)ipl->ipl_usec, nl->nl_rule + 1);
684 t += strlen(t);
685
686 switch (nl->nl_action)
687 {
688 case NL_NEW :
689 strcpy(t, "NAT:NEW");
690 break;
691
692 case NL_FLUSH :
693 strcpy(t, "NAT:FLUSH");
694 break;
695
696 case NL_CLONE :
697 strcpy(t, "NAT:CLONE");
698 break;
699
700 case NL_EXPIRE :
701 strcpy(t, "NAT:EXPIRE");
702 break;
703
704 case NL_DESTROY :
705 strcpy(t, "NAT:DESTROY");
706 break;
707
708 case NL_PURGE :
709 strcpy(t, "NAT:PURGE");
710 break;
711
712 default :
713 sprintf(t, "NAT:Action(%d)", nl->nl_action);
714 break;
715 }
716 t += strlen(t);
717
718
719 switch (nl->nl_type)
720 {
721 case NAT_MAP :
722 strcpy(t, "-MAP ");
723 simple = 1;
724 break;
725
726 case NAT_REDIRECT :
727 strcpy(t, "-RDR ");
728 simple = 1;
729 break;
730
731 case NAT_BIMAP :
732 strcpy(t, "-BIMAP ");
733 simple = 1;
734 break;
735
736 case NAT_MAPBLK :
737 strcpy(t, "-MAPBLOCK ");
738 simple = 1;
739 break;
740
741 case NAT_REWRITE|NAT_MAP :
742 strcpy(t, "-RWR_MAP ");
743 break;
744
745 case NAT_REWRITE|NAT_REDIRECT :
746 strcpy(t, "-RWR_RDR ");
747 break;
748
749 case NAT_ENCAP|NAT_MAP :
750 strcpy(t, "-ENC_MAP ");
751 break;
752
753 case NAT_ENCAP|NAT_REDIRECT :
754 strcpy(t, "-ENC_RDR ");
755 break;
756
757 case NAT_DIVERTUDP|NAT_MAP :
758 strcpy(t, "-DIV_MAP ");
759 break;
760
761 case NAT_DIVERTUDP|NAT_REDIRECT :
762 strcpy(t, "-DIV_RDR ");
763 break;
764
765 default :
766 sprintf(t, "-Type(%d) ", nl->nl_type);
767 break;
768 }
769 t += strlen(t);
770
771 proto = getlocalproto(nl->nl_p[0]);
772
773 family = vtof(nl->nl_v[0]);
774
775 if (simple == 1) {
776 sprintf(t, "%s,%s <- -> ", hostname(family, nl->nl_osrcip.i6),
777 portlocalname(res, proto, (u_int)nl->nl_osrcport));
778 t += strlen(t);
779 sprintf(t, "%s,%s ", hostname(family, nl->nl_nsrcip.i6),
780 portlocalname(res, proto, (u_int)nl->nl_nsrcport));
781 t += strlen(t);
782 sprintf(t, "[%s,%s] ", hostname(family, nl->nl_odstip.i6),
783 portlocalname(res, proto, (u_int)nl->nl_odstport));
784 } else {
785 sprintf(t, "%s,%s ", hostname(family, nl->nl_osrcip.i6),
786 portlocalname(res, proto, (u_int)nl->nl_osrcport));
787 t += strlen(t);
788 sprintf(t, "%s,%s <- -> ", hostname(family, nl->nl_odstip.i6),
789 portlocalname(res, proto, (u_int)nl->nl_odstport));
790 t += strlen(t);
791 sprintf(t, "%s,%s ", hostname(family, nl->nl_nsrcip.i6),
792 portlocalname(res, proto, (u_int)nl->nl_nsrcport));
793 t += strlen(t);
794 sprintf(t, "%s,%s ", hostname(family, nl->nl_ndstip.i6),
795 portlocalname(res, proto, (u_int)nl->nl_ndstport));
796 }
797 t += strlen(t);
798
799 strcpy(t, getlocalproto(nl->nl_p[0]));
800 t += strlen(t);
801
802 if (nl->nl_action == NL_EXPIRE || nl->nl_action == NL_FLUSH) {
803 #ifdef USE_QUAD_T
804 # ifdef PRId64
805 sprintf(t, " Pkts %" PRId64 "/%" PRId64 " Bytes %" PRId64 "/%"
806 PRId64,
807 # else
808 sprintf(t, " Pkts %qd/%qd Bytes %qd/%qd",
809 # endif
810 #else
811 sprintf(t, " Pkts %ld/%ld Bytes %ld/%ld",
812 #endif
813 nl->nl_pkts[0], nl->nl_pkts[1],
814 nl->nl_bytes[0], nl->nl_bytes[1]);
815 t += strlen(t);
816 }
817
818 *t++ = '\n';
819 *t++ = '\0';
820 if (ipmonopts & IPMON_SYSLOG)
821 syslog(LOG_INFO, "%s", line);
822 else if (conf->log != NULL)
823 (void) fprintf(conf->log, "%s", line);
824 }
825
826
print_statelog(conf,buf,blen)827 static void print_statelog(conf, buf, blen)
828 config_t *conf;
829 char *buf;
830 int blen;
831 {
832 static u_32_t seqnum = 0;
833 int res, i, len, family;
834 struct ipslog *sl;
835 char *t, *proto;
836 struct tm *tm;
837 iplog_t *ipl;
838
839 t = line;
840 ipl = (iplog_t *)buf;
841 if (ipl->ipl_seqnum != seqnum) {
842 if ((ipmonopts & IPMON_SYSLOG) != 0) {
843 syslog(LOG_WARNING,
844 "missed %u state log entries: %u %u",
845 ipl->ipl_seqnum - seqnum, seqnum,
846 ipl->ipl_seqnum);
847 } else {
848 (void) fprintf(conf->log,
849 "missed %u state log entries: %u %u\n",
850 ipl->ipl_seqnum - seqnum, seqnum,
851 ipl->ipl_seqnum);
852 }
853 }
854 seqnum = ipl->ipl_seqnum + ipl->ipl_count;
855
856 sl = (struct ipslog *)((char *)ipl + sizeof(*ipl));
857 res = (ipmonopts & IPMON_RESOLVE) ? 1 : 0;
858 tm = get_tm(ipl->ipl_sec);
859 len = sizeof(line);
860 if (!(ipmonopts & IPMON_SYSLOG)) {
861 (void) strftime(t, len, "%d/%m/%Y ", tm);
862 i = strlen(t);
863 len -= i;
864 t += i;
865 }
866 (void) strftime(t, len, "%T", tm);
867 t += strlen(t);
868 sprintf(t, ".%-.6ld ", (long)ipl->ipl_usec);
869 t += strlen(t);
870
871 family = vtof(sl->isl_v);
872
873 switch (sl->isl_type)
874 {
875 case ISL_NEW :
876 strcpy(t, "STATE:NEW ");
877 break;
878
879 case ISL_CLONE :
880 strcpy(t, "STATE:CLONED ");
881 break;
882
883 case ISL_EXPIRE :
884 if ((sl->isl_p == IPPROTO_TCP) &&
885 (sl->isl_state[0] > IPF_TCPS_ESTABLISHED ||
886 sl->isl_state[1] > IPF_TCPS_ESTABLISHED))
887 strcpy(t, "STATE:CLOSE ");
888 else
889 strcpy(t, "STATE:EXPIRE ");
890 break;
891
892 case ISL_FLUSH :
893 strcpy(t, "STATE:FLUSH ");
894 break;
895
896 case ISL_INTERMEDIATE :
897 strcpy(t, "STATE:INTERMEDIATE ");
898 break;
899
900 case ISL_REMOVE :
901 strcpy(t, "STATE:REMOVE ");
902 break;
903
904 case ISL_KILLED :
905 strcpy(t, "STATE:KILLED ");
906 break;
907
908 case ISL_UNLOAD :
909 strcpy(t, "STATE:UNLOAD ");
910 break;
911
912 default :
913 sprintf(t, "Type: %d ", sl->isl_type);
914 break;
915 }
916 t += strlen(t);
917
918 proto = getlocalproto(sl->isl_p);
919
920 if (sl->isl_p == IPPROTO_TCP || sl->isl_p == IPPROTO_UDP) {
921 sprintf(t, "%s,%s -> ",
922 hostname(family, (u_32_t *)&sl->isl_src),
923 portlocalname(res, proto, (u_int)sl->isl_sport));
924 t += strlen(t);
925 sprintf(t, "%s,%s PR %s",
926 hostname(family, (u_32_t *)&sl->isl_dst),
927 portlocalname(res, proto, (u_int)sl->isl_dport), proto);
928 } else if (sl->isl_p == IPPROTO_ICMP) {
929 sprintf(t, "%s -> ", hostname(family, (u_32_t *)&sl->isl_src));
930 t += strlen(t);
931 sprintf(t, "%s PR icmp %d",
932 hostname(family, (u_32_t *)&sl->isl_dst),
933 sl->isl_itype);
934 } else if (sl->isl_p == IPPROTO_ICMPV6) {
935 sprintf(t, "%s -> ", hostname(family, (u_32_t *)&sl->isl_src));
936 t += strlen(t);
937 sprintf(t, "%s PR icmpv6 %d",
938 hostname(family, (u_32_t *)&sl->isl_dst),
939 sl->isl_itype);
940 } else {
941 sprintf(t, "%s -> ", hostname(family, (u_32_t *)&sl->isl_src));
942 t += strlen(t);
943 sprintf(t, "%s PR %s",
944 hostname(family, (u_32_t *)&sl->isl_dst), proto);
945 }
946 t += strlen(t);
947 if (sl->isl_tag != FR_NOLOGTAG) {
948 sprintf(t, " tag %u", sl->isl_tag);
949 t += strlen(t);
950 }
951 if (sl->isl_type != ISL_NEW) {
952 sprintf(t,
953 #ifdef USE_QUAD_T
954 #ifdef PRId64
955 " Forward: Pkts in %" PRId64 " Bytes in %" PRId64
956 " Pkts out %" PRId64 " Bytes out %" PRId64
957 " Backward: Pkts in %" PRId64 " Bytes in %" PRId64
958 " Pkts out %" PRId64 " Bytes out %" PRId64,
959 #else
960 " Forward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd Backward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd",
961 #endif /* PRId64 */
962 #else
963 " Forward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld Backward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld",
964 #endif
965 sl->isl_pkts[0], sl->isl_bytes[0],
966 sl->isl_pkts[1], sl->isl_bytes[1],
967 sl->isl_pkts[2], sl->isl_bytes[2],
968 sl->isl_pkts[3], sl->isl_bytes[3]);
969
970 t += strlen(t);
971 }
972
973 *t++ = '\n';
974 *t++ = '\0';
975 if (ipmonopts & IPMON_SYSLOG)
976 syslog(LOG_INFO, "%s", line);
977 else if (conf->log != NULL)
978 (void) fprintf(conf->log, "%s", line);
979 }
980
981
print_log(conf,log,buf,blen)982 static void print_log(conf, log, buf, blen)
983 config_t *conf;
984 logsource_t *log;
985 char *buf;
986 int blen;
987 {
988 char *bp, *bpo;
989 iplog_t *ipl;
990 int psize;
991
992 bp = NULL;
993 bpo = NULL;
994
995 while (blen > 0) {
996 ipl = (iplog_t *)buf;
997 if ((u_long)ipl & (sizeof(long)-1)) {
998 if (bp)
999 bpo = bp;
1000 bp = (char *)malloc(blen);
1001 bcopy((char *)ipl, bp, blen);
1002 if (bpo) {
1003 free(bpo);
1004 bpo = NULL;
1005 }
1006 buf = bp;
1007 continue;
1008 }
1009
1010 psize = ipl->ipl_dsize;
1011 if (psize > blen)
1012 break;
1013
1014 if (conf->blog != NULL) {
1015 fwrite(buf, psize, 1, conf->blog);
1016 fflush(conf->blog);
1017 }
1018
1019 if (log->logtype == IPL_LOGIPF) {
1020 if (ipl->ipl_magic == IPL_MAGIC)
1021 print_ipflog(conf, buf, psize);
1022
1023 } else if (log->logtype == IPL_LOGNAT) {
1024 if (ipl->ipl_magic == IPL_MAGIC_NAT)
1025 print_natlog(conf, buf, psize);
1026
1027 } else if (log->logtype == IPL_LOGSTATE) {
1028 if (ipl->ipl_magic == IPL_MAGIC_STATE)
1029 print_statelog(conf, buf, psize);
1030 }
1031
1032 blen -= psize;
1033 buf += psize;
1034 }
1035 if (bp)
1036 free(bp);
1037 return;
1038 }
1039
1040
print_ipflog(conf,buf,blen)1041 static void print_ipflog(conf, buf, blen)
1042 config_t *conf;
1043 char *buf;
1044 int blen;
1045 {
1046 static u_32_t seqnum = 0;
1047 int i, f, lvl, res, len, off, plen, ipoff, defaction;
1048 struct icmp *icmp;
1049 struct icmp *ic;
1050 char *t, *proto;
1051 ip_t *ipc, *ip;
1052 struct tm *tm;
1053 u_32_t *s, *d;
1054 u_short hl, p;
1055 ipflog_t *ipf;
1056 iplog_t *ipl;
1057 tcphdr_t *tp;
1058 #ifdef USE_INET6
1059 struct ip6_ext *ehp;
1060 u_short ehl;
1061 ip6_t *ip6;
1062 int go;
1063 #endif
1064
1065 ipl = (iplog_t *)buf;
1066 if (ipl->ipl_seqnum != seqnum) {
1067 if ((ipmonopts & IPMON_SYSLOG) != 0) {
1068 syslog(LOG_WARNING,
1069 "missed %u ipf log entries: %u %u",
1070 ipl->ipl_seqnum - seqnum, seqnum,
1071 ipl->ipl_seqnum);
1072 } else {
1073 (void) fprintf(conf->log,
1074 "missed %u ipf log entries: %u %u\n",
1075 ipl->ipl_seqnum - seqnum, seqnum,
1076 ipl->ipl_seqnum);
1077 }
1078 }
1079 seqnum = ipl->ipl_seqnum + ipl->ipl_count;
1080
1081 ipf = (ipflog_t *)((char *)buf + sizeof(*ipl));
1082 ip = (ip_t *)((char *)ipf + sizeof(*ipf));
1083 f = ipf->fl_family;
1084 res = (ipmonopts & IPMON_RESOLVE) ? 1 : 0;
1085 t = line;
1086 *t = '\0';
1087 tm = get_tm(ipl->ipl_sec);
1088
1089 len = sizeof(line);
1090 if (!(ipmonopts & IPMON_SYSLOG)) {
1091 (void) strftime(t, len, "%d/%m/%Y ", tm);
1092 i = strlen(t);
1093 len -= i;
1094 t += i;
1095 }
1096 (void) strftime(t, len, "%T", tm);
1097 t += strlen(t);
1098 sprintf(t, ".%-.6ld ", (long)ipl->ipl_usec);
1099 t += strlen(t);
1100 if (ipl->ipl_count > 1) {
1101 sprintf(t, "%dx ", ipl->ipl_count);
1102 t += strlen(t);
1103 }
1104 {
1105 char ifname[sizeof(ipf->fl_ifname) + 1];
1106
1107 strncpy(ifname, ipf->fl_ifname, sizeof(ipf->fl_ifname));
1108 ifname[sizeof(ipf->fl_ifname)] = '\0';
1109 sprintf(t, "%s", ifname);
1110 t += strlen(t);
1111 # if defined(MENTAT)
1112 if (ISALPHA(*(t - 1))) {
1113 sprintf(t, "%d", ipf->fl_unit);
1114 t += strlen(t);
1115 }
1116 # endif
1117 }
1118 if ((ipf->fl_group[0] == (char)~0) && (ipf->fl_group[1] == '\0'))
1119 strcat(t, " @-1:");
1120 else if (ipf->fl_group[0] == '\0')
1121 (void) strcpy(t, " @0:");
1122 else
1123 sprintf(t, " @%s:", ipf->fl_group);
1124 t += strlen(t);
1125 if (ipf->fl_rule == 0xffffffff)
1126 strcat(t, "-1 ");
1127 else
1128 sprintf(t, "%u ", ipf->fl_rule + 1);
1129 t += strlen(t);
1130
1131 lvl = LOG_NOTICE;
1132
1133 if (ipf->fl_lflags & FI_SHORT) {
1134 *t++ = 'S';
1135 lvl = LOG_ERR;
1136 }
1137
1138 if (FR_ISPASS(ipf->fl_flags)) {
1139 if (ipf->fl_flags & FR_LOGP)
1140 *t++ = 'p';
1141 else
1142 *t++ = 'P';
1143 } else if (FR_ISBLOCK(ipf->fl_flags)) {
1144 if (ipf->fl_flags & FR_LOGB)
1145 *t++ = 'b';
1146 else
1147 *t++ = 'B';
1148 lvl = LOG_WARNING;
1149 } else if ((ipf->fl_flags & FR_LOGMASK) == FR_LOG) {
1150 *t++ = 'L';
1151 lvl = LOG_INFO;
1152 } else if (ipf->fl_flags & FF_LOGNOMATCH) {
1153 *t++ = 'n';
1154 } else {
1155 *t++ = '?';
1156 lvl = LOG_EMERG;
1157 }
1158 if (ipf->fl_loglevel != 0xffff)
1159 lvl = ipf->fl_loglevel;
1160 *t++ = ' ';
1161 *t = '\0';
1162
1163 if (f == AF_INET) {
1164 hl = IP_HL(ip) << 2;
1165 ipoff = ntohs(ip->ip_off);
1166 off = ipoff & IP_OFFMASK;
1167 p = (u_short)ip->ip_p;
1168 s = (u_32_t *)&ip->ip_src;
1169 d = (u_32_t *)&ip->ip_dst;
1170 plen = ntohs(ip->ip_len);
1171 } else
1172 #ifdef USE_INET6
1173 if (f == AF_INET6) {
1174 off = 0;
1175 ipoff = 0;
1176 hl = sizeof(ip6_t);
1177 ip6 = (ip6_t *)ip;
1178 p = (u_short)ip6->ip6_nxt;
1179 s = (u_32_t *)&ip6->ip6_src;
1180 d = (u_32_t *)&ip6->ip6_dst;
1181 plen = hl + ntohs(ip6->ip6_plen);
1182 go = 1;
1183 ehp = (struct ip6_ext *)((char *)ip6 + hl);
1184 while (go == 1) {
1185 switch (p)
1186 {
1187 case IPPROTO_HOPOPTS :
1188 case IPPROTO_MOBILITY :
1189 case IPPROTO_DSTOPTS :
1190 case IPPROTO_ROUTING :
1191 case IPPROTO_AH :
1192 p = ehp->ip6e_nxt;
1193 ehl = 8 + (ehp->ip6e_len << 3);
1194 hl += ehl;
1195 ehp = (struct ip6_ext *)((char *)ehp + ehl);
1196 break;
1197 case IPPROTO_FRAGMENT :
1198 hl += sizeof(struct ip6_frag);
1199 /* FALLTHROUGH */
1200 default :
1201 go = 0;
1202 break;
1203 }
1204 }
1205 } else
1206 #endif
1207 {
1208 goto printipflog;
1209 }
1210 proto = getlocalproto(p);
1211
1212 if ((p == IPPROTO_TCP || p == IPPROTO_UDP) && !off) {
1213 tp = (tcphdr_t *)((char *)ip + hl);
1214 if (!(ipf->fl_lflags & FI_SHORT)) {
1215 sprintf(t, "%s,%s -> ", hostname(f, s),
1216 portlocalname(res, proto, (u_int)tp->th_sport));
1217 t += strlen(t);
1218 sprintf(t, "%s,%s PR %s len %hu %hu",
1219 hostname(f, d),
1220 portlocalname(res, proto, (u_int)tp->th_dport),
1221 proto, hl, plen);
1222 t += strlen(t);
1223
1224 if (p == IPPROTO_TCP) {
1225 *t++ = ' ';
1226 *t++ = '-';
1227 for (i = 0; tcpfl[i].value; i++)
1228 if (tp->th_flags & tcpfl[i].value)
1229 *t++ = tcpfl[i].flag;
1230 if (ipmonopts & IPMON_VERBOSE) {
1231 sprintf(t, " %lu %lu %hu",
1232 (u_long)(ntohl(tp->th_seq)),
1233 (u_long)(ntohl(tp->th_ack)),
1234 ntohs(tp->th_win));
1235 t += strlen(t);
1236 }
1237 }
1238 *t = '\0';
1239 } else {
1240 sprintf(t, "%s -> ", hostname(f, s));
1241 t += strlen(t);
1242 sprintf(t, "%s PR %s len %hu %hu",
1243 hostname(f, d), proto, hl, plen);
1244 }
1245 #if defined(AF_INET6) && defined(IPPROTO_ICMPV6)
1246 } else if ((p == IPPROTO_ICMPV6) && !off && (f == AF_INET6)) {
1247 ic = (struct icmp *)((char *)ip + hl);
1248 sprintf(t, "%s -> ", hostname(f, s));
1249 t += strlen(t);
1250 sprintf(t, "%s PR icmpv6 len %hu %hu icmpv6 %s",
1251 hostname(f, d), hl, plen,
1252 icmpname6(ic->icmp_type, ic->icmp_code));
1253 #endif
1254 } else if ((p == IPPROTO_ICMP) && !off && (f == AF_INET)) {
1255 ic = (struct icmp *)((char *)ip + hl);
1256 sprintf(t, "%s -> ", hostname(f, s));
1257 t += strlen(t);
1258 sprintf(t, "%s PR icmp len %hu %hu icmp %s",
1259 hostname(f, d), hl, plen,
1260 icmpname(ic->icmp_type, ic->icmp_code));
1261 if (ic->icmp_type == ICMP_UNREACH ||
1262 ic->icmp_type == ICMP_SOURCEQUENCH ||
1263 ic->icmp_type == ICMP_PARAMPROB ||
1264 ic->icmp_type == ICMP_REDIRECT ||
1265 ic->icmp_type == ICMP_TIMXCEED) {
1266 ipc = &ic->icmp_ip;
1267 i = ntohs(ipc->ip_len);
1268 /*
1269 * XXX - try to guess endian of ip_len in ICMP
1270 * returned data.
1271 */
1272 if (i > 1500)
1273 i = ipc->ip_len;
1274 ipoff = ntohs(ipc->ip_off);
1275 proto = getlocalproto(ipc->ip_p);
1276
1277 if (!(ipoff & IP_OFFMASK) &&
1278 ((ipc->ip_p == IPPROTO_TCP) ||
1279 (ipc->ip_p == IPPROTO_UDP))) {
1280 tp = (tcphdr_t *)((char *)ipc + hl);
1281 t += strlen(t);
1282 sprintf(t, " for %s,%s -",
1283 HOSTNAMEV4(ipc->ip_src),
1284 portlocalname(res, proto,
1285 (u_int)tp->th_sport));
1286 t += strlen(t);
1287 sprintf(t, " %s,%s PR %s len %hu %hu",
1288 HOSTNAMEV4(ipc->ip_dst),
1289 portlocalname(res, proto,
1290 (u_int)tp->th_dport),
1291 proto, IP_HL(ipc) << 2, i);
1292 } else if (!(ipoff & IP_OFFMASK) &&
1293 (ipc->ip_p == IPPROTO_ICMP)) {
1294 icmp = (icmphdr_t *)((char *)ipc + hl);
1295
1296 t += strlen(t);
1297 sprintf(t, " for %s -",
1298 HOSTNAMEV4(ipc->ip_src));
1299 t += strlen(t);
1300 sprintf(t,
1301 " %s PR icmp len %hu %hu icmp %d/%d",
1302 HOSTNAMEV4(ipc->ip_dst),
1303 IP_HL(ipc) << 2, i,
1304 icmp->icmp_type, icmp->icmp_code);
1305 } else {
1306 t += strlen(t);
1307 sprintf(t, " for %s -",
1308 HOSTNAMEV4(ipc->ip_src));
1309 t += strlen(t);
1310 sprintf(t, " %s PR %s len %hu (%hu)",
1311 HOSTNAMEV4(ipc->ip_dst), proto,
1312 IP_HL(ipc) << 2, i);
1313 t += strlen(t);
1314 if (ipoff & IP_OFFMASK) {
1315 sprintf(t, "(frag %d:%hu@%hu%s%s)",
1316 ntohs(ipc->ip_id),
1317 i - (IP_HL(ipc) << 2),
1318 (ipoff & IP_OFFMASK) << 3,
1319 ipoff & IP_MF ? "+" : "",
1320 ipoff & IP_DF ? "-" : "");
1321 }
1322 }
1323
1324 }
1325 } else {
1326 sprintf(t, "%s -> ", hostname(f, s));
1327 t += strlen(t);
1328 sprintf(t, "%s PR %s len %hu (%hu)",
1329 hostname(f, d), proto, hl, plen);
1330 t += strlen(t);
1331 if (off & IP_OFFMASK)
1332 sprintf(t, " (frag %d:%hu@%hu%s%s)",
1333 ntohs(ip->ip_id),
1334 plen - hl, (off & IP_OFFMASK) << 3,
1335 ipoff & IP_MF ? "+" : "",
1336 ipoff & IP_DF ? "-" : "");
1337 }
1338 t += strlen(t);
1339
1340 printipflog:
1341 if (ipf->fl_flags & FR_KEEPSTATE) {
1342 (void) strcpy(t, " K-S");
1343 t += strlen(t);
1344 }
1345
1346 if (ipf->fl_flags & FR_KEEPFRAG) {
1347 (void) strcpy(t, " K-F");
1348 t += strlen(t);
1349 }
1350
1351 if (ipf->fl_dir == 0)
1352 strcpy(t, " IN");
1353 else if (ipf->fl_dir == 1)
1354 strcpy(t, " OUT");
1355 t += strlen(t);
1356 if (ipf->fl_logtag != 0) {
1357 sprintf(t, " log-tag %d", ipf->fl_logtag);
1358 t += strlen(t);
1359 }
1360 if (ipf->fl_nattag.ipt_num[0] != 0) {
1361 strcpy(t, " nat-tag ");
1362 t += strlen(t);
1363 strncpy(t, ipf->fl_nattag.ipt_tag, sizeof(ipf->fl_nattag));
1364 t += strlen(t);
1365 }
1366 if ((ipf->fl_lflags & FI_LOWTTL) != 0) {
1367 strcpy(t, " low-ttl");
1368 t += 8;
1369 }
1370 if ((ipf->fl_lflags & FI_OOW) != 0) {
1371 strcpy(t, " OOW");
1372 t += 4;
1373 }
1374 if ((ipf->fl_lflags & FI_BAD) != 0) {
1375 strcpy(t, " bad");
1376 t += 4;
1377 }
1378 if ((ipf->fl_lflags & FI_NATED) != 0) {
1379 strcpy(t, " NAT");
1380 t += 4;
1381 }
1382 if ((ipf->fl_lflags & FI_BADNAT) != 0) {
1383 strcpy(t, " bad-NAT");
1384 t += 8;
1385 }
1386 if ((ipf->fl_lflags & FI_BADSRC) != 0) {
1387 strcpy(t, " bad-src");
1388 t += 8;
1389 }
1390 if ((ipf->fl_lflags & FI_MULTICAST) != 0) {
1391 strcpy(t, " multicast");
1392 t += 10;
1393 }
1394 if ((ipf->fl_lflags & FI_BROADCAST) != 0) {
1395 strcpy(t, " broadcast");
1396 t += 10;
1397 }
1398 if ((ipf->fl_lflags & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST)) ==
1399 FI_MBCAST) {
1400 strcpy(t, " mbcast");
1401 t += 7;
1402 }
1403 if (ipf->fl_breason != 0) {
1404 strcpy(t, " reason:");
1405 t += 8;
1406 strcpy(t, reasons[ipf->fl_breason]);
1407 t += strlen(reasons[ipf->fl_breason]);
1408 }
1409 *t++ = '\n';
1410 *t++ = '\0';
1411 defaction = 0;
1412 if (conf->cfile != NULL)
1413 defaction = check_action(buf, line, ipmonopts, lvl);
1414
1415 if (defaction == 0) {
1416 if (ipmonopts & IPMON_SYSLOG) {
1417 syslog(lvl, "%s", line);
1418 } else if (conf->log != NULL) {
1419 (void) fprintf(conf->log, "%s", line);
1420 }
1421
1422 if (ipmonopts & IPMON_HEXHDR) {
1423 dumphex(conf->log, ipmonopts, buf,
1424 sizeof(iplog_t) + sizeof(*ipf));
1425 }
1426 if (ipmonopts & IPMON_HEXBODY) {
1427 dumphex(conf->log, ipmonopts, (char *)ip,
1428 ipf->fl_plen + ipf->fl_hlen);
1429 } else if ((ipmonopts & IPMON_LOGBODY) &&
1430 (ipf->fl_flags & FR_LOGBODY)) {
1431 dumphex(conf->log, ipmonopts, (char *)ip + ipf->fl_hlen,
1432 ipf->fl_plen);
1433 }
1434 }
1435 }
1436
1437
usage(prog)1438 static void usage(prog)
1439 char *prog;
1440 {
1441 fprintf(stderr, "Usage: %s [ -abDFhnpstvxX ] [ -B <binary-logfile> ] [ -C <config-file> ]\n"
1442 "\t[ -f <device> ] [ -L <facility> ] [ -N <device> ]\n"
1443 "\t[ -o [NSI] ] [ -O [NSI] ] [ -P <pidfile> ] [ -S <device> ]\n"
1444 "\t[ <filename> ]\n", prog);
1445 exit(1);
1446 }
1447
1448
write_pid(file)1449 static void write_pid(file)
1450 char *file;
1451 {
1452 FILE *fp = NULL;
1453 int fd;
1454
1455 if ((fd = open(file, O_CREAT|O_TRUNC|O_WRONLY, 0644)) >= 0) {
1456 fp = fdopen(fd, "w");
1457 if (fp == NULL) {
1458 close(fd);
1459 fprintf(stderr,
1460 "unable to open/create pid file: %s\n", file);
1461 return;
1462 }
1463 fprintf(fp, "%d", getpid());
1464 fclose(fp);
1465 }
1466 }
1467
1468
flushlogs(file,log)1469 static void flushlogs(file, log)
1470 char *file;
1471 FILE *log;
1472 {
1473 int fd, flushed = 0;
1474
1475 if ((fd = open(file, O_RDWR)) == -1) {
1476 (void) fprintf(stderr, "%s: open: %s\n",
1477 file, STRERROR(errno));
1478 exit(1);
1479 }
1480
1481 if (ioctl(fd, SIOCIPFFB, &flushed) == 0) {
1482 printf("%d bytes flushed from log buffer\n",
1483 flushed);
1484 fflush(stdout);
1485 } else
1486 ipferror(fd, "SIOCIPFFB");
1487 (void) close(fd);
1488
1489 if (flushed) {
1490 if (ipmonopts & IPMON_SYSLOG) {
1491 syslog(LOG_INFO, "%d bytes flushed from log\n",
1492 flushed);
1493 } else if ((log != stdout) && (log != NULL)) {
1494 fprintf(log, "%d bytes flushed from log\n", flushed);
1495 }
1496 }
1497 }
1498
1499
logopts(turnon,options)1500 static void logopts(turnon, options)
1501 int turnon;
1502 char *options;
1503 {
1504 int flags = 0;
1505 char *s;
1506
1507 for (s = options; *s; s++)
1508 {
1509 switch (*s)
1510 {
1511 case 'N' :
1512 flags |= IPMON_NAT;
1513 break;
1514 case 'S' :
1515 flags |= IPMON_STATE;
1516 break;
1517 case 'I' :
1518 flags |= IPMON_FILTER;
1519 break;
1520 default :
1521 fprintf(stderr, "Unknown log option %c\n", *s);
1522 exit(1);
1523 }
1524 }
1525
1526 if (turnon)
1527 ipmonopts |= flags;
1528 else
1529 ipmonopts &= ~(flags);
1530 }
1531
initconfig(config_t * conf)1532 static void initconfig(config_t *conf)
1533 {
1534 int i;
1535
1536 memset(conf, 0, sizeof(*conf));
1537
1538 conf->log = stdout;
1539 conf->maxfd = -1;
1540
1541 for (i = 0; i < 3; i++) {
1542 conf->logsrc[i].fd = -1;
1543 conf->logsrc[i].logtype = -1;
1544 conf->logsrc[i].regular = -1;
1545 }
1546
1547 conf->logsrc[0].file = IPL_NAME;
1548 conf->logsrc[1].file = IPNAT_NAME;
1549 conf->logsrc[2].file = IPSTATE_NAME;
1550
1551 add_doing(&executesaver);
1552 add_doing(&snmpv1saver);
1553 add_doing(&snmpv2saver);
1554 add_doing(&syslogsaver);
1555 add_doing(&filesaver);
1556 add_doing(¬hingsaver);
1557 }
1558
1559
main(argc,argv)1560 int main(argc, argv)
1561 int argc;
1562 char *argv[];
1563 {
1564 int doread, c, make_daemon = 0;
1565 char *prog;
1566 config_t config;
1567
1568 prog = strrchr(argv[0], '/');
1569 if (prog == NULL)
1570 prog = argv[0];
1571 else
1572 prog++;
1573
1574 initconfig(&config);
1575
1576 while ((c = getopt(argc, argv,
1577 "?abB:C:Df:FhL:nN:o:O:pP:sS:tvxX")) != -1)
1578 switch (c)
1579 {
1580 case 'a' :
1581 ipmonopts |= IPMON_LOGALL;
1582 config.logsrc[0].logtype = IPL_LOGIPF;
1583 config.logsrc[1].logtype = IPL_LOGNAT;
1584 config.logsrc[2].logtype = IPL_LOGSTATE;
1585 break;
1586 case 'b' :
1587 ipmonopts |= IPMON_LOGBODY;
1588 break;
1589 case 'B' :
1590 config.bfile = optarg;
1591 config.blog = fopen(optarg, "a");
1592 break;
1593 case 'C' :
1594 config.cfile = optarg;
1595 break;
1596 case 'D' :
1597 make_daemon = 1;
1598 break;
1599 case 'f' : case 'I' :
1600 ipmonopts |= IPMON_FILTER;
1601 config.logsrc[0].logtype = IPL_LOGIPF;
1602 config.logsrc[0].file = optarg;
1603 break;
1604 case 'F' :
1605 flushlogs(config.logsrc[0].file, config.log);
1606 flushlogs(config.logsrc[1].file, config.log);
1607 flushlogs(config.logsrc[2].file, config.log);
1608 break;
1609 case 'L' :
1610 logfac = fac_findname(optarg);
1611 if (logfac == -1) {
1612 fprintf(stderr,
1613 "Unknown syslog facility '%s'\n",
1614 optarg);
1615 exit(1);
1616 }
1617 break;
1618 case 'n' :
1619 ipmonopts |= IPMON_RESOLVE;
1620 opts &= ~OPT_NORESOLVE;
1621 break;
1622 case 'N' :
1623 ipmonopts |= IPMON_NAT;
1624 config.logsrc[1].logtype = IPL_LOGNAT;
1625 config.logsrc[1].file = optarg;
1626 break;
1627 case 'o' : case 'O' :
1628 logopts(c == 'o', optarg);
1629 if (ipmonopts & IPMON_FILTER)
1630 config.logsrc[0].logtype = IPL_LOGIPF;
1631 if (ipmonopts & IPMON_NAT)
1632 config.logsrc[1].logtype = IPL_LOGNAT;
1633 if (ipmonopts & IPMON_STATE)
1634 config.logsrc[2].logtype = IPL_LOGSTATE;
1635 break;
1636 case 'p' :
1637 ipmonopts |= IPMON_PORTNUM;
1638 break;
1639 case 'P' :
1640 pidfile = optarg;
1641 break;
1642 case 's' :
1643 ipmonopts |= IPMON_SYSLOG;
1644 config.log = NULL;
1645 break;
1646 case 'S' :
1647 ipmonopts |= IPMON_STATE;
1648 config.logsrc[2].logtype = IPL_LOGSTATE;
1649 config.logsrc[2].file = optarg;
1650 break;
1651 case 't' :
1652 ipmonopts |= IPMON_TAIL;
1653 break;
1654 case 'v' :
1655 ipmonopts |= IPMON_VERBOSE;
1656 break;
1657 case 'x' :
1658 ipmonopts |= IPMON_HEXBODY;
1659 break;
1660 case 'X' :
1661 ipmonopts |= IPMON_HEXHDR;
1662 break;
1663 default :
1664 case 'h' :
1665 case '?' :
1666 usage(argv[0]);
1667 }
1668
1669 if (ipmonopts & IPMON_SYSLOG)
1670 openlog(prog, LOG_NDELAY|LOG_PID, logfac);
1671
1672 init_tabs();
1673 if (config.cfile)
1674 if (load_config(config.cfile) == -1) {
1675 unload_config();
1676 exit(1);
1677 }
1678
1679 /*
1680 * Default action is to only open the filter log file.
1681 */
1682 if ((config.logsrc[0].logtype == -1) &&
1683 (config.logsrc[0].logtype == -1) &&
1684 (config.logsrc[0].logtype == -1))
1685 config.logsrc[0].logtype = IPL_LOGIPF;
1686
1687 openlogs(&config);
1688
1689 if (!(ipmonopts & IPMON_SYSLOG)) {
1690 config.file = argv[optind];
1691 config.log = config.file ? fopen(config.file, "a") : stdout;
1692 if (config.log == NULL) {
1693 (void) fprintf(stderr, "%s: fopen: %s\n",
1694 argv[optind], STRERROR(errno));
1695 exit(1);
1696 /* NOTREACHED */
1697 }
1698 setvbuf(config.log, NULL, _IONBF, 0);
1699 } else {
1700 config.log = NULL;
1701 }
1702
1703 if (make_daemon &&
1704 ((config.log != stdout) || (ipmonopts & IPMON_SYSLOG))) {
1705 #if BSD >= 199306
1706 daemon(0, !(ipmonopts & IPMON_SYSLOG));
1707 #else
1708 int pid;
1709
1710 switch (fork())
1711 {
1712 case -1 :
1713 (void) fprintf(stderr, "%s: fork() failed: %s\n",
1714 argv[0], STRERROR(errno));
1715 exit(1);
1716 /* NOTREACHED */
1717 case 0 :
1718 break;
1719 default :
1720 exit(0);
1721 }
1722
1723 setsid();
1724 if ((ipmonopts & IPMON_SYSLOG))
1725 close(2);
1726 #endif /* !BSD */
1727 close(0);
1728 close(1);
1729 write_pid(pidfile);
1730 }
1731
1732 signal(SIGHUP, handlehup);
1733
1734 for (doread = 1; doread; )
1735 doread = read_loginfo(&config);
1736
1737 unload_config();
1738
1739 return(0);
1740 /* NOTREACHED */
1741 }
1742
1743
openlogs(config_t * conf)1744 static void openlogs(config_t *conf)
1745 {
1746 logsource_t *l;
1747 struct stat sb;
1748 int i;
1749
1750 for (i = 0; i < 3; i++) {
1751 l = &conf->logsrc[i];
1752 if (l->logtype == -1)
1753 continue;
1754 if (!strcmp(l->file, "-"))
1755 l->fd = 0;
1756 else {
1757 if ((l->fd= open(l->file, O_RDONLY)) == -1) {
1758 (void) fprintf(stderr,
1759 "%s: open: %s\n", l->file,
1760 STRERROR(errno));
1761 exit(1);
1762 /* NOTREACHED */
1763 }
1764
1765 if (fstat(l->fd, &sb) == -1) {
1766 (void) fprintf(stderr, "%d: fstat: %s\n",
1767 l->fd, STRERROR(errno));
1768 exit(1);
1769 /* NOTREACHED */
1770 }
1771
1772 l->regular = !S_ISCHR(sb.st_mode);
1773 if (l->regular)
1774 l->size = sb.st_size;
1775
1776 FD_SET(l->fd, &conf->fdmr);
1777 if (l->fd > conf->maxfd)
1778 conf->maxfd = l->fd;
1779 }
1780 }
1781 }
1782
1783
read_loginfo(config_t * conf)1784 static int read_loginfo(config_t *conf)
1785 {
1786 iplog_t buf[DEFAULT_IPFLOGSIZE/sizeof(iplog_t)+1];
1787 int n, tr, nr, i;
1788 logsource_t *l;
1789 fd_set fdr;
1790
1791 fdr = conf->fdmr;
1792
1793 n = select(conf->maxfd + 1, &fdr, NULL, NULL, NULL);
1794 if (n == 0)
1795 return 1;
1796 if (n == -1) {
1797 if (errno == EINTR)
1798 return 1;
1799 return -1;
1800 }
1801
1802 for (i = 0, nr = 0; i < 3; i++) {
1803 l = &conf->logsrc[i];
1804
1805 if ((l->logtype == -1) || !FD_ISSET(l->fd, &fdr))
1806 continue;
1807
1808 tr = 0;
1809 if (l->regular) {
1810 tr = (lseek(l->fd, 0, SEEK_CUR) < l->size);
1811 if (!tr && !(ipmonopts & IPMON_TAIL))
1812 return 0;
1813 }
1814
1815 n = 0;
1816 tr = read_log(l->fd, &n, (char *)buf, sizeof(buf));
1817 if (donehup) {
1818 if (conf->file != NULL) {
1819 if (conf->log != NULL) {
1820 fclose(conf->log);
1821 conf->log = NULL;
1822 }
1823 conf->log = fopen(conf->file, "a");
1824 }
1825
1826 if (conf->bfile != NULL) {
1827 if (conf->blog != NULL) {
1828 fclose(conf->blog);
1829 conf->blog = NULL;
1830 }
1831 conf->blog = fopen(conf->bfile, "a");
1832 }
1833
1834 init_tabs();
1835 if (conf->cfile != NULL)
1836 load_config(conf->cfile);
1837 donehup = 0;
1838 }
1839
1840 switch (tr)
1841 {
1842 case -1 :
1843 if (ipmonopts & IPMON_SYSLOG)
1844 syslog(LOG_CRIT, "read: %m\n");
1845 else {
1846 ipferror(l->fd, "read");
1847 }
1848 return 0;
1849 case 1 :
1850 if (ipmonopts & IPMON_SYSLOG)
1851 syslog(LOG_CRIT, "aborting logging\n");
1852 else if (conf->log != NULL)
1853 fprintf(conf->log, "aborting logging\n");
1854 return 0;
1855 case 2 :
1856 break;
1857 case 0 :
1858 nr += tr;
1859 if (n > 0) {
1860 print_log(conf, l, (char *)buf, n);
1861 if (!(ipmonopts & IPMON_SYSLOG))
1862 fflush(conf->log);
1863 }
1864 break;
1865 }
1866 }
1867
1868 if (!nr && (ipmonopts & IPMON_TAIL))
1869 sleep(1);
1870
1871 return 1;
1872 }
1873