Date: Mon, 31 Jan 2011 12:06:35 +0100 From: Daniel Hartmeier <daniel@benzedrine.cx> To: Kevin Wilcox <kevin.wilcox@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: log NAT translations Message-ID: <20110131110635.GA5861@insomnia.benzedrine.cx> In-Reply-To: <AANLkTim9JeLdYpnUkruKZuGC9WVr-mk75xd62o9ML06q@mail.gmail.com> References: <AANLkTim9JeLdYpnUkruKZuGC9WVr-mk75xd62o9ML06q@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 27, 2011 at 11:33:51AM -0500, Kevin Wilcox wrote:
> Before I write something to interpret state changes from pfsync, can
> anyone offer guidance on how to pull those translations?
pfsync should be the simplest source to get that information from,
the idea is that you can use tcpdump on the pfsync interface to
filter and print any state changes.
It seems neither the stock tcpdump nor the one from ports actually
does this (yet) in FreeBSD. That's a pity, since it's sometimes
a very useful feature, not just for debugging.
The patch below adds this to the stock tcpdump (against 8.2),
so you can run
# tcpdump -s 1600 -npi pfsync0 'ether[2]!=2'
to get output like
11:56:24.843786 11:56:24.843786 INS ST:
all icmp 172.17.227.9:512 <- 192.168.107.134 0:0
11:56:27.285591 11:56:27.285591 DEL ST:
all icmp 172.17.227.9:16 <- 192.168.107.25 0:0
If the states involve address translation, you'll see three
pairs of addresses/ports, including before/after translation.
The filter 'ether[2]!=2' means 'any action except update', as
the ether layer in this context means struct pfsync_header, see
/usr/include/net/if_pfsync.h. Updates are chatty, inserts and
deletions usually less so.
There are probably more pieces to be lifted from OpenBSD's
tcpdump, but this might be enough or at least a good start.
You can use other tcpdump options, like write to a pcap file,
then later use tcpdump to read that file and search for specific
time slices, etc.
HTH,
Daniel
Index: usr.sbin/tcpdump/tcpdump/Makefile
===================================================================
RCS file: /home/ncvs/src/usr.sbin/tcpdump/tcpdump/Makefile,v
retrieving revision 1.47.2.1
diff -u -r1.47.2.1 Makefile
--- usr.sbin/tcpdump/tcpdump/Makefile 3 Aug 2009 08:13:06 -0000 1.47.2.1
+++ usr.sbin/tcpdump/tcpdump/Makefile 31 Jan 2011 10:42:07 -0000
@@ -61,6 +61,9 @@
.if ${MK_PF} != "no"
SRCS+= print-pflog.c
+SRCS+= print-pfsync.c
+SRCS+= pf_print_state.c
+CFLAGS+= -I/usr/src/contrib/pf/pfctl
CFLAGS+= -DHAVE_NET_PFVAR_H
.endif
Index: contrib/tcpdump/interface.h
===================================================================
RCS file: /home/ncvs/src/contrib/tcpdump/interface.h,v
retrieving revision 1.14.2.1
diff -u -r1.14.2.1 interface.h
--- contrib/tcpdump/interface.h 3 Aug 2009 08:13:06 -0000 1.14.2.1
+++ contrib/tcpdump/interface.h 31 Jan 2011 09:37:35 -0000
@@ -203,6 +203,7 @@
extern void egp_print(const u_char *, u_int);
extern u_int enc_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int pflog_if_print(const struct pcap_pkthdr *, const u_char *);
+extern u_int pfsync_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int arcnet_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int arcnet_linux_if_print(const struct pcap_pkthdr *, const u_char *);
extern void ether_print(const u_char *, u_int, u_int);
Index: contrib/tcpdump/tcpdump.c
===================================================================
RCS file: /home/ncvs/src/contrib/tcpdump/tcpdump.c,v
retrieving revision 1.14.2.1
diff -u -r1.14.2.1 tcpdump.c
--- contrib/tcpdump/tcpdump.c 3 Aug 2009 08:13:06 -0000 1.14.2.1
+++ contrib/tcpdump/tcpdump.c 31 Jan 2011 09:35:23 -0000
@@ -197,6 +197,9 @@
#if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H)
{ pflog_if_print, DLT_PFLOG },
#endif
+#if defined(DLT_PFSYNC) && defined(HAVE_NET_PFVAR_H)
+ { pfsync_if_print, DLT_PFSYNC },
+#endif
#ifdef DLT_FR
{ fr_if_print, DLT_FR },
#endif
--- /dev/null 2011-01-31 11:44:00.000000000 +0100
+++ contrib/tcpdump/print-pfsync.c 2011-01-31 11:09:28.000000000 +0100
@@ -0,0 +1,247 @@
+/* $OpenBSD: print-pfsync.c,v 1.29 2005/11/04 08:24:15 mcbride Exp $ */
+
+/*
+ * Copyright (c) 2002 Michael Shalayeff
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef lint
+static const char rcsid[] =
+ "@(#) $Header: /open/anoncvs/cvs/src/usr.sbin/tcpdump/print-pfsync.c,v 1.29 2005/11/04 08:24:15 mcbride Exp $";
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifndef HAVE_NET_PFVAR_H
+#error "No pf headers available"
+#endif
+#include <sys/endian.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <net/if.h>
+#include <net/pfvar.h>
+#define PFSYNC_TDB
+#include <net/if_pfsync.h>
+
+#include <tcpdump-stdinc.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <strings.h>
+#include <pcap.h>
+
+#include "interface.h"
+#include "addrtoname.h"
+#include "pfctl_parser.h"
+
+
+const char *pfsync_acts[] = { PFSYNC_ACTIONS };
+
+void pfsync_print(struct pfsync_header *, int);
+void print_state(struct pf_state *, int);
+
+/*
+void
+pfsync_if_print(u_char *user, const struct pcap_pkthdr *h,
+ register const u_char *p)
+*/
+u_int
+pfsync_if_print(const struct pcap_pkthdr *h, register const u_char *p)
+{
+ u_int caplen = h->caplen;
+
+ ts_print(&h->ts);
+
+ if (caplen < PFSYNC_HDRLEN) {
+ printf("[|pfsync]");
+ goto out;
+ }
+
+ pfsync_print((struct pfsync_header *)p,
+ caplen - sizeof(struct pfsync_header));
+out:
+ if (xflag) {
+ default_print((const u_char *)h, caplen);
+ }
+ putchar('\n');
+}
+
+void
+pfsync_ip_print(const u_char *bp, u_int len, const u_char *bp2)
+{
+ struct pfsync_header *hdr = (struct pfsync_header *)bp;
+ struct ip *ip = (struct ip *)bp2;
+
+ if (vflag)
+ printf("%s > %s: ", ipaddr_string(&ip->ip_src),
+ ipaddr_string(&ip->ip_dst));
+ else
+ printf("%s: ", ipaddr_string(&ip->ip_src));
+
+ if (len < PFSYNC_HDRLEN)
+ printf("[|pfsync]");
+ else
+ pfsync_print(hdr, (len - sizeof(struct pfsync_header)));
+ putchar('\n');
+}
+
+void
+pfsync_print(struct pfsync_header *hdr, int len)
+{
+ struct pfsync_state *s;
+ struct pfsync_state_upd *u;
+ struct pfsync_state_del *d;
+ struct pfsync_state_clr *c;
+ struct pfsync_state_upd_req *r;
+ struct pfsync_state_bus *b;
+ struct pfsync_tdb *t;
+ int i, flags = 0, min, sec;
+ u_int64_t id;
+
+ if (eflag)
+ printf("PFSYNCv%d count %d: ",
+ hdr->version, hdr->count);
+
+ if (hdr->action < PFSYNC_ACT_MAX)
+ printf("%s:", pfsync_acts[hdr->action]);
+ else
+ printf("%d?:", hdr->action);
+
+ if (vflag)
+ flags |= PF_OPT_VERBOSE;
+ if (vflag > 1)
+ flags |= PF_OPT_VERBOSE2;
+ if (!nflag)
+ flags |= PF_OPT_USEDNS;
+
+ switch (hdr->action) {
+ case PFSYNC_ACT_CLR:
+ if (sizeof(*c) <= len) {
+ c = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ printf("\n\tcreatorid: %08x", htonl(c->creatorid));
+ if (c->ifname[0] != '\0')
+ printf(" interface: %s", c->ifname);
+ }
+ case PFSYNC_ACT_INS:
+ case PFSYNC_ACT_UPD:
+ case PFSYNC_ACT_DEL:
+ for (i = 1, s = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ i <= hdr->count && i * sizeof(*s) <= len; i++, s++) {
+ struct pf_state st;
+
+ bzero(&st, sizeof(st));
+ bcopy(&s->id, &st.id, sizeof(st.id));
+ strlcpy(st.u.ifname, s->ifname, sizeof(st.u.ifname));
+ pf_state_host_ntoh(&s->lan, &st.lan);
+ pf_state_host_ntoh(&s->gwy, &st.gwy);
+ pf_state_host_ntoh(&s->ext, &st.ext);
+ pf_state_peer_ntoh(&s->src, &st.src);
+ pf_state_peer_ntoh(&s->dst, &st.dst);
+ st.rule.nr = ntohl(s->rule);
+ st.nat_rule.nr = ntohl(s->nat_rule);
+ st.anchor.nr = ntohl(s->anchor);
+ bcopy(&s->rt_addr, &st.rt_addr, sizeof(st.rt_addr));
+ st.creation = ntohl(s->creation);
+ st.expire = ntohl(s->expire);
+ pf_state_counter_ntoh(s->packets[0], st.packets[0]);
+ pf_state_counter_ntoh(s->packets[1], st.packets[1]);
+ pf_state_counter_ntoh(s->bytes[0], st.bytes[0]);
+ pf_state_counter_ntoh(s->bytes[1], st.bytes[1]);
+ st.creatorid = s->creatorid;
+ st.af = s->af;
+ st.proto = s->proto;
+ st.direction = s->direction;
+ st.log = s->log;
+ st.timeout = s->timeout;
+ st.sync_flags = s->sync_flags;
+
+ putchar('\n');
+ print_state(&st, flags);
+ if (vflag > 1 && hdr->action == PFSYNC_ACT_UPD)
+ printf(" updates: %d", s->updates);
+ }
+ break;
+ case PFSYNC_ACT_UPD_C:
+ for (i = 1, u = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ i <= hdr->count && i * sizeof(*u) <= len; i++, u++) {
+ bcopy(&u->id, &id, sizeof(id));
+ printf("\n\tid: %016llx creatorid: %08x",
+ be64toh(id), ntohl(u->creatorid));
+ if (vflag > 1)
+ printf(" updates: %d", u->updates);
+ }
+ break;
+ case PFSYNC_ACT_DEL_C:
+ for (i = 1, d = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ i <= hdr->count && i * sizeof(*d) <= len; i++, d++) {
+ bcopy(&d->id, &id, sizeof(id));
+ printf("\n\tid: %016llx creatorid: %08x",
+ be64toh(id), ntohl(d->creatorid));
+ }
+ break;
+ case PFSYNC_ACT_UREQ:
+ for (i = 1, r = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ i <= hdr->count && i * sizeof(*r) <= len; i++, r++) {
+ bcopy(&r->id, &id, sizeof(id));
+ printf("\n\tid: %016llx creatorid: %08x",
+ be64toh(id), ntohl(r->creatorid));
+ }
+ break;
+ case PFSYNC_ACT_BUS:
+ if (sizeof(*b) <= len) {
+ b = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ printf("\n\tcreatorid: %08x", htonl(b->creatorid));
+ sec = b->endtime % 60;
+ b->endtime /= 60;
+ min = b->endtime % 60;
+ b->endtime /= 60;
+ printf(" age %.2u:%.2u:%.2u", b->endtime, min, sec);
+ switch (b->status) {
+ case PFSYNC_BUS_START:
+ printf(" status: start");
+ break;
+ case PFSYNC_BUS_END:
+ printf(" status: end");
+ break;
+ default:
+ printf(" status: ?");
+ break;
+ }
+ }
+ break;
+ case PFSYNC_ACT_TDB_UPD:
+ for (i = 1, t = (void *)((char *)hdr + PFSYNC_HDRLEN);
+ i <= hdr->count && i * sizeof(*t) <= len; i++, t++)
+ printf("\n\tspi: %08x rpl: %u cur_bytes: %llu",
+ htonl(t->spi), htonl(t->rpl),
+ be64toh(t->cur_bytes));
+ break;
+ default:
+ break;
+ }
+}
--- /dev/null 2011-01-31 11:44:00.000000000 +0100
+++ contrib/tcpdump/pf_print_state.c 2010-01-23 01:32:19.000000000 +0100
@@ -0,0 +1,332 @@
+/* $OpenBSD: pf_print_state.c,v 1.44 2007/03/01 17:20:53 deraadt Exp $ */
+
+/*
+ * Copyright (c) 2001 Daniel Hartmeier
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * - Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following
+ * disclaimer in the documentation and/or other materials provided
+ * with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: src/contrib/pf/pfctl/pf_print_state.c,v 1.4.10.2 2010/01/23 00:32:19 delphij Exp $");
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/endian.h>
+#include <net/if.h>
+#define TCPSTATES
+#include <netinet/tcp_fsm.h>
+#include <net/pfvar.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include "pfctl_parser.h"
+#include "pfctl.h"
+
+void print_name(struct pf_addr *, sa_family_t);
+
+void
+print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
+{
+ switch (addr->type) {
+ case PF_ADDR_DYNIFTL:
+ printf("(%s", addr->v.ifname);
+ if (addr->iflags & PFI_AFLAG_NETWORK)
+ printf(":network");
+ if (addr->iflags & PFI_AFLAG_BROADCAST)
+ printf(":broadcast");
+ if (addr->iflags & PFI_AFLAG_PEER)
+ printf(":peer");
+ if (addr->iflags & PFI_AFLAG_NOALIAS)
+ printf(":0");
+ if (verbose) {
+ if (addr->p.dyncnt <= 0)
+ printf(":*");
+ else
+ printf(":%d", addr->p.dyncnt);
+ }
+ printf(")");
+ break;
+ case PF_ADDR_TABLE:
+ if (verbose)
+ if (addr->p.tblcnt == -1)
+ printf("<%s:*>", addr->v.tblname);
+ else
+ printf("<%s:%d>", addr->v.tblname,
+ addr->p.tblcnt);
+ else
+ printf("<%s>", addr->v.tblname);
+ return;
+ case PF_ADDR_ADDRMASK:
+ if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
+ PF_AZERO(&addr->v.a.mask, AF_INET6))
+ printf("any");
+ else {
+ char buf[48];
+
+ if (inet_ntop(af, &addr->v.a.addr, buf,
+ sizeof(buf)) == NULL)
+ printf("?");
+ else
+ printf("%s", buf);
+ }
+ break;
+ case PF_ADDR_NOROUTE:
+ printf("no-route");
+ return;
+ case PF_ADDR_URPFFAILED:
+ printf("urpf-failed");
+ return;
+ case PF_ADDR_RTLABEL:
+ printf("route \"%s\"", addr->v.rtlabelname);
+ return;
+ default:
+ printf("?");
+ return;
+ }
+
+ /* mask if not _both_ address and mask are zero */
+ if (!(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
+ PF_AZERO(&addr->v.a.mask, AF_INET6))) {
+ int bits = unmask(&addr->v.a.mask, af);
+
+ if (bits != (af == AF_INET ? 32 : 128))
+ printf("/%d", bits);
+ }
+}
+
+void
+print_name(struct pf_addr *addr, sa_family_t af)
+{
+ char host[NI_MAXHOST];
+
+ strlcpy(host, "?", sizeof(host));
+ switch (af) {
+ case AF_INET: {
+ struct sockaddr_in sin;
+
+ memset(&sin, 0, sizeof(sin));
+ sin.sin_len = sizeof(sin);
+ sin.sin_family = AF_INET;
+ sin.sin_addr = addr->v4;
+ getnameinfo((struct sockaddr *)&sin, sin.sin_len,
+ host, sizeof(host), NULL, 0, NI_NOFQDN);
+ break;
+ }
+ case AF_INET6: {
+ struct sockaddr_in6 sin6;
+
+ memset(&sin6, 0, sizeof(sin6));
+ sin6.sin6_len = sizeof(sin6);
+ sin6.sin6_family = AF_INET6;
+ sin6.sin6_addr = addr->v6;
+ getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
+ host, sizeof(host), NULL, 0, NI_NOFQDN);
+ break;
+ }
+ }
+ printf("%s", host);
+}
+
+void
+print_host(struct pf_state_host *h, sa_family_t af, int opts)
+{
+ u_int16_t p = ntohs(h->port);
+
+ if (opts & PF_OPT_USEDNS)
+ print_name(&h->addr, af);
+ else {
+ struct pf_addr_wrap aw;
+
+ memset(&aw, 0, sizeof(aw));
+ aw.v.a.addr = h->addr;
+ if (af == AF_INET)
+ aw.v.a.mask.addr32[0] = 0xffffffff;
+ else {
+ memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
+ af = AF_INET6;
+ }
+ print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
+ }
+
+ if (p) {
+ if (af == AF_INET)
+ printf(":%u", p);
+ else
+ printf("[%u]", p);
+ }
+}
+
+void
+print_seq(struct pf_state_peer *p)
+{
+ if (p->seqdiff)
+ printf("[%u + %u](+%u)", p->seqlo, p->seqhi - p->seqlo,
+ p->seqdiff);
+ else
+ printf("[%u + %u]", p->seqlo, p->seqhi - p->seqlo);
+}
+
+void
+print_state(struct pf_state *s, int opts)
+{
+ struct pf_state_peer *src, *dst;
+ struct protoent *p;
+ int min, sec;
+
+ if (s->direction == PF_OUT) {
+ src = &s->src;
+ dst = &s->dst;
+ } else {
+ src = &s->dst;
+ dst = &s->src;
+ }
+ printf("%s ", s->u.ifname);
+ if ((p = getprotobynumber(s->proto)) != NULL)
+ printf("%s ", p->p_name);
+ else
+ printf("%u ", s->proto);
+ if (PF_ANEQ(&s->lan.addr, &s->gwy.addr, s->af) ||
+ (s->lan.port != s->gwy.port)) {
+ print_host(&s->lan, s->af, opts);
+ if (s->direction == PF_OUT)
+ printf(" -> ");
+ else
+ printf(" <- ");
+ }
+ print_host(&s->gwy, s->af, opts);
+ if (s->direction == PF_OUT)
+ printf(" -> ");
+ else
+ printf(" <- ");
+ print_host(&s->ext, s->af, opts);
+
+ printf(" ");
+ if (s->proto == IPPROTO_TCP) {
+ if (src->state <= TCPS_TIME_WAIT &&
+ dst->state <= TCPS_TIME_WAIT)
+ printf(" %s:%s\n", tcpstates[src->state],
+ tcpstates[dst->state]);
+ else if (src->state == PF_TCPS_PROXY_SRC ||
+ dst->state == PF_TCPS_PROXY_SRC)
+ printf(" PROXY:SRC\n");
+ else if (src->state == PF_TCPS_PROXY_DST ||
+ dst->state == PF_TCPS_PROXY_DST)
+ printf(" PROXY:DST\n");
+ else
+ printf(" <BAD STATE LEVELS %u:%u>\n",
+ src->state, dst->state);
+ if (opts & PF_OPT_VERBOSE) {
+ printf(" ");
+ print_seq(src);
+ if (src->wscale && dst->wscale)
+ printf(" wscale %u",
+ src->wscale & PF_WSCALE_MASK);
+ printf(" ");
+ print_seq(dst);
+ if (src->wscale && dst->wscale)
+ printf(" wscale %u",
+ dst->wscale & PF_WSCALE_MASK);
+ printf("\n");
+ }
+ } else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
+ dst->state < PFUDPS_NSTATES) {
+ const char *states[] = PFUDPS_NAMES;
+
+ printf(" %s:%s\n", states[src->state], states[dst->state]);
+ } else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
+ dst->state < PFOTHERS_NSTATES) {
+ /* XXX ICMP doesn't really have state levels */
+ const char *states[] = PFOTHERS_NAMES;
+
+ printf(" %s:%s\n", states[src->state], states[dst->state]);
+ } else {
+ printf(" %u:%u\n", src->state, dst->state);
+ }
+
+ if (opts & PF_OPT_VERBOSE) {
+ sec = s->creation % 60;
+ s->creation /= 60;
+ min = s->creation % 60;
+ s->creation /= 60;
+ printf(" age %.2u:%.2u:%.2u", s->creation, min, sec);
+ sec = s->expire % 60;
+ s->expire /= 60;
+ min = s->expire % 60;
+ s->expire /= 60;
+ printf(", expires in %.2u:%.2u:%.2u", s->expire, min, sec);
+ printf(", %llu:%llu pkts, %llu:%llu bytes",
+#ifdef __FreeBSD__
+ (unsigned long long)s->packets[0],
+ (unsigned long long)s->packets[1],
+ (unsigned long long)s->bytes[0],
+ (unsigned long long)s->bytes[1]);
+#else
+ s->packets[0], s->packets[1], s->bytes[0], s->bytes[1]);
+#endif
+ if (s->anchor.nr != -1)
+ printf(", anchor %u", s->anchor.nr);
+ if (s->rule.nr != -1)
+ printf(", rule %u", s->rule.nr);
+ if (s->state_flags & PFSTATE_SLOPPY)
+ printf(", sloppy");
+ if (s->src_node != NULL)
+ printf(", source-track");
+ if (s->nat_src_node != NULL)
+ printf(", sticky-address");
+ printf("\n");
+ }
+ if (opts & PF_OPT_VERBOSE2) {
+ printf(" id: %016llx creatorid: %08x%s\n",
+#ifdef __FreeBSD__
+ (unsigned long long)be64toh(s->id), ntohl(s->creatorid),
+#else
+ betoh64(s->id), ntohl(s->creatorid),
+#endif
+ ((s->sync_flags & PFSTATE_NOSYNC) ? " (no-sync)" : ""));
+ }
+}
+
+int
+unmask(struct pf_addr *m, sa_family_t af)
+{
+ int i = 31, j = 0, b = 0;
+ u_int32_t tmp;
+
+ while (j < 4 && m->addr32[j] == 0xffffffff) {
+ b += 32;
+ j++;
+ }
+ if (j < 4) {
+ tmp = ntohl(m->addr32[j]);
+ for (i = 31; tmp & (1 << i); --i)
+ b++;
+ }
+ return (b);
+}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110131110635.GA5861>