Update pf handling for new DLT_PFLOG (117) as other systems are

 starting to adopt it.
Don't bother being backwards compatible to old value (17).

1 files changed, 79 insertions, 55 deletions

diff --git a/print-pflog.c b/print-pflog.c
index 3623e303..7b46749b 100644
--- a/print-pflog.c
+++ b/print-pflog.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-pflog.c,v 1.9 2001/09/18 14:52:53 jakob Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -23,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.9 2003-11-16 09:36:32 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-pflog.c,v 1.10 2004-03-28 20:33:28 fenner Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -37,62 +35,56 @@ static const char rcsid[] _U_ =
 
 #include "interface.h"
 #include "addrtoname.h"
-
-/* The header in OpenBSD pflog files. */
-
-struct pfloghdr {
-	u_int32_t af;
-	char	ifname[16];
-	int16_t rnr;
-	u_int16_t reason;
-	u_int16_t action;
-	u_int16_t dir;
-};
-#define PFLOG_HDRLEN    sizeof(struct pfloghdr)
-
-/* Actions */
-#define PF_PASS  0
-#define PF_DROP  1
-#define PF_SCRUB 2
-
-/* Directions */
-#define PF_IN  0
-#define PF_OUT 1
+#include "pf.h"
 
 static struct tok pf_reasons[] = {
-	{ 0,	"match" },
-	{ 1,	"bad-offset" },
-	{ 2,	"fragment" },
-	{ 3,	"short" },
-	{ 4,	"normalize" },
-	{ 5,	"memory" },
+	{ 0,	"0(match)" },
+	{ 1,	"1(bad-offset)" },
+	{ 2,	"2(fragment)" },
+	{ 3,	"3(short)" },
+	{ 4,	"4(normalize)" },
+	{ 5,	"5(memory)" },
 	{ 0,	NULL }
 };
 
 static struct tok pf_actions[] = {
-	{ PF_PASS,	"pass" },
-	{ PF_DROP,	"drop" },
-	{ PF_SCRUB,	"scrub" },
-	{ 0,		NULL }
+	{ PF_PASS,		"pass" },
+	{ PF_DROP,		"block" },
+	{ PF_SCRUB,		"scrub" },
+	{ PF_NAT,		"nat" },
+	{ PF_NONAT,		"nat" },
+	{ PF_BINAT,		"binat" },
+	{ PF_NOBINAT,		"binat" },
+	{ PF_RDR,		"rdr" },
+	{ PF_NORDR,		"rdr" },
+	{ PF_SYNPROXY_DROP,	"synproxy-drop" },
+	{ 0,			NULL }
 };
 
 static struct tok pf_directions[] = {
+	{ PF_INOUT,	"in/out" },
 	{ PF_IN,	"in" },
 	{ PF_OUT,	"out" },
 	{ 0,		NULL }
 };
 
-#define OPENBSD_AF_INET		2
-#define OPENBSD_AF_INET6	24
+/* For reading capture files on other systems */
+#define	OPENBSD_AF_INET		2
+#define	OPENBSD_AF_INET6	24
 
 static void
 pflog_print(const struct pfloghdr *hdr)
 {
-	printf("rule %d/%s: %s %s on %s: ",
-	    (short)ntohs(hdr->rnr),
-	    tok2str(pf_reasons, "unkn(%u)", ntohs(hdr->reason)),
-	    tok2str(pf_actions, "unkn(%u)", ntohs(hdr->action)),
-	    tok2str(pf_directions, "unkn(%u)", ntohs(hdr->dir)),
+	if (ntohl(hdr->subrulenr) == (u_int32_t)-1)
+		printf("rule %u/", ntohl(hdr->rulenr));
+	else
+		printf("rule %u.%s.%u/", ntohl(hdr->rulenr), hdr->ruleset,
+		    ntohl(hdr->subrulenr));
+
+	printf("%s: %s %s on %s: ",
+	    tok2str(pf_reasons, "unkn(%u)", hdr->reason),
+	    tok2str(pf_actions, "unkn(%u)", hdr->action),
+	    tok2str(pf_directions, "unkn(%u)", hdr->dir),
 	    hdr->ifname);
 }
 
@@ -100,32 +92,61 @@ u_int
 pflog_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 {
 	u_int length = h->len;
+	u_int hdrlen;
 	u_int caplen = h->caplen;
+	const struct ip *ip;
+#ifdef INET6
+	const struct ip6_hdr *ip6;
+#endif
 	const struct pfloghdr *hdr;
 	u_int8_t af;
 
-	if (caplen < PFLOG_HDRLEN) {
+	/* check length */
+	if (caplen < sizeof(u_int8_t)) {
 		printf("[|pflog]");
 		return (caplen);
 	}
 
-	hdr = (const struct pfloghdr *)p;
+#define MIN_PFLOG_HDRLEN	45
+	hdr = (struct pfloghdr *)p;
+	if (hdr->length < MIN_PFLOG_HDRLEN) {
+		printf("[pflog: invalid header length!]");
+		return (hdr->length);	/* XXX: not really */
+	}
+	hdrlen = BPF_WORDALIGN(hdr->length);
+
+	if (caplen < hdrlen) {
+		printf("[|pflog]");
+		return (hdrlen);	/* XXX: true? */
+	}
+
+	/* print what we know */
+	hdr = (struct pfloghdr *)p;
+	TCHECK(*hdr);
 	if (eflag)
 		pflog_print(hdr);
-	af = ntohl(hdr->af);
-	length -= PFLOG_HDRLEN;
-	caplen -= PFLOG_HDRLEN;
-	p += PFLOG_HDRLEN;
+	
+	/* skip to the real packet */
+	af = hdr->af;
+	length -= hdrlen;
+	caplen -= hdrlen;
+	p += hdrlen;
 	switch (af) {
 
-	case OPENBSD_AF_INET:
-		ip_print(p, length);
-		break;
+		case AF_INET:
+#if OPENBSD_AF_INET != AF_INET
+		case OPENBSD_AF_INET:		/* XXX: read pcap files */
+#endif
+			ip_print(p, length);
+			break;
 
 #ifdef INET6
-	case OPENBSD_AF_INET6:
-		ip6_print(p, length);
-		break;
+		case AF_INET6:
+#if OPENBSD_AF_INET6 != AF_INET6
+		case OPENBSD_AF_INET6:		/* XXX: read pcap files */
+#endif
+			ip6_print(p, length);
+			break;
 #endif
 
 	default:
@@ -135,6 +156,9 @@ pflog_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 		if (!xflag && !qflag)
 			default_print(p, caplen);
 	}
-
-	return (PFLOG_HDRLEN);
+	
+	return (hdrlen);
+trunc:
+	printf("[|pflog]");
+	return (hdrlen);
 }