when a packet has had addresses and/or ports rewritten, show the original

addresses/ports too. ok ryan dlg

1 files changed, 20 insertions, 1 deletions

diff --git a/usr.sbin/tcpdump/print-pflog.c b/usr.sbin/tcpdump/print-pflog.c
index 1d6bb339a94..4599c523421 100644
--- a/usr.sbin/tcpdump/print-pflog.c
+++ b/usr.sbin/tcpdump/print-pflog.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print-pflog.c,v 1.21 2010/06/26 16:47:07 henning Exp $	*/
+/*	$OpenBSD: print-pflog.c,v 1.22 2010/09/21 10:46:12 henning Exp $	*/
 
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
@@ -21,6 +21,7 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+#include <sys/types.h>
 #include <sys/param.h>
 #include <sys/time.h>
 #include <sys/socket.h>
@@ -43,6 +44,8 @@ struct rtentry;
 
 #include <net/pfvar.h>
 
+#include <arpa/inet.h>
+
 #include <ctype.h>
 #include <netdb.h>
 #include <pcap.h>
@@ -152,6 +155,22 @@ pflog_if_print(u_char *user, const struct pcap_pkthdr *h,
 		if (vflag && hdr->pid != NO_PID)
 			printf("[uid %u, pid %u] ", (unsigned)hdr->uid,
 			    (unsigned)hdr->pid);
+		if (vflag && hdr->rewritten) {
+			char buf[48];
+
+			if (inet_ntop(hdr->af, &hdr->saddr.v4, buf,
+			    sizeof(buf)) == NULL)
+				printf("[orig src ?, ");
+			else
+				printf("[orig src %s:%u, ", buf,
+				    ntohs(hdr->sport));
+			if (inet_ntop(hdr->af, &hdr->daddr.v4, buf,
+			    sizeof(buf)) == NULL)
+				printf("dst ?] ");
+			else
+				printf("dst %s:%u] ", buf,
+				    ntohs(hdr->dport));
+		}
 	}
 	af = hdr->af;
 	length -= hdrlen;