interpret DLT_PFLOG

4 files changed, 105 insertions, 6 deletions

diff --git a/usr.sbin/tcpdump/Makefile b/usr.sbin/tcpdump/Makefile
index 4ef071b32cf..24af6dc13d8 100644
--- a/usr.sbin/tcpdump/Makefile
+++ b/usr.sbin/tcpdump/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.30 2001/06/25 19:56:10 itojun Exp $
+#	$OpenBSD: Makefile,v 1.31 2001/06/25 23:05:16 provos Exp $
 #
 #  Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
 # 	The Regents of the University of California.  All rights reserved.
@@ -46,7 +46,7 @@ SRCS=	tcpdump.c addrtoname.c \
 	print-ipsec.c print-ike.c print-raw.c print-l2tp.c print-mobile.c \
 	print-ip6.c print-ip6opts.c print-icmp6.c print-dhcp6.c print-frag6.c \
 	print-bgp.c print-ospf6.c print-ripng.c print-rt6.c print-stp.c \
-	print-etherip.c print-lwres.c print-cdp.c \
+	print-etherip.c print-lwres.c print-cdp.c print-pflog.c \
 	gmt2local.c savestr.c setsignal.c
 
 #SRCS+=	smbutil.c print-smb.c
diff --git a/usr.sbin/tcpdump/interface.h b/usr.sbin/tcpdump/interface.h
index 2a5965a61b9..a7321546b20 100644
--- a/usr.sbin/tcpdump/interface.h
+++ b/usr.sbin/tcpdump/interface.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: interface.h,v 1.26 2001/04/09 21:44:40 ho Exp $	*/
+/*	$OpenBSD: interface.h,v 1.27 2001/06/25 23:05:17 provos Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
@@ -20,7 +20,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/interface.h,v 1.26 2001/04/09 21:44:40 ho Exp $ (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/interface.h,v 1.27 2001/06/25 23:05:17 provos Exp $ (LBL)
  */
 
 #ifndef tcpdump_interface_h
@@ -190,6 +190,8 @@ extern void default_print_unaligned(const u_char *, u_int);
 extern void dvmrp_print(const u_char *, u_int);
 extern void egp_print(const u_char *, u_int, const u_char *);
 extern void enc_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void pflog_if_print(u_char *, const struct pcap_pkthdr *,
+        const u_char *);
 extern void ether_if_print(u_char *, const struct pcap_pkthdr *,
 	const u_char *);
 extern void fddi_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
diff --git a/usr.sbin/tcpdump/print-pflog.c b/usr.sbin/tcpdump/print-pflog.c
new file mode 100644
index 00000000000..c6eaeaf52b3
--- /dev/null
+++ b/usr.sbin/tcpdump/print-pflog.c
@@ -0,0 +1,96 @@
+/*	$OpenBSD: print-pflog.c,v 1.1 2001/06/25 23:05:17 provos Exp $	*/
+
+/*
+ * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-pflog.c,v 1.1 2001/06/25 23:05:17 provos Exp $ (LBL)";
+#endif
+
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+
+#ifdef __STDC__
+struct rtentry;
+#endif
+#include <net/if.h>
+#include <net/pfvar.h>
+#include <net/if_pflog.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+
+#include <ctype.h>
+#include <netdb.h>
+#include <pcap.h>
+#include <signal.h>
+#include <stdio.h>
+
+#include "interface.h"
+#include "addrtoname.h"
+
+void
+pflog_if_print(u_char *user, const struct pcap_pkthdr *h,
+     register const u_char *p)
+{
+	u_int length = h->len;
+	u_int caplen = h->caplen;
+	const struct ip *ip;
+	const struct pfloghdr *hdr;
+
+	ts_print(&h->ts);
+
+	if (caplen < PFLOG_HDRLEN) {
+		printf("[|pflog]");
+		goto out;
+	}
+
+	/*
+	 * Some printers want to get back at the link level addresses,
+	 * and/or check that they're not walking off the end of the packet.
+	 * Rather than pass them all the way down, we set these globals.
+	 */
+	packetp = p;
+	snapend = p + caplen;
+	
+	hdr = (struct pfloghdr *)p;
+
+	printf("rule nr %d: %s %s on %s: ",
+	       ntohl(hdr->rnr),
+	       ntohs(hdr->action) == PF_PASS ? "pass" : "block",
+	       ntohs(hdr->dir) == PF_OUT ? "out" : "in",
+	       hdr->ifname);
+
+	length -= PFLOG_HDRLEN;
+	ip = (struct ip *)(p + PFLOG_HDRLEN);
+	ip_print((const u_char *)ip, length);
+
+	if (xflag)
+		default_print((const u_char *)ip, caplen - PFLOG_HDRLEN);
+out:
+	putchar('\n');
+}
diff --git a/usr.sbin/tcpdump/tcpdump.c b/usr.sbin/tcpdump/tcpdump.c
index 16d07f751e3..6caecbc9df6 100644
--- a/usr.sbin/tcpdump/tcpdump.c
+++ b/usr.sbin/tcpdump/tcpdump.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcpdump.c,v 1.21 2001/01/19 17:53:19 deraadt Exp $	*/
+/*	$OpenBSD: tcpdump.c,v 1.22 2001/06/25 23:05:17 provos Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
@@ -26,7 +26,7 @@ static const char copyright[] =
     "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997\n\
 The Regents of the University of California.  All rights reserved.\n";
 static const char rcsid[] =
-    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/tcpdump.c,v 1.21 2001/01/19 17:53:19 deraadt Exp $ (LBL)";
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/tcpdump.c,v 1.22 2001/06/25 23:05:17 provos Exp $ (LBL)";
 #endif
 
 /*
@@ -110,6 +110,7 @@ static struct printer printers[] = {
 	{ atm_if_print,		DLT_ATM_RFC1483 },
 	{ null_if_print, 	DLT_LOOP },
 	{ enc_if_print, 	DLT_ENC },
+	{ pflog_if_print, 	DLT_PFLOG },
 	{ NULL,			0 },
 };