[src/netbsd-1-5]: src/dist/ipf Pull up revisions 1.1-1.2 (new, requested by m...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8415e3e1ac4d
branches:  netbsd-1-5
changeset: 492694:8415e3e1ac4d
user:      he <he%NetBSD.org@localhost>
date:      Sat Feb 09 16:56:14 2002 +0000

description:
Pull up revisions 1.1-1.2 (new, requested by martti):
  Updated IPFilter to 3.4.23

diffstat:

 dist/ipf/printnat.c |  462 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 462 insertions(+), 0 deletions(-)

diffs (truncated from 466 to 300 lines):

diff -r 5d755d210826 -r 8415e3e1ac4d dist/ipf/printnat.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/dist/ipf/printnat.c       Sat Feb 09 16:56:14 2002 +0000
@@ -0,0 +1,462 @@
+/*     $NetBSD: printnat.c,v 1.2.2.2 2002/02/09 16:56:14 he Exp $      */
+
+/*
+ * Copyright (C) 1993-2001 by Darren Reed.
+ *
+ * See the IPFILTER.LICENCE file for details on licencing.
+ *
+ * Added redirect stuff and a variety of bug fixes. (mcn%EnGarde.com@localhost)
+ */
+#include <stdio.h>
+#include <string.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/types.h>
+#if !defined(__SVR4) && !defined(__svr4__)
+#include <strings.h>
+#else
+#include <sys/byteorder.h>
+#endif
+#include <sys/time.h>
+#include <sys/param.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stddef.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#if defined(sun) && (defined(__svr4__) || defined(__SVR4))
+# include <sys/ioccom.h>
+# include <sys/sysmacros.h>
+#endif
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+#include <net/if.h>
+#if __FreeBSD_version >= 300000
+# include <net/if_var.h>
+#endif
+#include <netdb.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+#include <resolv.h>
+#include <ctype.h>
+#include "netinet/ip_compat.h"
+#include "netinet/ip_fil.h"
+#include "netinet/ip_nat.h"
+#include "netinet/ip_state.h"
+#include "netinet/ip_proxy.h"
+#include "ipf.h"
+#include "kmem.h"
+
+#if    defined(sun) && !SOLARIS2
+# define       STRERROR(x)     sys_errlist[x]
+extern char    *sys_errlist[];
+#else
+# define       STRERROR(x)     strerror(x)
+#endif
+
+#if !defined(lint)
+static const char rcsid[] = "@(#)Id: printnat.c,v 1.1.2.4 2002/01/02 03:45:07 darrenr Exp";
+#endif
+
+
+#if    SOLARIS
+#define        bzero(a,b)      memset(a,0,b)
+#endif
+#ifdef USE_INET6
+extern int     use_inet6;
+#endif
+
+extern char    thishost[MAXHOSTNAMELEN];
+
+extern int     countbits __P((u_32_t));
+
+void   printnat __P((ipnat_t *, int));
+char   *getnattype __P((ipnat_t *));
+void   printactivenat __P((nat_t *, int));
+void   printhostmap __P((hostmap_t *, u_int));
+char   *getsumd __P((u_32_t));
+
+static void    printaps __P((ap_session_t *, int));
+
+static void printaps(aps, opts)
+ap_session_t *aps;
+int opts;
+{
+       ipsec_pxy_t ipsec;
+       ap_session_t ap;
+       ftpinfo_t ftp;
+       aproxy_t apr;
+       raudio_t ra;
+
+       if (kmemcpy((char *)&ap, (long)aps, sizeof(ap)))
+               return;
+       if (kmemcpy((char *)&apr, (long)ap.aps_apr, sizeof(apr)))
+               return;
+       printf("\tproxy %s/%d use %d flags %x\n", apr.apr_label,
+               apr.apr_p, apr.apr_ref, apr.apr_flags);
+       printf("\t\tproto %d flags %#x bytes ", ap.aps_p, ap.aps_flags);
+#ifdef USE_QUAD_T
+       printf("%qu pkts %qu", (unsigned long long)ap.aps_bytes,
+               (unsigned long long)ap.aps_pkts);
+#else
+       printf("%lu pkts %lu", ap.aps_bytes, ap.aps_pkts);
+#endif
+       printf(" data %s size %d\n", ap.aps_data ? "YES" : "NO", ap.aps_psiz);
+       if ((ap.aps_p == IPPROTO_TCP) && (opts & OPT_VERBOSE)) {
+               printf("\t\tstate[%u,%u], sel[%d,%d]\n",
+                       ap.aps_state[0], ap.aps_state[1],
+                       ap.aps_sel[0], ap.aps_sel[1]);
+#if (defined(NetBSD) && (NetBSD >= 199905) && (NetBSD < 1991011)) || \
+    (__FreeBSD_version >= 300000) || defined(OpenBSD)
+               printf("\t\tseq: off %hd/%hd min %x/%x\n",
+                       ap.aps_seqoff[0], ap.aps_seqoff[1],
+                       ap.aps_seqmin[0], ap.aps_seqmin[1]);
+               printf("\t\tack: off %hd/%hd min %x/%x\n",
+                       ap.aps_ackoff[0], ap.aps_ackoff[1],
+                       ap.aps_ackmin[0], ap.aps_ackmin[1]);
+#else
+               printf("\t\tseq: off %hd/%hd min %lx/%lx\n",
+                       ap.aps_seqoff[0], ap.aps_seqoff[1],
+                       ap.aps_seqmin[0], ap.aps_seqmin[1]);
+               printf("\t\tack: off %hd/%hd min %lx/%lx\n",
+                       ap.aps_ackoff[0], ap.aps_ackoff[1],
+                       ap.aps_ackmin[0], ap.aps_ackmin[1]);
+#endif
+       }
+
+       if (!strcmp(apr.apr_label, "raudio") && ap.aps_psiz == sizeof(ra)) {
+               if (kmemcpy((char *)&ra, (long)ap.aps_data, sizeof(ra)))
+                       return;
+               printf("\tReal Audio Proxy:\n");
+               printf("\t\tSeen PNA: %d\tVersion: %d\tEOS: %d\n",
+                       ra.rap_seenpna, ra.rap_version, ra.rap_eos);
+               printf("\t\tMode: %#x\tSBF: %#x\n", ra.rap_mode, ra.rap_sbf);
+               printf("\t\tPorts:pl %hu, pr %hu, sr %hu\n",
+                       ra.rap_plport, ra.rap_prport, ra.rap_srport);
+       } else if (!strcmp(apr.apr_label, "ftp") &&
+                  (ap.aps_psiz == sizeof(ftp))) {
+               if (kmemcpy((char *)&ftp, (long)ap.aps_data, sizeof(ftp)))
+                       return;
+               printf("\tFTP Proxy:\n");
+               printf("\t\tpassok: %d\n", ftp.ftp_passok);
+               ftp.ftp_side[0].ftps_buf[FTP_BUFSZ - 1] = '\0';
+               ftp.ftp_side[1].ftps_buf[FTP_BUFSZ - 1] = '\0';
+               printf("\tClient:\n");
+               printf("\t\tseq %x len %d junk %d cmds %d\n",
+                       ftp.ftp_side[0].ftps_seq, ftp.ftp_side[0].ftps_len,
+                       ftp.ftp_side[0].ftps_junk, ftp.ftp_side[0].ftps_cmds);
+               printf("\t\tbuf [");
+               printbuf(ftp.ftp_side[0].ftps_buf, FTP_BUFSZ, 1);
+               printf("]\n\tServer:\n");
+               printf("\t\tseq %x len %d junk %d cmds %d\n",
+                       ftp.ftp_side[1].ftps_seq, ftp.ftp_side[1].ftps_len,
+                       ftp.ftp_side[1].ftps_junk, ftp.ftp_side[1].ftps_cmds);
+               printf("\t\tbuf [");
+               printbuf(ftp.ftp_side[1].ftps_buf, FTP_BUFSZ, 1);
+               printf("]\n");
+       } else if (!strcmp(apr.apr_label, "ipsec") &&
+                  (ap.aps_psiz == sizeof(ipsec))) {
+               if (kmemcpy((char *)&ipsec, (long)ap.aps_data, sizeof(ipsec)))
+                       return;
+               printf("\tIPSec Proxy:\n");
+               printf("\t\tICookie %08x%08x RCookie %08x%08x %s\n",
+                       (u_int)ntohl(ipsec.ipsc_icookie[0]),
+                       (u_int)ntohl(ipsec.ipsc_icookie[1]),
+                       (u_int)ntohl(ipsec.ipsc_rcookie[0]),
+                       (u_int)ntohl(ipsec.ipsc_rcookie[1]),
+                       ipsec.ipsc_rckset ? "(Set)" : "(Not set)");
+       }
+}
+
+
+/*
+ * Get a nat filter type given its kernel address.
+ */
+char *getnattype(ipnat)
+ipnat_t *ipnat;
+{
+       static char unknownbuf[20];
+       ipnat_t ipnatbuff;
+       char *which;
+
+       if (!ipnat || (ipnat && kmemcpy((char *)&ipnatbuff, (long)ipnat,
+                                       sizeof(ipnatbuff))))
+               return "???";
+
+       switch (ipnatbuff.in_redir)
+       {
+       case NAT_MAP :
+               which = "MAP";
+               break;
+       case NAT_MAPBLK :
+               which = "MAP-BLOCK";
+               break;
+       case NAT_REDIRECT :
+               which = "RDR";
+               break;
+       case NAT_BIMAP :
+               which = "BIMAP";
+               break;
+       default :
+               sprintf(unknownbuf, "unknown(%04x)",
+                       ipnatbuff.in_redir & 0xffffffff);
+               which = unknownbuf;
+               break;
+       }
+       return which;
+}
+
+
+void printactivenat(nat, opts)
+nat_t *nat;
+int opts;
+{
+       u_int hv1, hv2;
+
+       printf("%s %-15s", getnattype(nat->nat_ptr), inet_ntoa(nat->nat_inip));
+
+       if ((nat->nat_flags & IPN_TCPUDP) != 0)
+               printf(" %-5hu", ntohs(nat->nat_inport));
+
+       printf(" <- -> %-15s",inet_ntoa(nat->nat_outip));
+
+       if ((nat->nat_flags & IPN_TCPUDP) != 0)
+               printf(" %-5hu", ntohs(nat->nat_outport));
+
+       printf(" [%s", inet_ntoa(nat->nat_oip));
+       if ((nat->nat_flags & IPN_TCPUDP) != 0)
+               printf(" %hu]", ntohs(nat->nat_oport));
+       else
+               printf("]");
+
+       if (opts & OPT_VERBOSE) {
+               printf("\n\tage %lu use %hu sumd %s/",
+                       nat->nat_age, nat->nat_use, getsumd(nat->nat_sumd[0]));
+               hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
+                                 0xffffffff),
+               hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
+                                 NAT_TABLE_SZ),
+               hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
+                                 0xffffffff),
+               hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
+                                 NAT_TABLE_SZ),
+               printf("%s pr %u bkt %d/%d flags %x\n",
+                       getsumd(nat->nat_sumd[1]), nat->nat_p,
+                       hv1, hv2, nat->nat_flags);
+               printf("\tifp %s ", getifname(nat->nat_ifp));
+#ifdef USE_QUAD_T
+               printf("bytes %qu pkts %qu",
+                       (unsigned long long)nat->nat_bytes,
+                       (unsigned long long)nat->nat_pkts);
+#else
+               printf("bytes %lu pkts %lu", nat->nat_bytes, nat->nat_pkts);
+#endif
+#if SOLARIS
+               printf(" %lx", nat->nat_ipsumd);
+#endif
+       }
+
+       putchar('\n');
+       if (nat->nat_aps)
+               printaps(nat->nat_aps, opts);
+}
+
+
+void printhostmap(hmp, hv)
+hostmap_t *hmp;
+u_int hv;
+{
+       printf("%s -> ", inet_ntoa(hmp->hm_realip));
+       printf("%s ", inet_ntoa(hmp->hm_mapip));
+       printf("(use = %d hv = %u)\n", hmp->hm_ref, hv);
+}
+
+
+char *getsumd(sum)
+u_32_t sum;
+{
+       static char sumdbuf[17];
+
+       if (sum & NAT_HW_CKSUM)
+               sprintf(sumdbuf, "hw(%#0x)", sum & 0xffff);
+       else
+               sprintf(sumdbuf, "%#0x", sum);
+       return sumdbuf;
+}
+
+
+/*
+ * Print out a NAT rule
+ */
+void printnat(np, opts)
+ipnat_t *np;
+int opts;
+{