contrib/ipfilter/tools/ipfstat.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2002-2006 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  */
   8 #ifdef __FreeBSD__
   9 # ifndef __FreeBSD_cc_version
  10 #  include <osreldate.h>
  11 # else
  12 #  if __FreeBSD_cc_version < 430000
  13 #   include <osreldate.h>
  14 #  endif
  15 # endif
  16 #endif
  17 #include <sys/ioctl.h>
  18 #include <fcntl.h>
  19 #ifdef linux
  20 # include <linux/a.out.h>
  21 #else
  22 # include <nlist.h>
  23 #endif
  24 #include <ctype.h>
  25 #if defined(sun) && (defined(__svr4__) || defined(__SVR4))
  26 # include <stddef.h>
  27 #endif
  28 #include "ipf.h"
  29 #include "netinet/ipl.h"
  30 #if defined(STATETOP)
  31 # if defined(_BSDI_VERSION)
  32 #  undef STATETOP
  33 # endif
  34 # if defined(__FreeBSD__) && \
  35      (!defined(__FreeBSD_version) || (__FreeBSD_version < 430000))
  36 #  undef STATETOP
  37 # endif
  38 # if defined(__NetBSD_Version__) && (__NetBSD_Version__ < 105000000)
  39 #  undef STATETOP
  40 # endif
  41 # if defined(sun)
  42 #  if defined(__svr4__) || defined(__SVR4)
  43 #   include <sys/select.h>
  44 #  else
  45 #   undef STATETOP      /* NOT supported on SunOS4 */
  46 #  endif
  47 # endif
  48 #endif
  49 #if defined(STATETOP) && !defined(linux)
  50 # include <netinet/ip_var.h>
  51 # include <netinet/tcp_fsm.h>
  52 #endif
  53 #ifdef STATETOP
  54 # include <ctype.h>
  55 # include <signal.h>
  56 # include <time.h>
  57 # if SOLARIS || defined(__NetBSD__) || defined(_BSDI_VERSION) || \
  58      defined(__sgi)
  59 #  ifdef ERR
  60 #   undef ERR
  61 #  endif
  62 #  include <curses.h>
  63 # else /* SOLARIS */
  64 #  include <ncurses.h>
  65 # endif /* SOLARIS */
  66 #endif /* STATETOP */
  67 #include "kmem.h"
  68 #if defined(__NetBSD__) || (__OpenBSD__)
  69 # include <paths.h>
  70 #endif
  71
  72 #if !defined(lint)
  73 static const char sccsid[] = "@(#)fils.c        1.21 4/20/96 (C) 1993-2000 Darren Reed";
  74 static const char rcsid[] = "@(#)$Id: ipfstat.c,v 1.44.2.25 2007/06/30 09:48:50 darrenr Exp $";
  75 #endif
  76
  77 #ifdef __hpux
  78 # define        nlist   nlist64
  79 #endif
  80
  81 extern  char    *optarg;
  82 extern  int     optind;
  83 extern  int     opterr;
  84
  85 #define PRINTF  (void)printf
  86 #define FPRINTF (void)fprintf
  87 static  char    *filters[4] = { "ipfilter(in)", "ipfilter(out)",
  88                                 "ipacct(in)", "ipacct(out)" };
  89 static  int     state_logging = -1;
  90
  91 int     opts = 0;
  92 int     use_inet6 = 0;
  93 int     live_kernel = 1;
  94 int     state_fd = -1;
  95 int     ipf_fd = -1;
  96 int     auth_fd = -1;
  97 int     nat_fd = -1;
  98 frgroup_t *grtop = NULL;
  99 frgroup_t *grtail = NULL;
 100
 101 #ifdef STATETOP
 102 #define STSTRSIZE       80
 103 #define STGROWSIZE      16
 104 #define HOSTNMLEN       40
 105
 106 #define STSORT_PR       0
 107 #define STSORT_PKTS     1
 108 #define STSORT_BYTES    2
 109 #define STSORT_TTL      3
 110 #define STSORT_SRCIP    4
 111 #define STSORT_SRCPT    5
 112 #define STSORT_DSTIP    6
 113 #define STSORT_DSTPT    7
 114 #define STSORT_MAX      STSORT_DSTPT
 115 #define STSORT_DEFAULT  STSORT_BYTES
 116
 117
 118 typedef struct statetop {
 119         i6addr_t        st_src;
 120         i6addr_t        st_dst;
 121         u_short         st_sport;
 122         u_short         st_dport;
 123         u_char          st_p;
 124         u_char          st_v;
 125         u_char          st_state[2];
 126         U_QUAD_T        st_pkts;
 127         U_QUAD_T        st_bytes;
 128         u_long          st_age;
 129 } statetop_t;
 130 #endif
 131
 132 int             main __P((int, char *[]));
 133
 134 static  int     fetchfrag __P((int, int, ipfr_t *));
 135 static  void    showstats __P((friostat_t *, u_32_t));
 136 static  void    showfrstates __P((ipfrstat_t *, u_long));
 137 static  void    showlist __P((friostat_t *));
 138 static  void    showipstates __P((ips_stat_t *));
 139 static  void    showauthstates __P((fr_authstat_t *));
 140 static  void    showgroups __P((friostat_t *));
 141 static  void    usage __P((char *));
 142 static  void    showtqtable_live __P((int));
 143 static  void    printlivelist __P((int, int, frentry_t *, char *, char *));
 144 static  void    printdeadlist __P((int, int, frentry_t *, char *, char *));
 145 static  void    parse_ipportstr __P((const char *, i6addr_t *, int *));
 146 static  void    ipfstate_live __P((char *, friostat_t **, ips_stat_t **,
 147                                    ipfrstat_t **, fr_authstat_t **, u_32_t *));
 148 static  void    ipfstate_dead __P((char *, friostat_t **, ips_stat_t **,
 149                                    ipfrstat_t **, fr_authstat_t **, u_32_t *));
 150 static  ipstate_t *fetchstate __P((ipstate_t *, ipstate_t *));
 151 #ifdef STATETOP
 152 static  void    topipstates __P((i6addr_t, i6addr_t, int, int, int,
 153                                  int, int, int));
 154 static  void    sig_break __P((int));
 155 static  void    sig_resize __P((int));
 156 static  char    *getip __P((int, i6addr_t *));
 157 static  char    *ttl_to_string __P((long));
 158 static  int     sort_p __P((const void *, const void *));
 159 static  int     sort_pkts __P((const void *, const void *));
 160 static  int     sort_bytes __P((const void *, const void *));
 161 static  int     sort_ttl __P((const void *, const void *));
 162 static  int     sort_srcip __P((const void *, const void *));
 163 static  int     sort_srcpt __P((const void *, const void *));
 164 static  int     sort_dstip __P((const void *, const void *));
 165 static  int     sort_dstpt __P((const void *, const void *));
 166 #endif
 167
 168
 169 static void usage(name)
 170 char *name;
 171 {
 172 #ifdef  USE_INET6
 173         fprintf(stderr, "Usage: %s [-6aAdfghIilnoRsv]\n", name);
 174 #else
 175         fprintf(stderr, "Usage: %s [-aAdfghIilnoRsv]\n", name);
 176 #endif
 177         fprintf(stderr, "       %s [-M corefile] [-N symbol-list]\n", name);
 178 #ifdef  USE_INET6
 179         fprintf(stderr, "       %s -t [-6C] ", name);
 180 #else
 181         fprintf(stderr, "       %s -t [-C] ", name);
 182 #endif
 183         fprintf(stderr, "[-D destination address] [-P protocol] [-S source address] [-T refresh time]\n");
 184         exit(1);
 185 }
 186
 187
 188 int main(argc,argv)
 189 int argc;
 190 char *argv[];
 191 {
 192         fr_authstat_t   frauthst;
 193         fr_authstat_t   *frauthstp = &frauthst;
 194         friostat_t fio;
 195         friostat_t *fiop = &fio;
 196         ips_stat_t ipsst;
 197         ips_stat_t *ipsstp = &ipsst;
 198         ipfrstat_t ifrst;
 199         ipfrstat_t *ifrstp = &ifrst;
 200         char    *memf = NULL;
 201         char    *options, *kern = NULL;
 202         int     c, myoptind;
 203
 204         int protocol = -1;              /* -1 = wild card for any protocol */
 205         int refreshtime = 1;            /* default update time */
 206         int sport = -1;                 /* -1 = wild card for any source port */
 207         int dport = -1;                 /* -1 = wild card for any dest port */
 208         int topclosed = 0;              /* do not show closed tcp sessions */
 209         i6addr_t saddr, daddr;
 210         u_32_t frf;
 211
 212 #ifdef  USE_INET6
 213         options = "6aACdfghIilnostvD:M:N:P:RS:T:";
 214 #else
 215         options = "aACdfghIilnostvD:M:N:P:RS:T:";
 216 #endif
 217
 218         saddr.in4.s_addr = INADDR_ANY;  /* default any v4 source addr */
 219         daddr.in4.s_addr = INADDR_ANY;  /* default any v4 dest addr */
 220 #ifdef  USE_INET6
 221         saddr.in6 = in6addr_any;        /* default any v6 source addr */
 222         daddr.in6 = in6addr_any;        /* default any v6 dest addr */
 223 #endif
 224
 225         /* Don't warn about invalid flags when we run getopt for the 1st time */
 226         opterr = 0;
 227
 228         /*
 229          * Parse these two arguments now lest there be any buffer overflows
 230          * in the parsing of the rest.
 231          */
 232         myoptind = optind;
 233         while ((c = getopt(argc, argv, options)) != -1) {
 234                 switch (c)
 235                 {
 236                 case 'M' :
 237                         memf = optarg;
 238                         live_kernel = 0;
 239                         break;
 240                 case 'N' :
 241                         kern = optarg;
 242                         live_kernel = 0;
 243                         break;
 244                 }
 245         }
 246         optind = myoptind;
 247
 248         if (live_kernel == 1) {
 249                 if ((state_fd = open(IPSTATE_NAME, O_RDONLY)) == -1) {
 250                         perror("open(IPSTATE_NAME)");
 251                         exit(-1);
 252                 }
 253                 if ((auth_fd = open(IPAUTH_NAME, O_RDONLY)) == -1) {
 254                         perror("open(IPAUTH_NAME)");
 255                         exit(-1);
 256                 }
 257                 if ((nat_fd = open(IPNAT_NAME, O_RDONLY)) == -1) {
 258                         perror("open(IPAUTH_NAME)");
 259                         exit(-1);
 260                 }
 261                 if ((ipf_fd = open(IPL_NAME, O_RDONLY)) == -1) {
 262                         fprintf(stderr, "open(%s)", IPL_NAME);
 263                         perror("");
 264                         exit(-1);
 265                 }
 266         }
 267
 268         if (kern != NULL || memf != NULL) {
 269                 (void)setgid(getgid());
 270                 (void)setuid(getuid());
 271         }
 272
 273         if (live_kernel == 1) {
 274                 (void) checkrev(IPL_NAME);
 275         } else {
 276                 if (openkmem(kern, memf) == -1)
 277                         exit(-1);
 278         }
 279
 280         (void)setgid(getgid());
 281         (void)setuid(getuid());
 282
 283         opterr = 1;
 284
 285         while ((c = getopt(argc, argv, options)) != -1)
 286         {
 287                 switch (c)
 288                 {
 289 #ifdef  USE_INET6
 290                 case '6' :
 291                         use_inet6 = 1;
 292                         break;
 293 #endif
 294                 case 'a' :
 295                         opts |= OPT_ACCNT|OPT_SHOWLIST;
 296                         break;
 297                 case 'A' :
 298                         opts |= OPT_AUTHSTATS;
 299                         break;
 300                 case 'C' :
 301                         topclosed = 1;
 302                         break;
 303                 case 'd' :
 304                         opts |= OPT_DEBUG;
 305                         break;
 306                 case 'D' :
 307                         parse_ipportstr(optarg, &daddr, &dport);
 308                         break;
 309                 case 'f' :
 310                         opts |= OPT_FRSTATES;
 311                         break;
 312                 case 'g' :
 313                         opts |= OPT_GROUPS;
 314                         break;
 315                 case 'h' :
 316                         opts |= OPT_HITS;
 317                         break;
 318                 case 'i' :
 319                         opts |= OPT_INQUE|OPT_SHOWLIST;
 320                         break;
 321                 case 'I' :
 322                         opts |= OPT_INACTIVE;
 323                         break;
 324                 case 'l' :
 325                         opts |= OPT_SHOWLIST;
 326                         break;
 327                 case 'M' :
 328                         break;
 329                 case 'N' :
 330                         break;
 331                 case 'n' :
 332                         opts |= OPT_SHOWLINENO;
 333                         break;
 334                 case 'o' :
 335                         opts |= OPT_OUTQUE|OPT_SHOWLIST;
 336                         break;
 337                 case 'P' :
 338                         protocol = getproto(optarg);
 339                         if (protocol == -1) {
 340                                 fprintf(stderr, "%s: Invalid protocol: %s\n",
 341                                         argv[0], optarg);
 342                                 exit(-2);
 343                         }
 344                         break;
 345                 case 'R' :
 346                         opts |= OPT_NORESOLVE;
 347                         break;
 348                 case 's' :
 349                         opts |= OPT_IPSTATES;
 350                         break;
 351                 case 'S' :
 352                         parse_ipportstr(optarg, &saddr, &sport);
 353                         break;
 354                 case 't' :
 355 #ifdef STATETOP
 356                         opts |= OPT_STATETOP;
 357                         break;
 358 #else
 359                         fprintf(stderr,
 360                                 "%s: state top facility not compiled in\n",
 361                                 argv[0]);
 362                         exit(-2);
 363 #endif
 364                 case 'T' :
 365                         if (!sscanf(optarg, "%d", &refreshtime) ||
 366                                     (refreshtime <= 0)) {
 367                                 fprintf(stderr,
 368                                         "%s: Invalid refreshtime < 1 : %s\n",
 369                                         argv[0], optarg);
 370                                 exit(-2);
 371                         }
 372                         break;
 373                 case 'v' :
 374                         opts |= OPT_VERBOSE;
 375                         break;
 376                 default :
 377                         usage(argv[0]);
 378                         break;
 379                 }
 380         }
 381
 382         if (live_kernel == 1) {
 383                 bzero((char *)&fio, sizeof(fio));
 384                 bzero((char *)&ipsst, sizeof(ipsst));
 385                 bzero((char *)&ifrst, sizeof(ifrst));
 386
 387                 ipfstate_live(IPL_NAME, &fiop, &ipsstp, &ifrstp,
 388                               &frauthstp, &frf);
 389         } else
 390                 ipfstate_dead(kern, &fiop, &ipsstp, &ifrstp, &frauthstp, &frf);
 391
 392         if (opts & OPT_IPSTATES) {
 393                 showipstates(ipsstp);
 394         } else if (opts & OPT_SHOWLIST) {
 395                 showlist(fiop);
 396                 if ((opts & OPT_OUTQUE) && (opts & OPT_INQUE)){
 397                         opts &= ~OPT_OUTQUE;
 398                         showlist(fiop);
 399                 }
 400         } else if (opts & OPT_FRSTATES)
 401                 showfrstates(ifrstp, fiop->f_ticks);
 402 #ifdef STATETOP
 403         else if (opts & OPT_STATETOP)
 404                 topipstates(saddr, daddr, sport, dport, protocol,
 405                             use_inet6 ? 6 : 4, refreshtime, topclosed);
 406 #endif
 407         else if (opts & OPT_AUTHSTATS)
 408                 showauthstates(frauthstp);
 409         else if (opts & OPT_GROUPS)
 410                 showgroups(fiop);
 411         else
 412                 showstats(fiop, frf);
 413
 414         return 0;
 415 }
 416
 417
 418 /*
 419  * Fill in the stats structures from the live kernel, using a combination
 420  * of ioctl's and copying directly from kernel memory.
 421  */
 422 static void ipfstate_live(device, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
 423 char *device;
 424 friostat_t **fiopp;
 425 ips_stat_t **ipsstpp;
 426 ipfrstat_t **ifrstpp;
 427 fr_authstat_t **frauthstpp;
 428 u_32_t *frfp;
 429 {
 430         ipfobj_t ipfo;
 431
 432         if (checkrev(device) == -1) {
 433                 fprintf(stderr, "User/kernel version check failed\n");
 434                 exit(1);
 435         }
 436
 437         if ((opts & OPT_AUTHSTATS) == 0) {
 438                 bzero((caddr_t)&ipfo, sizeof(ipfo));
 439                 ipfo.ipfo_rev = IPFILTER_VERSION;
 440                 ipfo.ipfo_type = IPFOBJ_IPFSTAT;
 441                 ipfo.ipfo_size = sizeof(friostat_t);
 442                 ipfo.ipfo_ptr = (void *)*fiopp;
 443
 444                 if (ioctl(ipf_fd, SIOCGETFS, &ipfo) == -1) {
 445                         perror("ioctl(ipf:SIOCGETFS)");
 446                         exit(-1);
 447                 }
 448
 449                 if (ioctl(ipf_fd, SIOCGETFF, frfp) == -1)
 450                         perror("ioctl(SIOCGETFF)");
 451         }
 452
 453         if ((opts & OPT_IPSTATES) != 0) {
 454
 455                 bzero((caddr_t)&ipfo, sizeof(ipfo));
 456                 ipfo.ipfo_rev = IPFILTER_VERSION;
 457                 ipfo.ipfo_type = IPFOBJ_STATESTAT;
 458                 ipfo.ipfo_size = sizeof(ips_stat_t);
 459                 ipfo.ipfo_ptr = (void *)*ipsstpp;
 460
 461                 if ((ioctl(state_fd, SIOCGETFS, &ipfo) == -1)) {
 462                         perror("ioctl(state:SIOCGETFS)");
 463                         exit(-1);
 464                 }
 465                 if (ioctl(state_fd, SIOCGETLG, &state_logging) == -1) {
 466                         perror("ioctl(state:SIOCGETLG)");
 467                         exit(-1);
 468                 }
 469         }
 470
 471         if ((opts & OPT_FRSTATES) != 0) {
 472                 bzero((caddr_t)&ipfo, sizeof(ipfo));
 473                 ipfo.ipfo_rev = IPFILTER_VERSION;
 474                 ipfo.ipfo_type = IPFOBJ_FRAGSTAT;
 475                 ipfo.ipfo_size = sizeof(ipfrstat_t);
 476                 ipfo.ipfo_ptr = (void *)*ifrstpp;
 477
 478                 if (ioctl(ipf_fd, SIOCGFRST, &ipfo) == -1) {
 479                         perror("ioctl(SIOCGFRST)");
 480                         exit(-1);
 481                 }
 482         }
 483
 484         if (opts & OPT_DEBUG)
 485                 PRINTF("opts %#x name %s\n", opts, device);
 486
 487         if ((opts & OPT_AUTHSTATS) != 0) {
 488                 bzero((caddr_t)&ipfo, sizeof(ipfo));
 489                 ipfo.ipfo_rev = IPFILTER_VERSION;
 490                 ipfo.ipfo_type = IPFOBJ_AUTHSTAT;
 491                 ipfo.ipfo_size = sizeof(fr_authstat_t);
 492                 ipfo.ipfo_ptr = (void *)*frauthstpp;
 493
 494                 if (ioctl(auth_fd, SIOCATHST, &ipfo) == -1) {
 495                         perror("ioctl(SIOCATHST)");
 496                         exit(-1);
 497                 }
 498         }
 499 }
 500
 501
 502 /*
 503  * Build up the stats structures from data held in the "core" memory.
 504  * This is mainly useful when looking at data in crash dumps and ioctl's
 505  * just won't work any more.
 506  */
 507 static void ipfstate_dead(kernel, fiopp, ipsstpp, ifrstpp, frauthstpp, frfp)
 508 char *kernel;
 509 friostat_t **fiopp;
 510 ips_stat_t **ipsstpp;
 511 ipfrstat_t **ifrstpp;
 512 fr_authstat_t **frauthstpp;
 513 u_32_t *frfp;
 514 {
 515         static fr_authstat_t frauthst, *frauthstp;
 516         static ips_stat_t ipsst, *ipsstp;
 517         static ipfrstat_t ifrst, *ifrstp;
 518         static friostat_t fio, *fiop;
 519         static ipftq_t ipssttab[IPF_TCP_NSTATES];
 520         int temp;
 521
 522         void *rules[2][2];
 523         struct nlist deadlist[44] = {
 524                 { "fr_authstats" },             /* 0 */
 525                 { "fae_list" },
 526                 { "ipauth" },
 527                 { "fr_authlist" },
 528                 { "fr_authstart" },
 529                 { "fr_authend" },               /* 5 */
 530                 { "fr_authnext" },
 531                 { "fr_auth" },
 532                 { "fr_authused" },
 533                 { "fr_authsize" },
 534                 { "fr_defaultauthage" },        /* 10 */
 535                 { "fr_authpkts" },
 536                 { "fr_auth_lock" },
 537                 { "frstats" },
 538                 { "ips_stats" },
 539                 { "ips_num" },                  /* 15 */
 540                 { "ips_wild" },
 541                 { "ips_list" },
 542                 { "ips_table" },
 543                 { "fr_statemax" },
 544                 { "fr_statesize" },             /* 20 */
 545                 { "fr_state_doflush" },
 546                 { "fr_state_lock" },
 547                 { "ipfr_heads" },
 548                 { "ipfr_nattab" },
 549                 { "ipfr_stats" },               /* 25 */
 550                 { "ipfr_inuse" },
 551                 { "fr_ipfrttl" },
 552                 { "fr_frag_lock" },
 553                 { "ipfr_timer_id" },
 554                 { "fr_nat_lock" },              /* 30 */
 555                 { "ipfilter" },
 556                 { "ipfilter6" },
 557                 { "ipacct" },
 558                 { "ipacct6" },
 559                 { "ipl_frouteok" },             /* 35 */
 560                 { "fr_running" },
 561                 { "ipfgroups" },
 562                 { "fr_active" },
 563                 { "fr_pass" },
 564                 { "fr_flags" },                 /* 40 */
 565                 { "ipstate_logging" },
 566                 { "ips_tqtqb" },
 567                 { NULL }
 568         };
 569
 570
 571         frauthstp = &frauthst;
 572         ipsstp = &ipsst;
 573         ifrstp = &ifrst;
 574         fiop = &fio;
 575
 576         *frfp = 0;
 577         *fiopp = fiop;
 578         *ipsstpp = ipsstp;
 579         *ifrstpp = ifrstp;
 580         *frauthstpp = frauthstp;
 581
 582         bzero((char *)fiop, sizeof(*fiop));
 583         bzero((char *)ipsstp, sizeof(*ipsstp));
 584         bzero((char *)ifrstp, sizeof(*ifrstp));
 585         bzero((char *)frauthstp, sizeof(*frauthstp));
 586
 587         if (nlist(kernel, deadlist) == -1) {
 588                 fprintf(stderr, "nlist error\n");
 589                 return;
 590         }
 591
 592         /*
 593          * This is for SIOCGETFF.
 594          */
 595         kmemcpy((char *)frfp, (u_long)deadlist[40].n_value, sizeof(*frfp));
 596
 597         /*
 598          * f_locks is a combination of the lock variable from each part of
 599          * ipfilter (state, auth, nat, fragments).
 600          */
 601         kmemcpy((char *)fiop, (u_long)deadlist[13].n_value, sizeof(*fiop));
 602         kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[22].n_value,
 603                 sizeof(fiop->f_locks[0]));
 604         kmemcpy((char *)&fiop->f_locks[0], (u_long)deadlist[30].n_value,
 605                 sizeof(fiop->f_locks[1]));
 606         kmemcpy((char *)&fiop->f_locks[2], (u_long)deadlist[28].n_value,
 607                 sizeof(fiop->f_locks[2]));
 608         kmemcpy((char *)&fiop->f_locks[3], (u_long)deadlist[12].n_value,
 609                 sizeof(fiop->f_locks[3]));
 610
 611         /*
 612          * Get pointers to each list of rules (active, inactive, in, out)
 613          */
 614         kmemcpy((char *)&rules, (u_long)deadlist[31].n_value, sizeof(rules));
 615         fiop->f_fin[0] = rules[0][0];
 616         fiop->f_fin[1] = rules[0][1];
 617         fiop->f_fout[0] = rules[1][0];
 618         fiop->f_fout[1] = rules[1][1];
 619
 620         /*
 621          * Same for IPv6, except make them null if support for it is not
 622          * being compiled in.
 623          */
 624 #ifdef  USE_INET6
 625         kmemcpy((char *)&rules, (u_long)deadlist[32].n_value, sizeof(rules));
 626         fiop->f_fin6[0] = rules[0][0];
 627         fiop->f_fin6[1] = rules[0][1];
 628         fiop->f_fout6[0] = rules[1][0];
 629         fiop->f_fout6[1] = rules[1][1];
 630 #else
 631         fiop->f_fin6[0] = NULL;
 632         fiop->f_fin6[1] = NULL;
 633         fiop->f_fout6[0] = NULL;
 634         fiop->f_fout6[1] = NULL;
 635 #endif
 636
 637         /*
 638          * Now get accounting rules pointers.
 639          */
 640         kmemcpy((char *)&rules, (u_long)deadlist[33].n_value, sizeof(rules));
 641         fiop->f_acctin[0] = rules[0][0];
 642         fiop->f_acctin[1] = rules[0][1];
 643         fiop->f_acctout[0] = rules[1][0];
 644         fiop->f_acctout[1] = rules[1][1];
 645
 646 #ifdef  USE_INET6
 647         kmemcpy((char *)&rules, (u_long)deadlist[34].n_value, sizeof(rules));
 648         fiop->f_acctin6[0] = rules[0][0];
 649         fiop->f_acctin6[1] = rules[0][1];
 650         fiop->f_acctout6[0] = rules[1][0];
 651         fiop->f_acctout6[1] = rules[1][1];
 652 #else
 653         fiop->f_acctin6[0] = NULL;
 654         fiop->f_acctin6[1] = NULL;
 655         fiop->f_acctout6[0] = NULL;
 656         fiop->f_acctout6[1] = NULL;
 657 #endif
 658
 659         /*
 660          * A collection of "global" variables used inside the kernel which
 661          * are all collected in friostat_t via ioctl.
 662          */
 663         kmemcpy((char *)&fiop->f_froute, (u_long)deadlist[35].n_value,
 664                 sizeof(fiop->f_froute));
 665         kmemcpy((char *)&fiop->f_running, (u_long)deadlist[36].n_value,
 666                 sizeof(fiop->f_running));
 667         kmemcpy((char *)&fiop->f_groups, (u_long)deadlist[37].n_value,
 668                 sizeof(fiop->f_groups));
 669         kmemcpy((char *)&fiop->f_active, (u_long)deadlist[38].n_value,
 670                 sizeof(fiop->f_active));
 671         kmemcpy((char *)&fiop->f_defpass, (u_long)deadlist[39].n_value,
 672                 sizeof(fiop->f_defpass));
 673
 674         /*
 675          * Build up the state information stats structure.
 676          */
 677         kmemcpy((char *)ipsstp, (u_long)deadlist[14].n_value, sizeof(*ipsstp));
 678         kmemcpy((char *)&temp, (u_long)deadlist[15].n_value, sizeof(temp));
 679         kmemcpy((char *)ipssttab, (u_long)deadlist[42].n_value,
 680                 sizeof(ipssttab));
 681         ipsstp->iss_active = temp;
 682         ipsstp->iss_table = (void *)deadlist[18].n_value;
 683         ipsstp->iss_list = (void *)deadlist[17].n_value;
 684         ipsstp->iss_tcptab = ipssttab;
 685
 686         /*
 687          * Build up the authentiation information stats structure.
 688          */
 689         kmemcpy((char *)frauthstp, (u_long)deadlist[0].n_value,
 690                 sizeof(*frauthstp));
 691         frauthstp->fas_faelist = (void *)deadlist[1].n_value;
 692
 693         /*
 694          * Build up the fragment information stats structure.
 695          */
 696         kmemcpy((char *)ifrstp, (u_long)deadlist[25].n_value,
 697                 sizeof(*ifrstp));
 698         ifrstp->ifs_table = (void *)deadlist[23].n_value;
 699         ifrstp->ifs_nattab = (void *)deadlist[24].n_value;
 700         kmemcpy((char *)&ifrstp->ifs_inuse, (u_long)deadlist[26].n_value,
 701                 sizeof(ifrstp->ifs_inuse));
 702
 703         /*
 704          * Get logging on/off switches
 705          */
 706         kmemcpy((char *)&state_logging, (u_long)deadlist[41].n_value,
 707                 sizeof(state_logging));
 708 }
 709
 710
 711 /*
 712  * Display the kernel stats for packets blocked and passed and other
 713  * associated running totals which are kept.
 714  */
 715 static  void    showstats(fp, frf)
 716 struct  friostat        *fp;
 717 u_32_t frf;
 718 {
 719
 720         PRINTF("bad packets:\t\tin %lu\tout %lu\n",
 721                         fp->f_st[0].fr_bad, fp->f_st[1].fr_bad);
 722 #ifdef  USE_INET6
 723         PRINTF(" IPv6 packets:\t\tin %lu out %lu\n",
 724                         fp->f_st[0].fr_ipv6, fp->f_st[1].fr_ipv6);
 725 #endif
 726         PRINTF(" input packets:\t\tblocked %lu passed %lu nomatch %lu",
 727                         fp->f_st[0].fr_block, fp->f_st[0].fr_pass,
 728                         fp->f_st[0].fr_nom);
 729         PRINTF(" counted %lu short %lu\n",
 730                         fp->f_st[0].fr_acct, fp->f_st[0].fr_short);
 731         PRINTF("output packets:\t\tblocked %lu passed %lu nomatch %lu",
 732                         fp->f_st[1].fr_block, fp->f_st[1].fr_pass,
 733                         fp->f_st[1].fr_nom);
 734         PRINTF(" counted %lu short %lu\n",
 735                         fp->f_st[1].fr_acct, fp->f_st[1].fr_short);
 736         PRINTF(" input packets logged:\tblocked %lu passed %lu\n",
 737                         fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl);
 738         PRINTF("output packets logged:\tblocked %lu passed %lu\n",
 739                         fp->f_st[1].fr_bpkl, fp->f_st[1].fr_ppkl);
 740         PRINTF(" packets logged:\tinput %lu output %lu\n",
 741                         fp->f_st[0].fr_pkl, fp->f_st[1].fr_pkl);
 742         PRINTF(" log failures:\t\tinput %lu output %lu\n",
 743                         fp->f_st[0].fr_skip, fp->f_st[1].fr_skip);
 744         PRINTF("fragment state(in):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
 745                         fp->f_st[0].fr_nfr, fp->f_st[0].fr_bnfr,
 746                         fp->f_st[0].fr_cfr);
 747         PRINTF("fragment state(out):\tkept %lu\tlost %lu\tnot fragmented %lu\n",
 748                         fp->f_st[1].fr_nfr, fp->f_st[1].fr_bnfr,
 749                         fp->f_st[0].fr_cfr);
 750         PRINTF("packet state(in):\tkept %lu\tlost %lu\n",
 751                         fp->f_st[0].fr_ads, fp->f_st[0].fr_bads);
 752         PRINTF("packet state(out):\tkept %lu\tlost %lu\n",
 753                         fp->f_st[1].fr_ads, fp->f_st[1].fr_bads);
 754         PRINTF("ICMP replies:\t%lu\tTCP RSTs sent:\t%lu\n",
 755                         fp->f_st[0].fr_ret, fp->f_st[1].fr_ret);
 756         PRINTF("Invalid source(in):\t%lu\n", fp->f_st[0].fr_badsrc);
 757         PRINTF("Result cache hits(in):\t%lu\t(out):\t%lu\n",
 758                         fp->f_st[0].fr_chit, fp->f_st[1].fr_chit);
 759         PRINTF("IN Pullups succeeded:\t%lu\tfailed:\t%lu\n",
 760                         fp->f_st[0].fr_pull[0], fp->f_st[0].fr_pull[1]);
 761         PRINTF("OUT Pullups succeeded:\t%lu\tfailed:\t%lu\n",
 762                         fp->f_st[1].fr_pull[0], fp->f_st[1].fr_pull[1]);
 763         PRINTF("Fastroute successes:\t%lu\tfailures:\t%lu\n",
 764                         fp->f_froute[0], fp->f_froute[1]);
 765         PRINTF("TCP cksum fails(in):\t%lu\t(out):\t%lu\n",
 766                         fp->f_st[0].fr_tcpbad, fp->f_st[1].fr_tcpbad);
 767         PRINTF("IPF Ticks:\t%lu\n", fp->f_ticks);
 768
 769         PRINTF("Packet log flags set: (%#x)\n", frf);
 770         if (frf & FF_LOGPASS)
 771                 PRINTF("\tpackets passed through filter\n");
 772         if (frf & FF_LOGBLOCK)
 773                 PRINTF("\tpackets blocked by filter\n");
 774         if (frf & FF_LOGNOMATCH)
 775                 PRINTF("\tpackets not matched by filter\n");
 776         if (!frf)
 777                 PRINTF("\tnone\n");
 778 }
 779
 780
 781 /*
 782  * Print out a list of rules from the kernel, starting at the one passed.
 783  */
 784 static void printlivelist(out, set, fp, group, comment)
 785 int out, set;
 786 frentry_t *fp;
 787 char *group, *comment;
 788 {
 789         struct  frentry fb;
 790         ipfruleiter_t rule;
 791         frentry_t zero;
 792         frgroup_t *g;
 793         ipfobj_t obj;
 794         int n;
 795
 796         if (use_inet6 == 1)
 797                 fb.fr_v = 6;
 798         else
 799                 fb.fr_v = 4;
 800         fb.fr_next = fp;
 801         n = 0;
 802
 803         rule.iri_inout = out;
 804         rule.iri_active = set;
 805         rule.iri_rule = &fb;
 806         rule.iri_nrules = 1;
 807         rule.iri_v = use_inet6 ? 6 : 4;
 808         if (group != NULL)
 809                 strncpy(rule.iri_group, group, FR_GROUPLEN);
 810         else
 811                 rule.iri_group[0] = '\0';
 812
 813         bzero((char *)&zero, sizeof(zero));
 814
 815         bzero((char *)&obj, sizeof(obj));
 816         obj.ipfo_rev = IPFILTER_VERSION;
 817         obj.ipfo_type = IPFOBJ_IPFITER;
 818         obj.ipfo_size = sizeof(rule);
 819         obj.ipfo_ptr = &rule;
 820
 821         do {
 822                 u_long array[1000];
 823
 824                 memset(array, 0xff, sizeof(array));
 825                 fp = (frentry_t *)array;
 826                 rule.iri_rule = fp;
 827                 if (ioctl(ipf_fd, SIOCIPFITER, &obj) == -1) {
 828                         perror("ioctl(SIOCIPFITER)");
 829                         n = IPFGENITER_IPF;
 830                         ioctl(ipf_fd, SIOCIPFDELTOK, &n);
 831                         return;
 832                 }
 833                 if (bcmp(fp, &zero, sizeof(zero)) == 0)
 834                         break;
 835                 if (fp->fr_data != NULL)
 836                         fp->fr_data = (char *)fp + sizeof(*fp);
 837
 838                 n++;
 839
 840                 if (opts & (OPT_HITS|OPT_VERBOSE))
 841 #ifdef  USE_QUAD_T
 842                         PRINTF("%qu ", (unsigned long long) fp->fr_hits);
 843 #else
 844                         PRINTF("%lu ", fp->fr_hits);
 845 #endif
 846                 if (opts & (OPT_ACCNT|OPT_VERBOSE))
 847 #ifdef  USE_QUAD_T
 848                         PRINTF("%qu ", (unsigned long long) fp->fr_bytes);
 849 #else
 850                         PRINTF("%lu ", fp->fr_bytes);
 851 #endif
 852                 if (opts & OPT_SHOWLINENO)
 853                         PRINTF("@%d ", n);
 854
 855                 printfr(fp, ioctl);
 856                 if (opts & OPT_DEBUG) {
 857                         binprint(fp, sizeof(*fp));
 858                         if (fp->fr_data != NULL && fp->fr_dsize > 0)
 859                                 binprint(fp->fr_data, fp->fr_dsize);
 860                 }
 861                 if (fp->fr_grhead[0] != '\0') {
 862                         for (g = grtop; g != NULL; g = g->fg_next) {
 863                                 if (!strncmp(fp->fr_grhead, g->fg_name,
 864                                              FR_GROUPLEN))
 865                                         break;
 866                         }
 867                         if (g == NULL) {
 868                                 g = calloc(1, sizeof(*g));
 869
 870                                 if (g != NULL) {
 871                                         strncpy(g->fg_name, fp->fr_grhead,
 872                                                 FR_GROUPLEN);
 873                                         if (grtop == NULL) {
 874                                                 grtop = g;
 875                                                 grtail = g;
 876                                         } else {
 877                                                 grtail->fg_next = g;
 878                                                 grtail = g;
 879                                         }
 880                                 }
 881                         }
 882                 }
 883                 if (fp->fr_type == FR_T_CALLFUNC) {
 884                         printlivelist(out, set, fp->fr_data, group,
 885                                       "# callfunc: ");
 886                 }
 887         } while (fp->fr_next != NULL);
 888
 889         n = IPFGENITER_IPF;
 890         ioctl(ipf_fd, SIOCIPFDELTOK, &n);
 891
 892         if (group == NULL) {
 893                 while ((g = grtop) != NULL) {
 894                         printf("# Group %s\n", g->fg_name);
 895                         printlivelist(out, set, NULL, g->fg_name, comment);
 896                         grtop = g->fg_next;
 897                         free(g);
 898                 }
 899         }
 900 }
 901
 902
 903 static void printdeadlist(out, set, fp, group, comment)
 904 int out, set;
 905 frentry_t *fp;
 906 char *group, *comment;
 907 {
 908         frgroup_t *grtop, *grtail, *g;
 909         struct  frentry fb;
 910         char    *data;
 911         u_32_t  type;
 912         int     n;
 913
 914         fb.fr_next = fp;
 915         n = 0;
 916         grtop = NULL;
 917         grtail = NULL;
 918
 919         do {
 920                 fp = fb.fr_next;
 921                 if (kmemcpy((char *)&fb, (u_long)fb.fr_next,
 922                             sizeof(fb)) == -1) {
 923                         perror("kmemcpy");
 924                         return;
 925                 }
 926
 927                 data = NULL;
 928                 type = fb.fr_type & ~FR_T_BUILTIN;
 929                 if (type == FR_T_IPF || type == FR_T_BPFOPC) {
 930                         if (fb.fr_dsize) {
 931                                 data = malloc(fb.fr_dsize);
 932
 933                                 if (kmemcpy(data, (u_long)fb.fr_data,
 934                                             fb.fr_dsize) == -1) {
 935                                         perror("kmemcpy");
 936                                         return;
 937                                 }
 938                                 fb.fr_data = data;
 939                         }
 940                 }
 941
 942                 n++;
 943
 944                 if (opts & (OPT_HITS|OPT_VERBOSE))
 945 #ifdef  USE_QUAD_T
 946                         PRINTF("%qu ", (unsigned long long) fb.fr_hits);
 947 #else
 948                         PRINTF("%lu ", fb.fr_hits);
 949 #endif
 950                 if (opts & (OPT_ACCNT|OPT_VERBOSE))
 951 #ifdef  USE_QUAD_T
 952                         PRINTF("%qu ", (unsigned long long) fb.fr_bytes);
 953 #else
 954                         PRINTF("%lu ", fb.fr_bytes);
 955 #endif
 956                 if (opts & OPT_SHOWLINENO)
 957                         PRINTF("@%d ", n);
 958
 959                 printfr(fp, ioctl);
 960                 if (opts & OPT_DEBUG) {
 961                         binprint(fp, sizeof(*fp));
 962                         if (fb.fr_data != NULL && fb.fr_dsize > 0)
 963                                 binprint(fb.fr_data, fb.fr_dsize);
 964                 }
 965                 if (data != NULL)
 966                         free(data);
 967                 if (fb.fr_grhead[0] != '\0') {
 968                         g = calloc(1, sizeof(*g));
 969
 970                         if (g != NULL) {
 971                                 strncpy(g->fg_name, fb.fr_grhead,
 972                                         FR_GROUPLEN);
 973                                 if (grtop == NULL) {
 974                                         grtop = g;
 975                                         grtail = g;
 976                                 } else {
 977                                         grtail->fg_next = g;
 978                                         grtail = g;
 979                                 }
 980                         }
 981                 }
 982                 if (type == FR_T_CALLFUNC) {
 983                         printdeadlist(out, set, fb.fr_data, group,
 984                                       "# callfunc: ");
 985                 }
 986         } while (fb.fr_next != NULL);
 987
 988         while ((g = grtop) != NULL) {
 989                 printdeadlist(out, set, NULL, g->fg_name, comment);
 990                 grtop = g->fg_next;
 991                 free(g);
 992         }
 993 }
 994
 995 /*
 996  * print out all of the asked for rule sets, using the stats struct as
 997  * the base from which to get the pointers.
 998  */
 999 static  void    showlist(fiop)
1000 struct  friostat        *fiop;
1001 {
1002         struct  frentry *fp = NULL;
1003         int     i, set;
1004
1005         set = fiop->f_active;
1006         if (opts & OPT_INACTIVE)
1007                 set = 1 - set;
1008         if (opts & OPT_ACCNT) {
1009 #ifdef USE_INET6
1010                 if ((use_inet6) && (opts & OPT_OUTQUE)) {
1011                         i = F_ACOUT;
1012                         fp = (struct frentry *)fiop->f_acctout6[set];
1013                 } else if ((use_inet6) && (opts & OPT_INQUE)) {
1014                         i = F_ACIN;
1015                         fp = (struct frentry *)fiop->f_acctin6[set];
1016                 } else
1017 #endif
1018                 if (opts & OPT_OUTQUE) {
1019                         i = F_ACOUT;
1020                         fp = (struct frentry *)fiop->f_acctout[set];
1021                 } else if (opts & OPT_INQUE) {
1022                         i = F_ACIN;
1023                         fp = (struct frentry *)fiop->f_acctin[set];
1024                 } else {
1025                         FPRINTF(stderr, "No -i or -o given with -a\n");
1026                         return;
1027                 }
1028         } else {
1029 #ifdef  USE_INET6
1030                 if ((use_inet6) && (opts & OPT_OUTQUE)) {
1031                         i = F_OUT;
1032                         fp = (struct frentry *)fiop->f_fout6[set];
1033                 } else if ((use_inet6) && (opts & OPT_INQUE)) {
1034                         i = F_IN;
1035                         fp = (struct frentry *)fiop->f_fin6[set];
1036                 } else
1037 #endif
1038                 if (opts & OPT_OUTQUE) {
1039                         i = F_OUT;
1040                         fp = (struct frentry *)fiop->f_fout[set];
1041                 } else if (opts & OPT_INQUE) {
1042                         i = F_IN;
1043                         fp = (struct frentry *)fiop->f_fin[set];
1044                 } else
1045                         return;
1046         }
1047         if (opts & OPT_DEBUG)
1048                 FPRINTF(stderr, "showlist:opts %#x i %d\n", opts, i);
1049
1050         if (opts & OPT_DEBUG)
1051                 PRINTF("fp %p set %d\n", fp, set);
1052         if (!fp) {
1053                 FPRINTF(stderr, "empty list for %s%s\n",
1054                         (opts & OPT_INACTIVE) ? "inactive " : "", filters[i]);
1055                 return;
1056         }
1057         if (live_kernel == 1)
1058                 printlivelist(i, set, fp, NULL, NULL);
1059         else
1060                 printdeadlist(i, set, fp, NULL, NULL);
1061 }
1062
1063
1064 /*
1065  * Display ipfilter stateful filtering information
1066  */
1067 static void showipstates(ipsp)
1068 ips_stat_t *ipsp;
1069 {
1070         u_long minlen, maxlen, totallen, *buckets;
1071         ipftable_t table;
1072         ipfobj_t obj;
1073         int i, sz;
1074
1075         /*
1076          * If a list of states hasn't been asked for, only print out stats
1077          */
1078         if (!(opts & OPT_SHOWLIST)) {
1079
1080                 sz = sizeof(*buckets) * ipsp->iss_statesize;
1081                 buckets = (u_long *)malloc(sz);
1082
1083                 obj.ipfo_rev = IPFILTER_VERSION;
1084                 obj.ipfo_type = IPFOBJ_GTABLE;
1085                 obj.ipfo_size = sizeof(table);
1086                 obj.ipfo_ptr = &table;
1087
1088                 table.ita_type = IPFTABLE_BUCKETS;
1089                 table.ita_table = buckets;
1090
1091                 if (live_kernel == 1) {
1092                         if (ioctl(state_fd, SIOCGTABL, &obj) != 0) {
1093                                 free(buckets);
1094                                 return;
1095                         }
1096                 } else {
1097                         if (kmemcpy((char *)buckets,
1098                                     (u_long)ipsp->iss_bucketlen, sz)) {
1099                                 free(buckets);
1100                                 return;
1101                         }
1102                 }
1103
1104                 PRINTF("IP states added:\n\t%lu TCP\n\t%lu UDP\n\t%lu ICMP\n",
1105                         ipsp->iss_tcp, ipsp->iss_udp, ipsp->iss_icmp);
1106                 PRINTF("\t%lu hits\n\t%lu misses\n", ipsp->iss_hits,
1107                         ipsp->iss_miss);
1108                 PRINTF("\t%lu bucket full\n", ipsp->iss_bucketfull);
1109                 PRINTF("\t%lu maximum rule references\n", ipsp->iss_maxref);
1110                 PRINTF("\t%lu maximum\n\t%lu no memory\n\t%lu bkts in use\n",
1111                         ipsp->iss_max, ipsp->iss_nomem, ipsp->iss_inuse);
1112                 PRINTF("\t%lu active\n\t%lu expired\n\t%lu closed\n",
1113                         ipsp->iss_active, ipsp->iss_expire, ipsp->iss_fin);
1114
1115                 PRINTF("State logging %sabled\n",
1116                         state_logging ? "en" : "dis");
1117
1118                 PRINTF("\nState table bucket statistics:\n");
1119                 PRINTF("\t%lu in use\t\n", ipsp->iss_inuse);
1120                 PRINTF("\t%u%% hash efficiency\n", ipsp->iss_active ?
1121                         (u_int)(ipsp->iss_inuse * 100 / ipsp->iss_active) : 0);
1122
1123                 minlen = ipsp->iss_inuse;
1124                 totallen = 0;
1125                 maxlen = 0;
1126
1127                 for (i = 0; i < ipsp->iss_statesize; i++) {
1128                         if (buckets[i] > maxlen)
1129                                 maxlen = buckets[i];
1130                         if (buckets[i] < minlen)
1131                                 minlen = buckets[i];
1132                         totallen += buckets[i];
1133                 }
1134
1135                 PRINTF("\t%2.2f%% bucket usage\n\t%lu minimal length\n",
1136                         ((float)ipsp->iss_inuse / ipsp->iss_statesize) * 100.0,
1137                         minlen);
1138                 PRINTF("\t%lu maximal length\n\t%.3f average length\n",
1139                         maxlen,
1140                         ipsp->iss_inuse ? (float) totallen/ ipsp->iss_inuse :
1141                                           0.0);
1142
1143 #define ENTRIES_PER_LINE 5
1144
1145                 if (opts & OPT_VERBOSE) {
1146                         PRINTF("\nCurrent bucket sizes :\n");
1147                         for (i = 0; i < ipsp->iss_statesize; i++) {
1148                                 if ((i % ENTRIES_PER_LINE) == 0)
1149                                         PRINTF("\t");
1150                                 PRINTF("%4d -> %4lu", i, buckets[i]);
1151                                 if ((i % ENTRIES_PER_LINE) ==
1152                                     (ENTRIES_PER_LINE - 1))
1153                                         PRINTF("\n");
1154                                 else
1155                                         PRINTF("  ");
1156                         }
1157                         PRINTF("\n");
1158                 }
1159                 PRINTF("\n");
1160
1161                 free(buckets);
1162
1163                 if (live_kernel == 1) {
1164                         showtqtable_live(state_fd);
1165                 } else {
1166                         printtqtable(ipsp->iss_tcptab);
1167                 }
1168
1169                 return;
1170
1171         }
1172
1173         /*
1174          * Print out all the state information currently held in the kernel.
1175          */
1176         while (ipsp->iss_list != NULL) {
1177                 ipstate_t ips;
1178
1179                 ipsp->iss_list = fetchstate(ipsp->iss_list, &ips);
1180
1181                 if (ipsp->iss_list != NULL) {
1182                         ipsp->iss_list = ips.is_next;
1183                         printstate(&ips, opts, ipsp->iss_ticks);
1184                 }
1185         }
1186 }
1187
1188
1189 #ifdef STATETOP
1190 static int handle_resize = 0, handle_break = 0;
1191
1192 static void topipstates(saddr, daddr, sport, dport, protocol, ver,
1193                         refreshtime, topclosed)
1194 i6addr_t saddr;
1195 i6addr_t daddr;
1196 int sport;
1197 int dport;
1198 int protocol;
1199 int ver;
1200 int refreshtime;
1201 int topclosed;
1202 {
1203         char str1[STSTRSIZE], str2[STSTRSIZE], str3[STSTRSIZE], str4[STSTRSIZE];
1204         int maxtsentries = 0, reverse = 0, sorting = STSORT_DEFAULT;
1205         int i, j, winy, tsentry, maxx, maxy, redraw = 0, ret = 0;
1206         int len, srclen, dstlen, forward = 1, c = 0;
1207         ips_stat_t ipsst, *ipsstp = &ipsst;
1208         statetop_t *tstable = NULL, *tp;
1209         const char *errstr = "";
1210         ipstate_t ips;
1211         ipfobj_t ipfo;
1212         struct timeval selecttimeout;
1213         char hostnm[HOSTNMLEN];
1214         struct protoent *proto;
1215         fd_set readfd;
1216         time_t t;
1217
1218         /* install signal handlers */
1219         signal(SIGINT, sig_break);
1220         signal(SIGQUIT, sig_break);
1221         signal(SIGTERM, sig_break);
1222         signal(SIGWINCH, sig_resize);
1223
1224         /* init ncurses stuff */
1225         initscr();
1226         cbreak();
1227         noecho();
1228         curs_set(0);
1229         timeout(0);
1230         getmaxyx(stdscr, maxy, maxx);
1231
1232         /* init hostname */
1233         gethostname(hostnm, sizeof(hostnm) - 1);
1234         hostnm[sizeof(hostnm) - 1] = '\0';
1235
1236         /* init ipfobj_t stuff */
1237         bzero((caddr_t)&ipfo, sizeof(ipfo));
1238         ipfo.ipfo_rev = IPFILTER_VERSION;
1239         ipfo.ipfo_type = IPFOBJ_STATESTAT;
1240         ipfo.ipfo_size = sizeof(*ipsstp);
1241         ipfo.ipfo_ptr = (void *)ipsstp;
1242
1243         /* repeat until user aborts */
1244         while ( 1 ) {
1245
1246                 /* get state table */
1247                 bzero((char *)&ipsst, sizeof(ipsst));
1248                 if ((ioctl(state_fd, SIOCGETFS, &ipfo) == -1)) {
1249                         errstr = "ioctl(SIOCGETFS)";
1250                         ret = -1;
1251                         goto out;
1252                 }
1253
1254                 /* clear the history */
1255                 tsentry = -1;
1256
1257                 /* reset max str len */
1258                 srclen = dstlen = 0;
1259
1260                 /* read the state table and store in tstable */
1261                 for (; ipsstp->iss_list; ipsstp->iss_list = ips.is_next) {
1262
1263                         ipsstp->iss_list = fetchstate(ipsstp->iss_list, &ips);
1264                         if (ipsstp->iss_list == NULL)
1265                                 break;
1266
1267                         if (ips.is_v != ver)
1268                                 continue;
1269
1270                         /* check v4 src/dest addresses */
1271                         if (ips.is_v == 4) {
1272                                 if ((saddr.in4.s_addr != INADDR_ANY &&
1273                                      saddr.in4.s_addr != ips.is_saddr) ||
1274                                     (daddr.in4.s_addr != INADDR_ANY &&
1275                                      daddr.in4.s_addr != ips.is_daddr))
1276                                         continue;
1277                         }
1278 #ifdef  USE_INET6
1279                         /* check v6 src/dest addresses */
1280                         if (ips.is_v == 6) {
1281                                 if ((IP6_NEQ(&saddr, &in6addr_any) &&
1282                                      IP6_NEQ(&saddr, &ips.is_src)) ||
1283                                     (IP6_NEQ(&daddr, &in6addr_any) &&
1284                                      IP6_NEQ(&daddr, &ips.is_dst)))
1285                                         continue;
1286                         }
1287 #endif
1288                         /* check protocol */
1289                         if (protocol > 0 && protocol != ips.is_p)
1290                                 continue;
1291
1292                         /* check ports if protocol is TCP or UDP */
1293                         if (((ips.is_p == IPPROTO_TCP) ||
1294                              (ips.is_p == IPPROTO_UDP)) &&
1295                            (((sport > 0) && (htons(sport) != ips.is_sport)) ||
1296                             ((dport > 0) && (htons(dport) != ips.is_dport))))
1297                                 continue;
1298
1299                         /* show closed TCP sessions ? */
1300                         if ((topclosed == 0) && (ips.is_p == IPPROTO_TCP) &&
1301                             (ips.is_state[0] >= IPF_TCPS_LAST_ACK) &&
1302                             (ips.is_state[1] >= IPF_TCPS_LAST_ACK))
1303                                 continue;
1304
1305                         /*
1306                          * if necessary make room for this state
1307                          * entry
1308                          */
1309                         tsentry++;
1310                         if (!maxtsentries || tsentry == maxtsentries) {
1311                                 maxtsentries += STGROWSIZE;
1312                                 tstable = realloc(tstable,
1313                                     maxtsentries * sizeof(statetop_t));
1314                                 if (tstable == NULL) {
1315                                         perror("realloc");
1316                                         exit(-1);
1317                                 }
1318                         }
1319
1320                         /* get max src/dest address string length */
1321                         len = strlen(getip(ips.is_v, &ips.is_src));
1322                         if (srclen < len)
1323                                 srclen = len;
1324                         len = strlen(getip(ips.is_v, &ips.is_dst));
1325                         if (dstlen < len)
1326                                 dstlen = len;
1327
1328                         /* fill structure */
1329                         tp = tstable + tsentry;
1330                         tp->st_src = ips.is_src;
1331                         tp->st_dst = ips.is_dst;
1332                         tp->st_p = ips.is_p;
1333                         tp->st_v = ips.is_v;
1334                         tp->st_state[0] = ips.is_state[0];
1335                         tp->st_state[1] = ips.is_state[1];
1336                         if (forward) {
1337                                 tp->st_pkts = ips.is_pkts[0]+ips.is_pkts[1];
1338                                 tp->st_bytes = ips.is_bytes[0]+ips.is_bytes[1];
1339                         } else {
1340                                 tp->st_pkts = ips.is_pkts[2]+ips.is_pkts[3];
1341                                 tp->st_bytes = ips.is_bytes[2]+ips.is_bytes[3];
1342                         }
1343                         tp->st_age = ips.is_die - ipsstp->iss_ticks;
1344                         if ((ips.is_p == IPPROTO_TCP) ||
1345                             (ips.is_p == IPPROTO_UDP)) {
1346                                 tp->st_sport = ips.is_sport;
1347                                 tp->st_dport = ips.is_dport;
1348                         }
1349                 }
1350
1351
1352                 /* sort the array */
1353                 if (tsentry != -1) {
1354                         switch (sorting)
1355                         {
1356                         case STSORT_PR:
1357                                 qsort(tstable, tsentry + 1,
1358                                       sizeof(statetop_t), sort_p);
1359                                 break;
1360                         case STSORT_PKTS:
1361                                 qsort(tstable, tsentry + 1,
1362                                       sizeof(statetop_t), sort_pkts);
1363                                 break;
1364                         case STSORT_BYTES:
1365                                 qsort(tstable, tsentry + 1,
1366                                       sizeof(statetop_t), sort_bytes);
1367                                 break;
1368                         case STSORT_TTL:
1369                                 qsort(tstable, tsentry + 1,
1370                                       sizeof(statetop_t), sort_ttl);
1371                                 break;
1372                         case STSORT_SRCIP:
1373                                 qsort(tstable, tsentry + 1,
1374                                       sizeof(statetop_t), sort_srcip);
1375                                 break;
1376                         case STSORT_SRCPT:
1377                                 qsort(tstable, tsentry +1,
1378                                         sizeof(statetop_t), sort_srcpt);
1379                                 break;
1380                         case STSORT_DSTIP:
1381                                 qsort(tstable, tsentry + 1,
1382                                       sizeof(statetop_t), sort_dstip);
1383                                 break;
1384                         case STSORT_DSTPT:
1385                                 qsort(tstable, tsentry + 1,
1386                                       sizeof(statetop_t), sort_dstpt);
1387                                 break;
1388                         default:
1389                                 break;
1390                         }
1391                 }
1392
1393                 /* handle window resizes */
1394                 if (handle_resize) {
1395                         endwin();
1396                         initscr();
1397                         cbreak();
1398                         noecho();
1399                         curs_set(0);
1400                         timeout(0);
1401                         getmaxyx(stdscr, maxy, maxx);
1402                         redraw = 1;
1403                         handle_resize = 0;
1404                 }
1405
1406                 /* stop program? */
1407                 if (handle_break)
1408                         break;
1409
1410                 /* print title */
1411                 erase();
1412                 attron(A_BOLD);
1413                 winy = 0;
1414                 move(winy,0);
1415                 sprintf(str1, "%s - %s - state top", hostnm, IPL_VERSION);
1416                 for (j = 0 ; j < (maxx - 8 - strlen(str1)) / 2; j++)
1417                         printw(" ");
1418                 printw("%s", str1);
1419                 attroff(A_BOLD);
1420
1421                 /* just for fun add a clock */
1422                 move(winy, maxx - 8);
1423                 t = time(NULL);
1424                 strftime(str1, 80, "%T", localtime(&t));
1425                 printw("%s\n", str1);
1426
1427                 /*
1428                  * print the display filters, this is placed in the loop,
1429                  * because someday I might add code for changing these
1430                  * while the programming is running :-)
1431                  */
1432                 if (sport >= 0)
1433                         sprintf(str1, "%s,%d", getip(ver, &saddr), sport);
1434                 else
1435                         sprintf(str1, "%s", getip(ver, &saddr));
1436
1437                 if (dport >= 0)
1438                         sprintf(str2, "%s,%d", getip(ver, &daddr), dport);
1439                 else
1440                         sprintf(str2, "%s", getip(ver, &daddr));
1441
1442                 if (protocol < 0)
1443                         strcpy(str3, "any");
1444                 else if ((proto = getprotobynumber(protocol)) != NULL)
1445                         sprintf(str3, "%s", proto->p_name);
1446                 else
1447                         sprintf(str3, "%d", protocol);
1448
1449                 switch (sorting)
1450                 {
1451                 case STSORT_PR:
1452                         sprintf(str4, "proto");
1453                         break;
1454                 case STSORT_PKTS:
1455                         sprintf(str4, "# pkts");
1456                         break;
1457                 case STSORT_BYTES:
1458                         sprintf(str4, "# bytes");
1459                         break;
1460                 case STSORT_TTL:
1461                         sprintf(str4, "ttl");
1462                         break;
1463                 case STSORT_SRCIP:
1464                         sprintf(str4, "src ip");
1465                         break;
1466                 case STSORT_SRCPT:
1467                         sprintf(str4, "src port");
1468                         break;
1469                 case STSORT_DSTIP:
1470                         sprintf(str4, "dest ip");
1471                         break;
1472                 case STSORT_DSTPT:
1473                         sprintf(str4, "dest port");
1474                         break;
1475                 default:
1476                         sprintf(str4, "unknown");
1477                         break;
1478                 }
1479
1480                 if (reverse)
1481                         strcat(str4, " (reverse)");
1482
1483                 winy += 2;
1484                 move(winy,0);
1485                 printw("Src: %s, Dest: %s, Proto: %s, Sorted by: %s\n\n",
1486                        str1, str2, str3, str4);
1487
1488                 /*
1489                  * For an IPv4 IP address we need at most 15 characters,
1490                  * 4 tuples of 3 digits, separated by 3 dots. Enforce this
1491                  * length, so the colums do not change positions based
1492                  * on the size of the IP address. This length makes the
1493                  * output fit in a 80 column terminal.
1494                  * We are lacking a good solution for IPv6 addresses (that
1495                  * can be longer that 15 characters), so we do not enforce
1496                  * a maximum on the IP field size.
1497                  */
1498                 if (srclen < 15)
1499                         srclen = 15;
1500                 if (dstlen < 15)
1501                         dstlen = 15;
1502
1503                 /* print column description */
1504                 winy += 2;
1505                 move(winy,0);
1506                 attron(A_BOLD);
1507                 printw("%-*s %-*s %3s %4s %7s %9s %9s\n",
1508                        srclen + 6, "Source IP", dstlen + 6, "Destination IP",
1509                        "ST", "PR", "#pkts", "#bytes", "ttl");
1510                 attroff(A_BOLD);
1511
1512                 /* print all the entries */
1513                 tp = tstable;
1514                 if (reverse)
1515                         tp += tsentry;
1516
1517                 if (tsentry > maxy - 6)
1518                         tsentry = maxy - 6;
1519                 for (i = 0; i <= tsentry; i++) {
1520                         /* print src/dest and port */
1521                         if ((tp->st_p == IPPROTO_TCP) ||
1522                             (tp->st_p == IPPROTO_UDP)) {
1523                                 sprintf(str1, "%s,%hu",
1524                                         getip(tp->st_v, &tp->st_src),
1525                                         ntohs(tp->st_sport));
1526                                 sprintf(str2, "%s,%hu",
1527                                         getip(tp->st_v, &tp->st_dst),
1528                                         ntohs(tp->st_dport));
1529                         } else {
1530                                 sprintf(str1, "%s", getip(tp->st_v,
1531                                     &tp->st_src));
1532                                 sprintf(str2, "%s", getip(tp->st_v,
1533                                     &tp->st_dst));
1534                         }
1535                         winy++;
1536                         move(winy, 0);
1537                         printw("%-*s %-*s", srclen + 6, str1, dstlen + 6, str2);
1538
1539                         /* print state */
1540                         sprintf(str1, "%X/%X", tp->st_state[0],
1541                                 tp->st_state[1]);
1542                         printw(" %3s", str1);
1543
1544                         /* print protocol */
1545                         proto = getprotobynumber(tp->st_p);
1546                         if (proto) {
1547                                 strncpy(str1, proto->p_name, 4);
1548                                 str1[4] = '\0';
1549                         } else {
1550                                 sprintf(str1, "%d", tp->st_p);
1551                         }
1552                         /* just print icmp for IPv6-ICMP */
1553                         if (tp->st_p == IPPROTO_ICMPV6)
1554                                 strcpy(str1, "icmp");
1555                         printw(" %4s", str1);
1556
1557                         /* print #pkt/#bytes */
1558 #ifdef  USE_QUAD_T
1559                         printw(" %7qu %9qu", (unsigned long long) tp->st_pkts,
1560                                 (unsigned long long) tp->st_bytes);
1561 #else
1562                         printw(" %7lu %9lu", tp->st_pkts, tp->st_bytes);
1563 #endif
1564                         printw(" %9s", ttl_to_string(tp->st_age));
1565
1566                         if (reverse)
1567                                 tp--;
1568                         else
1569                                 tp++;
1570                 }
1571
1572                 /* screen data structure is filled, now update the screen */
1573                 if (redraw)
1574                         clearok(stdscr,1);
1575
1576                 if (refresh() == ERR)
1577                         break;
1578                 if (redraw) {
1579                         clearok(stdscr,0);
1580                         redraw = 0;
1581                 }
1582
1583                 /* wait for key press or a 1 second time out period */
1584                 selecttimeout.tv_sec = refreshtime;
1585                 selecttimeout.tv_usec = 0;
1586                 FD_ZERO(&readfd);
1587                 FD_SET(0, &readfd);
1588                 select(1, &readfd, NULL, NULL, &selecttimeout);
1589
1590                 /* if key pressed, read all waiting keys */
1591                 if (FD_ISSET(0, &readfd)) {
1592                         c = wgetch(stdscr);
1593                         if (c == ERR)
1594                                 continue;
1595
1596                         if (ISALPHA(c) && ISUPPER(c))
1597                                 c = TOLOWER(c);
1598                         if (c == 'l') {
1599                                 redraw = 1;
1600                         } else if (c == 'q') {
1601                                 break;
1602                         } else if (c == 'r') {
1603                                 reverse = !reverse;
1604                         } else if (c == 'b') {
1605                                 forward = 0;
1606                         } else if (c == 'f') {
1607                                 forward = 1;
1608                         } else if (c == 's') {
1609                                 if (++sorting > STSORT_MAX)
1610                                         sorting = 0;
1611                         }
1612                 }
1613         } /* while */
1614
1615 out:
1616         printw("\n");
1617         curs_set(1);
1618         /* nocbreak(); XXX - endwin() should make this redundant */
1619         endwin();
1620
1621         free(tstable);
1622         if (ret != 0)
1623                 perror(errstr);
1624 }
1625 #endif
1626
1627
1628 /*
1629  * Show fragment cache information that's held in the kernel.
1630  */
1631 static void showfrstates(ifsp, ticks)
1632 ipfrstat_t *ifsp;
1633 u_long ticks;
1634 {
1635         struct ipfr *ipfrtab[IPFT_SIZE], ifr;
1636         int i;
1637
1638         /*
1639          * print out the numeric statistics
1640          */
1641         PRINTF("IP fragment states:\n\t%lu new\n\t%lu expired\n\t%lu hits\n",
1642                 ifsp->ifs_new, ifsp->ifs_expire, ifsp->ifs_hits);
1643         PRINTF("\t%lu retrans\n\t%lu too short\n",
1644                 ifsp->ifs_retrans0, ifsp->ifs_short);
1645         PRINTF("\t%lu no memory\n\t%lu already exist\n",
1646                 ifsp->ifs_nomem, ifsp->ifs_exists);
1647         PRINTF("\t%lu inuse\n", ifsp->ifs_inuse);
1648         PRINTF("\n");
1649
1650         if (live_kernel == 0) {
1651                 if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_table,
1652                             sizeof(ipfrtab)))
1653                         return;
1654         }
1655
1656         /*
1657          * Print out the contents (if any) of the fragment cache table.
1658          */
1659         if (live_kernel == 1) {
1660                 do {
1661                         if (fetchfrag(ipf_fd, IPFGENITER_FRAG, &ifr) != 0)
1662                                 break;
1663                         if (ifr.ipfr_ifp == NULL)
1664                                 break;
1665                         ifr.ipfr_ttl -= ticks;
1666                         printfraginfo("", &ifr);
1667                 } while (1);
1668         } else {
1669                 for (i = 0; i < IPFT_SIZE; i++)
1670                         while (ipfrtab[i] != NULL) {
1671                                 if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
1672                                             sizeof(ifr)) == -1)
1673                                         break;
1674                                 printfraginfo("", &ifr);
1675                                 ipfrtab[i] = ifr.ipfr_next;
1676                         }
1677         }
1678         /*
1679          * Print out the contents (if any) of the NAT fragment cache table.
1680          */
1681
1682         if (live_kernel == 0) {
1683                 if (kmemcpy((char *)ipfrtab, (u_long)ifsp->ifs_nattab,
1684                             sizeof(ipfrtab)))
1685                         return;
1686         }
1687
1688         if (live_kernel == 1) {
1689                 do {
1690                         if (fetchfrag(nat_fd, IPFGENITER_NATFRAG, &ifr) != 0)
1691                                 break;
1692                         if (ifr.ipfr_ifp == NULL)
1693                                 break;
1694                         ifr.ipfr_ttl -= ticks;
1695                         printfraginfo("NAT: ", &ifr);
1696                 } while (1);
1697         } else {
1698                 for (i = 0; i < IPFT_SIZE; i++)
1699                         while (ipfrtab[i] != NULL) {
1700                                 if (kmemcpy((char *)&ifr, (u_long)ipfrtab[i],
1701                                             sizeof(ifr)) == -1)
1702                                         break;
1703                                 printfraginfo("NAT: ", &ifr);
1704                                 ipfrtab[i] = ifr.ipfr_next;
1705                         }
1706         }
1707 }
1708
1709
1710 /*
1711  * Show stats on how auth within IPFilter has been used
1712  */
1713 static void showauthstates(asp)
1714 fr_authstat_t *asp;
1715 {
1716         frauthent_t *frap, fra;
1717         ipfgeniter_t auth;
1718         ipfobj_t obj;
1719
1720         obj.ipfo_rev = IPFILTER_VERSION;
1721         obj.ipfo_type = IPFOBJ_GENITER;
1722         obj.ipfo_size = sizeof(auth);
1723         obj.ipfo_ptr = &auth;
1724
1725         auth.igi_type = IPFGENITER_AUTH;
1726         auth.igi_nitems = 1;
1727         auth.igi_data = &fra;
1728
1729 #ifdef  USE_QUAD_T
1730         printf("Authorisation hits: %qu\tmisses %qu\n",
1731                 (unsigned long long) asp->fas_hits,
1732                 (unsigned long long) asp->fas_miss);
1733 #else
1734         printf("Authorisation hits: %ld\tmisses %ld\n", asp->fas_hits,
1735                 asp->fas_miss);
1736 #endif
1737         printf("nospace %ld\nadded %ld\nsendfail %ld\nsendok %ld\n",
1738                 asp->fas_nospace, asp->fas_added, asp->fas_sendfail,
1739                 asp->fas_sendok);
1740         printf("queok %ld\nquefail %ld\nexpire %ld\n",
1741                 asp->fas_queok, asp->fas_quefail, asp->fas_expire);
1742
1743         frap = asp->fas_faelist;
1744         while (frap) {
1745                 if (live_kernel == 1) {
1746                         if (ioctl(auth_fd, SIOCGENITER, &obj))
1747                                 break;
1748                 } else {
1749                         if (kmemcpy((char *)&fra, (u_long)frap,
1750                                     sizeof(fra)) == -1)
1751                                 break;
1752                 }
1753                 printf("age %ld\t", fra.fae_age);
1754                 printfr(&fra.fae_fr, ioctl);
1755                 frap = fra.fae_next;
1756         }
1757 }
1758
1759
1760 /*
1761  * Display groups used for each of filter rules, accounting rules and
1762  * authentication, separately.
1763  */
1764 static void showgroups(fiop)
1765 struct friostat *fiop;
1766 {
1767         static char *gnames[3] = { "Filter", "Accounting", "Authentication" };
1768         static int gnums[3] = { IPL_LOGIPF, IPL_LOGCOUNT, IPL_LOGAUTH };
1769         frgroup_t *fp, grp;
1770         int on, off, i;
1771
1772         on = fiop->f_active;
1773         off = 1 - on;
1774
1775         for (i = 0; i < 3; i++) {
1776                 printf("%s groups (active):\n", gnames[i]);
1777                 for (fp = fiop->f_groups[gnums[i]][on]; fp != NULL;
1778                      fp = grp.fg_next)
1779                         if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
1780                                 break;
1781                         else
1782                                 printf("%s\n", grp.fg_name);
1783                 printf("%s groups (inactive):\n", gnames[i]);
1784                 for (fp = fiop->f_groups[gnums[i]][off]; fp != NULL;
1785                      fp = grp.fg_next)
1786                         if (kmemcpy((char *)&grp, (u_long)fp, sizeof(grp)))
1787                                 break;
1788                         else
1789                                 printf("%s\n", grp.fg_name);
1790         }
1791 }
1792
1793 static void parse_ipportstr(argument, ip, port)
1794 const char *argument;
1795 i6addr_t *ip;
1796 int *port;
1797 {
1798         char *s, *comma;
1799         int ok = 0;
1800
1801         /* make working copy of argument, Theoretically you must be able
1802          * to write to optarg, but that seems very ugly to me....
1803          */
1804         s = strdup(argument);
1805         if (s == NULL)
1806                 return;
1807
1808         /* get port */
1809         if ((comma = strchr(s, ',')) != NULL) {
1810                 if (!strcasecmp(comma + 1, "any")) {
1811                         *port = -1;
1812                 } else if (!sscanf(comma + 1, "%d", port) ||
1813                            (*port < 0) || (*port > 65535)) {
1814                         fprintf(stderr, "Invalid port specification in %s\n",
1815                                 argument);
1816                         free(s);
1817                         exit(-2);
1818                 }
1819                 *comma = '\0';
1820         }
1821
1822
1823         /* get ip address */
1824         if (!strcasecmp(s, "any")) {
1825                 ip->in4.s_addr = INADDR_ANY;
1826                 ok = 1;
1827 #ifdef  USE_INET6
1828                 ip->in6 = in6addr_any;
1829         } else if (use_inet6 && inet_pton(AF_INET6, s, &ip->in6)) {
1830                 ok = 1;
1831 #endif
1832         } else if (inet_aton(s, &ip->in4))
1833                 ok = 1;
1834
1835         if (ok == 0) {
1836                 fprintf(stderr, "Invalid IP address: %s\n", s);
1837                 free(s);
1838                 exit(-2);
1839         }
1840
1841         /* free allocated memory */
1842         free(s);
1843 }
1844
1845
1846 #ifdef STATETOP
1847 static void sig_resize(s)
1848 int s;
1849 {
1850         handle_resize = 1;
1851 }
1852
1853 static void sig_break(s)
1854 int s;
1855 {
1856         handle_break = 1;
1857 }
1858
1859 static char *getip(v, addr)
1860 int v;
1861 i6addr_t *addr;
1862 {
1863 #ifdef  USE_INET6
1864         static char hostbuf[MAXHOSTNAMELEN+1];
1865 #endif
1866
1867         if (v == 4)
1868                 return inet_ntoa(addr->in4);
1869
1870 #ifdef  USE_INET6
1871         (void) inet_ntop(AF_INET6, &addr->in6, hostbuf, sizeof(hostbuf) - 1);
1872         hostbuf[MAXHOSTNAMELEN] = '\0';
1873         return hostbuf;
1874 #else
1875         return "IPv6";
1876 #endif
1877 }
1878
1879
1880 static char *ttl_to_string(ttl)
1881 long int ttl;
1882 {
1883         static char ttlbuf[STSTRSIZE];
1884         int hours, minutes, seconds;
1885
1886         /* ttl is in half seconds */
1887         ttl /= 2;
1888
1889         hours = ttl / 3600;
1890         ttl = ttl % 3600;
1891         minutes = ttl / 60;
1892         seconds = ttl % 60;
1893
1894         if (hours > 0)
1895                 sprintf(ttlbuf, "%2d:%02d:%02d", hours, minutes, seconds);
1896         else
1897                 sprintf(ttlbuf, "%2d:%02d", minutes, seconds);
1898         return ttlbuf;
1899 }
1900
1901
1902 static int sort_pkts(a, b)
1903 const void *a;
1904 const void *b;
1905 {
1906
1907         register const statetop_t *ap = a;
1908         register const statetop_t *bp = b;
1909
1910         if (ap->st_pkts == bp->st_pkts)
1911                 return 0;
1912         else if (ap->st_pkts < bp->st_pkts)
1913                 return 1;
1914         return -1;
1915 }
1916
1917
1918 static int sort_bytes(a, b)
1919 const void *a;
1920 const void *b;
1921 {
1922         register const statetop_t *ap = a;
1923         register const statetop_t *bp = b;
1924
1925         if (ap->st_bytes == bp->st_bytes)
1926                 return 0;
1927         else if (ap->st_bytes < bp->st_bytes)
1928                 return 1;
1929         return -1;
1930 }
1931
1932
1933 static int sort_p(a, b)
1934 const void *a;
1935 const void *b;
1936 {
1937         register const statetop_t *ap = a;
1938         register const statetop_t *bp = b;
1939
1940         if (ap->st_p == bp->st_p)
1941                 return 0;
1942         else if (ap->st_p < bp->st_p)
1943                 return 1;
1944         return -1;
1945 }
1946
1947
1948 static int sort_ttl(a, b)
1949 const void *a;
1950 const void *b;
1951 {
1952         register const statetop_t *ap = a;
1953         register const statetop_t *bp = b;
1954
1955         if (ap->st_age == bp->st_age)
1956                 return 0;
1957         else if (ap->st_age < bp->st_age)
1958                 return 1;
1959         return -1;
1960 }
1961
1962 static int sort_srcip(a, b)
1963 const void *a;
1964 const void *b;
1965 {
1966         register const statetop_t *ap = a;
1967         register const statetop_t *bp = b;
1968
1969 #ifdef USE_INET6
1970         if (use_inet6) {
1971                 if (IP6_EQ(&ap->st_src, &bp->st_src))
1972                         return 0;
1973                 else if (IP6_GT(&ap->st_src, &bp->st_src))
1974                         return 1;
1975         } else
1976 #endif
1977         {
1978                 if (ntohl(ap->st_src.in4.s_addr) ==
1979                     ntohl(bp->st_src.in4.s_addr))
1980                         return 0;
1981                 else if (ntohl(ap->st_src.in4.s_addr) >
1982                          ntohl(bp->st_src.in4.s_addr))
1983                         return 1;
1984         }
1985         return -1;
1986 }
1987
1988 static int sort_srcpt(a, b)
1989 const void *a;
1990 const void *b;
1991 {
1992         register const statetop_t *ap = a;
1993         register const statetop_t *bp = b;
1994
1995         if (htons(ap->st_sport) == htons(bp->st_sport))
1996                 return 0;
1997         else if (htons(ap->st_sport) > htons(bp->st_sport))
1998                 return 1;
1999         return -1;
2000 }
2001
2002 static int sort_dstip(a, b)
2003 const void *a;
2004 const void *b;
2005 {
2006         register const statetop_t *ap = a;
2007         register const statetop_t *bp = b;
2008
2009 #ifdef USE_INET6
2010         if (use_inet6) {
2011                 if (IP6_EQ(&ap->st_dst, &bp->st_dst))
2012                         return 0;
2013                 else if (IP6_GT(&ap->st_dst, &bp->st_dst))
2014                         return 1;
2015         } else
2016 #endif
2017         {
2018                 if (ntohl(ap->st_dst.in4.s_addr) ==
2019                     ntohl(bp->st_dst.in4.s_addr))
2020                         return 0;
2021                 else if (ntohl(ap->st_dst.in4.s_addr) >
2022                          ntohl(bp->st_dst.in4.s_addr))
2023                         return 1;
2024         }
2025         return -1;
2026 }
2027
2028 static int sort_dstpt(a, b)
2029 const void *a;
2030 const void *b;
2031 {
2032         register const statetop_t *ap = a;
2033         register const statetop_t *bp = b;
2034
2035         if (htons(ap->st_dport) == htons(bp->st_dport))
2036                 return 0;
2037         else if (htons(ap->st_dport) > htons(bp->st_dport))
2038                 return 1;
2039         return -1;
2040 }
2041
2042 #endif
2043
2044
2045 ipstate_t *fetchstate(src, dst)
2046 ipstate_t *src, *dst;
2047 {
2048         int i;
2049
2050         if (live_kernel == 1) {
2051                 ipfgeniter_t state;
2052                 ipfobj_t obj;
2053
2054                 obj.ipfo_rev = IPFILTER_VERSION;
2055                 obj.ipfo_type = IPFOBJ_GENITER;
2056                 obj.ipfo_size = sizeof(state);
2057                 obj.ipfo_ptr = &state;
2058
2059                 state.igi_type = IPFGENITER_STATE;
2060                 state.igi_nitems = 1;
2061                 state.igi_data = dst;
2062
2063                 if (ioctl(state_fd, SIOCGENITER, &obj) != 0)
2064                         return NULL;
2065                 if (dst->is_next == NULL) {
2066                         i = IPFGENITER_STATE;
2067                         ioctl(state_fd, SIOCIPFDELTOK, &i);
2068                 }
2069         } else {
2070                 if (kmemcpy((char *)dst, (u_long)src, sizeof(*dst)))
2071                         return NULL;
2072         }
2073         return dst;
2074 }
2075
2076
2077 static int fetchfrag(fd, type, frp)
2078 int fd, type;
2079 ipfr_t *frp;
2080 {
2081         ipfgeniter_t frag;
2082         ipfobj_t obj;
2083
2084         obj.ipfo_rev = IPFILTER_VERSION;
2085         obj.ipfo_type = IPFOBJ_GENITER;
2086         obj.ipfo_size = sizeof(frag);
2087         obj.ipfo_ptr = &frag;
2088
2089         frag.igi_type = type;
2090         frag.igi_nitems = 1;
2091         frag.igi_data = frp;
2092
2093         if (ioctl(fd, SIOCGENITER, &obj))
2094                 return EFAULT;
2095         return 0;
2096 }
2097
2098
2099 static void showtqtable_live(fd)
2100 int fd;
2101 {
2102         ipftq_t table[IPF_TCP_NSTATES];
2103         ipfobj_t obj;
2104
2105         bzero((char *)&obj, sizeof(obj));
2106         obj.ipfo_rev = IPFILTER_VERSION;
2107         obj.ipfo_size = sizeof(table);
2108         obj.ipfo_ptr = (void *)table;
2109         obj.ipfo_type = IPFOBJ_STATETQTAB;
2110
2111         if (ioctl(fd, SIOCGTQTAB, &obj) == 0) {
2112                 printtqtable(table);
2113         }
2114 }