On Thu, Jan 27, 2011 at 11:33:51AM -0500, Kevin Wilcox wrote:
Before I write something to interpret state changes from pfsync, can
anyone offer guidance on how to pull those translations?
pfsync should be the simplest source to get that information from,
the idea is that you can use tcpdump on the pfsync interface to
filter and print any state changes.
It seems neither the stock tcpdump nor the one from ports actually
does this (yet) in FreeBSD. That's a pity, since it's sometimes
a very useful feature, not just for debugging.
The patch below adds this to the stock tcpdump (against 8.2),
so you can run
# tcpdump -s 1600 -npi pfsync0 'ether[2]!=2'
to get output like
11:56:24.843786 11:56:24.843786 INS ST:
all icmp 172.17.227.9:512 - 192.168.107.134 0:0
11:56:27.285591 11:56:27.285591 DEL ST:
all icmp 172.17.227.9:16 - 192.168.107.25 0:0
If the states involve address translation, you'll see three
pairs of addresses/ports, including before/after translation.
The filter 'ether[2]!=2' means 'any action except update', as
the ether layer in this context means struct pfsync_header, see
/usr/include/net/if_pfsync.h. Updates are chatty, inserts and
deletions usually less so.
There are probably more pieces to be lifted from OpenBSD's
tcpdump, but this might be enough or at least a good start.
You can use other tcpdump options, like write to a pcap file,
then later use tcpdump to read that file and search for specific
time slices, etc.
HTH,
Daniel
Index: usr.sbin/tcpdump/tcpdump/Makefile
===
RCS file: /home/ncvs/src/usr.sbin/tcpdump/tcpdump/Makefile,v
retrieving revision 1.47.2.1
diff -u -r1.47.2.1 Makefile
--- usr.sbin/tcpdump/tcpdump/Makefile 3 Aug 2009 08:13:06 - 1.47.2.1
+++ usr.sbin/tcpdump/tcpdump/Makefile 31 Jan 2011 10:42:07 -
@@ -61,6 +61,9 @@
.if ${MK_PF} != no
SRCS+= print-pflog.c
+SRCS+= print-pfsync.c
+SRCS+= pf_print_state.c
+CFLAGS+= -I/usr/src/contrib/pf/pfctl
CFLAGS+= -DHAVE_NET_PFVAR_H
.endif
Index: contrib/tcpdump/interface.h
===
RCS file: /home/ncvs/src/contrib/tcpdump/interface.h,v
retrieving revision 1.14.2.1
diff -u -r1.14.2.1 interface.h
--- contrib/tcpdump/interface.h 3 Aug 2009 08:13:06 - 1.14.2.1
+++ contrib/tcpdump/interface.h 31 Jan 2011 09:37:35 -
@@ -203,6 +203,7 @@
extern void egp_print(const u_char *, u_int);
extern u_int enc_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int pflog_if_print(const struct pcap_pkthdr *, const u_char *);
+extern u_int pfsync_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int arcnet_if_print(const struct pcap_pkthdr *, const u_char *);
extern u_int arcnet_linux_if_print(const struct pcap_pkthdr *, const u_char *);
extern void ether_print(const u_char *, u_int, u_int);
Index: contrib/tcpdump/tcpdump.c
===
RCS file: /home/ncvs/src/contrib/tcpdump/tcpdump.c,v
retrieving revision 1.14.2.1
diff -u -r1.14.2.1 tcpdump.c
--- contrib/tcpdump/tcpdump.c 3 Aug 2009 08:13:06 - 1.14.2.1
+++ contrib/tcpdump/tcpdump.c 31 Jan 2011 09:35:23 -
@@ -197,6 +197,9 @@
#if defined(DLT_PFLOG) defined(HAVE_NET_PFVAR_H)
{ pflog_if_print, DLT_PFLOG },
#endif
+#if defined(DLT_PFSYNC) defined(HAVE_NET_PFVAR_H)
+ { pfsync_if_print, DLT_PFSYNC },
+#endif
#ifdef DLT_FR
{ fr_if_print, DLT_FR },
#endif
--- /dev/null 2011-01-31 11:44:00.0 +0100
+++ contrib/tcpdump/print-pfsync.c 2011-01-31 11:09:28.0 +0100
@@ -0,0 +1,247 @@
+/* $OpenBSD: print-pfsync.c,v 1.29 2005/11/04 08:24:15 mcbride Exp $
*/
+
+/*
+ * Copyright (c) 2002 Michael Shalayeff
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *notice, this list of conditions and the following disclaimer in the
+ *documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR
