pfctl's -P flag (introduced in OpenBSD 5.1) makes pfctl print ports
using their names in /etc/services.  It was originally intended to be
used with -sr.

The diff extends it to make it work with -ss.

Example:

# pfctl -P -ss
all tcp 192.168.6.7:ssh (172.16.88.25:6688) <- 172.16.88.22:49622       
ESTABLISHED:ESTABLISHED
all udp 172.16.88.25:37076 -> 8.8.8.8:domain       MULTIPLE:SINGLE
all udp 172.16.88.25:18253 -> 8.8.8.8:domain       MULTIPLE:SINGLE
all udp 172.16.88.25:36447 -> 8.8.8.8:domain       MULTIPLE:SINGLE
all udp 172.16.88.25:16927 -> 8.8.8.8:domain       MULTIPLE:SINGLE
all tcp 172.16.88.25:4461 -> 142.244.12.42:www       FIN_WAIT_2:FIN_WAIT_2
all udp 172.16.88.25:21053 -> 65.49.70.244:ntp       MULTIPLE:MULTIPLE
all tcp 2001:470:e3b6:1:20c:29ff:fe9b:22f7[28976] -> 2001:4860:800a::93[www]    
   FIN_WAIT_2:FIN_WAIT_2
all ipv6-icmp 2001:470:e3b6:1:20c:29ff:fe9b:22f7[135] <- 
2001:470:e3b6:1::ff[30569]       0:0

Comments? Ok?

Lawrence


Index: pf_print_state.c
===================================================================
RCS file: /cvs/src/sbin/pfctl/pf_print_state.c,v
retrieving revision 1.59
diff -u -p -r1.59 pf_print_state.c
--- pf_print_state.c    13 Oct 2011 18:30:54 -0000      1.59
+++ pf_print_state.c    31 May 2012 03:10:29 -0000
@@ -166,8 +166,11 @@ print_name(struct pf_addr *addr, sa_fami
 
 void
 print_host(struct pf_addr *addr, u_int16_t port, sa_family_t af, u_int16_t 
rdom,
-    int opts)
+    const char *proto, int opts)
 {
+       struct servent  *s = NULL;
+       char            ps[6];
+
        if (rdom)
                printf("(%u) ", ntohs(rdom));
 
@@ -188,10 +191,13 @@ print_host(struct pf_addr *addr, u_int16
        }
 
        if (port) {
+               snprintf(ps, sizeof(ps), "%u", ntohs(port));
+               if (opts & PF_OPT_PORTNAMES)
+                       s = getservbyport(port, proto);
                if (af == AF_INET)
-                       printf(":%u", ntohs(port));
+                       printf(":%s", s ? s->s_name : ps);
                else
-                       printf("[%u]", ntohs(port));
+                       printf("[%s]", s ? s->s_name : ps);
        }
 }
 
@@ -212,6 +218,7 @@ print_state(struct pfsync_state *s, int 
        struct pfsync_state_peer *src, *dst;
        struct pfsync_state_key *sk, *nk;
        struct protoent *p;
+       char *pn = NULL;
        int min, sec;
        int afto = (s->key[PF_SK_STACK].af != s->key[PF_SK_WIRE].af);
        int idx;
@@ -232,33 +239,34 @@ print_state(struct pfsync_state *s, int 
                        sk->port[1] = nk->port[1];
        }
        printf("%s ", s->ifname);
-       if ((p = getprotobynumber(s->proto)) != NULL)
-               printf("%s ", p->p_name);
-       else
+       if ((p = getprotobynumber(s->proto)) != NULL) {
+               pn = p->p_name;
+               printf("%s ", pn);
+       } else
                printf("%u ", s->proto);
 
-       print_host(&nk->addr[1], nk->port[1], nk->af, nk->rdomain, opts);
+       print_host(&nk->addr[1], nk->port[1], nk->af, nk->rdomain, pn, opts);
        if (nk->af != sk->af || PF_ANEQ(&nk->addr[1], &sk->addr[1], nk->af) ||
            nk->port[1] != sk->port[1] ||
            nk->rdomain != sk->rdomain) {
                idx = afto ? 0 : 1;
                printf(" (");
                print_host(&sk->addr[idx], sk->port[idx], sk->af,
-                   sk->rdomain, opts);
+                   sk->rdomain, pn, opts);
                printf(")");
        }
        if (s->direction == PF_OUT || (afto && s->direction == PF_IN))
                printf(" -> ");
        else
                printf(" <- ");
-       print_host(&nk->addr[0], nk->port[0], nk->af, nk->rdomain, opts);
+       print_host(&nk->addr[0], nk->port[0], nk->af, nk->rdomain, pn, opts);
        if (nk->af != sk->af || PF_ANEQ(&nk->addr[0], &sk->addr[0], nk->af) ||
            nk->port[0] != sk->port[0] ||
            nk->rdomain != sk->rdomain) {
                idx = afto ? 1 : 0;
                printf(" (");
                print_host(&sk->addr[idx], sk->port[idx], sk->af,
-                   sk->rdomain, opts);
+                   sk->rdomain, pn, opts);
                printf(")");
        }
 
Index: pfctl.h
===================================================================
RCS file: /cvs/src/sbin/pfctl/pfctl.h,v
retrieving revision 1.47
diff -u -p -r1.47 pfctl.h
--- pfctl.h     27 Jul 2011 00:26:10 -0000      1.47
+++ pfctl.h     29 May 2012 04:38:38 -0000
@@ -106,7 +106,7 @@ struct pf_altq      *pfaltq_lookup(const char
 char           *rate2str(double);
 
 void    print_addr(struct pf_addr_wrap *, sa_family_t, int);
-void    print_host(struct pf_addr *, u_int16_t p, sa_family_t, u_int16_t, int);
+void    print_host(struct pf_addr *, u_int16_t p, sa_family_t, u_int16_t, 
const char *, int);
 void    print_seq(struct pfsync_state_peer *);
 void    print_state(struct pfsync_state *, int);
 int     unmask(struct pf_addr *, sa_family_t);

Reply via email to