pfctl's -P flag (introduced in OpenBSD 5.1) makes pfctl print ports
using their names in /etc/services. It was originally intended to be
used with -sr.
The diff extends it to make it work with -ss.
Example:
# pfctl -P -ss
all tcp 192.168.6.7:ssh (172.16.88.25:6688) <- 172.16.88.22:49622
ESTABLISHED:ESTABLISHED
all udp 172.16.88.25:37076 -> 8.8.8.8:domain MULTIPLE:SINGLE
all udp 172.16.88.25:18253 -> 8.8.8.8:domain MULTIPLE:SINGLE
all udp 172.16.88.25:36447 -> 8.8.8.8:domain MULTIPLE:SINGLE
all udp 172.16.88.25:16927 -> 8.8.8.8:domain MULTIPLE:SINGLE
all tcp 172.16.88.25:4461 -> 142.244.12.42:www FIN_WAIT_2:FIN_WAIT_2
all udp 172.16.88.25:21053 -> 65.49.70.244:ntp MULTIPLE:MULTIPLE
all tcp 2001:470:e3b6:1:20c:29ff:fe9b:22f7[28976] -> 2001:4860:800a::93[www]
FIN_WAIT_2:FIN_WAIT_2
all ipv6-icmp 2001:470:e3b6:1:20c:29ff:fe9b:22f7[135] <-
2001:470:e3b6:1::ff[30569] 0:0
Comments? Ok?
Lawrence
Index: pf_print_state.c
===================================================================
RCS file: /cvs/src/sbin/pfctl/pf_print_state.c,v
retrieving revision 1.59
diff -u -p -r1.59 pf_print_state.c
--- pf_print_state.c 13 Oct 2011 18:30:54 -0000 1.59
+++ pf_print_state.c 31 May 2012 03:10:29 -0000
@@ -166,8 +166,11 @@ print_name(struct pf_addr *addr, sa_fami
void
print_host(struct pf_addr *addr, u_int16_t port, sa_family_t af, u_int16_t
rdom,
- int opts)
+ const char *proto, int opts)
{
+ struct servent *s = NULL;
+ char ps[6];
+
if (rdom)
printf("(%u) ", ntohs(rdom));
@@ -188,10 +191,13 @@ print_host(struct pf_addr *addr, u_int16
}
if (port) {
+ snprintf(ps, sizeof(ps), "%u", ntohs(port));
+ if (opts & PF_OPT_PORTNAMES)
+ s = getservbyport(port, proto);
if (af == AF_INET)
- printf(":%u", ntohs(port));
+ printf(":%s", s ? s->s_name : ps);
else
- printf("[%u]", ntohs(port));
+ printf("[%s]", s ? s->s_name : ps);
}
}
@@ -212,6 +218,7 @@ print_state(struct pfsync_state *s, int
struct pfsync_state_peer *src, *dst;
struct pfsync_state_key *sk, *nk;
struct protoent *p;
+ char *pn = NULL;
int min, sec;
int afto = (s->key[PF_SK_STACK].af != s->key[PF_SK_WIRE].af);
int idx;
@@ -232,33 +239,34 @@ print_state(struct pfsync_state *s, int
sk->port[1] = nk->port[1];
}
printf("%s ", s->ifname);
- if ((p = getprotobynumber(s->proto)) != NULL)
- printf("%s ", p->p_name);
- else
+ if ((p = getprotobynumber(s->proto)) != NULL) {
+ pn = p->p_name;
+ printf("%s ", pn);
+ } else
printf("%u ", s->proto);
- print_host(&nk->addr[1], nk->port[1], nk->af, nk->rdomain, opts);
+ print_host(&nk->addr[1], nk->port[1], nk->af, nk->rdomain, pn, opts);
if (nk->af != sk->af || PF_ANEQ(&nk->addr[1], &sk->addr[1], nk->af) ||
nk->port[1] != sk->port[1] ||
nk->rdomain != sk->rdomain) {
idx = afto ? 0 : 1;
printf(" (");
print_host(&sk->addr[idx], sk->port[idx], sk->af,
- sk->rdomain, opts);
+ sk->rdomain, pn, opts);
printf(")");
}
if (s->direction == PF_OUT || (afto && s->direction == PF_IN))
printf(" -> ");
else
printf(" <- ");
- print_host(&nk->addr[0], nk->port[0], nk->af, nk->rdomain, opts);
+ print_host(&nk->addr[0], nk->port[0], nk->af, nk->rdomain, pn, opts);
if (nk->af != sk->af || PF_ANEQ(&nk->addr[0], &sk->addr[0], nk->af) ||
nk->port[0] != sk->port[0] ||
nk->rdomain != sk->rdomain) {
idx = afto ? 1 : 0;
printf(" (");
print_host(&sk->addr[idx], sk->port[idx], sk->af,
- sk->rdomain, opts);
+ sk->rdomain, pn, opts);
printf(")");
}
Index: pfctl.h
===================================================================
RCS file: /cvs/src/sbin/pfctl/pfctl.h,v
retrieving revision 1.47
diff -u -p -r1.47 pfctl.h
--- pfctl.h 27 Jul 2011 00:26:10 -0000 1.47
+++ pfctl.h 29 May 2012 04:38:38 -0000
@@ -106,7 +106,7 @@ struct pf_altq *pfaltq_lookup(const char
char *rate2str(double);
void print_addr(struct pf_addr_wrap *, sa_family_t, int);
-void print_host(struct pf_addr *, u_int16_t p, sa_family_t, u_int16_t, int);
+void print_host(struct pf_addr *, u_int16_t p, sa_family_t, u_int16_t,
const char *, int);
void print_seq(struct pfsync_state_peer *);
void print_state(struct pfsync_state *, int);
int unmask(struct pf_addr *, sa_family_t);
