17c478bdstevel@tonic-gate/*
2d6c23f6yx * Copyright (C) 2001-2008 by Darren Reed.
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
57c478bdstevel@tonic-gate *
6d6c23f6yx * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
77c478bdstevel@tonic-gate * Use is subject to license terms.
894bdecdRob Gulewich *
994bdecdRob Gulewich * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
107c478bdstevel@tonic-gate */
117c478bdstevel@tonic-gate
12ae7a42bToomas Soome#ifdef SOLARIS
13ae7a42bToomas Soome#undef	SOLARIS
14ae7a42bToomas Soome#endif
15ae7a42bToomas Soome#if (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
16ae7a42bToomas Soome#define	SOLARIS	(1)
17ae7a42bToomas Soome#else
18ae7a42bToomas Soome#define	SOLARIS	(0)
197c478bdstevel@tonic-gate#endif
207c478bdstevel@tonic-gate
217c478bdstevel@tonic-gate#include <sys/types.h>
227c478bdstevel@tonic-gate#include <sys/stat.h>
237c478bdstevel@tonic-gate#include <sys/param.h>
247c478bdstevel@tonic-gate#include <sys/file.h>
257c478bdstevel@tonic-gate#include <sys/time.h>
267c478bdstevel@tonic-gate#define _KERNEL
277c478bdstevel@tonic-gate#include <sys/uio.h>
287c478bdstevel@tonic-gate#undef _KERNEL
297c478bdstevel@tonic-gate#include <sys/socket.h>
307c478bdstevel@tonic-gate#include <sys/ioctl.h>
317c478bdstevel@tonic-gate
327c478bdstevel@tonic-gate#include <stdio.h>
337c478bdstevel@tonic-gate#include <unistd.h>
347c478bdstevel@tonic-gate#include <string.h>
357c478bdstevel@tonic-gate#include <fcntl.h>
367c478bdstevel@tonic-gate#include <errno.h>
37ab25eebyz#include <time.h>
387c478bdstevel@tonic-gate#if !defined(__SVR4) && !defined(__svr4__)
397c478bdstevel@tonic-gate# if (__FreeBSD_version >= 300000)
407c478bdstevel@tonic-gate#  include <sys/dirent.h>
417c478bdstevel@tonic-gate# else
427c478bdstevel@tonic-gate#  include <sys/dir.h>
437c478bdstevel@tonic-gate# endif
447c478bdstevel@tonic-gate#else
457c478bdstevel@tonic-gate# include <sys/filio.h>
467c478bdstevel@tonic-gate# include <sys/byteorder.h>
477c478bdstevel@tonic-gate#endif
487c478bdstevel@tonic-gate#if !defined(__hpux) && (!defined(__SVR4) && !defined(__GNUC__))
497c478bdstevel@tonic-gate# include <strings.h>
507c478bdstevel@tonic-gate#endif
517c478bdstevel@tonic-gate#include <signal.h>
527c478bdstevel@tonic-gate#include <stdlib.h>
537c478bdstevel@tonic-gate#include <stddef.h>
547c478bdstevel@tonic-gate#include <netinet/in.h>
557c478bdstevel@tonic-gate#include <netinet/in_systm.h>
567c478bdstevel@tonic-gate#include <net/if.h>
577c478bdstevel@tonic-gate#include <netinet/ip.h>
58ab25eebyz#if !defined(__hpux) && !defined(linux)
597c478bdstevel@tonic-gate# include <netinet/tcp_fsm.h>
607c478bdstevel@tonic-gate#endif
617c478bdstevel@tonic-gate#include <netdb.h>
627c478bdstevel@tonic-gate#include <arpa/inet.h>
637c478bdstevel@tonic-gate#include <arpa/nameser.h>
647c478bdstevel@tonic-gate#ifdef	__hpux
657c478bdstevel@tonic-gate# undef	NOERROR
667c478bdstevel@tonic-gate#endif
677c478bdstevel@tonic-gate#include <resolv.h>
687c478bdstevel@tonic-gate
69ab25eebyz#if !defined(linux)
70ab25eebyz# include <sys/protosw.h>
71ab25eebyz# include <netinet/ip_var.h>
72ab25eebyz#endif
737c478bdstevel@tonic-gate
747c478bdstevel@tonic-gate#include <netinet/tcp.h>
757c478bdstevel@tonic-gate#include <netinet/ip_icmp.h>
767c478bdstevel@tonic-gate
777c478bdstevel@tonic-gate#include <ctype.h>
787c478bdstevel@tonic-gate#include <syslog.h>
797c478bdstevel@tonic-gate
807c478bdstevel@tonic-gate#include "netinet/ip_compat.h"
81ab25eebyz#include <netinet/tcpip.h>
827c478bdstevel@tonic-gate#include "netinet/ip_fil.h"
837c478bdstevel@tonic-gate#include "netinet/ip_nat.h"
847c478bdstevel@tonic-gate#include "netinet/ip_state.h"
857c478bdstevel@tonic-gate#include "netinet/ip_proxy.h"
867c478bdstevel@tonic-gate#include "ipmon.h"
8794bdecdRob Gulewich#include "ipfzone.h"
887c478bdstevel@tonic-gate
897c478bdstevel@tonic-gate#if !defined(lint)
907c478bdstevel@tonic-gatestatic const char sccsid[] = "@(#)ipmon.c	1.21 6/5/96 (C)1993-2000 Darren Reed";
91ab25eebyzstatic const char rcsid[] = "@(#)$Id: ipmon.c,v 1.33.2.10 2005/06/18 02:41:35 darrenr Exp $";
927c478bdstevel@tonic-gate#endif
937c478bdstevel@tonic-gate
947c478bdstevel@tonic-gate
957c478bdstevel@tonic-gate#if	defined(sun) && !defined(SOLARIS2)
967c478bdstevel@tonic-gate#define	STRERROR(x)	sys_errlist[x]
977c478bdstevel@tonic-gateextern	char	*sys_errlist[];
987c478bdstevel@tonic-gate#else
997c478bdstevel@tonic-gate#define	STRERROR(x)	strerror(x)
1007c478bdstevel@tonic-gate#endif
1017c478bdstevel@tonic-gate
1027c478bdstevel@tonic-gate
1037c478bdstevel@tonic-gatestruct	flags {
1047c478bdstevel@tonic-gate	int	value;
1057c478bdstevel@tonic-gate	char	flag;
1067c478bdstevel@tonic-gate};
1077c478bdstevel@tonic-gate
1087c478bdstevel@tonic-gate
1097c478bdstevel@tonic-gatetypedef	struct	icmp_subtype {
1107c478bdstevel@tonic-gate	int	ist_val;
1117c478bdstevel@tonic-gate	char	*ist_name;
1127c478bdstevel@tonic-gate} icmp_subtype_t;
1137c478bdstevel@tonic-gate
1147c478bdstevel@tonic-gatetypedef	struct	icmp_type {
1157c478bdstevel@tonic-gate	int	it_val;
1167c478bdstevel@tonic-gate	struct	icmp_subtype *it_subtable;
1177c478bdstevel@tonic-gate	size_t	it_stsize;
1187c478bdstevel@tonic-gate	char	*it_name;
1197c478bdstevel@tonic-gate} icmp_type_t;
1207c478bdstevel@tonic-gate
1217c478bdstevel@tonic-gate
1227c478bdstevel@tonic-gate#define	IST_SZ(x)	(sizeof(x)/sizeof(icmp_subtype_t))
1237c478bdstevel@tonic-gate
1247c478bdstevel@tonic-gate
1257c478bdstevel@tonic-gatestruct	flags	tcpfl[] = {
1267c478bdstevel@tonic-gate	{ TH_ACK, 'A' },
1277c478bdstevel@tonic-gate	{ TH_RST, 'R' },
1287c478bdstevel@tonic-gate	{ TH_SYN, 'S' },
1297c478bdstevel@tonic-gate	{ TH_FIN, 'F' },
1307c478bdstevel@tonic-gate	{ TH_URG, 'U' },
1317c478bdstevel@tonic-gate	{ TH_PUSH,'P' },
1327c478bdstevel@tonic-gate	{ TH_ECN, 'E' },
1337c478bdstevel@tonic-gate	{ TH_CWR, 'C' },
1347c478bdstevel@tonic-gate	{ 0, '\0' }
1357c478bdstevel@tonic-gate};
1367c478bdstevel@tonic-gate
137af5f29dToomas Soome#if defined(__hpux) || (defined(SOLARIS) && (SOLARIS2 < 10))
1387c478bdstevel@tonic-gatestatic	char	*pidfile = "/etc/ipf/ipmon.pid";
1397c478bdstevel@tonic-gate#else
140af5f29dToomas Soome# if (BSD >= 199306) || defined(SOLARIS)
1417c478bdstevel@tonic-gatestatic	char	*pidfile = "/var/run/ipmon.pid";
1427c478bdstevel@tonic-gate# else
1437c478bdstevel@tonic-gatestatic	char	*pidfile = "/etc/ipmon.pid";
1447c478bdstevel@tonic-gate# endif
1457c478bdstevel@tonic-gate#endif
1467c478bdstevel@tonic-gate
1477c478bdstevel@tonic-gatestatic	char	line[2048];
1487c478bdstevel@tonic-gatestatic	int	opts = 0;
1497c478bdstevel@tonic-gatestatic	char	*logfile = NULL;
1507c478bdstevel@tonic-gatestatic	FILE	*binarylog = NULL;
1517c478bdstevel@tonic-gatestatic	char	*binarylogfile = NULL;
1527c478bdstevel@tonic-gatestatic	int	donehup = 0;
1537c478bdstevel@tonic-gatestatic	void	usage __P((char *));
1547c478bdstevel@tonic-gatestatic	void	handlehup __P((int));
1557c478bdstevel@tonic-gatestatic	void	flushlogs __P((char *, FILE *));
1567c478bdstevel@tonic-gatestatic	void	print_log __P((int, FILE *, char *, int));
1577c478bdstevel@tonic-gatestatic	void	print_ipflog __P((FILE *, char *, int));
1587c478bdstevel@tonic-gatestatic	void	print_natlog __P((FILE *, char *, int));
1597c478bdstevel@tonic-gatestatic	void	print_statelog __P((FILE *, char *, int));
1607c478bdstevel@tonic-gatestatic	int	read_log __P((int, int *, char *, int));
1617c478bdstevel@tonic-gatestatic	void	write_pid __P((char *));
1627c478bdstevel@tonic-gatestatic	char	*icmpname __P((u_int, u_int));
1637c478bdstevel@tonic-gatestatic	char	*icmpname6 __P((u_int, u_int));
1647c478bdstevel@tonic-gatestatic	icmp_type_t *find_icmptype __P((int, icmp_type_t *, size_t));
1657c478bdstevel@tonic-gatestatic	icmp_subtype_t *find_icmpsubtype __P((int, icmp_subtype_t *, size_t));
1667c478bdstevel@tonic-gate#ifdef __hpux
1677c478bdstevel@tonic-gatestatic	struct	tm	*get_tm __P((u_32_t));
1687c478bdstevel@tonic-gate#else
1697c478bdstevel@tonic-gatestatic	struct	tm	*get_tm __P((time_t));
1707c478bdstevel@tonic-gate#endif
1717c478bdstevel@tonic-gate
1727c478bdstevel@tonic-gatechar	*hostname __P((int, int, u_32_t *));
1737c478bdstevel@tonic-gatechar	*portname __P((int, char *, u_int));
1747c478bdstevel@tonic-gateint	main __P((int, char *[]));
1757c478bdstevel@tonic-gate
1767c478bdstevel@tonic-gatestatic	void	logopts __P((int, char *));
1777c478bdstevel@tonic-gatestatic	void	init_tabs __P((void));
1787c478bdstevel@tonic-gatestatic	char	*getproto __P((u_int));
1797c478bdstevel@tonic-gate
1807c478bdstevel@tonic-gatestatic	char	**protocols = NULL;
1817c478bdstevel@tonic-gatestatic	char	**udp_ports = NULL;
1827c478bdstevel@tonic-gatestatic	char	**tcp_ports = NULL;
1837c478bdstevel@tonic-gatestatic	char	*conf_file = NULL;
1847c478bdstevel@tonic-gate
1857c478bdstevel@tonic-gate
1867c478bdstevel@tonic-gate#define	OPT_SYSLOG	0x001
1877c478bdstevel@tonic-gate#define	OPT_RESOLVE	0x002
1887c478bdstevel@tonic-gate#define	OPT_HEXBODY	0x004
1897c478bdstevel@tonic-gate#define	OPT_VERBOSE	0x008
1907c478bdstevel@tonic-gate#define	OPT_HEXHDR	0x010
1917c478bdstevel@tonic-gate#define	OPT_TAIL	0x020
1927c478bdstevel@tonic-gate#define	OPT_NAT		0x080
1937c478bdstevel@tonic-gate#define	OPT_STATE	0x100
1947c478bdstevel@tonic-gate#define	OPT_FILTER	0x200
1957c478bdstevel@tonic-gate#define	OPT_PORTNUM	0x400
1967c478bdstevel@tonic-gate#define	OPT_LOGALL	(OPT_NAT|OPT_STATE|OPT_FILTER)
1977c478bdstevel@tonic-gate#define	OPT_LOGBODY	0x800
1987c478bdstevel@tonic-gate
1997c478bdstevel@tonic-gate#define	HOSTNAME_V4(a,b)	hostname((a), 4, (u_32_t *)&(b))
2007c478bdstevel@tonic-gate
2017c478bdstevel@tonic-gate#ifndef	LOGFAC
2027c478bdstevel@tonic-gate#define	LOGFAC	LOG_LOCAL0
2037c478bdstevel@tonic-gate#endif
2047c478bdstevel@tonic-gate
2057c478bdstevel@tonic-gate
2067c478bdstevel@tonic-gatestatic icmp_subtype_t icmpunreachnames[] = {
2077c478bdstevel@tonic-gate	{ ICMP_UNREACH_NET,		"net" },
2087c478bdstevel@tonic-gate	{ ICMP_UNREACH_HOST,		"host" },
2097c478bdstevel@tonic-gate	{ ICMP_UNREACH_PROTOCOL,	"protocol" },
2107c478bdstevel@tonic-gate	{ ICMP_UNREACH_PORT,		"port" },
2117c478bdstevel@tonic-gate	{ ICMP_UNREACH_NEEDFRAG,	"needfrag" },
2127c478bdstevel@tonic-gate	{ ICMP_UNREACH_SRCFAIL,		"srcfail" },
2137c478bdstevel@tonic-gate	{ ICMP_UNREACH_NET_UNKNOWN,	"net_unknown" },
2147c478bdstevel@tonic-gate	{ ICMP_UNREACH_HOST_UNKNOWN,	"host_unknown" },
2157c478bdstevel@tonic-gate	{ ICMP_UNREACH_NET,		"isolated" },
2167c478bdstevel@tonic-gate	{ ICMP_UNREACH_NET_PROHIB,	"net_prohib" },
2177c478bdstevel@tonic-gate	{ ICMP_UNREACH_NET_PROHIB,	"host_prohib" },
2187c478bdstevel@tonic-gate	{ ICMP_UNREACH_TOSNET,		"tosnet" },
2197c478bdstevel@tonic-gate	{ ICMP_UNREACH_TOSHOST,		"toshost" },
2207c478bdstevel@tonic-gate	{ ICMP_UNREACH_ADMIN_PROHIBIT,	"admin_prohibit" },
2217c478bdstevel@tonic-gate	{ -2,				NULL }
2227c478bdstevel@tonic-gate};
2237c478bdstevel@tonic-gate
2247c478bdstevel@tonic-gatestatic icmp_subtype_t redirectnames[] = {
2257c478bdstevel@tonic-gate	{ ICMP_REDIRECT_NET,		"net" },
2267c478bdstevel@tonic-gate	{ ICMP_REDIRECT_HOST,		"host" },
2277c478bdstevel@tonic-gate	{ ICMP_REDIRECT_TOSNET,		"tosnet" },
2287c478bdstevel@tonic-gate	{ ICMP_REDIRECT_TOSHOST,	"toshost" },
2297c478bdstevel@tonic-gate	{ -2,				NULL }
2307c478bdstevel@tonic-gate};
2317c478bdstevel@tonic-gate
2327c478bdstevel@tonic-gatestatic icmp_subtype_t timxceednames[] = {
2337c478bdstevel@tonic-gate	{ ICMP_TIMXCEED_INTRANS,	"transit" },
2347c478bdstevel@tonic-gate	{ ICMP_TIMXCEED_REASS,		"reassem" },
2357c478bdstevel@tonic-gate	{ -2,				NULL }
2367c478bdstevel@tonic-gate};
2377c478bdstevel@tonic-gate
2387c478bdstevel@tonic-gatestatic icmp_subtype_t paramnames[] = {
2397c478bdstevel@tonic-gate	{ ICMP_PARAMPROB_ERRATPTR,	"errata_pointer" },
2407c478bdstevel@tonic-gate	{ ICMP_PARAMPROB_OPTABSENT,	"optmissing" },
2417c478bdstevel@tonic-gate	{ ICMP_PARAMPROB_LENGTH,	"length" },
2427c478bdstevel@tonic-gate	{ -2,				NULL }
2437c478bdstevel@tonic-gate};
2447c478bdstevel@tonic-gate
2457c478bdstevel@tonic-gatestatic icmp_type_t icmptypes[] = {
2467c478bdstevel@tonic-gate	{ ICMP_ECHOREPLY,	NULL,	0,		"echoreply" },
2477c478bdstevel@tonic-gate	{ -1,			NULL,	0,		NULL },
2487c478bdstevel@tonic-gate	{ -1,			NULL,	0,		NULL },
2497c478bdstevel@tonic-gate	{ ICMP_UNREACH,		icmpunreachnames,
2507c478bdstevel@tonic-gate				IST_SZ(icmpunreachnames),"unreach" },
2517c478bdstevel@tonic-gate	{ ICMP_SOURCEQUENCH,	NULL,	0,		"sourcequench" },
2527c478bdstevel@tonic-gate	{ ICMP_REDIRECT,	redirectnames,
2537c478bdstevel@tonic-gate				IST_SZ(redirectnames),	"redirect" },
2547c478bdstevel@tonic-gate	{ -1,			NULL,	0,		NULL },
2557c478bdstevel@tonic-gate	{ -1,			NULL,	0,		NULL },
2567c478bdstevel@tonic-gate	{ ICMP_ECHO,		NULL,	0,		"echo" },
2577c478bdstevel@tonic-gate	{ ICMP_ROUTERADVERT,	NULL,	0,		"routeradvert" },
2587c478bdstevel@tonic-gate	{ ICMP_ROUTERSOLICIT,	NULL,	0,		"routersolicit" },
2597c478bdstevel@tonic-gate	{ ICMP_TIMXCEED,	timxceednames,
2607c478bdstevel@tonic-gate				IST_SZ(timxceednames),	"timxceed" },
2617c478bdstevel@tonic-gate	{ ICMP_PARAMPROB,	paramnames,
2627c478bdstevel@tonic-gate				IST_SZ(paramnames),	"paramprob" },
2637c478bdstevel@tonic-gate	{ ICMP_TSTAMP,		NULL,	0,		"timestamp" },
2647c478bdstevel@tonic-gate	{ ICMP_TSTAMPREPLY,	NULL,	0,		"timestampreply" },
2657c478bdstevel@tonic-gate	{ ICMP_IREQ,		NULL,	0,		"inforeq" },
2667c478bdstevel@tonic-gate	{ ICMP_IREQREPLY,	NULL,	0,		"inforeply" },
2677c478bdstevel@tonic-gate	{ ICMP_MASKREQ,		NULL,	0,		"maskreq" },
2687c478bdstevel@tonic-gate	{ ICMP_MASKREPLY,	NULL,	0,		"maskreply" },
2697c478bdstevel@tonic-gate	{ -2,			NULL,	0,		NULL }
2707c478bdstevel@tonic-gate};
2717c478bdstevel@tonic-gate
2727c478bdstevel@tonic-gatestatic icmp_subtype_t icmpredirect6[] = {
2737c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH_NOROUTE,		"noroute" },
2747c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH_ADMIN,		"admin" },
2757c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH_NOTNEIGHBOR,	"neighbour" },
2767c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH_ADDR,		"address" },
2777c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH_NOPORT,		"noport" },
2787c478bdstevel@tonic-gate	{ -2,					NULL }
2797c478bdstevel@tonic-gate};
2807c478bdstevel@tonic-gate
2817c478bdstevel@tonic-gatestatic icmp_subtype_t icmptimexceed6[] = {
2827c478bdstevel@tonic-gate	{ ICMP6_TIME_EXCEED_TRANSIT,		"intransit" },
2837c478bdstevel@tonic-gate	{ ICMP6_TIME_EXCEED_REASSEMBLY,		"reassem" },
2847c478bdstevel@tonic-gate	{ -2,					NULL }
2857c478bdstevel@tonic-gate};
2867c478bdstevel@tonic-gate
2877c478bdstevel@tonic-gatestatic icmp_subtype_t icmpparamprob6[] = {
2887c478bdstevel@tonic-gate	{ ICMP6_PARAMPROB_HEADER,		"header" },
2897c478bdstevel@tonic-gate	{ ICMP6_PARAMPROB_NEXTHEADER,		"nextheader" },
2907c478bdstevel@tonic-gate	{ ICMP6_PARAMPROB_OPTION,		"option" },
2917c478bdstevel@tonic-gate	{ -2,					NULL }
2927c478bdstevel@tonic-gate};
2937c478bdstevel@tonic-gate
2947c478bdstevel@tonic-gatestatic icmp_subtype_t icmpquerysubject6[] = {
2957c478bdstevel@tonic-gate	{ ICMP6_NI_SUBJ_IPV6,			"ipv6" },
2967c478bdstevel@tonic-gate	{ ICMP6_NI_SUBJ_FQDN,			"fqdn" },
2977c478bdstevel@tonic-gate	{ ICMP6_NI_SUBJ_IPV4,			"ipv4" },
2987c478bdstevel@tonic-gate	{ -2,					NULL },
2997c478bdstevel@tonic-gate};
3007c478bdstevel@tonic-gate
3017c478bdstevel@tonic-gatestatic icmp_subtype_t icmpnodeinfo6[] = {
3027c478bdstevel@tonic-gate	{ ICMP6_NI_SUCCESS,			"success" },
3037c478bdstevel@tonic-gate	{ ICMP6_NI_REFUSED,			"refused" },
3047c478bdstevel@tonic-gate	{ ICMP6_NI_UNKNOWN,			"unknown" },
3057c478bdstevel@tonic-gate	{ -2,					NULL }
3067c478bdstevel@tonic-gate};
3077c478bdstevel@tonic-gate
3087c478bdstevel@tonic-gatestatic icmp_subtype_t icmprenumber6[] = {
3097c478bdstevel@tonic-gate	{ ICMP6_ROUTER_RENUMBERING_COMMAND,		"command" },
3107c478bdstevel@tonic-gate	{ ICMP6_ROUTER_RENUMBERING_RESULT,		"result" },
3117c478bdstevel@tonic-gate	{ ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET,	"seqnum_reset" },
3127c478bdstevel@tonic-gate	{ -2,						NULL }
3137c478bdstevel@tonic-gate};
3147c478bdstevel@tonic-gate
3157c478bdstevel@tonic-gatestatic icmp_type_t icmptypes6[] = {
3167c478bdstevel@tonic-gate	{ 0,			NULL,	0,		NULL },
3177c478bdstevel@tonic-gate	{ ICMP6_DST_UNREACH,	icmpredirect6,
3187c478bdstevel@tonic-gate			IST_SZ(icmpredirect6),		"unreach" },
3197c478bdstevel@tonic-gate	{ ICMP6_PACKET_TOO_BIG,	NULL,	0,		"toobig" },
3207c478bdstevel@tonic-gate	{ ICMP6_TIME_EXCEEDED,	icmptimexceed6,
3217c478bdstevel@tonic-gate			IST_SZ(icmptimexceed6),		"timxceed" },
3227c478bdstevel@tonic-gate	{ ICMP6_PARAM_PROB,	icmpparamprob6,
3237c478bdstevel@tonic-gate			IST_SZ(icmpparamprob6),		"paramprob" },
3247c478bdstevel@tonic-gate	{ ICMP6_ECHO_REQUEST,	NULL,	0,		"echo" },
3257c478bdstevel@tonic-gate	{ ICMP6_ECHO_REPLY,	NULL,	0,		"echoreply" },
3267c478bdstevel@tonic-gate	{ ICMP6_MEMBERSHIP_QUERY, icmpquerysubject6,
3277c478bdstevel@tonic-gate			IST_SZ(icmpquerysubject6),	"groupmemberquery" },
3287c478bdstevel@tonic-gate	{ ICMP6_MEMBERSHIP_REPORT,NULL,	0,		"groupmemberreport" },
3297c478bdstevel@tonic-gate	{ ICMP6_MEMBERSHIP_REDUCTION,NULL,	0,	"groupmemberterm" },
3307c478bdstevel@tonic-gate	{ ND_ROUTER_SOLICIT,	NULL,	0,		"routersolicit" },
3317c478bdstevel@tonic-gate	{ ND_ROUTER_ADVERT,	NULL,	0,		"routeradvert" },
3327c478bdstevel@tonic-gate	{ ND_NEIGHBOR_SOLICIT,	NULL,	0,		"neighborsolicit" },
3337c478bdstevel@tonic-gate	{ ND_NEIGHBOR_ADVERT,	NULL,	0,		"neighboradvert" },
3347c478bdstevel@tonic-gate	{ ND_REDIRECT,		NULL,	0,		"redirect" },
3357c478bdstevel@tonic-gate	{ ICMP6_ROUTER_RENUMBERING,	icmprenumber6,
3367c478bdstevel@tonic-gate			IST_SZ(icmprenumber6),		"routerrenumber" },
3377c478bdstevel@tonic-gate	{ ICMP6_WRUREQUEST,	NULL,	0,		"whoareyourequest" },
3387c478bdstevel@tonic-gate	{ ICMP6_WRUREPLY,	NULL,	0,		"whoareyoureply" },
3397c478bdstevel@tonic-gate	{ ICMP6_FQDN_QUERY,	NULL,	0,		"fqdnquery" },
3407c478bdstevel@tonic-gate	{ ICMP6_FQDN_REPLY,	NULL,	0,		"fqdnreply" },
3417c478bdstevel@tonic-gate	{ ICMP6_NI_QUERY,	icmpnodeinfo6,
3427c478bdstevel@tonic-gate			IST_SZ(icmpnodeinfo6),		"nodeinforequest" },
3437c478bdstevel@tonic-gate	{ ICMP6_NI_REPLY,	NULL,	0,		"nodeinforeply" },
3447c478bdstevel@tonic-gate	{ MLD6_MTRACE_RESP,	NULL,	0,		"mtraceresponse" },
3457c478bdstevel@tonic-gate	{ MLD6_MTRACE,		NULL,	0,		"mtracerequest" },
3467c478bdstevel@tonic-gate	{ -2,			NULL,	0,		NULL }
3477c478bdstevel@tonic-gate};
3487c478bdstevel@tonic-gate
3497c478bdstevel@tonic-gatestatic icmp_subtype_t *find_icmpsubtype(type, table, tablesz)
3507c478bdstevel@tonic-gateint type;
3517c478bdstevel@tonic-gateicmp_subtype_t *table;
3527c478bdstevel@tonic-gatesize_t tablesz;
3537c478bdstevel@tonic-gate{
3547c478bdstevel@tonic-gate	icmp_subtype_t *ist;
3557c478bdstevel@tonic-gate	int i;
3567c478bdstevel@tonic-gate
3577c478bdstevel@tonic-gate	if (tablesz < 2)
3587c478bdstevel@tonic-gate		return NULL;
3597c478bdstevel@tonic-gate
3607c478bdstevel@tonic-gate	if ((type < 0) || (type > table[tablesz - 2].ist_val))
3617c478bdstevel@tonic-gate		return NULL;
3627c478bdstevel@tonic-gate
3637c478bdstevel@tonic-gate	i = type;
3647c478bdstevel@tonic-gate	if (table[type].ist_val == type)
3657c478bdstevel@tonic-gate		return table + type;
3667c478bdstevel@tonic-gate
3677c478bdstevel@tonic-gate	for (i = 0, ist = table; ist->ist_val != -2; i++, ist++)
3687c478bdstevel@tonic-gate		if (ist->ist_val == type)
3697c478bdstevel@tonic-gate			return ist;
3707c478bdstevel@tonic-gate	return NULL;
3717c478bdstevel@tonic-gate}
3727c478bdstevel@tonic-gate
3737c478bdstevel@tonic-gate
3747c478bdstevel@tonic-gatestatic icmp_type_t *find_icmptype(type, table, tablesz)
3757c478bdstevel@tonic-gateint type;
3767c478bdstevel@tonic-gateicmp_type_t *table;
3777c478bdstevel@tonic-gatesize_t tablesz;
3787c478bdstevel@tonic-gate{
3797c478bdstevel@tonic-gate	icmp_type_t *it;
3807c478bdstevel@tonic-gate	int i;
3817c478bdstevel@tonic-gate
3827c478bdstevel@tonic-gate	if (tablesz < 2)
3837c478bdstevel@tonic-gate		return NULL;
3847c478bdstevel@tonic-gate
3857c478bdstevel@tonic-gate	if ((type < 0) || (type > table[tablesz - 2].it_val))
3867c478bdstevel@tonic-gate		return NULL;
3877c478bdstevel@tonic-gate
3887c478bdstevel@tonic-gate	i = type;
3897c478bdstevel@tonic-gate	if (table[type].it_val == type)
3907c478bdstevel@tonic-gate		return table + type;
3917c478bdstevel@tonic-gate
3927c478bdstevel@tonic-gate	for (i = 0, it = table; it->it_val != -2; i++, it++)
3937c478bdstevel@tonic-gate		if (it->it_val == type)
3947c478bdstevel@tonic-gate			return it;
3957c478bdstevel@tonic-gate	return NULL;
3967c478bdstevel@tonic-gate}
3977c478bdstevel@tonic-gate
3987c478bdstevel@tonic-gate
3997c478bdstevel@tonic-gatestatic void handlehup(sig)
4007c478bdstevel@tonic-gateint sig;
4017c478bdstevel@tonic-gate{
4027c478bdstevel@tonic-gate	signal(SIGHUP, handlehup);
4037c478bdstevel@tonic-gate	donehup = 1;
4047c478bdstevel@tonic-gate}
4057c478bdstevel@tonic-gate
4067c478bdstevel@tonic-gate
4077c478bdstevel@tonic-gatestatic void init_tabs()
4087c478bdstevel@tonic-gate{
4097c478bdstevel@tonic-gate	struct	protoent	*p;
4107c478bdstevel@tonic-gate	struct	servent	*s;
4117c478bdstevel@tonic-gate	char	*name, **tab;
4127c478bdstevel@tonic-gate	int	port, i;
4137c478bdstevel@tonic-gate
4147c478bdstevel@tonic-gate	if (protocols != NULL) {
4157c478bdstevel@tonic-gate		for (i = 0; i < 256; i++)
4167c478bdstevel@tonic-gate			if (protocols[i] != NULL) {
4177c478bdstevel@tonic-gate				free(protocols[i]);
4187c478bdstevel@tonic-gate				protocols[i] = NULL;
4197c478bdstevel@tonic-gate			}
4207c478bdstevel@tonic-gate		free(protocols);
4217c478bdstevel@tonic-gate		protocols = NULL;
4227c478bdstevel@tonic-gate	}
4237c478bdstevel@tonic-gate	protocols = (char **)malloc(256 * sizeof(*protocols));
4247c478bdstevel@tonic-gate	if (protocols != NULL) {
4257c478bdstevel@tonic-gate		bzero((char *)protocols, 256 * sizeof(*protocols));
4267c478bdstevel@tonic-gate
4277c478bdstevel@tonic-gate		setprotoent(1);
4287c478bdstevel@tonic-gate		while ((p = getprotoent()) != NULL)
4297c478bdstevel@tonic-gate			if (p->p_proto >= 0 && p->p_proto <= 255 &&
4307c478bdstevel@tonic-gate			    p->p_name != NULL && protocols[p->p_proto] == NULL)
4317c478bdstevel@tonic-gate				protocols[p->p_proto] = strdup(p->p_name);
4327c478bdstevel@tonic-gate		endprotoent();
433ab25eebyz#if defined(_AIX51)
434ab25eebyz		if (protocols[0])
435ab25eebyz			free(protocols[0]);
436ab25eebyz		if (protocols[252])
437ab25eebyz			free(protocols[252]);
438ab25eebyz		protocols[0] = "ip";
439ab25eebyz		protocols[252] = NULL;
440ab25eebyz#endif
4417c478bdstevel@tonic-gate	}
4427c478bdstevel@tonic-gate
4437c478bdstevel@tonic-gate	if (udp_ports != NULL) {
4447c478bdstevel@tonic-gate		for (i = 0; i < 65536; i++)
4457c478bdstevel@tonic-gate			if (udp_ports[i] != NULL) {
4467c478bdstevel@tonic-gate				free(udp_ports[i]);
4477c478bdstevel@tonic-gate				udp_ports[i] = NULL;
4487c478bdstevel@tonic-gate			}
4497c478bdstevel@tonic-gate		free(udp_ports);
4507c478bdstevel@tonic-gate		udp_ports = NULL;
4517c478bdstevel@tonic-gate	}
4527c478bdstevel@tonic-gate	udp_ports = (char **)malloc(65536 * sizeof(*udp_ports));
4537c478bdstevel@tonic-gate	if (udp_ports != NULL)
4547c478bdstevel@tonic-gate		bzero((char *)udp_ports, 65536 * sizeof(*udp_ports));
4557c478bdstevel@tonic-gate
4567c478bdstevel@tonic-gate	if (tcp_ports != NULL) {
4577c478bdstevel@tonic-gate		for (i = 0; i < 65536; i++)
4587c478bdstevel@tonic-gate			if (tcp_ports[i] != NULL) {
4597c478bdstevel@tonic-gate				free(tcp_ports[i]);
4607c478bdstevel@tonic-gate				tcp_ports[i] = NULL;
4617c478bdstevel@tonic-gate			}
4627c478bdstevel@tonic-gate		free(tcp_ports);
4637c478bdstevel@tonic-gate		tcp_ports = NULL;
4647c478bdstevel@tonic-gate	}
4657c478bdstevel@tonic-gate	tcp_ports = (char **)malloc(65536 * sizeof(*tcp_ports));
4667c478bdstevel@tonic-gate	if (tcp_ports != NULL)
4677c478bdstevel@tonic-gate		bzero((char *)tcp_ports, 65536 * sizeof(*tcp_ports));
4687c478bdstevel@tonic-gate
4697c478bdstevel@tonic-gate	setservent(1);
4707c478bdstevel@tonic-gate	while ((s = getservent()) != NULL) {
4717c478bdstevel@tonic-gate		if (s->s_proto == NULL)
4727c478bdstevel@tonic-gate			continue;
4737c478bdstevel@tonic-gate		else if (!strcmp(s->s_proto, "tcp")) {
4747c478bdstevel@tonic-gate			port = ntohs(s->s_port);
4757c478bdstevel@tonic-gate			name = s->s_name;
4767c478bdstevel@tonic-gate			tab = tcp_ports;
4777c478bdstevel@tonic-gate		} else if (!strcmp(s->s_proto, "udp")) {
4787c478bdstevel@tonic-gate			port = ntohs(s->s_port);
4797c478bdstevel@tonic-gate			name = s->s_name;
4807c478bdstevel@tonic-gate			tab = udp_ports;
4817c478bdstevel@tonic-gate		} else
4827c478bdstevel@tonic-gate			continue;
4837c478bdstevel@tonic-gate		if ((port < 0 || port > 65535) || (name == NULL))
4847c478bdstevel@tonic-gate			continue;
4857c478bdstevel@tonic-gate		if (tab != NULL)
4867c478bdstevel@tonic-gate			tab[port] = strdup(name);
4877c478bdstevel@tonic-gate	}
4887c478bdstevel@tonic-gate	endservent();
4897c478bdstevel@tonic-gate}
4907c478bdstevel@tonic-gate
4917c478bdstevel@tonic-gate
4927c478bdstevel@tonic-gatestatic char *getproto(p)
4937c478bdstevel@tonic-gateu_int p;
4947c478bdstevel@tonic-gate{
4957c478bdstevel@tonic-gate	static char pnum[4];
4967c478bdstevel@tonic-gate	char *s;
4977c478bdstevel@tonic-gate
4987c478bdstevel@tonic-gate	p &= 0xff;
4997c478bdstevel@tonic-gate	s = protocols ? protocols[p] : NULL;
5007c478bdstevel@tonic-gate	if (s == NULL) {
5017c478bdstevel@tonic-gate		sprintf(pnum, "%u", p);
5027c478bdstevel@tonic-gate		s = pnum;
5037c478bdstevel@tonic-gate	}
5047c478bdstevel@tonic-gate	return s;
5057c478bdstevel@tonic-gate}
5067c478bdstevel@tonic-gate
5077c478bdstevel@tonic-gate
5087c478bdstevel@tonic-gatestatic int read_log(fd, lenp, buf, bufsize)
5097c478bdstevel@tonic-gateint fd, bufsize, *lenp;
5107c478bdstevel@tonic-gatechar *buf;
5117c478bdstevel@tonic-gate{
5127c478bdstevel@tonic-gate	int	nr;
5137c478bdstevel@tonic-gate
5147c478bdstevel@tonic-gate	nr = read(fd, buf, bufsize);
5157c478bdstevel@tonic-gate	if (!nr)
5167c478bdstevel@tonic-gate		return 2;
5177c478bdstevel@tonic-gate	if ((nr < 0) && (errno != EINTR))
5187c478bdstevel@tonic-gate		return -1;
5197c478bdstevel@tonic-gate	*lenp = nr;
5207c478bdstevel@tonic-gate	return 0;
5217c478bdstevel@tonic-gate}
5227c478bdstevel@tonic-gate
5237c478bdstevel@tonic-gate
5247c478bdstevel@tonic-gatechar	*hostname(res, v, ip)
5257c478bdstevel@tonic-gateint	res, v;
5267c478bdstevel@tonic-gateu_32_t	*ip;
5277c478bdstevel@tonic-gate{
5287c478bdstevel@tonic-gate# define MAX_INETA	16
5297c478bdstevel@tonic-gate	static char hname[MAXHOSTNAMELEN + MAX_INETA + 3];
5307c478bdstevel@tonic-gate#ifdef	USE_INET6
5317c478bdstevel@tonic-gate	static char hostbuf[MAXHOSTNAMELEN+1];
5327c478bdstevel@tonic-gate#endif
5337c478bdstevel@tonic-gate	struct hostent *hp;
5347c478bdstevel@tonic-gate	struct in_addr ipa;
5357c478bdstevel@tonic-gate
5367c478bdstevel@tonic-gate	if (v == 4) {
5377c478bdstevel@tonic-gate		ipa.s_addr = *ip;
5387c478bdstevel@tonic-gate		if (!res)
5397c478bdstevel@tonic-gate			return inet_ntoa(ipa);
5407c478bdstevel@tonic-gate		hp = gethostbyaddr((char *)ip, sizeof(*ip), AF_INET);
5417c478bdstevel@tonic-gate		if (!hp)
5427c478bdstevel@tonic-gate			return inet_ntoa(ipa);
5437c478bdstevel@tonic-gate		sprintf(hname, "%.*s[%s]", MAXHOSTNAMELEN, hp->h_name,
5447c478bdstevel@tonic-gate			inet_ntoa(ipa));
5457c478bdstevel@tonic-gate		return hname;
5467c478bdstevel@tonic-gate	}
5477c478bdstevel@tonic-gate#ifdef	USE_INET6
5487c478bdstevel@tonic-gate	(void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1);
5497c478bdstevel@tonic-gate	hostbuf[MAXHOSTNAMELEN] = '\0';
5507c478bdstevel@tonic-gate	return hostbuf;
5517c478bdstevel@tonic-gate#else
5527c478bdstevel@tonic-gate	return "IPv6";
5537c478bdstevel@tonic-gate#endif
5547c478bdstevel@tonic-gate}
5557c478bdstevel@tonic-gate
5567c478bdstevel@tonic-gate
5577c478bdstevel@tonic-gatechar	*portname(res, proto, port)
5587c478bdstevel@tonic-gateint	res;
5597c478bdstevel@tonic-gatechar	*proto;
5607c478bdstevel@tonic-gateu_int	port;
5617c478bdstevel@tonic-gate{
5627c478bdstevel@tonic-gate	static	char	pname[8];
5637c478bdstevel@tonic-gate	char	*s;
5647c478bdstevel@tonic-gate
5657c478bdstevel@tonic-gate	port = ntohs(port);
5667c478bdstevel@tonic-gate	port &= 0xffff;
5677c478bdstevel@tonic-gate	(void) sprintf(pname, "%u", port);
5687c478bdstevel@tonic-gate	if (!res || (opts & OPT_PORTNUM))
5697c478bdstevel@tonic-gate		return pname;
5707c478bdstevel@tonic-gate	s = NULL;
5717c478bdstevel@tonic-gate	if (!strcmp(proto, "tcp"))
5727c478bdstevel@tonic-gate		s = tcp_ports[port];
5737c478bdstevel@tonic-gate	else if (!strcmp(proto, "udp"))
5747c478bdstevel@tonic-gate		s = udp_ports[port];
5757c478bdstevel@tonic-gate	if (s == NULL)
5767c478bdstevel@tonic-gate		s = pname;
5777c478bdstevel@tonic-gate	return s;
5787c478bdstevel@tonic-gate}
5797c478bdstevel@tonic-gate
5807c478bdstevel@tonic-gate
5817c478bdstevel@tonic-gatestatic	char	*icmpname(type, code)
5827c478bdstevel@tonic-gateu_int	type;
5837c478bdstevel@tonic-gateu_int	code;
5847c478bdstevel@tonic-gate{
5857c478bdstevel@tonic-gate	static char name[80];
5867c478bdstevel@tonic-gate	icmp_subtype_t *ist;
5877c478bdstevel@tonic-gate	icmp_type_t *it;
5887c478bdstevel@tonic-gate	char *s;
5897c478bdstevel@tonic-gate
5907c478bdstevel@tonic-gate	s = NULL;
5917c478bdstevel@tonic-gate	it = find_icmptype(type, icmptypes, sizeof(icmptypes) / sizeof(*it));
5927c478bdstevel@tonic-gate	if (it != NULL)
5937c478bdstevel@tonic-gate		s = it->it_name;
5947c478bdstevel@tonic-gate
5957c478bdstevel@tonic-gate	if (s == NULL)
5967c478bdstevel@tonic-gate		sprintf(name, "icmptype(%d)/", type);
5977c478bdstevel@tonic-gate	else
5987c478bdstevel@tonic-gate		sprintf(name, "%s/", s);
5997c478bdstevel@tonic-gate
6007c478bdstevel@tonic-gate	ist = NULL;
6017c478bdstevel@tonic-gate	if (it != NULL && it->it_subtable != NULL)
6027c478bdstevel@tonic-gate		ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
6037c478bdstevel@tonic-gate
6047c478bdstevel@tonic-gate	if (ist != NULL && ist->ist_name != NULL)
6057c478bdstevel@tonic-gate		strcat(name, ist->ist_name);
6067c478bdstevel@tonic-gate	else
6077c478bdstevel@tonic-gate		sprintf(name + strlen(name), "%d", code);
6087c478bdstevel@tonic-gate
6097c478bdstevel@tonic-gate	return name;
6107c478bdstevel@tonic-gate}
6117c478bdstevel@tonic-gate
6127c478bdstevel@tonic-gatestatic	char	*icmpname6(type, code)
6137c478bdstevel@tonic-gateu_int	type;
6147c478bdstevel@tonic-gateu_int	code;
6157c478bdstevel@tonic-gate{
6167c478bdstevel@tonic-gate	static char name[80];
6177c478bdstevel@tonic-gate	icmp_subtype_t *ist;
6187c478bdstevel@tonic-gate	icmp_type_t *it;
6197c478bdstevel@tonic-gate	char *s;
6207c478bdstevel@tonic-gate
6217c478bdstevel@tonic-gate	s = NULL;
6227c478bdstevel@tonic-gate	it = find_icmptype(type, icmptypes6, sizeof(icmptypes6) / sizeof(*it));
6237c478bdstevel@tonic-gate	if (it != NULL)
6247c478bdstevel@tonic-gate		s = it->it_name;
6257c478bdstevel@tonic-gate
6267c478bdstevel@tonic-gate	if (s == NULL)
6277c478bdstevel@tonic-gate		sprintf(name, "icmpv6type(%d)/", type);
6287c478bdstevel@tonic-gate	else
6297c478bdstevel@tonic-gate		sprintf(name, "%s/", s);
6307c478bdstevel@tonic-gate
6317c478bdstevel@tonic-gate	ist = NULL;
6327c478bdstevel@tonic-gate	if (it != NULL && it->it_subtable != NULL)
6337c478bdstevel@tonic-gate		ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
6347c478bdstevel@tonic-gate
6357c478bdstevel@tonic-gate	if (ist != NULL && ist->ist_name != NULL)
6367c478bdstevel@tonic-gate		strcat(name, ist->ist_name);
6377c478bdstevel@tonic-gate	else
6387c478bdstevel@tonic-gate		sprintf(name + strlen(name), "%d", code);
6397c478bdstevel@tonic-gate
6407c478bdstevel@tonic-gate	return name;
6417c478bdstevel@tonic-gate}
6427c478bdstevel@tonic-gate
6437c478bdstevel@tonic-gate
6447c478bdstevel@tonic-gatevoid	dumphex(log, dopts, buf, len)
6457c478bdstevel@tonic-gateFILE	*log;
6467c478bdstevel@tonic-gateint	dopts;
6477c478bdstevel@tonic-gatechar	*buf;
6487c478bdstevel@tonic-gateint	len;
6497c478bdstevel@tonic-gate{
6507c478bdstevel@tonic-gate	char	hline[80];
6517c478bdstevel@tonic-gate	int	i, j, k;
6527c478bdstevel@tonic-gate	u_char	*s = (u_char *)buf, *t = (u_char *)hline;
6537c478bdstevel@tonic-gate
6547c478bdstevel@tonic-gate	if (buf == NULL || len == 0)
6557c478bdstevel@tonic-gate		return;
6567c478bdstevel@tonic-gate
6577c478bdstevel@tonic-gate	*hline = '\0';
6587c478bdstevel@tonic-gate
6597c478bdstevel@tonic-gate	for (i = len, j = 0; i; i--, j++, s++) {
6607c478bdstevel@tonic-gate		if (j && !(j & 0xf)) {
6617c478bdstevel@tonic-gate			*t++ = '\n';
6627c478bdstevel@tonic-gate			*t = '\0';
6637c478bdstevel@tonic-gate			if (!(dopts & OPT_SYSLOG))
6647c478bdstevel@tonic-gate				fputs(hline, log);
6657c478bdstevel@tonic-gate			else
6667c478bdstevel@tonic-gate				syslog(LOG_INFO, "%s", hline);
6677c478bdstevel@tonic-gate			t = (u_char *)hline;
6687c478bdstevel@tonic-gate			*t = '\0';
6697c478bdstevel@tonic-gate		}
6707c478bdstevel@tonic-gate		sprintf((char *)t, "%02x", *s & 0xff);
6717c478bdstevel@tonic-gate		t += 2;
6727c478bdstevel@tonic-gate		if (!((j + 1) & 0xf)) {
6737c478bdstevel@tonic-gate			s -= 15;
6747c478bdstevel@tonic-gate			sprintf((char *)t, "        ");
6757c478bdstevel@tonic-gate			t += 8;
6767c478bdstevel@tonic-gate			for (k = 16; k; k--, s++)
677ab25eebyz				*t++ = (ISPRINT(*s) ? *s : '.');
6787c478bdstevel@tonic-gate			s--;
6797c478bdstevel@tonic-gate		}
6807c478bdstevel@tonic-gate
6817c478bdstevel@tonic-gate		if ((j + 1) & 0xf)
6827c478bdstevel@tonic-gate			*t++ = ' ';;
6837c478bdstevel@tonic-gate	}
6847c478bdstevel@tonic-gate
6857c478bdstevel@tonic-gate	if (j & 0xf) {
6867c478bdstevel@tonic-gate		for (k = 16 - (j & 0xf); k; k--) {
6877c478bdstevel@tonic-gate			*t++ = ' ';
6887c478bdstevel@tonic-gate			*t++ = ' ';
6897c478bdstevel@tonic-gate			*t++ = ' ';
6907c478bdstevel@tonic-gate		}
6917c478bdstevel@tonic-gate		sprintf((char *)t, "       ");
6927c478bdstevel@tonic-gate		t += 7;
6937c478bdstevel@tonic-gate		s -= j & 0xf;
6947c478bdstevel@tonic-gate		for (k = j & 0xf; k; k--, s++)
695ab25eebyz			*t++ = (ISPRINT(*s) ? *s : '.');
6967c478bdstevel@tonic-gate		*t++ = '\n';
6977c478bdstevel@tonic-gate		*t = '\0';
6987c478bdstevel@tonic-gate	}
6997c478bdstevel@tonic-gate	if (!(dopts & OPT_SYSLOG)) {
7007c478bdstevel@tonic-gate		fputs(hline, log);
7017c478bdstevel@tonic-gate		fflush(log);
7027c478bdstevel@tonic-gate	} else
7037c478bdstevel@tonic-gate		syslog(LOG_INFO, "%s", hline);
7047c478bdstevel@tonic-gate}
7057c478bdstevel@tonic-gate
7067c478bdstevel@tonic-gate
7077c478bdstevel@tonic-gatestatic	struct	tm	*get_tm(sec)
7087c478bdstevel@tonic-gate#ifdef __hpux
7097c478bdstevel@tonic-gateu_32_t	sec;
7107c478bdstevel@tonic-gate#else
7117c478bdstevel@tonic-gatetime_t	sec;
7127c478bdstevel@tonic-gate#endif
7137c478bdstevel@tonic-gate{
7147c478bdstevel@tonic-gate	struct tm *tm;
7157c478bdstevel@tonic-gate	time_t t;
7167c478bdstevel@tonic-gate
7177c478bdstevel@tonic-gate	t = sec;
7187c478bdstevel@tonic-gate	tm = localtime(&t);
7197c478bdstevel@tonic-gate	return tm;
7207c478bdstevel@tonic-gate}
7217c478bdstevel@tonic-gate
7227c478bdstevel@tonic-gatestatic	void	print_natlog(log, buf, blen)
7237c478bdstevel@tonic-gateFILE	*log;
7247c478bdstevel@tonic-gatechar	*buf;
7257c478bdstevel@tonic-gateint	blen;
7267c478bdstevel@tonic-gate{
7277c478bdstevel@tonic-gate	struct	natlog	*nl;
7287c478bdstevel@tonic-gate	iplog_t	*ipl = (iplog_t *)buf;
7297c478bdstevel@tonic-gate	char	*t = line;
7307c478bdstevel@tonic-gate	struct	tm	*tm;
7317c478bdstevel@tonic-gate	int	res, i, len;
7327c478bdstevel@tonic-gate	char	*proto;
7337c478bdstevel@tonic-gate
7347c478bdstevel@tonic-gate	nl = (struct natlog *)((char *)ipl + sizeof(*ipl));
7357c478bdstevel@tonic-gate	res = (opts & OPT_RESOLVE) ? 1 : 0;
7367c478bdstevel@tonic-gate	tm = get_tm(ipl->ipl_sec);
7377c478bdstevel@tonic-gate	len = sizeof(line);
7387c478bdstevel@tonic-gate	if (!(opts & OPT_SYSLOG)) {
7397c478bdstevel@tonic-gate		(void) strftime(t, len, "%d/%m/%Y ", tm);
7407c478bdstevel@tonic-gate		i = strlen(t);
7417c478bdstevel@tonic-gate		len -= i;
7427c478bdstevel@tonic-gate		t += i;
7437c478bdstevel@tonic-gate	}
7447c478bdstevel@tonic-gate	(void) strftime(t, len, "%T", tm);
7457c478bdstevel@tonic-gate	t += strlen(t);
746d6c23f6yx	(void) sprintf(t, ".%-.6ld @%hd ", ipl->ipl_usec, nl->nlg_rule + 1);
7477c478bdstevel@tonic-gate	t += strlen(t);
7487c478bdstevel@tonic-gate
749d6c23f6yx	if (nl->nlg_type == NL_NEWMAP)
7507c478bdstevel@tonic-gate		strcpy(t, "NAT:MAP ");
751d6c23f6yx	else if (nl->nlg_type == NL_NEWRDR)
7527c478bdstevel@tonic-gate		strcpy(t, "NAT:RDR ");
753d6c23f6yx	else if (nl->nlg_type == NL_FLUSH)
7547c478bdstevel@tonic-gate		strcpy(t, "NAT:FLUSH ");
755d6c23f6yx	else if (nl->nlg_type == NL_EXPIRE)
7567c478bdstevel@tonic-gate		strcpy(t, "NAT:EXPIRE ");
757d6c23f6yx	else if (nl->nlg_type == NL_NEWBIMAP)
7587c478bdstevel@tonic-gate		strcpy(t, "NAT:BIMAP ");
759d6c23f6yx	else if (nl->nlg_type == NL_NEWBLOCK)
7607c478bdstevel@tonic-gate		strcpy(t, "NAT:MAPBLOCK ");
761d6c23f6yx	else if (nl->nlg_type == NL_CLONE)
7627c478bdstevel@tonic-gate		strcpy(t, "NAT:CLONE ");
7637c478bdstevel@tonic-gate	else
764d6c23f6yx		sprintf(t, "Type: %d ", nl->nlg_type);
7657c478bdstevel@tonic-gate	t += strlen(t);
7667c478bdstevel@tonic-gate
767d6c23f6yx	proto = getproto(nl->nlg_p);
7687c478bdstevel@tonic-gate
769d6c23f6yx	(void) sprintf(t, "%s,%s <- -> ", hostname(res, nl->nlg_v,
770d6c23f6yx		(u_32_t *)&nl->nlg_inip),
771d6c23f6yx		portname(res, proto, (u_int)nl->nlg_inport));
7727c478bdstevel@tonic-gate	t += strlen(t);
773d6c23f6yx	(void) sprintf(t, "%s,%s ", hostname(res, nl->nlg_v,
774d6c23f6yx		(u_32_t *)&nl->nlg_outip),
775d6c23f6yx		portname(res, proto, (u_int)nl->nlg_outport));
7767c478bdstevel@tonic-gate	t += strlen(t);
777d6c23f6yx	(void) sprintf(t, "[%s,%s]", hostname(res, nl->nlg_v,
778d6c23f6yx		(u_32_t *)&nl->nlg_origip),
779d6c23f6yx		portname(res, proto, (u_int)nl->nlg_origport));
7807c478bdstevel@tonic-gate	t += strlen(t);
781d6c23f6yx	if (nl->nlg_type == NL_EXPIRE) {
7827c478bdstevel@tonic-gate#ifdef	USE_QUAD_T
7837c478bdstevel@tonic-gate		(void) sprintf(t, " Pkts %qd/%qd Bytes %qd/%qd",
784d6c23f6yx				(long long)nl->nlg_pkts[0],
785d6c23f6yx				(long long)nl->nlg_pkts[1],
786d6c23f6yx				(long long)nl->nlg_bytes[0],
787d6c23f6yx				(long long)nl->nlg_bytes[1]);
7887c478bdstevel@tonic-gate#else
789ab25eebyz		(void) sprintf(t, " Pkts %ld/%ld Bytes %ld/%ld",
790d6c23f6yx				nl->nlg_pkts[0], nl->nlg_pkts[1],
791d6c23f6yx				nl->nlg_bytes[0], nl->nlg_bytes[1]);
7927c478bdstevel@tonic-gate#endif
7937c478bdstevel@tonic-gate		t += strlen(t);
7947c478bdstevel@tonic-gate	}
7957c478bdstevel@tonic-gate
7967c478bdstevel@tonic-gate	*t++ = '\n';
7977c478bdstevel@tonic-gate	*t++ = '\0';
7987c478bdstevel@tonic-gate	if (opts & OPT_SYSLOG)
7997c478bdstevel@tonic-gate		syslog(LOG_INFO, "%s", line);
8007c478bdstevel@tonic-gate	else
8017c478bdstevel@tonic-gate		(void) fprintf(log, "%s", line);
8027c478bdstevel@tonic-gate}
8037c478bdstevel@tonic-gate
8047c478bdstevel@tonic-gate
8057c478bdstevel@tonic-gatestatic	void	print_statelog(log, buf, blen)
8067c478bdstevel@tonic-gateFILE	*log;
8077c478bdstevel@tonic-gatechar	*buf;
8087c478bdstevel@tonic-gateint	blen;
8097c478bdstevel@tonic-gate{
8107c478bdstevel@tonic-gate	struct	ipslog *sl;
8117c478bdstevel@tonic-gate	iplog_t	*ipl = (iplog_t *)buf;
8127c478bdstevel@tonic-gate	char	*t = line, *proto;
8137c478bdstevel@tonic-gate	struct	tm	*tm;
8147c478bdstevel@tonic-gate	int	res, i, len;
8157c478bdstevel@tonic-gate
8167c478bdstevel@tonic-gate	sl = (struct ipslog *)((char *)ipl + sizeof(*ipl));
8177c478bdstevel@tonic-gate	res = (opts & OPT_RESOLVE) ? 1 : 0;
8187c478bdstevel@tonic-gate	tm = get_tm(ipl->ipl_sec);
8197c478bdstevel@tonic-gate	len = sizeof(line);
8207c478bdstevel@tonic-gate	if (!(opts & OPT_SYSLOG)) {
8217c478bdstevel@tonic-gate		(void) strftime(t, len, "%d/%m/%Y ", tm);
8227c478bdstevel@tonic-gate		i = strlen(t);
8237c478bdstevel@tonic-gate		len -= i;
8247c478bdstevel@tonic-gate		t += i;
8257c478bdstevel@tonic-gate	}
8267c478bdstevel@tonic-gate	(void) strftime(t, len, "%T", tm);
8277c478bdstevel@tonic-gate	t += strlen(t);
8287c478bdstevel@tonic-gate	(void) sprintf(t, ".%-.6ld ", ipl->ipl_usec);
8297c478bdstevel@tonic-gate	t += strlen(t);
8307c478bdstevel@tonic-gate
8317c478bdstevel@tonic-gate	if (sl->isl_type == ISL_NEW)
8327c478bdstevel@tonic-gate		strcpy(t, "STATE:NEW ");
8337c478bdstevel@tonic-gate	else if (sl->isl_type == ISL_CLONE)
8347c478bdstevel@tonic-gate		strcpy(t, "STATE:CLONED ");
8357c478bdstevel@tonic-gate	else if (sl->isl_type == ISL_EXPIRE) {
8367c478bdstevel@tonic-gate		if ((sl->isl_p == IPPROTO_TCP) &&
8377c478bdstevel@tonic-gate		    (sl->isl_state[0] > IPF_TCPS_ESTABLISHED ||
8387c478bdstevel@tonic-gate		     sl->isl_state[1] > IPF_TCPS_ESTABLISHED))
8397c478bdstevel@tonic-gate			strcpy(t, "STATE:CLOSE ");
8407c478bdstevel@tonic-gate		else
8417c478bdstevel@tonic-gate			strcpy(t, "STATE:EXPIRE ");
8427c478bdstevel@tonic-gate	} else if (sl->isl_type == ISL_FLUSH)
8437c478bdstevel@tonic-gate		strcpy(t, "STATE:FLUSH ");
8447c478bdstevel@tonic-gate	else if (sl->isl_type == ISL_INTERMEDIATE)
8457c478bdstevel@tonic-gate		strcpy(t, "STATE:INTERMEDIATE ");
8467c478bdstevel@tonic-gate	else if (sl->isl_type == ISL_REMOVE)
8477c478bdstevel@tonic-gate		strcpy(t, "STATE:REMOVE ");
8487c478bdstevel@tonic-gate	else if (sl->isl_type == ISL_KILLED)
8497c478bdstevel@tonic-gate		strcpy(t, "STATE:KILLED ");
8507c478bdstevel@tonic-gate	else
8517c478bdstevel@tonic-gate		sprintf(t, "Type: %d ", sl->isl_type);
8527c478bdstevel@tonic-gate	t += strlen(t);
8537c478bdstevel@tonic-gate
8547c478bdstevel@tonic-gate	proto = getproto(sl->isl_p);
8557c478bdstevel@tonic-gate
8567c478bdstevel@tonic-gate	if (sl->isl_p == IPPROTO_TCP || sl->isl_p == IPPROTO_UDP) {
8577c478bdstevel@tonic-gate		(void) sprintf(t, "%s,%s -> ",
8587c478bdstevel@tonic-gate			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_src),
8597c478bdstevel@tonic-gate			portname(res, proto, (u_int)sl->isl_sport));
8607c478bdstevel@tonic-gate		t += strlen(t);
8617c478bdstevel@tonic-gate		(void) sprintf(t, "%s,%s PR %s",
8627c478bdstevel@tonic-gate			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
8637c478bdstevel@tonic-gate			portname(res, proto, (u_int)sl->isl_dport), proto);
8647c478bdstevel@tonic-gate	} else if (sl->isl_p == IPPROTO_ICMP) {
8657c478bdstevel@tonic-gate		(void) sprintf(t, "%s -> ", hostname(res, sl->isl_v,
8667c478bdstevel@tonic-gate						     (u_32_t *)&sl->isl_src));
8677c478bdstevel@tonic-gate		t += strlen(t);
8687c478bdstevel@tonic-gate		(void) sprintf(t, "%s PR icmp %d",
8697c478bdstevel@tonic-gate			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
8707c478bdstevel@tonic-gate			sl->isl_itype);
8717c478bdstevel@tonic-gate	} else if (sl->isl_p == IPPROTO_ICMPV6) {
8727c478bdstevel@tonic-gate		(void) sprintf(t, "%s -> ", hostname(res, sl->isl_v,
8737c478bdstevel@tonic-gate						     (u_32_t *)&sl->isl_src));
8747c478bdstevel@tonic-gate		t += strlen(t);
8757c478bdstevel@tonic-gate		(void) sprintf(t, "%s PR icmpv6 %d",
8767c478bdstevel@tonic-gate			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
8777c478bdstevel@tonic-gate			sl->isl_itype);
878ab25eebyz	} else {
879ab25eebyz		(void) sprintf(t, "%s -> ",
880ab25eebyz			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_src));
881ab25eebyz		t += strlen(t);
882ab25eebyz		(void) sprintf(t, "%s PR %s",
883ab25eebyz			hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
884ab25eebyz			proto);
8857c478bdstevel@tonic-gate	}
8867c478bdstevel@tonic-gate	t += strlen(t);
8877c478bdstevel@tonic-gate	if (sl->isl_tag != FR_NOLOGTAG) {
8887c478bdstevel@tonic-gate		(void) sprintf(t, " tag %u", sl->isl_tag);
8897c478bdstevel@tonic-gate		t += strlen(t);
8907c478bdstevel@tonic-gate	}
8917c478bdstevel@tonic-gate	if (sl->isl_type != ISL_NEW) {
8927c478bdstevel@tonic-gate		sprintf(t,
8937c478bdstevel@tonic-gate#ifdef	USE_QUAD_T
894ab25eebyz#ifdef	PRId64
895ab25eebyz			" Forward: Pkts in %" PRId64 " Bytes in %" PRId64
896ab25eebyz			" Pkts out %" PRId64 " Bytes out %" PRId64
897ab25eebyz			" Backward: Pkts in %" PRId64 " Bytes in %" PRId64
898ab25eebyz			" Pkts out %" PRId64 " Bytes out %" PRId64,
899ab25eebyz#else
9007c478bdstevel@tonic-gate			" Forward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd Backward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd",
901ab25eebyz#endif /* PRId64 */
9027c478bdstevel@tonic-gate#else
9037c478bdstevel@tonic-gate			" Forward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld Backward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld",
9047c478bdstevel@tonic-gate#endif
9057c478bdstevel@tonic-gate			sl->isl_pkts[0], sl->isl_bytes[0],
9067c478bdstevel@tonic-gate			sl->isl_pkts[1], sl->isl_bytes[1],
9077c478bdstevel@tonic-gate			sl->isl_pkts[2], sl->isl_bytes[2],
9087c478bdstevel@tonic-gate			sl->isl_pkts[3], sl->isl_bytes[3]);
9097c478bdstevel@tonic-gate
9107c478bdstevel@tonic-gate		t += strlen(t);
9117c478bdstevel@tonic-gate	}
9127c478bdstevel@tonic-gate
9137c478bdstevel@tonic-gate	*t++ = '\n';
9147c478bdstevel@tonic-gate	*t++ = '\0';
9157c478bdstevel@tonic-gate	if (opts & OPT_SYSLOG)
9167c478bdstevel@tonic-gate		syslog(LOG_INFO, "%s", line);
9177c478bdstevel@tonic-gate	else
9187c478bdstevel@tonic-gate		(void) fprintf(log, "%s", line);
9197c478bdstevel@tonic-gate}
9207c478bdstevel@tonic-gate
9217c478bdstevel@tonic-gate
9227c478bdstevel@tonic-gatestatic	void	print_log(logtype, log, buf, blen)
9237c478bdstevel@tonic-gateFILE	*log;
9247c478bdstevel@tonic-gatechar	*buf;
9257c478bdstevel@tonic-gateint	logtype, blen;
9267c478bdstevel@tonic-gate{
9277c478bdstevel@tonic-gate	iplog_t	*ipl;
9287c478bdstevel@tonic-gate	char *bp = NULL, *bpo = NULL;
9297c478bdstevel@tonic-gate	int psize;
9307c478bdstevel@tonic-gate
9317c478bdstevel@tonic-gate	while (blen > 0) {
9327c478bdstevel@tonic-gate		ipl = (iplog_t *)buf;
9337c478bdstevel@tonic-gate		if ((u_long)ipl & (sizeof(long)-1)) {
9347c478bdstevel@tonic-gate			if (bp)
9357c478bdstevel@tonic-gate				bpo = bp;
9367c478bdstevel@tonic-gate			bp = (char *)malloc(blen);
9375e985dbschuster			if (bp == NULL) {
9385e985dbschuster				perror("malloc");
9395e985dbschuster				exit(1);
9405e985dbschuster			}
9417c478bdstevel@tonic-gate			bcopy((char *)ipl, bp, blen);
9427c478bdstevel@tonic-gate			if (bpo) {
9437c478bdstevel@tonic-gate				free(bpo);
9447c478bdstevel@tonic-gate				bpo = NULL;
9457c478bdstevel@tonic-gate			}
9467c478bdstevel@tonic-gate			buf = bp;
9477c478bdstevel@tonic-gate			continue;
9487c478bdstevel@tonic-gate		}
9497c478bdstevel@tonic-gate
9507c478bdstevel@tonic-gate		psize = ipl->ipl_dsize;
9517c478bdstevel@tonic-gate		if (psize > blen)
9527c478bdstevel@tonic-gate			break;
9537c478bdstevel@tonic-gate
9547c478bdstevel@tonic-gate		if (binarylog) {
9557c478bdstevel@tonic-gate			fwrite(buf, psize, 1, binarylog);
9567c478bdstevel@tonic-gate			fflush(binarylog);
9577c478bdstevel@tonic-gate		}
9587c478bdstevel@tonic-gate
9597c478bdstevel@tonic-gate		if (logtype == IPL_LOGIPF) {
960ab25eebyz			if (ipl->ipl_magic == IPL_MAGIC)
961ab25eebyz				print_ipflog(log, buf, psize);
9627c478bdstevel@tonic-gate
9637c478bdstevel@tonic-gate		} else if (logtype == IPL_LOGNAT) {
964ab25eebyz			if (ipl->ipl_magic == IPL_MAGIC_NAT)
965ab25eebyz				print_natlog(log, buf, psize);
9667c478bdstevel@tonic-gate
9677c478bdstevel@tonic-gate		} else if (logtype == IPL_LOGSTATE) {
968ab25eebyz			if (ipl->ipl_magic == IPL_MAGIC_STATE)
969ab25eebyz				print_statelog(log, buf, psize);
9707c478bdstevel@tonic-gate		}
9717c478bdstevel@tonic-gate
9727c478bdstevel@tonic-gate		blen -= psize;
9737c478bdstevel@tonic-gate		buf += psize;
9747c478bdstevel@tonic-gate	}
9757c478bdstevel@tonic-gate	if (bp)
9767c478bdstevel@tonic-gate		free(bp);
9777c478bdstevel@tonic-gate	return;
9787c478bdstevel@tonic-gate}
9797c478bdstevel@tonic-gate
9807c478bdstevel@tonic-gate
9817c478bdstevel@tonic-gatestatic	void	print_ipflog(log, buf, blen)
9827c478bdstevel@tonic-gateFILE	*log;
9837c478bdstevel@tonic-gatechar	*buf;
9847c478bdstevel@tonic-gateint	blen;
9857c478bdstevel@tonic-gate{
9867c478bdstevel@tonic-gate	tcphdr_t	*tp;
9877c478bdstevel@tonic-gate	struct	icmp	*ic;
9887c478bdstevel@tonic-gate	struct	icmp	*icmp;
9897c478bdstevel@tonic-gate	struct	tm	*tm;
9907c478bdstevel@tonic-gate	char	*t, *proto;
991ab25eebyz	int	i, v, lvl, res, len, off, plen, ipoff, defaction;
9927c478bdstevel@tonic-gate	ip_t	*ipc, *ip;
993ab25eebyz	u_32_t	*s, *d;
9947c478bdstevel@tonic-gate	u_short	hl, p;
9957c478bdstevel@tonic-gate	ipflog_t *ipf;
9967c478bdstevel@tonic-gate	iplog_t	*ipl;
9977c478bdstevel@tonic-gate#ifdef	USE_INET6
9987c478bdstevel@tonic-gate	ip6_t *ip6;
9997c478bdstevel@tonic-gate#endif
10007c478bdstevel@tonic-gate
10017c478bdstevel@tonic-gate	ipl = (iplog_t *)buf;
10027c478bdstevel@tonic-gate	ipf = (ipflog_t *)((char *)buf + sizeof(*ipl));
10037c478bdstevel@tonic-gate	ip = (ip_t *)((char *)ipf + sizeof(*ipf));
10047c478bdstevel@tonic-gate	v = IP_V(ip);
10057c478bdstevel@tonic-gate	res = (opts & OPT_RESOLVE) ? 1 : 0;
10067c478bdstevel@tonic-gate	t = line;
10077c478bdstevel@tonic-gate	*t = '\0';
10087c478bdstevel@tonic-gate	tm = get_tm(ipl->ipl_sec);
10097c478bdstevel@tonic-gate
10107c478bdstevel@tonic-gate	len = sizeof(line);
10117c478bdstevel@tonic-gate	if (!(opts & OPT_SYSLOG)) {
10127c478bdstevel@tonic-gate		(void) strftime(t, len, "%d/%m/%Y ", tm);
10137c478bdstevel@tonic-gate		i = strlen(t);
10147c478bdstevel@tonic-gate		len -= i;
10157c478bdstevel@tonic-gate		t += i;
10167c478bdstevel@tonic-gate	}
10177c478bdstevel@tonic-gate	(void) strftime(t, len, "%T", tm);
10187c478bdstevel@tonic-gate	t += strlen(t);
10197c478bdstevel@tonic-gate	(void) sprintf(t, ".%-.6ld ", ipl->ipl_usec);
10207c478bdstevel@tonic-gate	t += strlen(t);
10217c478bdstevel@tonic-gate	if (ipl->ipl_count > 1) {
10227c478bdstevel@tonic-gate		(void) sprintf(t, "%dx ", ipl->ipl_count);
10237c478bdstevel@tonic-gate		t += strlen(t);
10247c478bdstevel@tonic-gate	}
10257c478bdstevel@tonic-gate#if (defined(MENTAT) || \
10267c478bdstevel@tonic-gate	(defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
1027ab25eebyz	(defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) || \
10287c478bdstevel@tonic-gate	(defined(OpenBSD) && (OpenBSD >= 199603))) || defined(linux)
10297c478bdstevel@tonic-gate	{
10307c478bdstevel@tonic-gate	char	ifname[sizeof(ipf->fl_ifname) + 1];
10317c478bdstevel@tonic-gate
10327c478bdstevel@tonic-gate	strncpy(ifname, ipf->fl_ifname, sizeof(ipf->fl_ifname));
10337c478bdstevel@tonic-gate	ifname[sizeof(ipf->fl_ifname)] = '\0';
10347c478bdstevel@tonic-gate	(void) sprintf(t, "%s", ifname);
10357c478bdstevel@tonic-gate	t += strlen(t);
1036ab25eebyz# if defined(MENTAT) || defined(linux)
1037ab25eebyz	if (ISALPHA(*(t - 1))) {
10387c478bdstevel@tonic-gate		sprintf(t, "%d", ipf->fl_unit);
10397c478bdstevel@tonic-gate		t += strlen(t);
10407c478bdstevel@tonic-gate	}
10417c478bdstevel@tonic-gate# endif
10427c478bdstevel@tonic-gate	}
10437c478bdstevel@tonic-gate#else
10447c478bdstevel@tonic-gate	for (len = 0; len < 3; len++)
10457c478bdstevel@tonic-gate		if (ipf->fl_ifname[len] == '\0')
10467c478bdstevel@tonic-gate			break;
10477c478bdstevel@tonic-gate	if (ipf->fl_ifname[len])
10487c478bdstevel@tonic-gate		len++;
10497c478bdstevel@tonic-gate	(void) sprintf(t, "%*.*s%u", len, len, ipf->fl_ifname, ipf->fl_unit);
10507c478bdstevel@tonic-gate	t += strlen(t);
10517c478bdstevel@tonic-gate#endif
1052ab25eebyz#if defined(__sgi) || defined(_AIX51) || defined(__powerpc__) || \
1053ab25eebyz    defined(__arm__)
1054ab25eebyz	if ((ipf->fl_group[0] == 255) && (ipf->fl_group[1] == '\0'))
1055ab25eebyz#else
10567c478bdstevel@tonic-gate	if ((ipf->fl_group[0] == -1) && (ipf->fl_group[1] == '\0'))
1057ab25eebyz#endif
10587c478bdstevel@tonic-gate		strcat(t, " @-1:");
10597c478bdstevel@tonic-gate	else if (ipf->fl_group[0] == '\0')
10607c478bdstevel@tonic-gate		(void) strcpy(t, " @0:");
10617c478bdstevel@tonic-gate	else
10627c478bdstevel@tonic-gate		(void) sprintf(t, " @%s:", ipf->fl_group);
10637c478bdstevel@tonic-gate	t += strlen(t);
10647c478bdstevel@tonic-gate	if (ipf->fl_rule == 0xffffffff)
10657c478bdstevel@tonic-gate		strcat(t, "-1 ");
10667c478bdstevel@tonic-gate	else
10677c478bdstevel@tonic-gate		(void) sprintf(t, "%u ", ipf->fl_rule + 1);
10687c478bdstevel@tonic-gate	t += strlen(t);
10697c478bdstevel@tonic-gate
10707c478bdstevel@tonic-gate	lvl = LOG_NOTICE;
10717c478bdstevel@tonic-gate
10727c478bdstevel@tonic-gate 	if (ipf->fl_lflags & FI_SHORT) {
10737c478bdstevel@tonic-gate		*t++ = 'S';
10747c478bdstevel@tonic-gate		lvl = LOG_ERR;
10757c478bdstevel@tonic-gate	}
10767c478bdstevel@tonic-gate
10777c478bdstevel@tonic-gate	if (FR_ISPASS(ipf->fl_flags)) {
10787c478bdstevel@tonic-gate		if (ipf->fl_flags & FR_LOGP)
10797c478bdstevel@tonic-gate			*t++ = 'p';
10807c478bdstevel@tonic-gate		else
10817c478bdstevel@tonic-gate			*t++ = 'P';
10827c478bdstevel@tonic-gate	} else if (FR_ISBLOCK(ipf->fl_flags)) {
10837c478bdstevel@tonic-gate		if (ipf->fl_flags & FR_LOGB)
10847c478bdstevel@tonic-gate			*t++ = 'b';
10857c478bdstevel@tonic-gate		else
10867c478bdstevel@tonic-gate			*t++ = 'B';
10877c478bdstevel@tonic-gate		lvl = LOG_WARNING;
10887c478bdstevel@tonic-gate	} else if ((ipf->fl_flags & FR_LOGMASK) == FR_LOG) {
10897c478bdstevel@tonic-gate		*t++ = 'L';
10907c478bdstevel@tonic-gate		lvl = LOG_INFO;
10917c478bdstevel@tonic-gate	} else if (ipf->fl_flags & FF_LOGNOMATCH) {
10927c478bdstevel@tonic-gate		*t++ = 'n';
10937c478bdstevel@tonic-gate	} else {
10947c478bdstevel@tonic-gate		*t++ = '?';
10957c478bdstevel@tonic-gate		lvl = LOG_EMERG;
10967c478bdstevel@tonic-gate	}
10977c478bdstevel@tonic-gate	if (ipf->fl_loglevel != 0xffff)
10987c478bdstevel@tonic-gate		lvl = ipf->fl_loglevel;
10997c478bdstevel@tonic-gate	*t++ = ' ';
11007c478bdstevel@tonic-gate	*t = '\0';
11017c478bdstevel@tonic-gate
11027c478bdstevel@tonic-gate	if (v == 6) {
11037c478bdstevel@tonic-gate#ifdef	USE_INET6
11047c478bdstevel@tonic-gate		off = 0;
11057c478bdstevel@tonic-gate		ipoff = 0;
11067c478bdstevel@tonic-gate		hl = sizeof(ip6_t);
11077c478bdstevel@tonic-gate		ip6 = (ip6_t *)ip;
11087c478bdstevel@tonic-gate		p = (u_short)ip6->ip6_nxt;
11097c478bdstevel@tonic-gate		s = (u_32_t *)&ip6->ip6_src;
11107c478bdstevel@tonic-gate		d = (u_32_t *)&ip6->ip6_dst;
1111ab25eebyz		plen = hl + ntohs(ip6->ip6_plen);
11127c478bdstevel@tonic-gate#else
11137c478bdstevel@tonic-gate		sprintf(t, "ipv6");
11147c478bdstevel@tonic-gate		goto printipflog;
11157c478bdstevel@tonic-gate#endif
11167c478bdstevel@tonic-gate	} else if (v == 4) {
11177c478bdstevel@tonic-gate		hl = IP_HL(ip) << 2;
11187c478bdstevel@tonic-gate		ipoff = ip->ip_off;
11197c478bdstevel@tonic-gate		off = ipoff & IP_OFFMASK;
11207c478bdstevel@tonic-gate		p = (u_short)ip->ip_p;
11217c478bdstevel@tonic-gate		s = (u_32_t *)&ip->ip_src;
11227c478bdstevel@tonic-gate		d = (u_32_t *)&ip->ip_dst;
11237c478bdstevel@tonic-gate		plen = ip->ip_len;
11247c478bdstevel@tonic-gate	} else {
11257c478bdstevel@tonic-gate		goto printipflog;
11267c478bdstevel@tonic-gate	}
11277c478bdstevel@tonic-gate	proto = getproto(p);
11287c478bdstevel@tonic-gate
11297c478bdstevel@tonic-gate	if ((p == IPPROTO_TCP || p == IPPROTO_UDP) && !off) {
11307c478bdstevel@tonic-gate		tp = (tcphdr_t *)((char *)ip + hl);
11317c478bdstevel@tonic-gate		if (!(ipf->fl_lflags & FI_SHORT)) {
11327c478bdstevel@tonic-gate			(void) sprintf(t, "%s,%s -> ", hostname(res, v, s),
11337c478bdstevel@tonic-gate				portname(res, proto, (u_int)tp->th_sport));
11347c478bdstevel@tonic-gate			t += strlen(t);
11357c478bdstevel@tonic-gate			(void) sprintf(t, "%s,%s PR %s len %hu %hu",
11367c478bdstevel@tonic-gate				hostname(res, v, d),
11377c478bdstevel@tonic-gate				portname(res, proto, (u_int)tp->th_dport),
11387c478bdstevel@tonic-gate				proto, hl, plen);
11397c478bdstevel@tonic-gate			t += strlen(t);
11407c478bdstevel@tonic-gate
11417c478bdstevel@tonic-gate			if (p == IPPROTO_TCP) {
11427c478bdstevel@tonic-gate				*t++ = ' ';
11437c478bdstevel@tonic-gate				*t++ = '-';
11447c478bdstevel@tonic-gate				for (i = 0; tcpfl[i].value; i++)
11457c478bdstevel@tonic-gate					if (tp->th_flags & tcpfl[i].value)
11467c478bdstevel@tonic-gate						*t++ = tcpfl[i].flag;
11477c478bdstevel@tonic-gate				if (opts & OPT_VERBOSE) {
11487c478bdstevel@tonic-gate					(void) sprintf(t, " %lu %lu %hu",
11497c478bdstevel@tonic-gate						(u_long)(ntohl(tp->th_seq)),
11507c478bdstevel@tonic-gate						(u_long)(ntohl(tp->th_ack)),
11517c478bdstevel@tonic-gate						ntohs(tp->th_win));
11527c478bdstevel@tonic-gate					t += strlen(t);
11537c478bdstevel@tonic-gate				}
11547c478bdstevel@tonic-gate			}
11557c478bdstevel@tonic-gate			*t = '\0';
11567c478bdstevel@tonic-gate		} else {
11577c478bdstevel@tonic-gate			(void) sprintf(t, "%s -> ", hostname(res, v, s));
11587c478bdstevel@tonic-gate			t += strlen(t);
11597c478bdstevel@tonic-gate			(void) sprintf(t, "%s PR %s len %hu %hu",
11607c478bdstevel@tonic-gate				hostname(res, v, d), proto, hl, plen);
11617c478bdstevel@tonic-gate		}
11627c478bdstevel@tonic-gate	} else if ((p == IPPROTO_ICMPV6) && !off && (v == 6)) {
11637c478bdstevel@tonic-gate		ic = (struct icmp *)((char *)ip + hl);
11647c478bdstevel@tonic-gate		(void) sprintf(t, "%s -> ", hostname(res, v, s));
11657c478bdstevel@tonic-gate		t += strlen(t);
11667c478bdstevel@tonic-gate		(void) sprintf(t, "%s PR icmpv6 len %hu %hu icmpv6 %s",
11677c478bdstevel@tonic-gate			hostname(res, v, d), hl, plen,
11687c478bdstevel@tonic-gate			icmpname6(ic->icmp_type, ic->icmp_code));
11697c478bdstevel@tonic-gate	} else if ((p == IPPROTO_ICMP) && !off && (v == 4)) {
11707c478bdstevel@tonic-gate		ic = (struct icmp *)((char *)ip + hl);
11717c478bdstevel@tonic-gate		(void) sprintf(t, "%s -> ", hostname(res, v, s));
11727c478bdstevel@tonic-gate		t += strlen(t);
11737c478bdstevel@tonic-gate		(void) sprintf(t, "%s PR icmp len %hu %hu icmp %s",
11747c478bdstevel@tonic-gate			hostname(res, v, d), hl, plen,
11757c478bdstevel@tonic-gate			icmpname(ic->icmp_type, ic->icmp_code));
11767c478bdstevel@tonic-gate		if (ic->icmp_type == ICMP_UNREACH ||
11777c478bdstevel@tonic-gate		    ic->icmp_type == ICMP_SOURCEQUENCH ||
11787c478bdstevel@tonic-gate		    ic->icmp_type == ICMP_PARAMPROB ||
11797c478bdstevel@tonic-gate		    ic->icmp_type == ICMP_REDIRECT ||
11807c478bdstevel@tonic-gate		    ic->icmp_type == ICMP_TIMXCEED) {
11817c478bdstevel@tonic-gate			ipc = &ic->icmp_ip;
11827c478bdstevel@tonic-gate			i = ntohs(ipc->ip_len);
11837c478bdstevel@tonic-gate			/*
11847c478bdstevel@tonic-gate			 * XXX - try to guess endian of ip_len in ICMP
11857c478bdstevel@tonic-gate			 * returned data.
11867c478bdstevel@tonic-gate			 */
11877c478bdstevel@tonic-gate			if (i > 1500)
11887c478bdstevel@tonic-gate				i = ipc->ip_len;
11897c478bdstevel@tonic-gate			ipoff = ntohs(ipc->ip_off);
11907c478bdstevel@tonic-gate			proto = getproto(ipc->ip_p);
11917c478bdstevel@tonic-gate
11927c478bdstevel@tonic-gate			if (!(ipoff & IP_OFFMASK) &&
11937c478bdstevel@tonic-gate			    ((ipc->ip_p == IPPROTO_TCP) ||
11947c478bdstevel@tonic-gate			     (ipc->ip_p == IPPROTO_UDP))) {
11957c478bdstevel@tonic-gate				tp = (tcphdr_t *)((char *)ipc + hl);
11967c478bdstevel@tonic-gate				t += strlen(t);
11977c478bdstevel@tonic-gate				(void) sprintf(t, " for %s,%s -",
11987c478bdstevel@tonic-gate					HOSTNAME_V4(res, ipc->ip_src),
11997c478bdstevel@tonic-gate					portname(res, proto,
12007c478bdstevel@tonic-gate						 (u_int)tp->th_sport));
12017c478bdstevel@tonic-gate				t += strlen(t);
12027c478bdstevel@tonic-gate				(void) sprintf(t, " %s,%s PR %s len %hu %hu",
12037c478bdstevel@tonic-gate					HOSTNAME_V4(res, ipc->ip_dst),
12047c478bdstevel@tonic-gate					portname(res, proto,
12057c478bdstevel@tonic-gate						 (u_int)tp->th_dport),
12067c478bdstevel@tonic-gate					proto, IP_HL(ipc) << 2, i);
12077c478bdstevel@tonic-gate			} else if (!(ipoff & IP_OFFMASK) &&
12087c478bdstevel@tonic-gate				   (ipc->ip_p == IPPROTO_ICMP)) {
12097c478bdstevel@tonic-gate				icmp = (icmphdr_t *)((char *)ipc + hl);
12107c478bdstevel@tonic-gate
12117c478bdstevel@tonic-gate				t += strlen(t);
12127c478bdstevel@tonic-gate				(void) sprintf(t, " for %s -",
12137c478bdstevel@tonic-gate					HOSTNAME_V4(res, ipc->ip_src));
12147c478bdstevel@tonic-gate				t += strlen(t);
12157c478bdstevel@tonic-gate				(void) sprintf(t,
12167c478bdstevel@tonic-gate					" %s PR icmp len %hu %hu icmp %d/%d",
12177c478bdstevel@tonic-gate					HOSTNAME_V4(res, ipc->ip_dst),
12187c478bdstevel@tonic-gate					IP_HL(ipc) << 2, i,
12197c478bdstevel@tonic-gate					icmp->icmp_type, icmp->icmp_code);
12207c478bdstevel@tonic-gate			} else {
12217c478bdstevel@tonic-gate				t += strlen(t);
12227c478bdstevel@tonic-gate				(void) sprintf(t, " for %s -",
12237c478bdstevel@tonic-gate						HOSTNAME_V4(res, ipc->ip_src));
12247c478bdstevel@tonic-gate				t += strlen(t);
12257c478bdstevel@tonic-gate				(void) sprintf(t, " %s PR %s len %hu (%hu)",
12267c478bdstevel@tonic-gate					HOSTNAME_V4(res, ipc->ip_dst), proto,
12277c478bdstevel@tonic-gate					IP_HL(ipc) << 2, i);
12287c478bdstevel@tonic-gate				t += strlen(t);
12297c478bdstevel@tonic-gate				if (ipoff & IP_OFFMASK) {
1230ab25eebyz					(void) sprintf(t,
1231ab25eebyz						"(frag %d:%hu@%hu%s%s)",
1232ab25eebyz						ntohs(ipc->ip_id),
12337c478bdstevel@tonic-gate						i - (IP_HL(ipc) << 2),
1234ab25eebyz						(ipoff & IP_OFFMASK) << 3,
1235ab25eebyz						ipoff & IP_MF ? "+" : "",
1236ab25eebyz						ipoff & IP_DF ? "-" : "");
12377c478bdstevel@tonic-gate				}
12387c478bdstevel@tonic-gate			}
12397c478bdstevel@tonic-gate
12407c478bdstevel@tonic-gate		}
12417c478bdstevel@tonic-gate	} else {
12427c478bdstevel@tonic-gate		(void) sprintf(t, "%s -> ", hostname(res, v, s));
12437c478bdstevel@tonic-gate		t += strlen(t);
12447c478bdstevel@tonic-gate		(void) sprintf(t, "%s PR %s len %hu (%hu)",
12457c478bdstevel@tonic-gate			hostname(res, v, d), proto, hl, plen);
12467c478bdstevel@tonic-gate		t += strlen(t);
12477c478bdstevel@tonic-gate		if (off & IP_OFFMASK)
1248