[iptstate-commit] iptstate iptstate.8, 1.5, 1.6 iptstate.cc, 1.27, 1.28

[Phil D. <ja...@us...>]

Update of /cvsroot/iptstate/iptstate
In directory vz-cvs-4.sog:/tmp/cvs-serv32011

Modified Files:
	iptstate.8 iptstate.cc 
Log Message:
iptstate.8
 - document truncation of addresses
 
iptstate.cc
 - print "ipv6-icmp" as "icmp6"
 - support type/code in icmp6 states
 - support deletion of icmp6 states
 - dynamically size "state" column
 - if we can't resolve a proto to a name, rather than print "UNKNOWN!",
   just print the number
 - fixbug where we leave a space for a ":" even if there's no port

Signed-off-by: Phil Dibowitz <ph...@ip...>



Index: iptstate.8
===================================================================
RCS file: /cvsroot/iptstate/iptstate/iptstate.8,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -d -r1.5 -r1.6
--- iptstate.8	6 Apr 2011 07:39:32 -0000	1.5
+++ iptstate.8	2 Jun 2012 04:18:00 -0000	1.6
@@ -1,7 +1,7 @@
 .\" Process this file with
 .\" groff -man -Tascii iptstate.8
 .\"
-.TH IPTSTATE 8 "APRIL 2011" "" ""
+.TH IPTSTATE 8 "JUNE 2012" "" ""
 .\"
 .\" Man page written by Phil Dibowitz <phil AT ipom DOT com>
 .\"
@@ -167,7 +167,7 @@
 All bugs should be reported to Phil Dibowitz <phil AT ipom DOT com>. Please see the \fBREADME\fR and \fBBUGS\fR for more information on bug reports. Please read the \fBWISHLIST\fR before sending in features you hope to see.  
 
 .SH NOTES
-\fBiptstate\fP does a lot of work to try to fit everything on the screen in an easy-to-read way. However, in some cases, hostnames may need to be truncated in lookup mode. The truncation of names in lookup mode happens from the right for source because you most likely know your own domain name, and from the left for destination because knowing your users are connection to "mail.a." doesn't help much.
+\fBiptstate\fP does a lot of work to try to fit everything on the screen in an easy-to-read way. However, in some cases, hostnames may need to be truncated (in lookup mode). Similarly, IPv6 addresses may need to be truncated. The truncation of names happens from the right for source because you most likely know your own domain name, and from the left for destination because knowing your users are connection to "mail.a." doesn't help much. However, for addresses, this is reversed.
 .PP
 \fBiptstate\fP does not automatically handle window-resizes while in the \fBinteractive help\fP screen. If you do resize while in this window, you should return to the main window, hit \fBctrl-L\fP to re-calculate and re-draw the screen, and then, if you choose, return to the \fBinteractive help\fP.
 .PP

Index: iptstate.cc
===================================================================
RCS file: /cvsroot/iptstate/iptstate/iptstate.cc,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -d -r1.27 -r1.28
--- iptstate.cc	1 Jun 2012 08:00:46 -0000	1.27
+++ iptstate.cc	2 Jun 2012 04:18:00 -0000	1.28
@@ -63,7 +63,7 @@
 #include <unistd.h>
 using namespace std;
 
-#define VERSION "2.2.4"
+#define VERSION "2.2.4+CVS"
 /*
  * MAXCONS is set to 16k, the default number of states in iptables. Generally
  * speaking the ncurses pad is this many lines long, but since ncurses
@@ -910,13 +910,19 @@
     nfct_set_attr(ct, ATTR_ORIG_IPV6_DST, (void *)&entry.dst.s6_addr);
   }
 
-  nfct_set_attr_u8(ct, ATTR_ORIG_L4PROTO,
-                   getprotobyname(entry.proto.c_str())->p_proto);
+  // undo our space optimization so the kernel can find the state.
+  protoent *pn;
+  if (entry.proto == "icmp6")
+    pn = getprotobyname("ipv6-icmp");
+  else
+    pn = getprotobyname(entry.proto.c_str());
+
+  nfct_set_attr_u8(ct, ATTR_ORIG_L4PROTO, pn->p_proto);
 
   if (entry.proto == "tcp" || entry.proto == "udp") {
     nfct_set_attr_u16(ct, ATTR_ORIG_PORT_SRC, htons(entry.srcpt));
     nfct_set_attr_u16(ct, ATTR_ORIG_PORT_DST, htons(entry.dstpt));
-  } else if (entry.proto == "icmp") {
+  } else if (entry.proto == "icmp" || entry.proto == "icmp6") {
     string type, code, id, tmp;
     split('/', entry.state, type, tmp);
     split(' ', tmp, code, tmp);
@@ -970,7 +976,7 @@
   struct protoent* pe = NULL;
   int seconds, minutes, hours;
   char ttlc[11];
-  ostringstream typecode;
+  ostringstream buffer;
 
   /*
    * Clear the entry
@@ -988,11 +994,20 @@
    * same regardless of protocol
    */
 
-  pe = getprotobynumber(nfct_get_attr_u8(ct, ATTR_ORIG_L4PROTO));
+  short int pr = nfct_get_attr_u8(ct, ATTR_ORIG_L4PROTO);
+  pe = getprotobynumber(pr);
   if (pe == NULL) {
-    entry.proto = "unknown";
+    buffer << pr;
+    entry.proto = buffer.str();
+    buffer.str("");
   } else {
     entry.proto = pe->p_name;
+    /* 
+     * if proto is "ipv6-icmp" we can just say "icmp6" to save space...
+     * it's more common/standard anyway
+     */
+    if (entry.proto == "ipv6-icmp")
+      entry.proto = "icmp6";
   }
 
   // ttl
@@ -1050,13 +1065,15 @@
   } else if (entry.proto == "udp") {
     entry.state = "";
     counts->udp++;
-  } else if (entry.proto == "icmp") {
-    typecode.str("");
-    typecode << (int)nfct_get_attr_u8(ct, ATTR_ICMP_TYPE) << "/"
+  } else if (entry.proto == "icmp" || entry.proto == "icmp6") {
+    buffer.str("");
+    buffer << (int)nfct_get_attr_u8(ct, ATTR_ICMP_TYPE) << "/"
         << (int)nfct_get_attr_u8(ct, ATTR_ICMP_CODE) << " ("
         << nfct_get_attr_u16(ct, ATTR_ICMP_ID) << ")";
-    entry.state = typecode.str();
+    entry.state = buffer.str();
     counts->icmp++;
+    if (entry.state.size() > max->state)
+      max->state = entry.state.size();
   } else {
     counts->other++;
   }
@@ -1411,16 +1428,30 @@
   ostringstream buffer;
   bool have_port = table.proto == "tcp" || table.proto == "udp";
   char direction;
+  unsigned int length;
 
-  int length;
-  if (table.sname.size() + table.spname.size() + 1 > max.src) {
-    length = max.src - 1 - table.spname.size();
+  // What length would we currently use?
+  length = table.sname.size();
+  if (have_port)
+    length += table.spname.size() + 1;
+
+  // If it's too long, figure out how room we have and truncate it
+  if (length > max.src) {
+    length = max.src;
+    if (have_port)
+      length -= 1 + table.spname.size();
     direction = (flags.lookup) ? 'e' : 'f';
     truncate(table.sname, length, flags.tag_truncate, direction);
   }
 
-  if (table.dname.size() + table.dpname.size() + 1 > max.dst) {
-    length = max.dst - 1 - table.dpname.size();
+  // ... and repeat
+  length = table.dname.size();
+  if (have_port)
+    length += table.dpname.size() + 1;
+  if (length > max.dst) {
+    length = max.dst;
+    if (have_port)
+      length -= 1 + table.dpname.size();
     direction = (flags.lookup) ? 'f' : 'e';
     truncate(table.dname, length, flags.tag_truncate, direction);
   }
@@ -1473,7 +1504,7 @@
         color = 1;
       else if (table.proto == "udp")
         color = 2;
-      else if (table.proto == "icmp")
+      else if (table.proto == "icmp" || table.proto == "icmp6")
         color = 3;
       if (curr)
         color += 4;