flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2011 - 2013 Daniel Borkmann.
   4  * Copyright 2011 Emmanuel Roullit.
   5  * Subject to the GPL, version 2.
   6  */
   7
   8 #define _LGPL_SOURCE
   9 #include <stdio.h>
  10 #include <stdint.h>
  11 #include <stdlib.h>
  12 #include <signal.h>
  13 #include <getopt.h>
  14 #include <pthread.h>
  15 #include <signal.h>
  16 #include <netdb.h>
  17 #include <ctype.h>
  18 #include <netinet/in.h>
  19 #include <curses.h>
  20 #include <dirent.h>
  21 #include <sys/stat.h>
  22 #include <sys/fsuid.h>
  23 #include <urcu.h>
  24 #include <libgen.h>
  25 #include <inttypes.h>
  26
  27 #include "die.h"
  28 #include "xmalloc.h"
  29 #include "conntrack.h"
  30 #include "config.h"
  31 #include "str.h"
  32 #include "sig.h"
  33 #include "lookup.h"
  34 #include "geoip.h"
  35 #include "built_in.h"
  36 #include "locking.h"
  37 #include "pkt_buff.h"
  38 #include "screen.h"
  39
  40 struct flow_entry {
  41         uint32_t flow_id, use, status;
  42         uint8_t  l3_proto, l4_proto;
  43         uint32_t ip4_src_addr, ip4_dst_addr;
  44         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  45         uint16_t port_src, port_dst;
  46         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  47         uint64_t counter_pkts, counter_bytes;
  48         uint64_t timestamp_start, timestamp_stop;
  49         char country_src[128], country_dst[128];
  50         char city_src[128], city_dst[128];
  51         char rev_dns_src[256], rev_dns_dst[256];
  52         char cmdline[256];
  53         struct flow_entry *next;
  54         int inode;
  55         unsigned int procnum;
  56 };
  57
  58 struct flow_list {
  59         struct flow_entry *head;
  60         struct spinlock lock;
  61 };
  62
  63 #ifndef ATTR_TIMESTAMP_START
  64 # define ATTR_TIMESTAMP_START 63
  65 #endif
  66 #ifndef ATTR_TIMESTAMP_STOP
  67 # define ATTR_TIMESTAMP_STOP 64
  68 #endif
  69
  70 #define SCROLL_MAX 1000
  71
  72 #define INCLUDE_IPV4    (1 << 0)
  73 #define INCLUDE_IPV6    (1 << 1)
  74 #define INCLUDE_UDP     (1 << 2)
  75 #define INCLUDE_TCP     (1 << 3)
  76 #define INCLUDE_DCCP    (1 << 4)
  77 #define INCLUDE_ICMP    (1 << 5)
  78 #define INCLUDE_SCTP    (1 << 6)
  79
  80 static volatile sig_atomic_t sigint = 0;
  81 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
  82 static struct flow_list flow_list;
  83 static struct condlock collector_ready;
  84
  85 static const char *short_options = "vhTUsDIS46u";
  86 static const struct option long_options[] = {
  87         {"ipv4",        no_argument,            NULL, '4'},
  88         {"ipv6",        no_argument,            NULL, '6'},
  89         {"tcp",         no_argument,            NULL, 'T'},
  90         {"udp",         no_argument,            NULL, 'U'},
  91         {"dccp",        no_argument,            NULL, 'D'},
  92         {"icmp",        no_argument,            NULL, 'I'},
  93         {"sctp",        no_argument,            NULL, 'S'},
  94         {"show-src",    no_argument,            NULL, 's'},
  95         {"update",      no_argument,            NULL, 'u'},
  96         {"version",     no_argument,            NULL, 'v'},
  97         {"help",        no_argument,            NULL, 'h'},
  98         {NULL, 0, NULL, 0}
  99 };
 100
 101 static const char *copyright = "Please report bugs to <bugs@netsniff-ng.org>\n"
 102         "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 103         "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 104         "Swiss federal institute of technology (ETH Zurich)\n"
 105         "License: GNU GPL version 2.0\n"
 106         "This is free software: you are free to change and redistribute it.\n"
 107         "There is NO WARRANTY, to the extent permitted by law.";
 108
 109 static const char *const l3proto2str[AF_MAX] = {
 110         [AF_INET]                       = "ipv4",
 111         [AF_INET6]                      = "ipv6",
 112 };
 113
 114 static const char *const l4proto2str[IPPROTO_MAX] = {
 115         [IPPROTO_TCP]                   = "tcp",
 116         [IPPROTO_UDP]                   = "udp",
 117         [IPPROTO_UDPLITE]               = "udplite",
 118         [IPPROTO_ICMP]                  = "icmp",
 119         [IPPROTO_ICMPV6]                = "icmpv6",
 120         [IPPROTO_SCTP]                  = "sctp",
 121         [IPPROTO_GRE]                   = "gre",
 122         [IPPROTO_DCCP]                  = "dccp",
 123         [IPPROTO_IGMP]                  = "igmp",
 124         [IPPROTO_IPIP]                  = "ipip",
 125         [IPPROTO_EGP]                   = "egp",
 126         [IPPROTO_PUP]                   = "pup",
 127         [IPPROTO_IDP]                   = "idp",
 128         [IPPROTO_RSVP]                  = "rsvp",
 129         [IPPROTO_IPV6]                  = "ip6tun",
 130         [IPPROTO_ESP]                   = "esp",
 131         [IPPROTO_AH]                    = "ah",
 132         [IPPROTO_PIM]                   = "pim",
 133         [IPPROTO_COMP]                  = "comp",
 134 };
 135
 136 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 137         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 138         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 139         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 140         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 141         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 142         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 143         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 144         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 145         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 146         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 147 };
 148
 149 static const uint8_t tcp_states[] = {
 150         TCP_CONNTRACK_SYN_SENT,
 151         TCP_CONNTRACK_SYN_RECV,
 152         TCP_CONNTRACK_ESTABLISHED,
 153         TCP_CONNTRACK_FIN_WAIT,
 154         TCP_CONNTRACK_CLOSE_WAIT,
 155         TCP_CONNTRACK_LAST_ACK,
 156         TCP_CONNTRACK_TIME_WAIT,
 157         TCP_CONNTRACK_CLOSE,
 158         TCP_CONNTRACK_SYN_SENT2,
 159         TCP_CONNTRACK_NONE,
 160 };
 161
 162 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 163         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 164         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 165         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 166         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 167         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 168         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 169         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 170         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 171         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 172         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 173 };
 174
 175 static const uint8_t dccp_states[] = {
 176         DCCP_CONNTRACK_NONE,
 177         DCCP_CONNTRACK_REQUEST,
 178         DCCP_CONNTRACK_RESPOND,
 179         DCCP_CONNTRACK_PARTOPEN,
 180         DCCP_CONNTRACK_OPEN,
 181         DCCP_CONNTRACK_CLOSEREQ,
 182         DCCP_CONNTRACK_CLOSING,
 183         DCCP_CONNTRACK_TIMEWAIT,
 184         DCCP_CONNTRACK_IGNORE,
 185         DCCP_CONNTRACK_INVALID,
 186 };
 187
 188 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 189         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 190         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 191         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 192         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 193         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 194         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 195         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 196         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 197 };
 198
 199 static const uint8_t sctp_states[] = {
 200         SCTP_CONNTRACK_NONE,
 201         SCTP_CONNTRACK_CLOSED,
 202         SCTP_CONNTRACK_COOKIE_WAIT,
 203         SCTP_CONNTRACK_COOKIE_ECHOED,
 204         SCTP_CONNTRACK_ESTABLISHED,
 205         SCTP_CONNTRACK_SHUTDOWN_SENT,
 206         SCTP_CONNTRACK_SHUTDOWN_RECD,
 207         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 208 };
 209
 210 static const struct nfct_filter_ipv4 filter_ipv4 = {
 211         .addr = __constant_htonl(INADDR_LOOPBACK),
 212         .mask = 0xffffffff,
 213 };
 214
 215 static const struct nfct_filter_ipv6 filter_ipv6 = {
 216         .addr = { 0x0, 0x0, 0x0, 0x1 },
 217         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 218 };
 219
 220 static void signal_handler(int number)
 221 {
 222         switch (number) {
 223         case SIGINT:
 224         case SIGQUIT:
 225         case SIGTERM:
 226                 sigint = 1;
 227                 break;
 228         case SIGHUP:
 229         default:
 230                 break;
 231         }
 232 }
 233
 234 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 235 static void flow_entry_get_extended(struct flow_entry *n);
 236
 237 static void help(void)
 238 {
 239         printf("flowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
 240                VERSION_STRING);
 241         puts("http://www.netsniff-ng.org\n\n"
 242              "Usage: flowtop [options]\n"
 243              "Options:\n"
 244              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 245              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 246              "  -T|--tcp               Show only TCP flows (default)\n"
 247              "  -U|--udp               Show only UDP flows\n"
 248              "  -D|--dccp              Show only DCCP flows\n"
 249              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 250              "  -S|--sctp              Show only SCTP flows\n"
 251              "  -s|--show-src          Also show source, not only dest\n"
 252              "  -u|--update            Update GeoIP databases\n"
 253              "  -v|--version           Print version and exit\n"
 254              "  -h|--help              Print this help and exit\n\n"
 255              "Examples:\n"
 256              "  flowtop\n"
 257              "  flowtop -46UTDISs\n\n"
 258              "Note:\n"
 259              "  If netfilter is not running, you can activate it with e.g.:\n"
 260              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 261              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n");
 262         puts(copyright);
 263         die();
 264 }
 265
 266 static void version(void)
 267 {
 268         printf("flowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
 269         puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
 270              "http://www.netsniff-ng.org\n");
 271         puts(copyright);
 272         die();
 273 }
 274
 275 static inline struct flow_entry *flow_entry_xalloc(void)
 276 {
 277         return xzmalloc(sizeof(struct flow_entry));
 278 }
 279
 280 static inline void flow_entry_xfree(struct flow_entry *n)
 281 {
 282         xfree(n);
 283 }
 284
 285 static inline void flow_list_init(struct flow_list *fl)
 286 {
 287         fl->head = NULL;
 288         spinlock_init(&fl->lock);
 289 }
 290
 291 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 292 {
 293         struct flow_entry *n = flow_entry_xalloc();
 294
 295         flow_entry_from_ct(n, ct);
 296         flow_entry_get_extended(n);
 297
 298         rcu_assign_pointer(n->next, fl->head);
 299         rcu_assign_pointer(fl->head, n);
 300 }
 301
 302 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 303                                             uint32_t id)
 304 {
 305         struct flow_entry *n = rcu_dereference(fl->head);
 306
 307         while (n != NULL) {
 308                 if (n->flow_id == id)
 309                         return n;
 310
 311                 n = rcu_dereference(n->next);
 312         }
 313
 314         return NULL;
 315 }
 316
 317 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 318                                                  uint32_t id)
 319 {
 320         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 321
 322         if (n->flow_id == id)
 323                 return NULL;
 324
 325         while ((tmp = rcu_dereference(n->next)) != NULL) {
 326                 if (tmp->flow_id == id)
 327                         return n;
 328
 329                 n = tmp;
 330         }
 331
 332         return NULL;
 333 }
 334
 335 static void flow_list_update_entry(struct flow_list *fl,
 336                                    struct nf_conntrack *ct)
 337 {
 338         int do_ext = 0;
 339         struct flow_entry *n;
 340
 341         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 342         if (n == NULL) {
 343                 n = flow_entry_xalloc();
 344                 do_ext = 1;
 345         }
 346
 347         flow_entry_from_ct(n, ct);
 348         if (do_ext) {
 349                 flow_entry_get_extended(n);
 350
 351                 rcu_assign_pointer(n->next, fl->head);
 352                 rcu_assign_pointer(fl->head, n);
 353         }
 354 }
 355
 356 static void flow_list_destroy_entry(struct flow_list *fl,
 357                                     struct nf_conntrack *ct)
 358 {
 359         struct flow_entry *n1, *n2;
 360         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 361
 362         n1 = flow_list_find_id(fl, id);
 363         if (n1) {
 364                 n2 = flow_list_find_prev_id(fl, id);
 365                 if (n2) {
 366                         rcu_assign_pointer(n2->next, n1->next);
 367                         n1->next = NULL;
 368
 369                         flow_entry_xfree(n1);
 370                 } else {
 371                         flow_entry_xfree(fl->head);
 372                         fl->head = NULL;
 373                 }
 374         }
 375 }
 376
 377 static void flow_list_destroy(struct flow_list *fl)
 378 {
 379         struct flow_entry *n;
 380
 381         while (fl->head != NULL) {
 382                 n = rcu_dereference(fl->head->next);
 383                 fl->head->next = NULL;
 384
 385                 flow_entry_xfree(fl->head);
 386                 rcu_assign_pointer(fl->head, n);
 387         }
 388
 389         synchronize_rcu();
 390         spinlock_destroy(&fl->lock);
 391 }
 392
 393 static int walk_process(unsigned int pid, struct flow_entry *n)
 394 {
 395         int ret;
 396         DIR *dir;
 397         struct dirent *ent;
 398         char path[1024];
 399
 400         if (snprintf(path, sizeof(path), "/proc/%u/fd", pid) == -1)
 401                 panic("giant process name! %u\n", pid);
 402
 403         dir = opendir(path);
 404         if (!dir)
 405                 return 0;
 406
 407         while ((ent = readdir(dir))) {
 408                 struct stat statbuf;
 409
 410                 if (snprintf(path, sizeof(path), "/proc/%u/fd/%s",
 411                              pid, ent->d_name) < 0)
 412                         continue;
 413
 414                 if (stat(path, &statbuf) < 0)
 415                         continue;
 416
 417                 if (S_ISSOCK(statbuf.st_mode) && (ino_t) n->inode == statbuf.st_ino) {
 418                         memset(n->cmdline, 0, sizeof(n->cmdline));
 419
 420                         snprintf(path, sizeof(path), "/proc/%u/exe", pid);
 421
 422                         ret = readlink(path, n->cmdline,
 423                                        sizeof(n->cmdline) - 1);
 424                         if (ret < 0)
 425                                 panic("readlink error: %s\n", strerror(errno));
 426
 427                         n->procnum = pid;
 428                         closedir(dir);
 429                         return 1;
 430                 }
 431         }
 432
 433         closedir(dir);
 434         return 0;
 435 }
 436
 437 static void walk_processes(struct flow_entry *n)
 438 {
 439         int ret;
 440         DIR *dir;
 441         struct dirent *ent;
 442
 443         /* n->inode must be set */
 444         if (n->inode <= 0) {
 445                 memset(n->cmdline, 0, sizeof(n->cmdline));
 446                 return;
 447         }
 448
 449         dir = opendir("/proc");
 450         if (!dir)
 451                 panic("Cannot open /proc: %s\n", strerror(errno));
 452
 453         while ((ent = readdir(dir))) {
 454                 const char *name = ent->d_name;
 455                 char *end;
 456                 unsigned int pid = strtoul(name, &end, 10);
 457
 458                 /* not a PID */
 459                 if (pid == 0 && end == name)
 460                         continue;
 461
 462                 ret = walk_process(pid, n);
 463                 if (ret > 0)
 464                         break;
 465         }
 466
 467         closedir(dir);
 468 }
 469
 470 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 471 {
 472         int ret = -ENOENT;
 473         char path[128], buff[1024];
 474         FILE *proc;
 475
 476         memset(path, 0, sizeof(path));
 477         snprintf(path, sizeof(path), "/proc/net/%s%s",
 478                  l4proto2str[proto], is_ip6 ? "6" : "");
 479
 480         proc = fopen(path, "r");
 481         if (!proc)
 482                 return -EIO;
 483
 484         memset(buff, 0, sizeof(buff));
 485
 486         while (fgets(buff, sizeof(buff), proc) != NULL) {
 487                 int inode = 0;
 488                 unsigned int lport = 0;
 489
 490                 buff[sizeof(buff) - 1] = 0;
 491                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 492                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 493                         if ((uint16_t) lport == port) {
 494                                 ret = inode;
 495                                 break;
 496                         }
 497                 }
 498
 499                 memset(buff, 0, sizeof(buff));
 500         }
 501
 502         fclose(proc);
 503         return ret;
 504 }
 505
 506 #define CP_NFCT(elem, attr, x)                          \
 507         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 508 #define CP_NFCT_BUFF(elem, attr) do {                   \
 509         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 510         if (buff != NULL)                               \
 511                 memcpy(n->elem, buff, sizeof(n->elem)); \
 512 } while (0)
 513
 514 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 515 {
 516         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 517         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 518
 519         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 520         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 521
 522         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 523         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 524
 525         CP_NFCT(status, ATTR_STATUS, 32);
 526
 527         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 528         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 529         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 530         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 531
 532         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 533         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 534
 535         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 536         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 537
 538         CP_NFCT(flow_id, ATTR_ID, 32);
 539         CP_NFCT(use, ATTR_USE, 32);
 540
 541         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 542         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 543
 544         n->port_src = ntohs(n->port_src);
 545         n->port_dst = ntohs(n->port_dst);
 546
 547         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 548         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 549 }
 550
 551 enum flow_entry_direction {
 552         flow_entry_src,
 553         flow_entry_dst,
 554 };
 555
 556 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 557 {
 558         /* We don't want to analyze / display DNS itself, since we
 559          * use it to resolve reverse dns.
 560          */
 561         return n->port_src == 53 || n->port_dst == 53;
 562 }
 563
 564 #define SELFLD(dir,src_member,dst_member)       \
 565         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 566
 567 static void flow_entry_get_sain4_obj(struct flow_entry *n,
 568                                      enum flow_entry_direction dir,
 569                                      struct sockaddr_in *sa)
 570 {
 571         memset(sa, 0, sizeof(*sa));
 572         sa->sin_family = PF_INET;
 573         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 574 }
 575
 576 static void flow_entry_get_sain6_obj(struct flow_entry *n,
 577                                      enum flow_entry_direction dir,
 578                                      struct sockaddr_in6 *sa)
 579 {
 580         memset(sa, 0, sizeof(*sa));
 581         sa->sin6_family = PF_INET6;
 582
 583         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 584                sizeof(sa->sin6_addr));
 585 }
 586
 587 static void
 588 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 589                                    enum flow_entry_direction dir)
 590 {
 591         struct sockaddr_in sa4;
 592         struct sockaddr_in6 sa6;
 593         const char *city = NULL;
 594
 595         switch (n->l3_proto) {
 596         default:
 597                 bug();
 598
 599         case AF_INET:
 600                 flow_entry_get_sain4_obj(n, dir, &sa4);
 601                 city = geoip4_city_name(&sa4);
 602                 break;
 603
 604         case AF_INET6:
 605                 flow_entry_get_sain6_obj(n, dir, &sa6);
 606                 city = geoip6_city_name(&sa6);
 607                 break;
 608         }
 609
 610         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 611
 612         if (city) {
 613                 memcpy(SELFLD(dir, city_src, city_dst), city,
 614                        min(sizeof(n->city_src), strlen(city)));
 615         } else {
 616                 memset(SELFLD(dir, city_src, city_dst), 0,
 617                        sizeof(n->city_src));
 618         }
 619 }
 620
 621 static void
 622 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 623                                       enum flow_entry_direction dir)
 624 {
 625         struct sockaddr_in sa4;
 626         struct sockaddr_in6 sa6;
 627         const char *country = NULL;
 628
 629         switch (n->l3_proto) {
 630         default:
 631                 bug();
 632
 633         case AF_INET:
 634                 flow_entry_get_sain4_obj(n, dir, &sa4);
 635                 country = geoip4_country_name(&sa4);
 636                 break;
 637
 638         case AF_INET6:
 639                 flow_entry_get_sain6_obj(n, dir, &sa6);
 640                 country = geoip6_country_name(&sa6);
 641                 break;
 642         }
 643
 644         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 645
 646         if (country) {
 647                 memcpy(SELFLD(dir, country_src, country_dst), country,
 648                        min(sizeof(n->country_src), strlen(country)));
 649         } else {
 650                 memset(SELFLD(dir, country_src, country_dst), 0,
 651                        sizeof(n->country_src));
 652         }
 653 }
 654
 655 static void flow_entry_get_extended_geo(struct flow_entry *n,
 656                                         enum flow_entry_direction dir)
 657 {
 658         flow_entry_geo_city_lookup_generic(n, dir);
 659         flow_entry_geo_country_lookup_generic(n, dir);
 660 }
 661
 662 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 663                                            enum flow_entry_direction dir)
 664 {
 665         size_t sa_len;
 666         struct sockaddr_in sa4;
 667         struct sockaddr_in6 sa6;
 668         struct sockaddr *sa;
 669         struct hostent *hent;
 670
 671         switch (n->l3_proto) {
 672         default:
 673                 bug();
 674
 675         case AF_INET:
 676                 flow_entry_get_sain4_obj(n, dir, &sa4);
 677                 sa = (struct sockaddr *) &sa4;
 678                 sa_len = sizeof(sa4);
 679                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
 680                 break;
 681
 682         case AF_INET6:
 683                 flow_entry_get_sain6_obj(n, dir, &sa6);
 684                 sa = (struct sockaddr *) &sa6;
 685                 sa_len = sizeof(sa6);
 686                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
 687                 break;
 688         }
 689
 690         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 691         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 692                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 693
 694         if (hent) {
 695                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 696                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 697                        hent->h_name, min(sizeof(n->rev_dns_src),
 698                                          strlen(hent->h_name)));
 699         }
 700 }
 701
 702 static void flow_entry_get_extended(struct flow_entry *n)
 703 {
 704         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 705                 return;
 706
 707         flow_entry_get_extended_revdns(n, flow_entry_src);
 708         flow_entry_get_extended_geo(n, flow_entry_src);
 709
 710         flow_entry_get_extended_revdns(n, flow_entry_dst);
 711         flow_entry_get_extended_geo(n, flow_entry_dst);
 712
 713         /* Lookup application */
 714         n->inode = get_port_inode(n->port_src, n->l4_proto,
 715                                   n->l3_proto == AF_INET6);
 716         if (n->inode > 0)
 717                 walk_processes(n);
 718 }
 719
 720 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 721 {
 722         if (src < dst && src < 1024) {
 723                 return src;
 724         } else if (dst < src && dst < 1024) {
 725                 return dst;
 726         } else {
 727                 const char *tmp1, *tmp2;
 728                 if (tcp) {
 729                         tmp1 = lookup_port_tcp(src);
 730                         tmp2 = lookup_port_tcp(dst);
 731                 } else {
 732                         tmp1 = lookup_port_udp(src);
 733                         tmp2 = lookup_port_udp(dst);
 734                 }
 735                 if (tmp1 && !tmp2) {
 736                         return src;
 737                 } else if (!tmp1 && tmp2) {
 738                         return dst;
 739                 } else {
 740                         if (src < dst)
 741                                 return src;
 742                         else
 743                                 return dst;
 744                 }
 745         }
 746 }
 747
 748 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 749                                      unsigned int *line)
 750 {
 751         char tmp[128], *pname = NULL;
 752         uint16_t port;
 753
 754         mvwprintw(screen, *line, 2, "");
 755
 756         /* PID, application name */
 757         if (n->procnum > 0) {
 758                 slprintf(tmp, sizeof(tmp), "%s(%d)", basename(n->cmdline),
 759                          n->procnum);
 760
 761                 printw("[");
 762                 attron(COLOR_PAIR(3));
 763                 printw("%s", tmp);
 764                 attroff(COLOR_PAIR(3));
 765                 printw("]:");
 766         }
 767
 768         /* L3 protocol, L4 protocol, states */
 769         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 770         printw("[");
 771         attron(COLOR_PAIR(3));
 772         switch (n->l4_proto) {
 773         case IPPROTO_TCP:
 774                 printw("%s", tcp_state2str[n->tcp_state]);
 775                 break;
 776         case IPPROTO_SCTP:
 777                 printw("%s", sctp_state2str[n->sctp_state]);
 778                 break;
 779         case IPPROTO_DCCP:
 780                 printw("%s", dccp_state2str[n->dccp_state]);
 781                 break;
 782         case IPPROTO_UDP:
 783         case IPPROTO_UDPLITE:
 784         case IPPROTO_ICMP:
 785         case IPPROTO_ICMPV6:
 786                 printw("NOSTATE");
 787                 break;
 788         }
 789         attroff(COLOR_PAIR(3));
 790         printw("]");
 791
 792         /* Guess application port */
 793         switch (n->l4_proto) {
 794         case IPPROTO_TCP:
 795                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 796                 pname = lookup_port_tcp(port);
 797                 break;
 798         case IPPROTO_UDP:
 799         case IPPROTO_UDPLITE:
 800                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 801                 pname = lookup_port_udp(port);
 802                 break;
 803         }
 804         if (pname) {
 805                 attron(A_BOLD);
 806                 printw(":%s", pname);
 807                 attroff(A_BOLD);
 808         }
 809         printw(" ->");
 810
 811         /* Number packets, bytes */
 812         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 813                 printw(" (%"PRIu64" pkts, %"PRIu64" bytes) ->",
 814                        n->counter_pkts, n->counter_bytes);
 815
 816         /* Show source information: reverse DNS, port, country, city */
 817         if (show_src) {
 818                 attron(COLOR_PAIR(1));
 819                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 820                 attroff(COLOR_PAIR(1));
 821
 822                 printw(":%"PRIu16, n->port_src);
 823
 824                 if (n->country_src[0]) {
 825                         printw(" (");
 826
 827                         attron(COLOR_PAIR(4));
 828                         printw("%s", n->country_src);
 829                         attroff(COLOR_PAIR(4));
 830
 831                         if (n->city_src[0])
 832                                 printw(", %s", n->city_src);
 833
 834                         printw(")");
 835                 }
 836
 837                 printw(" => ");
 838         }
 839
 840         /* Show dest information: reverse DNS, port, country, city */
 841         attron(COLOR_PAIR(2));
 842         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 843         attroff(COLOR_PAIR(2));
 844
 845         printw(":%"PRIu16, n->port_dst);
 846
 847         if (n->country_dst[0]) {
 848                 printw(" (");
 849
 850                 attron(COLOR_PAIR(4));
 851                 printw("%s", n->country_dst);
 852                 attroff(COLOR_PAIR(4));
 853
 854                 if (n->city_dst[0])
 855                         printw(", %s", n->city_dst);
 856
 857                 printw(")");
 858         }
 859 }
 860
 861 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 862 {
 863         int ret = 1;
 864
 865         switch (n->l4_proto) {
 866         case IPPROTO_TCP:
 867                 if (n->tcp_state == state)
 868                         ret = 0;
 869                 break;
 870         case IPPROTO_SCTP:
 871                 if (n->sctp_state == state)
 872                         ret = 0;
 873                 break;
 874         case IPPROTO_DCCP:
 875                 if (n->dccp_state == state)
 876                         ret = 0;
 877                 break;
 878         case IPPROTO_UDP:
 879         case IPPROTO_UDPLITE:
 880         case IPPROTO_ICMP:
 881         case IPPROTO_ICMPV6:
 882                 ret = 0;
 883                 break;
 884         }
 885
 886         return ret;
 887 }
 888
 889 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 890                                     int skip_lines)
 891 {
 892         int maxy;
 893         size_t i, j;
 894         unsigned int line = 3;
 895         struct flow_entry *n;
 896         uint8_t protocols[] = {
 897                 IPPROTO_TCP,
 898                 IPPROTO_DCCP,
 899                 IPPROTO_SCTP,
 900                 IPPROTO_UDP,
 901                 IPPROTO_UDPLITE,
 902                 IPPROTO_ICMP,
 903                 IPPROTO_ICMPV6,
 904         };
 905         size_t protocol_state_size[] = {
 906                 [IPPROTO_TCP] = array_size(tcp_states),
 907                 [IPPROTO_DCCP] = array_size(dccp_states),
 908                 [IPPROTO_SCTP] = array_size(sctp_states),
 909                 [IPPROTO_UDP] = 1,
 910                 [IPPROTO_UDPLITE] = 1,
 911                 [IPPROTO_ICMP] = 1,
 912                 [IPPROTO_ICMPV6] = 1,
 913         };
 914
 915         curs_set(0);
 916
 917         maxy = getmaxy(screen);
 918         maxy -= 6;
 919
 920         start_color();
 921         init_pair(1, COLOR_RED, COLOR_BLACK);
 922         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 923         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 924         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 925
 926         wclear(screen);
 927         clear();
 928
 929         mvwprintw(screen, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
 930                   "[+%d]", what & INCLUDE_TCP ? "TCP, " : "" ,
 931                   what & INCLUDE_UDP ? "UDP, " : "",
 932                   what & INCLUDE_SCTP ? "SCTP, " : "",
 933                   what & INCLUDE_DCCP ? "DCCP, " : "",
 934                   what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
 935                   what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
 936                   skip_lines);
 937
 938         rcu_read_lock();
 939
 940         if (rcu_dereference(fl->head) == NULL)
 941                 mvwprintw(screen, line, 2, "(No active sessions! "
 942                           "Is netfilter running?)");
 943
 944         for (i = 0; i < array_size(protocols); i++) {
 945                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 946                         n = rcu_dereference(fl->head);
 947                         while (n && maxy > 0) {
 948                                 if (n->l4_proto != protocols[i] ||
 949                                     presenter_flow_wrong_state(n, j) ||
 950                                     presenter_get_port(n->port_src,
 951                                                        n->port_dst, 0) == 53) {
 952                                         /* skip entry */
 953                                         n = rcu_dereference(n->next);
 954                                         continue;
 955                                 }
 956                                 if (skip_lines > 0) {
 957                                         n = rcu_dereference(n->next);
 958                                         skip_lines--;
 959                                         continue;
 960                                 }
 961
 962                                 presenter_screen_do_line(screen, n, &line);
 963
 964                                 line++;
 965                                 maxy -= (2 + 1 * show_src);
 966                                 n = rcu_dereference(n->next);
 967                         }
 968                 }
 969         }
 970
 971         rcu_read_unlock();
 972
 973         wrefresh(screen);
 974         refresh();
 975 }
 976
 977 static void presenter(void)
 978 {
 979         int skip_lines = 0;
 980         WINDOW *screen;
 981
 982         condlock_wait(&collector_ready);
 983
 984         lookup_init_ports(PORTS_TCP);
 985         lookup_init_ports(PORTS_UDP);
 986         screen = screen_init(false);
 987
 988         rcu_register_thread();
 989         while (!sigint) {
 990                 switch (getch()) {
 991                 case 'q':
 992                         sigint = 1;
 993                         break;
 994                 case KEY_UP:
 995                 case 'u':
 996                 case 'k':
 997                         skip_lines--;
 998                         if (skip_lines < 0)
 999                                 skip_lines = 0;
1000                         break;
1001                 case KEY_DOWN:
1002                 case 'd':
1003                 case 'j':
1004                         skip_lines++;
1005                         if (skip_lines > SCROLL_MAX)
1006                                 skip_lines = SCROLL_MAX;
1007                         break;
1008                 default:
1009                         fflush(stdin);
1010                         break;
1011                 }
1012
1013                 presenter_screen_update(screen, &flow_list, skip_lines);
1014                 usleep(100000);
1015         }
1016         rcu_unregister_thread();
1017
1018         screen_end();
1019         lookup_cleanup_ports(PORTS_UDP);
1020         lookup_cleanup_ports(PORTS_TCP);
1021 }
1022
1023 static int collector_cb(enum nf_conntrack_msg_type type,
1024                         struct nf_conntrack *ct, void *data __maybe_unused)
1025 {
1026         if (sigint)
1027                 return NFCT_CB_STOP;
1028
1029         synchronize_rcu();
1030         spinlock_lock(&flow_list.lock);
1031
1032         switch (type) {
1033         case NFCT_T_NEW:
1034                 flow_list_new_entry(&flow_list, ct);
1035                 break;
1036         case NFCT_T_UPDATE:
1037                 flow_list_update_entry(&flow_list, ct);
1038                 break;
1039         case NFCT_T_DESTROY:
1040                 flow_list_destroy_entry(&flow_list, ct);
1041                 break;
1042         default:
1043                 break;
1044         }
1045
1046         spinlock_unlock(&flow_list.lock);
1047
1048         return NFCT_CB_CONTINUE;
1049 }
1050
1051 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1052 {
1053         nfct_query(handle, NFCT_Q_FLUSH, &family);
1054 }
1055
1056 static void *collector(void *null __maybe_unused)
1057 {
1058         int ret;
1059         struct nfct_handle *handle;
1060         struct nfct_filter *filter;
1061
1062         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1063                                       NF_NETLINK_CONNTRACK_UPDATE |
1064                                       NF_NETLINK_CONNTRACK_DESTROY);
1065         if (!handle)
1066                 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1067
1068         collector_flush(handle, AF_INET);
1069         collector_flush(handle, AF_INET6);
1070
1071         filter = nfct_filter_create();
1072         if (!filter)
1073                 panic("Cannot create a nfct filter: %s\n", strerror(errno));
1074
1075         ret = nfct_filter_attach(nfct_fd(handle), filter);
1076         if (ret < 0)
1077                 panic("Cannot attach filter to handle: %s\n", strerror(errno));
1078
1079         if (what & INCLUDE_UDP) {
1080                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1081                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1082         }
1083         if (what & INCLUDE_TCP)
1084                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1085         if (what & INCLUDE_DCCP)
1086                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1087         if (what & INCLUDE_SCTP)
1088                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1089         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1090                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1091         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1092                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1093         if (what & INCLUDE_IPV4) {
1094                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1095                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1096         }
1097         if (what & INCLUDE_IPV6) {
1098                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1099                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1100         }
1101
1102         ret = nfct_filter_attach(nfct_fd(handle), filter);
1103         if (ret < 0)
1104                 panic("Cannot attach filter to handle: %s\n", strerror(errno));
1105
1106         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1107         nfct_filter_destroy(filter);
1108         flow_list_init(&flow_list);
1109
1110         condlock_signal(&collector_ready);
1111
1112         rcu_register_thread();
1113
1114         while (!sigint && ret >= 0)
1115                 ret = nfct_catch(handle);
1116
1117         rcu_unregister_thread();
1118
1119         flow_list_destroy(&flow_list);
1120         nfct_close(handle);
1121
1122         pthread_exit(NULL);
1123 }
1124
1125 int main(int argc, char **argv)
1126 {
1127         pthread_t tid;
1128         int ret, c, opt_index, what_cmd = 0;
1129
1130         setfsuid(getuid());
1131         setfsgid(getgid());
1132
1133         while ((c = getopt_long(argc, argv, short_options, long_options,
1134                &opt_index)) != EOF) {
1135                 switch (c) {
1136                 case '4':
1137                         what_cmd |= INCLUDE_IPV4;
1138                         break;
1139                 case '6':
1140                         what_cmd |= INCLUDE_IPV6;
1141                         break;
1142                 case 'T':
1143                         what_cmd |= INCLUDE_TCP;
1144                         break;
1145                 case 'U':
1146                         what_cmd |= INCLUDE_UDP;
1147                         break;
1148                 case 'D':
1149                         what_cmd |= INCLUDE_DCCP;
1150                         break;
1151                 case 'I':
1152                         what_cmd |= INCLUDE_ICMP;
1153                         break;
1154                 case 'S':
1155                         what_cmd |= INCLUDE_SCTP;
1156                         break;
1157                 case 's':
1158                         show_src = 1;
1159                         break;
1160                 case 'u':
1161                         update_geoip();
1162                         die();
1163                         break;
1164                 case 'h':
1165                         help();
1166                         break;
1167                 case 'v':
1168                         version();
1169                         break;
1170                 default:
1171                         break;
1172                 }
1173         }
1174
1175         if (what_cmd > 0)
1176                 what = what_cmd;
1177
1178         rcu_init();
1179
1180         register_signal(SIGINT, signal_handler);
1181         register_signal(SIGQUIT, signal_handler);
1182         register_signal(SIGTERM, signal_handler);
1183         register_signal(SIGHUP, signal_handler);
1184
1185         init_geoip(1);
1186
1187         condlock_init(&collector_ready);
1188
1189         ret = pthread_create(&tid, NULL, collector, NULL);
1190         if (ret < 0)
1191                 panic("Cannot create phthread!\n");
1192
1193         presenter();
1194
1195         condlock_destroy(&collector_ready);
1196
1197         destroy_geoip();
1198
1199         return 0;
1200 }