flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2011 - 2013 Daniel Borkmann.
   4  * Copyright 2011 Emmanuel Roullit.
   5  * Subject to the GPL, version 2.
   6  */
   7
   8 #define _LGPL_SOURCE
   9 #include <stdio.h>
  10 #include <stdint.h>
  11 #include <stdlib.h>
  12 #include <signal.h>
  13 #include <getopt.h>
  14 #include <pthread.h>
  15 #include <signal.h>
  16 #include <netdb.h>
  17 #include <ctype.h>
  18 #include <netinet/in.h>
  19 #include <curses.h>
  20 #include <dirent.h>
  21 #include <sys/stat.h>
  22 #include <sys/fsuid.h>
  23 #include <urcu.h>
  24 #include <libgen.h>
  25 #include <inttypes.h>
  26
  27 #include "die.h"
  28 #include "xmalloc.h"
  29 #include "conntrack.h"
  30 #include "config.h"
  31 #include "str.h"
  32 #include "sig.h"
  33 #include "lookup.h"
  34 #include "geoip.h"
  35 #include "built_in.h"
  36 #include "locking.h"
  37 #include "pkt_buff.h"
  38 #include "screen.h"
  39
  40 struct flow_entry {
  41         uint32_t flow_id, use, status;
  42         uint8_t  l3_proto, l4_proto;
  43         uint32_t ip4_src_addr, ip4_dst_addr;
  44         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  45         uint16_t port_src, port_dst;
  46         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  47         uint64_t counter_pkts, counter_bytes;
  48         uint64_t timestamp_start, timestamp_stop;
  49         char country_src[128], country_dst[128];
  50         char city_src[128], city_dst[128];
  51         char rev_dns_src[256], rev_dns_dst[256];
  52         char cmdline[256];
  53         struct flow_entry *next;
  54         int procnum, inode;
  55 };
  56
  57 struct flow_list {
  58         struct flow_entry *head;
  59         struct spinlock lock;
  60 };
  61
  62 #ifndef ATTR_TIMESTAMP_START
  63 # define ATTR_TIMESTAMP_START 63
  64 #endif
  65 #ifndef ATTR_TIMESTAMP_STOP
  66 # define ATTR_TIMESTAMP_STOP 64
  67 #endif
  68
  69 #define SCROLL_MAX 1000
  70
  71 #define INCLUDE_IPV4    (1 << 0)
  72 #define INCLUDE_IPV6    (1 << 1)
  73 #define INCLUDE_UDP     (1 << 2)
  74 #define INCLUDE_TCP     (1 << 3)
  75 #define INCLUDE_DCCP    (1 << 4)
  76 #define INCLUDE_ICMP    (1 << 5)
  77 #define INCLUDE_SCTP    (1 << 6)
  78
  79 static volatile sig_atomic_t sigint = 0;
  80 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
  81 static struct flow_list flow_list;
  82
  83 static const char *short_options = "vhTUsDIS46u";
  84 static const struct option long_options[] = {
  85         {"ipv4",        no_argument,            NULL, '4'},
  86         {"ipv6",        no_argument,            NULL, '6'},
  87         {"tcp",         no_argument,            NULL, 'T'},
  88         {"udp",         no_argument,            NULL, 'U'},
  89         {"dccp",        no_argument,            NULL, 'D'},
  90         {"icmp",        no_argument,            NULL, 'I'},
  91         {"sctp",        no_argument,            NULL, 'S'},
  92         {"show-src",    no_argument,            NULL, 's'},
  93         {"update",      no_argument,            NULL, 'u'},
  94         {"version",     no_argument,            NULL, 'v'},
  95         {"help",        no_argument,            NULL, 'h'},
  96         {NULL, 0, NULL, 0}
  97 };
  98
  99 static const char *copyright = "Please report bugs to <bugs@netsniff-ng.org>\n"
 100         "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 101         "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 102         "Swiss federal institute of technology (ETH Zurich)\n"
 103         "License: GNU GPL version 2.0\n"
 104         "This is free software: you are free to change and redistribute it.\n"
 105         "There is NO WARRANTY, to the extent permitted by law.\n";
 106
 107 static const char *const l3proto2str[AF_MAX] = {
 108         [AF_INET]                       = "ipv4",
 109         [AF_INET6]                      = "ipv6",
 110 };
 111
 112 static const char *const l4proto2str[IPPROTO_MAX] = {
 113         [IPPROTO_TCP]                   = "tcp",
 114         [IPPROTO_UDP]                   = "udp",
 115         [IPPROTO_UDPLITE]               = "udplite",
 116         [IPPROTO_ICMP]                  = "icmp",
 117         [IPPROTO_ICMPV6]                = "icmpv6",
 118         [IPPROTO_SCTP]                  = "sctp",
 119         [IPPROTO_GRE]                   = "gre",
 120         [IPPROTO_DCCP]                  = "dccp",
 121         [IPPROTO_IGMP]                  = "igmp",
 122         [IPPROTO_IPIP]                  = "ipip",
 123         [IPPROTO_EGP]                   = "egp",
 124         [IPPROTO_PUP]                   = "pup",
 125         [IPPROTO_IDP]                   = "idp",
 126         [IPPROTO_RSVP]                  = "rsvp",
 127         [IPPROTO_IPV6]                  = "ip6tun",
 128         [IPPROTO_ESP]                   = "esp",
 129         [IPPROTO_AH]                    = "ah",
 130         [IPPROTO_PIM]                   = "pim",
 131         [IPPROTO_COMP]                  = "comp",
 132 };
 133
 134 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 135         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 136         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 137         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 138         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 139         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 140         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 141         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 142         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 143         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 144         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 145 };
 146
 147 static const uint8_t tcp_states[] = {
 148         TCP_CONNTRACK_SYN_SENT,
 149         TCP_CONNTRACK_SYN_RECV,
 150         TCP_CONNTRACK_ESTABLISHED,
 151         TCP_CONNTRACK_FIN_WAIT,
 152         TCP_CONNTRACK_CLOSE_WAIT,
 153         TCP_CONNTRACK_LAST_ACK,
 154         TCP_CONNTRACK_TIME_WAIT,
 155         TCP_CONNTRACK_CLOSE,
 156         TCP_CONNTRACK_SYN_SENT2,
 157         TCP_CONNTRACK_NONE,
 158 };
 159
 160 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 161         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 162         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 163         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 164         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 165         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 166         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 167         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 168         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 169         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 170         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 171 };
 172
 173 static const uint8_t dccp_states[] = {
 174         DCCP_CONNTRACK_NONE,
 175         DCCP_CONNTRACK_REQUEST,
 176         DCCP_CONNTRACK_RESPOND,
 177         DCCP_CONNTRACK_PARTOPEN,
 178         DCCP_CONNTRACK_OPEN,
 179         DCCP_CONNTRACK_CLOSEREQ,
 180         DCCP_CONNTRACK_CLOSING,
 181         DCCP_CONNTRACK_TIMEWAIT,
 182         DCCP_CONNTRACK_IGNORE,
 183         DCCP_CONNTRACK_INVALID,
 184 };
 185
 186 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 187         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 188         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 189         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 190         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 191         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 192         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 193         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 194         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 195 };
 196
 197 static const uint8_t sctp_states[] = {
 198         SCTP_CONNTRACK_NONE,
 199         SCTP_CONNTRACK_CLOSED,
 200         SCTP_CONNTRACK_COOKIE_WAIT,
 201         SCTP_CONNTRACK_COOKIE_ECHOED,
 202         SCTP_CONNTRACK_ESTABLISHED,
 203         SCTP_CONNTRACK_SHUTDOWN_SENT,
 204         SCTP_CONNTRACK_SHUTDOWN_RECD,
 205         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 206 };
 207
 208 static const struct nfct_filter_ipv4 filter_ipv4 = {
 209         .addr = __constant_htonl(INADDR_LOOPBACK),
 210         .mask = 0xffffffff,
 211 };
 212
 213 static const struct nfct_filter_ipv6 filter_ipv6 = {
 214         .addr = { 0x0, 0x0, 0x0, 0x1 },
 215         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 216 };
 217
 218 static void signal_handler(int number)
 219 {
 220         switch (number) {
 221         case SIGINT:
 222         case SIGQUIT:
 223         case SIGTERM:
 224                 sigint = 1;
 225                 break;
 226         case SIGHUP:
 227         default:
 228                 break;
 229         }
 230 }
 231
 232 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 233 static void flow_entry_get_extended(struct flow_entry *n);
 234
 235 static void help(void)
 236 {
 237         printf("\nflowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
 238                VERSION_STRING);
 239         puts("http://www.netsniff-ng.org\n\n"
 240              "Usage: flowtop [options]\n"
 241              "Options:\n"
 242              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 243              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 244              "  -T|--tcp               Show only TCP flows (default)\n"
 245              "  -U|--udp               Show only UDP flows\n"
 246              "  -D|--dccp              Show only DCCP flows\n"
 247              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 248              "  -S|--sctp              Show only SCTP flows\n"
 249              "  -s|--show-src          Also show source, not only dest\n"
 250              "  -u|--update            Update GeoIP databases\n"
 251              "  -v|--version           Print version and exit\n"
 252              "  -h|--help              Print this help and exit\n\n"
 253              "Examples:\n"
 254              "  flowtop\n"
 255              "  flowtop -46UTDISs\n\n"
 256              "Note:\n"
 257              "  If netfilter is not running, you can activate it with e.g.:\n"
 258              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 259              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n");
 260         puts(copyright);
 261         die();
 262 }
 263
 264 static void version(void)
 265 {
 266         printf("\nflowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
 267         puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
 268              "http://www.netsniff-ng.org\n\n");
 269         puts(copyright);
 270         die();
 271 }
 272
 273 static inline struct flow_entry *flow_entry_xalloc(void)
 274 {
 275         return xzmalloc(sizeof(struct flow_entry));
 276 }
 277
 278 static inline void flow_entry_xfree(struct flow_entry *n)
 279 {
 280         xfree(n);
 281 }
 282
 283 static inline void flow_list_init(struct flow_list *fl)
 284 {
 285         fl->head = NULL;
 286         spinlock_init(&fl->lock);
 287 }
 288
 289 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 290 {
 291         struct flow_entry *n = flow_entry_xalloc();
 292
 293         flow_entry_from_ct(n, ct);
 294         flow_entry_get_extended(n);
 295
 296         rcu_assign_pointer(n->next, fl->head);
 297         rcu_assign_pointer(fl->head, n);
 298 }
 299
 300 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 301                                             uint32_t id)
 302 {
 303         struct flow_entry *n = rcu_dereference(fl->head);
 304
 305         while (n != NULL) {
 306                 if (n->flow_id == id)
 307                         return n;
 308
 309                 n = rcu_dereference(n->next);
 310         }
 311
 312         return NULL;
 313 }
 314
 315 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 316                                                  uint32_t id)
 317 {
 318         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 319
 320         if (n->flow_id == id)
 321                 return NULL;
 322
 323         while ((tmp = rcu_dereference(n->next)) != NULL) {
 324                 if (tmp->flow_id == id)
 325                         return n;
 326
 327                 n = tmp;
 328         }
 329
 330         return NULL;
 331 }
 332
 333 static void flow_list_update_entry(struct flow_list *fl,
 334                                    struct nf_conntrack *ct)
 335 {
 336         int do_ext = 0;
 337         struct flow_entry *n;
 338
 339         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 340         if (n == NULL) {
 341                 n = flow_entry_xalloc();
 342                 do_ext = 1;
 343         }
 344
 345         flow_entry_from_ct(n, ct);
 346         if (do_ext) {
 347                 flow_entry_get_extended(n);
 348
 349                 rcu_assign_pointer(n->next, fl->head);
 350                 rcu_assign_pointer(fl->head, n);
 351         }
 352 }
 353
 354 static void flow_list_destroy_entry(struct flow_list *fl,
 355                                     struct nf_conntrack *ct)
 356 {
 357         struct flow_entry *n1, *n2;
 358         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 359
 360         n1 = flow_list_find_id(fl, id);
 361         if (n1) {
 362                 n2 = flow_list_find_prev_id(fl, id);
 363                 if (n2) {
 364                         rcu_assign_pointer(n2->next, n1->next);
 365                         n1->next = NULL;
 366
 367                         flow_entry_xfree(n1);
 368                 } else {
 369                         flow_entry_xfree(fl->head);
 370                         fl->head = NULL;
 371                 }
 372         }
 373 }
 374
 375 static void flow_list_destroy(struct flow_list *fl)
 376 {
 377         struct flow_entry *n;
 378
 379         while (fl->head != NULL) {
 380                 n = rcu_dereference(fl->head->next);
 381                 fl->head->next = NULL;
 382
 383                 flow_entry_xfree(fl->head);
 384                 rcu_assign_pointer(fl->head, n);
 385         }
 386
 387         synchronize_rcu();
 388         spinlock_destroy(&fl->lock);
 389 }
 390
 391 static int walk_process(const char *process, struct flow_entry *n)
 392 {
 393         int ret;
 394         DIR *dir;
 395         struct dirent *ent;
 396         char path[1024];
 397
 398         if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
 399                 panic("giant process name! %s\n", process);
 400
 401         dir = opendir(path);
 402         if (!dir)
 403                 return 0;
 404
 405         while ((ent = readdir(dir))) {
 406                 struct stat statbuf;
 407
 408                 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
 409                              process, ent->d_name) < 0)
 410                         continue;
 411
 412                 if (stat(path, &statbuf) < 0)
 413                         continue;
 414
 415                 if (S_ISSOCK(statbuf.st_mode) && (ino_t) n->inode == statbuf.st_ino) {
 416                         memset(n->cmdline, 0, sizeof(n->cmdline));
 417
 418                         snprintf(path, sizeof(path), "/proc/%s/exe", process);
 419
 420                         ret = readlink(path, n->cmdline,
 421                                        sizeof(n->cmdline) - 1);
 422                         if (ret < 0)
 423                                 panic("readlink error: %s\n", strerror(errno));
 424
 425                         n->procnum = atoi(process);
 426                         closedir(dir);
 427                         return 1;
 428                 }
 429         }
 430
 431         closedir(dir);
 432         return 0;
 433 }
 434
 435 static void walk_processes(struct flow_entry *n)
 436 {
 437         int ret;
 438         DIR *dir;
 439         struct dirent *ent;
 440
 441         /* n->inode must be set */
 442         if (n->inode <= 0) {
 443                 memset(n->cmdline, 0, sizeof(n->cmdline));
 444                 return;
 445         }
 446
 447         dir = opendir("/proc");
 448         if (!dir)
 449                 panic("Cannot open /proc!\n");
 450
 451         while ((ent = readdir(dir))) {
 452                 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
 453                         ret = walk_process(ent->d_name, n);
 454                         if (ret > 0)
 455                                 break;
 456                 }
 457         }
 458
 459         closedir(dir);
 460 }
 461
 462 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 463 {
 464         int ret = -ENOENT;
 465         char path[128], buff[1024];
 466         FILE *proc;
 467
 468         memset(path, 0, sizeof(path));
 469         snprintf(path, sizeof(path), "/proc/net/%s%s",
 470                  l4proto2str[proto], is_ip6 ? "6" : "");
 471
 472         proc = fopen(path, "r");
 473         if (!proc)
 474                 return -EIO;
 475
 476         memset(buff, 0, sizeof(buff));
 477
 478         while (fgets(buff, sizeof(buff), proc) != NULL) {
 479                 int inode = 0;
 480                 unsigned int lport = 0;
 481
 482                 buff[sizeof(buff) - 1] = 0;
 483                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 484                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 485                         if ((uint16_t) lport == port) {
 486                                 ret = inode;
 487                                 break;
 488                         }
 489                 }
 490
 491                 memset(buff, 0, sizeof(buff));
 492         }
 493
 494         fclose(proc);
 495         return ret;
 496 }
 497
 498 #define CP_NFCT(elem, attr, x)                          \
 499         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 500 #define CP_NFCT_BUFF(elem, attr) do {                   \
 501         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 502         if (buff != NULL)                               \
 503                 memcpy(n->elem, buff, sizeof(n->elem)); \
 504 } while (0)
 505
 506 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 507 {
 508         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 509         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 510
 511         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 512         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 513
 514         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 515         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 516
 517         CP_NFCT(status, ATTR_STATUS, 32);
 518
 519         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 520         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 521         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 522         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 523
 524         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 525         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 526
 527         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 528         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 529
 530         CP_NFCT(flow_id, ATTR_ID, 32);
 531         CP_NFCT(use, ATTR_USE, 32);
 532
 533         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 534         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 535
 536         n->port_src = ntohs(n->port_src);
 537         n->port_dst = ntohs(n->port_dst);
 538
 539         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 540         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 541 }
 542
 543 enum flow_entry_direction {
 544         flow_entry_src,
 545         flow_entry_dst,
 546 };
 547
 548 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 549 {
 550         /* We don't want to analyze / display DNS itself, since we
 551          * use it to resolve reverse dns.
 552          */
 553         return n->port_src == 53 || n->port_dst == 53;
 554 }
 555
 556 #define SELFLD(dir,src_member,dst_member)       \
 557         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 558
 559 static void flow_entry_get_sain4_obj(struct flow_entry *n,
 560                                      enum flow_entry_direction dir,
 561                                      struct sockaddr_in *sa)
 562 {
 563         memset(sa, 0, sizeof(*sa));
 564         sa->sin_family = PF_INET;
 565         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 566 }
 567
 568 static void flow_entry_get_sain6_obj(struct flow_entry *n,
 569                                      enum flow_entry_direction dir,
 570                                      struct sockaddr_in6 *sa)
 571 {
 572         memset(sa, 0, sizeof(*sa));
 573         sa->sin6_family = PF_INET6;
 574
 575         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 576                sizeof(sa->sin6_addr));
 577 }
 578
 579 static void
 580 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 581                                    enum flow_entry_direction dir)
 582 {
 583         struct sockaddr_in sa4;
 584         struct sockaddr_in6 sa6;
 585         const char *city = NULL;
 586
 587         switch (n->l3_proto) {
 588         default:
 589                 bug();
 590
 591         case AF_INET:
 592                 flow_entry_get_sain4_obj(n, dir, &sa4);
 593                 city = geoip4_city_name(&sa4);
 594                 break;
 595
 596         case AF_INET6:
 597                 flow_entry_get_sain6_obj(n, dir, &sa6);
 598                 city = geoip6_city_name(&sa6);
 599                 break;
 600         }
 601
 602         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 603
 604         if (city) {
 605                 memcpy(SELFLD(dir, city_src, city_dst), city,
 606                        min(sizeof(n->city_src), strlen(city)));
 607         } else {
 608                 memset(SELFLD(dir, city_src, city_dst), 0,
 609                        sizeof(n->city_src));
 610         }
 611 }
 612
 613 static void
 614 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 615                                       enum flow_entry_direction dir)
 616 {
 617         struct sockaddr_in sa4;
 618         struct sockaddr_in6 sa6;
 619         const char *country = NULL;
 620
 621         switch (n->l3_proto) {
 622         default:
 623                 bug();
 624
 625         case AF_INET:
 626                 flow_entry_get_sain4_obj(n, dir, &sa4);
 627                 country = geoip4_country_name(&sa4);
 628                 break;
 629
 630         case AF_INET6:
 631                 flow_entry_get_sain6_obj(n, dir, &sa6);
 632                 country = geoip6_country_name(&sa6);
 633                 break;
 634         }
 635
 636         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 637
 638         if (country) {
 639                 memcpy(SELFLD(dir, country_src, country_dst), country,
 640                        min(sizeof(n->country_src), strlen(country)));
 641         } else {
 642                 memset(SELFLD(dir, country_src, country_dst), 0,
 643                        sizeof(n->country_src));
 644         }
 645 }
 646
 647 static void flow_entry_get_extended_geo(struct flow_entry *n,
 648                                         enum flow_entry_direction dir)
 649 {
 650         flow_entry_geo_city_lookup_generic(n, dir);
 651         flow_entry_geo_country_lookup_generic(n, dir);
 652 }
 653
 654 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 655                                            enum flow_entry_direction dir)
 656 {
 657         size_t sa_len;
 658         struct sockaddr_in sa4;
 659         struct sockaddr_in6 sa6;
 660         struct sockaddr *sa;
 661         struct hostent *hent;
 662
 663         switch (n->l3_proto) {
 664         default:
 665                 bug();
 666
 667         case AF_INET:
 668                 flow_entry_get_sain4_obj(n, dir, &sa4);
 669                 sa = (struct sockaddr *) &sa4;
 670                 sa_len = sizeof(sa4);
 671                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
 672                 break;
 673
 674         case AF_INET6:
 675                 flow_entry_get_sain6_obj(n, dir, &sa6);
 676                 sa = (struct sockaddr *) &sa6;
 677                 sa_len = sizeof(sa6);
 678                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
 679                 break;
 680         }
 681
 682         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 683         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 684                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 685
 686         if (hent) {
 687                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 688                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 689                        hent->h_name, min(sizeof(n->rev_dns_src),
 690                                          strlen(hent->h_name)));
 691         }
 692 }
 693
 694 static void flow_entry_get_extended(struct flow_entry *n)
 695 {
 696         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 697                 return;
 698
 699         flow_entry_get_extended_revdns(n, flow_entry_src);
 700         flow_entry_get_extended_geo(n, flow_entry_src);
 701
 702         flow_entry_get_extended_revdns(n, flow_entry_dst);
 703         flow_entry_get_extended_geo(n, flow_entry_dst);
 704
 705         /* Lookup application */
 706         n->inode = get_port_inode(n->port_src, n->l4_proto,
 707                                   n->l3_proto == AF_INET6);
 708         if (n->inode > 0)
 709                 walk_processes(n);
 710 }
 711
 712 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 713 {
 714         if (src < dst && src < 1024) {
 715                 return src;
 716         } else if (dst < src && dst < 1024) {
 717                 return dst;
 718         } else {
 719                 const char *tmp1, *tmp2;
 720                 if (tcp) {
 721                         tmp1 = lookup_port_tcp(src);
 722                         tmp2 = lookup_port_tcp(dst);
 723                 } else {
 724                         tmp1 = lookup_port_udp(src);
 725                         tmp2 = lookup_port_udp(dst);
 726                 }
 727                 if (tmp1 && !tmp2) {
 728                         return src;
 729                 } else if (!tmp1 && tmp2) {
 730                         return dst;
 731                 } else {
 732                         if (src < dst)
 733                                 return src;
 734                         else
 735                                 return dst;
 736                 }
 737         }
 738 }
 739
 740 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 741                                      unsigned int *line)
 742 {
 743         char tmp[128], *pname = NULL;
 744         uint16_t port;
 745
 746         mvwprintw(screen, *line, 2, "");
 747
 748         /* PID, application name */
 749         if (n->procnum > 0) {
 750                 slprintf(tmp, sizeof(tmp), "%s(%d)", basename(n->cmdline),
 751                          n->procnum);
 752
 753                 printw("[");
 754                 attron(COLOR_PAIR(3));
 755                 printw("%s", tmp);
 756                 attroff(COLOR_PAIR(3));
 757                 printw("]:");
 758         }
 759
 760         /* L3 protocol, L4 protocol, states */
 761         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 762         printw("[");
 763         attron(COLOR_PAIR(3));
 764         switch (n->l4_proto) {
 765         case IPPROTO_TCP:
 766                 printw("%s", tcp_state2str[n->tcp_state]);
 767                 break;
 768         case IPPROTO_SCTP:
 769                 printw("%s", sctp_state2str[n->sctp_state]);
 770                 break;
 771         case IPPROTO_DCCP:
 772                 printw("%s", dccp_state2str[n->dccp_state]);
 773                 break;
 774         case IPPROTO_UDP:
 775         case IPPROTO_UDPLITE:
 776         case IPPROTO_ICMP:
 777         case IPPROTO_ICMPV6:
 778                 printw("NOSTATE");
 779                 break;
 780         }
 781         attroff(COLOR_PAIR(3));
 782         printw("]");
 783
 784         /* Guess application port */
 785         switch (n->l4_proto) {
 786         case IPPROTO_TCP:
 787                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 788                 pname = lookup_port_tcp(port);
 789                 break;
 790         case IPPROTO_UDP:
 791         case IPPROTO_UDPLITE:
 792                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 793                 pname = lookup_port_udp(port);
 794                 break;
 795         }
 796         if (pname) {
 797                 attron(A_BOLD);
 798                 printw(":%s", pname);
 799                 attroff(A_BOLD);
 800         }
 801         printw(" ->");
 802
 803         /* Number packets, bytes */
 804         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 805                 printw(" (%"PRIu64" pkts, %"PRIu64" bytes) ->",
 806                        n->counter_pkts, n->counter_bytes);
 807
 808         /* Show source information: reverse DNS, port, country, city */
 809         if (show_src) {
 810                 attron(COLOR_PAIR(1));
 811                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 812                 attroff(COLOR_PAIR(1));
 813
 814                 printw(":%"PRIu16, n->port_src);
 815
 816                 if (n->country_src[0]) {
 817                         printw(" (");
 818
 819                         attron(COLOR_PAIR(4));
 820                         printw("%s", n->country_src);
 821                         attroff(COLOR_PAIR(4));
 822
 823                         if (n->city_src[0])
 824                                 printw(", %s", n->city_src);
 825
 826                         printw(")");
 827                 }
 828
 829                 printw(" => ");
 830         }
 831
 832         /* Show dest information: reverse DNS, port, country, city */
 833         attron(COLOR_PAIR(2));
 834         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 835         attroff(COLOR_PAIR(2));
 836
 837         printw(":%"PRIu16, n->port_dst);
 838
 839         if (n->country_dst[0]) {
 840                 printw(" (");
 841
 842                 attron(COLOR_PAIR(4));
 843                 printw("%s", n->country_dst);
 844                 attroff(COLOR_PAIR(4));
 845
 846                 if (n->city_dst[0])
 847                         printw(", %s", n->city_dst);
 848
 849                 printw(")");
 850         }
 851 }
 852
 853 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 854 {
 855         int ret = 1;
 856
 857         switch (n->l4_proto) {
 858         case IPPROTO_TCP:
 859                 if (n->tcp_state == state)
 860                         ret = 0;
 861                 break;
 862         case IPPROTO_SCTP:
 863                 if (n->sctp_state == state)
 864                         ret = 0;
 865                 break;
 866         case IPPROTO_DCCP:
 867                 if (n->dccp_state == state)
 868                         ret = 0;
 869                 break;
 870         case IPPROTO_UDP:
 871         case IPPROTO_UDPLITE:
 872         case IPPROTO_ICMP:
 873         case IPPROTO_ICMPV6:
 874                 ret = 0;
 875                 break;
 876         }
 877
 878         return ret;
 879 }
 880
 881 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 882                                     int skip_lines)
 883 {
 884         int maxy;
 885         size_t i, j;
 886         unsigned int line = 3;
 887         struct flow_entry *n;
 888         uint8_t protocols[] = {
 889                 IPPROTO_TCP,
 890                 IPPROTO_DCCP,
 891                 IPPROTO_SCTP,
 892                 IPPROTO_UDP,
 893                 IPPROTO_UDPLITE,
 894                 IPPROTO_ICMP,
 895                 IPPROTO_ICMPV6,
 896         };
 897         size_t protocol_state_size[] = {
 898                 [IPPROTO_TCP] = array_size(tcp_states),
 899                 [IPPROTO_DCCP] = array_size(dccp_states),
 900                 [IPPROTO_SCTP] = array_size(sctp_states),
 901                 [IPPROTO_UDP] = 1,
 902                 [IPPROTO_UDPLITE] = 1,
 903                 [IPPROTO_ICMP] = 1,
 904                 [IPPROTO_ICMPV6] = 1,
 905         };
 906
 907         curs_set(0);
 908
 909         maxy = getmaxy(screen);
 910         maxy -= 6;
 911
 912         start_color();
 913         init_pair(1, COLOR_RED, COLOR_BLACK);
 914         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 915         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 916         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 917
 918         wclear(screen);
 919         clear();
 920
 921         mvwprintw(screen, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
 922                   "[+%d]", what & INCLUDE_TCP ? "TCP, " : "" ,
 923                   what & INCLUDE_UDP ? "UDP, " : "",
 924                   what & INCLUDE_SCTP ? "SCTP, " : "",
 925                   what & INCLUDE_DCCP ? "DCCP, " : "",
 926                   what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
 927                   what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
 928                   skip_lines);
 929
 930         rcu_read_lock();
 931
 932         if (rcu_dereference(fl->head) == NULL)
 933                 mvwprintw(screen, line, 2, "(No active sessions! "
 934                           "Is netfilter running?)");
 935
 936         for (i = 0; i < array_size(protocols); i++) {
 937                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 938                         n = rcu_dereference(fl->head);
 939                         while (n && maxy > 0) {
 940                                 int skip_entry = 0;
 941
 942                                 if (n->l4_proto != protocols[i])
 943                                         skip_entry = 1;
 944                                 if (presenter_flow_wrong_state(n, j))
 945                                         skip_entry = 1;
 946                                 if (presenter_get_port(n->port_src,
 947                                                        n->port_dst, 0) == 53)
 948                                         skip_entry = 1;
 949                                 if (skip_entry) {
 950                                         n = rcu_dereference(n->next);
 951                                         continue;
 952                                 }
 953                                 if (skip_lines > 0) {
 954                                         n = rcu_dereference(n->next);
 955                                         skip_lines--;
 956                                         continue;
 957                                 }
 958
 959                                 presenter_screen_do_line(screen, n, &line);
 960
 961                                 line++;
 962                                 maxy -= (2 + 1 * show_src);
 963                                 n = rcu_dereference(n->next);
 964                         }
 965                 }
 966         }
 967
 968         rcu_read_unlock();
 969
 970         wrefresh(screen);
 971         refresh();
 972 }
 973
 974 static void presenter(void)
 975 {
 976         int skip_lines = 0;
 977         WINDOW *screen;
 978
 979         lookup_init_ports(PORTS_TCP);
 980         lookup_init_ports(PORTS_UDP);
 981         screen = screen_init(false);
 982
 983         rcu_register_thread();
 984         while (!sigint) {
 985                 switch (getch()) {
 986                 case 'q':
 987                         sigint = 1;
 988                         break;
 989                 case KEY_UP:
 990                 case 'u':
 991                 case 'k':
 992                         skip_lines--;
 993                         if (skip_lines < 0)
 994                                 skip_lines = 0;
 995                         break;
 996                 case KEY_DOWN:
 997                 case 'd':
 998                 case 'j':
 999                         skip_lines++;
1000                         if (skip_lines > SCROLL_MAX)
1001                                 skip_lines = SCROLL_MAX;
1002                         break;
1003                 default:
1004                         fflush(stdin);
1005                         break;
1006                 }
1007
1008                 presenter_screen_update(screen, &flow_list, skip_lines);
1009                 usleep(100000);
1010         }
1011         rcu_unregister_thread();
1012
1013         screen_end();
1014         lookup_cleanup_ports(PORTS_UDP);
1015         lookup_cleanup_ports(PORTS_TCP);
1016 }
1017
1018 static int collector_cb(enum nf_conntrack_msg_type type,
1019                         struct nf_conntrack *ct, void *data __maybe_unused)
1020 {
1021         if (sigint)
1022                 return NFCT_CB_STOP;
1023
1024         synchronize_rcu();
1025         spinlock_lock(&flow_list.lock);
1026
1027         switch (type) {
1028         case NFCT_T_NEW:
1029                 flow_list_new_entry(&flow_list, ct);
1030                 break;
1031         case NFCT_T_UPDATE:
1032                 flow_list_update_entry(&flow_list, ct);
1033                 break;
1034         case NFCT_T_DESTROY:
1035                 flow_list_destroy_entry(&flow_list, ct);
1036                 break;
1037         default:
1038                 break;
1039         }
1040
1041         spinlock_unlock(&flow_list.lock);
1042
1043         return NFCT_CB_CONTINUE;
1044 }
1045
1046 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1047 {
1048         nfct_query(handle, NFCT_Q_FLUSH, &family);
1049 }
1050
1051 static void *collector(void *null __maybe_unused)
1052 {
1053         int ret;
1054         struct nfct_handle *handle;
1055         struct nfct_filter *filter;
1056
1057         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1058                                       NF_NETLINK_CONNTRACK_UPDATE |
1059                                       NF_NETLINK_CONNTRACK_DESTROY);
1060         if (!handle)
1061                 panic("Cannot create a nfct handle!\n");
1062
1063         collector_flush(handle, AF_INET);
1064         collector_flush(handle, AF_INET6);
1065
1066         filter = nfct_filter_create();
1067         if (!filter)
1068                 panic("Cannot create a nfct filter!\n");
1069
1070         ret = nfct_filter_attach(nfct_fd(handle), filter);
1071         if (ret < 0)
1072                 panic("Cannot attach filter to handle!\n");
1073
1074         if (what & INCLUDE_UDP) {
1075                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1076                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1077         }
1078         if (what & INCLUDE_TCP)
1079                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1080         if (what & INCLUDE_DCCP)
1081                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1082         if (what & INCLUDE_SCTP)
1083                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1084         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1085                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1086         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1087                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1088         if (what & INCLUDE_IPV4) {
1089                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1090                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1091         }
1092         if (what & INCLUDE_IPV6) {
1093                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1094                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1095         }
1096
1097         ret = nfct_filter_attach(nfct_fd(handle), filter);
1098         if (ret < 0)
1099                 panic("Cannot attach filter to handle!\n");
1100
1101         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1102         nfct_filter_destroy(filter);
1103         flow_list_init(&flow_list);
1104
1105         rcu_register_thread();
1106
1107         while (!sigint && ret >= 0)
1108                 ret = nfct_catch(handle);
1109
1110         rcu_unregister_thread();
1111
1112         flow_list_destroy(&flow_list);
1113         nfct_close(handle);
1114
1115         pthread_exit(NULL);
1116 }
1117
1118 int main(int argc, char **argv)
1119 {
1120         pthread_t tid;
1121         int ret, c, opt_index, what_cmd = 0;
1122
1123         setfsuid(getuid());
1124         setfsgid(getgid());
1125
1126         while ((c = getopt_long(argc, argv, short_options, long_options,
1127                &opt_index)) != EOF) {
1128                 switch (c) {
1129                 case '4':
1130                         what_cmd |= INCLUDE_IPV4;
1131                         break;
1132                 case '6':
1133                         what_cmd |= INCLUDE_IPV6;
1134                         break;
1135                 case 'T':
1136                         what_cmd |= INCLUDE_TCP;
1137                         break;
1138                 case 'U':
1139                         what_cmd |= INCLUDE_UDP;
1140                         break;
1141                 case 'D':
1142                         what_cmd |= INCLUDE_DCCP;
1143                         break;
1144                 case 'I':
1145                         what_cmd |= INCLUDE_ICMP;
1146                         break;
1147                 case 'S':
1148                         what_cmd |= INCLUDE_SCTP;
1149                         break;
1150                 case 's':
1151                         show_src = 1;
1152                         break;
1153                 case 'u':
1154                         update_geoip();
1155                         die();
1156                         break;
1157                 case 'h':
1158                         help();
1159                         break;
1160                 case 'v':
1161                         version();
1162                         break;
1163                 default:
1164                         break;
1165                 }
1166         }
1167
1168         if (what_cmd > 0)
1169                 what = what_cmd;
1170
1171         rcu_init();
1172
1173         register_signal(SIGINT, signal_handler);
1174         register_signal(SIGQUIT, signal_handler);
1175         register_signal(SIGTERM, signal_handler);
1176         register_signal(SIGHUP, signal_handler);
1177
1178         init_geoip(1);
1179
1180         ret = pthread_create(&tid, NULL, collector, NULL);
1181         if (ret < 0)
1182                 panic("Cannot create phthread!\n");
1183
1184         presenter();
1185
1186         destroy_geoip();
1187
1188         return 0;
1189 }