build: Add Makefile target for Coverity scanner
[netsniff-ng.git] / flowtop.c
blobd0b9a807f4f5da6c196511d87f0b81ba0f8ccc06
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2011 - 2013 Daniel Borkmann.
4 * Copyright 2011 Emmanuel Roullit.
5 * Subject to the GPL, version 2.
6 */
8 #define _LGPL_SOURCE
9 #include <stdio.h>
10 #include <stdint.h>
11 #include <stdlib.h>
12 #include <signal.h>
13 #include <getopt.h>
14 #include <pthread.h>
15 #include <signal.h>
16 #include <netdb.h>
17 #include <ctype.h>
18 #include <netinet/in.h>
19 #include <curses.h>
20 #include <dirent.h>
21 #include <sys/stat.h>
22 #include <sys/fsuid.h>
23 #include <urcu.h>
24 #include <libgen.h>
26 #include "die.h"
27 #include "xmalloc.h"
28 #include "conntrack.h"
29 #include "ioops.h"
30 #include "config.h"
31 #include "str.h"
32 #include "sig.h"
33 #include "geoip.h"
34 #include "built_in.h"
35 #include "locking.h"
36 #include "dissector_eth.h"
37 #include "pkt_buff.h"
38 #include "screen.h"
40 struct flow_entry {
41 uint32_t flow_id, use, status;
42 uint8_t l3_proto, l4_proto;
43 uint32_t ip4_src_addr, ip4_dst_addr;
44 uint32_t ip6_src_addr[4], ip6_dst_addr[4];
45 uint16_t port_src, port_dst;
46 uint8_t tcp_state, tcp_flags, sctp_state, dccp_state;
47 uint64_t counter_pkts, counter_bytes;
48 uint64_t timestamp_start, timestamp_stop;
49 char country_src[128], country_dst[128];
50 char city_src[128], city_dst[128];
51 char rev_dns_src[256], rev_dns_dst[256];
52 char cmdline[256];
53 struct flow_entry *next;
54 int procnum, inode;
57 struct flow_list {
58 struct flow_entry *head;
59 struct spinlock lock;
62 #ifndef ATTR_TIMESTAMP_START
63 # define ATTR_TIMESTAMP_START 63
64 #endif
65 #ifndef ATTR_TIMESTAMP_STOP
66 # define ATTR_TIMESTAMP_STOP 64
67 #endif
69 #define SCROLL_MAX 1000
71 #define INCLUDE_IPV4 (1 << 0)
72 #define INCLUDE_IPV6 (1 << 1)
73 #define INCLUDE_UDP (1 << 2)
74 #define INCLUDE_TCP (1 << 3)
75 #define INCLUDE_DCCP (1 << 4)
76 #define INCLUDE_ICMP (1 << 5)
77 #define INCLUDE_SCTP (1 << 6)
79 static volatile sig_atomic_t sigint = 0;
80 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
81 static struct flow_list flow_list;
83 static const char *short_options = "vhTUsDIS46u";
84 static const struct option long_options[] = {
85 {"ipv4", no_argument, NULL, '4'},
86 {"ipv6", no_argument, NULL, '6'},
87 {"tcp", no_argument, NULL, 'T'},
88 {"udp", no_argument, NULL, 'U'},
89 {"dccp", no_argument, NULL, 'D'},
90 {"icmp", no_argument, NULL, 'I'},
91 {"sctp", no_argument, NULL, 'S'},
92 {"show-src", no_argument, NULL, 's'},
93 {"update", no_argument, NULL, 'u'},
94 {"version", no_argument, NULL, 'v'},
95 {"help", no_argument, NULL, 'h'},
96 {NULL, 0, NULL, 0}
99 static const char *const l3proto2str[AF_MAX] = {
100 [AF_INET] = "ipv4",
101 [AF_INET6] = "ipv6",
104 static const char *const l4proto2str[IPPROTO_MAX] = {
105 [IPPROTO_TCP] = "tcp",
106 [IPPROTO_UDP] = "udp",
107 [IPPROTO_UDPLITE] = "udplite",
108 [IPPROTO_ICMP] = "icmp",
109 [IPPROTO_ICMPV6] = "icmpv6",
110 [IPPROTO_SCTP] = "sctp",
111 [IPPROTO_GRE] = "gre",
112 [IPPROTO_DCCP] = "dccp",
113 [IPPROTO_IGMP] = "igmp",
114 [IPPROTO_IPIP] = "ipip",
115 [IPPROTO_EGP] = "egp",
116 [IPPROTO_PUP] = "pup",
117 [IPPROTO_IDP] = "idp",
118 [IPPROTO_RSVP] = "rsvp",
119 [IPPROTO_IPV6] = "ip6tun",
120 [IPPROTO_ESP] = "esp",
121 [IPPROTO_AH] = "ah",
122 [IPPROTO_PIM] = "pim",
123 [IPPROTO_COMP] = "comp",
126 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
127 [TCP_CONNTRACK_NONE] = "NOSTATE",
128 [TCP_CONNTRACK_SYN_SENT] = "SYN_SENT",
129 [TCP_CONNTRACK_SYN_RECV] = "SYN_RECV",
130 [TCP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
131 [TCP_CONNTRACK_FIN_WAIT] = "FIN_WAIT",
132 [TCP_CONNTRACK_CLOSE_WAIT] = "CLOSE_WAIT",
133 [TCP_CONNTRACK_LAST_ACK] = "LAST_ACK",
134 [TCP_CONNTRACK_TIME_WAIT] = "TIME_WAIT",
135 [TCP_CONNTRACK_CLOSE] = "CLOSE",
136 [TCP_CONNTRACK_SYN_SENT2] = "SYN_SENT2",
139 static const uint8_t tcp_states[] = {
140 TCP_CONNTRACK_SYN_SENT,
141 TCP_CONNTRACK_SYN_RECV,
142 TCP_CONNTRACK_ESTABLISHED,
143 TCP_CONNTRACK_FIN_WAIT,
144 TCP_CONNTRACK_CLOSE_WAIT,
145 TCP_CONNTRACK_LAST_ACK,
146 TCP_CONNTRACK_TIME_WAIT,
147 TCP_CONNTRACK_CLOSE,
148 TCP_CONNTRACK_SYN_SENT2,
149 TCP_CONNTRACK_NONE,
152 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
153 [DCCP_CONNTRACK_NONE] = "NOSTATE",
154 [DCCP_CONNTRACK_REQUEST] = "REQUEST",
155 [DCCP_CONNTRACK_RESPOND] = "RESPOND",
156 [DCCP_CONNTRACK_PARTOPEN] = "PARTOPEN",
157 [DCCP_CONNTRACK_OPEN] = "OPEN",
158 [DCCP_CONNTRACK_CLOSEREQ] = "CLOSEREQ",
159 [DCCP_CONNTRACK_CLOSING] = "CLOSING",
160 [DCCP_CONNTRACK_TIMEWAIT] = "TIMEWAIT",
161 [DCCP_CONNTRACK_IGNORE] = "IGNORE",
162 [DCCP_CONNTRACK_INVALID] = "INVALID",
165 static const uint8_t dccp_states[] = {
166 DCCP_CONNTRACK_NONE,
167 DCCP_CONNTRACK_REQUEST,
168 DCCP_CONNTRACK_RESPOND,
169 DCCP_CONNTRACK_PARTOPEN,
170 DCCP_CONNTRACK_OPEN,
171 DCCP_CONNTRACK_CLOSEREQ,
172 DCCP_CONNTRACK_CLOSING,
173 DCCP_CONNTRACK_TIMEWAIT,
174 DCCP_CONNTRACK_IGNORE,
175 DCCP_CONNTRACK_INVALID,
178 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
179 [SCTP_CONNTRACK_NONE] = "NOSTATE",
180 [SCTP_CONNTRACK_CLOSED] = "CLOSED",
181 [SCTP_CONNTRACK_COOKIE_WAIT] = "COOKIE_WAIT",
182 [SCTP_CONNTRACK_COOKIE_ECHOED] = "COOKIE_ECHOED",
183 [SCTP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
184 [SCTP_CONNTRACK_SHUTDOWN_SENT] = "SHUTDOWN_SENT",
185 [SCTP_CONNTRACK_SHUTDOWN_RECD] = "SHUTDOWN_RECD",
186 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
189 static const uint8_t sctp_states[] = {
190 SCTP_CONNTRACK_NONE,
191 SCTP_CONNTRACK_CLOSED,
192 SCTP_CONNTRACK_COOKIE_WAIT,
193 SCTP_CONNTRACK_COOKIE_ECHOED,
194 SCTP_CONNTRACK_ESTABLISHED,
195 SCTP_CONNTRACK_SHUTDOWN_SENT,
196 SCTP_CONNTRACK_SHUTDOWN_RECD,
197 SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
200 static const struct nfct_filter_ipv4 filter_ipv4 = {
201 .addr = __constant_htonl(INADDR_LOOPBACK),
202 .mask = 0xffffffff,
205 static const struct nfct_filter_ipv6 filter_ipv6 = {
206 .addr = { 0x0, 0x0, 0x0, 0x1 },
207 .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
210 static void signal_handler(int number)
212 switch (number) {
213 case SIGINT:
214 sigint = 1;
215 break;
216 case SIGHUP:
217 default:
218 break;
222 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
223 static void flow_entry_get_extended(struct flow_entry *n);
225 static void help(void)
227 printf("\nflowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
228 VERSION_STRING);
229 puts("http://www.netsniff-ng.org\n\n"
230 "Usage: flowtop [options]\n"
231 "Options:\n"
232 " -4|--ipv4 Show only IPv4 flows (default)\n"
233 " -6|--ipv6 Show only IPv6 flows (default)\n"
234 " -T|--tcp Show only TCP flows (default)\n"
235 " -U|--udp Show only UDP flows\n"
236 " -D|--dccp Show only DCCP flows\n"
237 " -I|--icmp Show only ICMP/ICMPv6 flows\n"
238 " -S|--sctp Show only SCTP flows\n"
239 " -s|--show-src Also show source, not only dest\n"
240 " -u|--update Update GeoIP databases\n"
241 " -v|--version Print version and exit\n"
242 " -h|--help Print this help and exit\n\n"
243 "Examples:\n"
244 " flowtop\n"
245 " flowtop -46UTDISs\n\n"
246 "Note:\n"
247 " If netfilter is not running, you can activate it with e.g.:\n"
248 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
249 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
250 "Please report bugs to <bugs@netsniff-ng.org>\n"
251 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
252 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
253 "Swiss federal institute of technology (ETH Zurich)\n"
254 "License: GNU GPL version 2.0\n"
255 "This is free software: you are free to change and redistribute it.\n"
256 "There is NO WARRANTY, to the extent permitted by law.\n");
257 die();
260 static void version(void)
262 printf("\nflowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
263 puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
264 "http://www.netsniff-ng.org\n\n"
265 "Please report bugs to <bugs@netsniff-ng.org>\n"
266 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
267 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
268 "Swiss federal institute of technology (ETH Zurich)\n"
269 "License: GNU GPL version 2.0\n"
270 "This is free software: you are free to change and redistribute it.\n"
271 "There is NO WARRANTY, to the extent permitted by law.\n");
272 die();
275 static inline struct flow_entry *flow_entry_xalloc(void)
277 return xzmalloc(sizeof(struct flow_entry));
280 static inline void flow_entry_xfree(struct flow_entry *n)
282 xfree(n);
285 static inline void flow_list_init(struct flow_list *fl)
287 fl->head = NULL;
288 spinlock_init(&fl->lock);
291 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
293 struct flow_entry *n = flow_entry_xalloc();
295 flow_entry_from_ct(n, ct);
296 flow_entry_get_extended(n);
298 rcu_assign_pointer(n->next, fl->head);
299 rcu_assign_pointer(fl->head, n);
302 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
303 uint32_t id)
305 struct flow_entry *n = rcu_dereference(fl->head);
307 while (n != NULL) {
308 if (n->flow_id == id)
309 return n;
311 n = rcu_dereference(n->next);
314 return NULL;
317 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
318 uint32_t id)
320 struct flow_entry *n = rcu_dereference(fl->head), *tmp;
322 if (n->flow_id == id)
323 return NULL;
325 while ((tmp = rcu_dereference(n->next)) != NULL) {
326 if (tmp->flow_id == id)
327 return n;
329 n = tmp;
332 return NULL;
335 static void flow_list_update_entry(struct flow_list *fl,
336 struct nf_conntrack *ct)
338 int do_ext = 0;
339 struct flow_entry *n;
341 n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
342 if (n == NULL) {
343 n = flow_entry_xalloc();
344 do_ext = 1;
347 flow_entry_from_ct(n, ct);
348 if (do_ext) {
349 flow_entry_get_extended(n);
351 rcu_assign_pointer(n->next, fl->head);
352 rcu_assign_pointer(fl->head, n);
356 static void flow_list_destroy_entry(struct flow_list *fl,
357 struct nf_conntrack *ct)
359 struct flow_entry *n1, *n2;
360 uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
362 n1 = flow_list_find_id(fl, id);
363 if (n1) {
364 n2 = flow_list_find_prev_id(fl, id);
365 if (n2) {
366 rcu_assign_pointer(n2->next, n1->next);
367 n1->next = NULL;
369 flow_entry_xfree(n1);
370 } else {
371 flow_entry_xfree(fl->head);
372 fl->head = NULL;
377 static void flow_list_destroy(struct flow_list *fl)
379 struct flow_entry *n;
381 while (fl->head != NULL) {
382 n = rcu_dereference(fl->head->next);
383 fl->head->next = NULL;
385 flow_entry_xfree(fl->head);
386 rcu_assign_pointer(fl->head, n);
389 synchronize_rcu();
390 spinlock_destroy(&fl->lock);
393 static int walk_process(char *process, struct flow_entry *n)
395 int ret;
396 DIR *dir;
397 struct dirent *ent;
398 char path[1024];
400 if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
401 panic("giant process name! %s\n", process);
403 dir = opendir(path);
404 if (!dir)
405 return 0;
407 while ((ent = readdir(dir))) {
408 struct stat statbuf;
410 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
411 process, ent->d_name) < 0)
412 continue;
414 if (stat(path, &statbuf) < 0)
415 continue;
417 if (S_ISSOCK(statbuf.st_mode) && (ino_t) n->inode == statbuf.st_ino) {
418 memset(n->cmdline, 0, sizeof(n->cmdline));
420 snprintf(path, sizeof(path), "/proc/%s/exe", process);
422 ret = readlink(path, n->cmdline,
423 sizeof(n->cmdline) - 1);
424 if (ret < 0)
425 panic("readlink error: %s\n", strerror(errno));
427 n->procnum = atoi(process);
428 closedir(dir);
429 return 1;
433 closedir(dir);
434 return 0;
437 static void walk_processes(struct flow_entry *n)
439 int ret;
440 DIR *dir;
441 struct dirent *ent;
443 /* n->inode must be set */
444 if (n->inode <= 0) {
445 memset(n->cmdline, 0, sizeof(n->cmdline));
446 return;
449 dir = opendir("/proc");
450 if (!dir)
451 panic("Cannot open /proc!\n");
453 while ((ent = readdir(dir))) {
454 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
455 ret = walk_process(ent->d_name, n);
456 if (ret > 0)
457 break;
461 closedir(dir);
464 static int get_port_inode(uint16_t port, int proto, int is_ip6)
466 int ret = -ENOENT;
467 char path[128], buff[1024];
468 FILE *proc;
470 memset(path, 0, sizeof(path));
471 snprintf(path, sizeof(path), "/proc/net/%s%s",
472 l4proto2str[proto], is_ip6 ? "6" : "");
474 proc = fopen(path, "r");
475 if (!proc)
476 return -EIO;
478 memset(buff, 0, sizeof(buff));
480 while (fgets(buff, sizeof(buff), proc) != NULL) {
481 int inode = 0;
482 unsigned int lport = 0;
484 buff[sizeof(buff) - 1] = 0;
485 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
486 "%*X %*u %*u %u", &lport, &inode) == 2) {
487 if ((uint16_t) lport == port) {
488 ret = inode;
489 break;
493 memset(buff, 0, sizeof(buff));
496 fclose(proc);
497 return ret;
500 #define CP_NFCT(elem, attr, x) \
501 do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
502 #define CP_NFCT_BUFF(elem, attr) do { \
503 const uint8_t *buff = nfct_get_attr(ct,(attr)); \
504 if (buff != NULL) \
505 memcpy(n->elem, buff, sizeof(n->elem)); \
506 } while (0)
508 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
510 CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
511 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
513 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
514 CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
516 CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
517 CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
519 CP_NFCT(status, ATTR_STATUS, 32);
521 CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
522 CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
523 CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
524 CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
526 CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
527 CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
529 CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
530 CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
532 CP_NFCT(flow_id, ATTR_ID, 32);
533 CP_NFCT(use, ATTR_USE, 32);
535 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
536 CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
538 n->port_src = ntohs(n->port_src);
539 n->port_dst = ntohs(n->port_dst);
541 n->ip4_src_addr = ntohl(n->ip4_src_addr);
542 n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
545 enum flow_entry_direction {
546 flow_entry_src,
547 flow_entry_dst,
550 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
552 /* We don't want to analyze / display DNS itself, since we
553 * use it to resolve reverse dns.
555 return n->port_src == 53 || n->port_dst == 53;
558 #define SELFLD(dir,src_member,dst_member) \
559 (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
561 static void flow_entry_get_sain4_obj(struct flow_entry *n,
562 enum flow_entry_direction dir,
563 struct sockaddr_in *sa)
565 memset(sa, 0, sizeof(*sa));
566 sa->sin_family = PF_INET;
567 sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
570 static void flow_entry_get_sain6_obj(struct flow_entry *n,
571 enum flow_entry_direction dir,
572 struct sockaddr_in6 *sa)
574 memset(sa, 0, sizeof(*sa));
575 sa->sin6_family = PF_INET6;
577 memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
578 sizeof(sa->sin6_addr));
581 static void
582 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
583 enum flow_entry_direction dir)
585 struct sockaddr_in sa4;
586 struct sockaddr_in6 sa6;
587 const char *city = NULL;
589 switch (n->l3_proto) {
590 default:
591 bug();
593 case AF_INET:
594 flow_entry_get_sain4_obj(n, dir, &sa4);
595 city = geoip4_city_name(sa4);
596 break;
598 case AF_INET6:
599 flow_entry_get_sain6_obj(n, dir, &sa6);
600 city = geoip6_city_name(sa6);
601 break;
604 bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
606 if (city) {
607 memcpy(SELFLD(dir, city_src, city_dst), city,
608 min(sizeof(n->city_src), strlen(city)));
609 } else {
610 memset(SELFLD(dir, city_src, city_dst), 0,
611 sizeof(n->city_src));
615 static void
616 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
617 enum flow_entry_direction dir)
619 struct sockaddr_in sa4;
620 struct sockaddr_in6 sa6;
621 const char *country = NULL;
623 switch (n->l3_proto) {
624 default:
625 bug();
627 case AF_INET:
628 flow_entry_get_sain4_obj(n, dir, &sa4);
629 country = geoip4_country_name(sa4);
630 break;
632 case AF_INET6:
633 flow_entry_get_sain6_obj(n, dir, &sa6);
634 country = geoip6_country_name(sa6);
635 break;
638 bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
640 if (country) {
641 memcpy(SELFLD(dir, country_src, country_dst), country,
642 min(sizeof(n->country_src), strlen(country)));
643 } else {
644 memset(SELFLD(dir, country_src, country_dst), 0,
645 sizeof(n->country_src));
649 static void flow_entry_get_extended_geo(struct flow_entry *n,
650 enum flow_entry_direction dir)
652 flow_entry_geo_city_lookup_generic(n, dir);
653 flow_entry_geo_country_lookup_generic(n, dir);
656 static void flow_entry_get_extended_revdns(struct flow_entry *n,
657 enum flow_entry_direction dir)
659 size_t sa_len;
660 struct sockaddr_in sa4;
661 struct sockaddr_in6 sa6;
662 struct sockaddr *sa;
663 struct hostent *hent;
665 switch (n->l3_proto) {
666 default:
667 bug();
669 case AF_INET:
670 flow_entry_get_sain4_obj(n, dir, &sa4);
671 sa = (struct sockaddr *) &sa4;
672 sa_len = sizeof(sa4);
673 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
674 break;
676 case AF_INET6:
677 flow_entry_get_sain6_obj(n, dir, &sa6);
678 sa = (struct sockaddr *) &sa6;
679 sa_len = sizeof(sa6);
680 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
681 break;
684 bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
685 getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
686 sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
688 if (hent) {
689 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
690 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
691 hent->h_name, min(sizeof(n->rev_dns_src),
692 strlen(hent->h_name)));
696 static void flow_entry_get_extended(struct flow_entry *n)
698 if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
699 return;
701 flow_entry_get_extended_revdns(n, flow_entry_src);
702 flow_entry_get_extended_geo(n, flow_entry_src);
704 flow_entry_get_extended_revdns(n, flow_entry_dst);
705 flow_entry_get_extended_geo(n, flow_entry_dst);
707 /* Lookup application */
708 n->inode = get_port_inode(n->port_src, n->l4_proto,
709 n->l3_proto == AF_INET6);
710 if (n->inode > 0)
711 walk_processes(n);
714 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
716 if (src < dst && src < 1024) {
717 return src;
718 } else if (dst < src && dst < 1024) {
719 return dst;
720 } else {
721 const char *tmp1, *tmp2;
722 if (tcp) {
723 tmp1 = lookup_port_tcp(src);
724 tmp2 = lookup_port_tcp(dst);
725 } else {
726 tmp1 = lookup_port_udp(src);
727 tmp2 = lookup_port_udp(dst);
729 if (tmp1 && !tmp2) {
730 return src;
731 } else if (!tmp1 && tmp2) {
732 return dst;
733 } else {
734 if (src < dst)
735 return src;
736 else
737 return dst;
742 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
743 unsigned int *line)
745 char tmp[128], *pname = NULL;
746 uint16_t port;
748 mvwprintw(screen, *line, 2, "");
750 /* PID, application name */
751 if (n->procnum > 0) {
752 slprintf(tmp, sizeof(tmp), "%s(%u)", basename(n->cmdline),
753 n->procnum);
755 printw("[");
756 attron(COLOR_PAIR(3));
757 printw("%s", tmp);
758 attroff(COLOR_PAIR(3));
759 printw("]:");
762 /* L3 protocol, L4 protocol, states */
763 printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
764 printw("[");
765 attron(COLOR_PAIR(3));
766 switch (n->l4_proto) {
767 case IPPROTO_TCP:
768 printw("%s", tcp_state2str[n->tcp_state]);
769 break;
770 case IPPROTO_SCTP:
771 printw("%s", sctp_state2str[n->sctp_state]);
772 break;
773 case IPPROTO_DCCP:
774 printw("%s", dccp_state2str[n->dccp_state]);
775 break;
776 case IPPROTO_UDP:
777 case IPPROTO_UDPLITE:
778 case IPPROTO_ICMP:
779 case IPPROTO_ICMPV6:
780 printw("NOSTATE");
781 break;
783 attroff(COLOR_PAIR(3));
784 printw("]");
786 /* Guess application port */
787 switch (n->l4_proto) {
788 case IPPROTO_TCP:
789 port = presenter_get_port(n->port_src, n->port_dst, 1);
790 pname = lookup_port_tcp(port);
791 break;
792 case IPPROTO_UDP:
793 case IPPROTO_UDPLITE:
794 port = presenter_get_port(n->port_src, n->port_dst, 0);
795 pname = lookup_port_udp(port);
796 break;
798 if (pname) {
799 attron(A_BOLD);
800 printw(":%s", pname);
801 attroff(A_BOLD);
803 printw(" ->");
805 /* Number packets, bytes */
806 if (n->counter_pkts > 0 && n->counter_bytes > 0)
807 printw(" (%llu pkts, %llu bytes) ->",
808 n->counter_pkts, n->counter_bytes);
810 /* Show source information: reverse DNS, port, country, city */
811 if (show_src) {
812 attron(COLOR_PAIR(1));
813 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
814 attroff(COLOR_PAIR(1));
816 printw(":%u", n->port_src);
818 if (n->country_src[0]) {
819 printw(" (");
821 attron(COLOR_PAIR(4));
822 printw("%s", n->country_src);
823 attroff(COLOR_PAIR(4));
825 if (n->city_src[0])
826 printw(", %s", n->city_src);
828 printw(")");
831 printw(" => ");
834 /* Show dest information: reverse DNS, port, country, city */
835 attron(COLOR_PAIR(2));
836 mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
837 attroff(COLOR_PAIR(2));
839 printw(":%u", n->port_dst);
841 if (n->country_dst[0]) {
842 printw(" (");
844 attron(COLOR_PAIR(4));
845 printw("%s", n->country_dst);
846 attroff(COLOR_PAIR(4));
848 if (n->city_dst[0])
849 printw(", %s", n->city_dst);
851 printw(")");
855 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
857 int ret = 1;
859 switch (n->l4_proto) {
860 case IPPROTO_TCP:
861 if (n->tcp_state == state)
862 ret = 0;
863 break;
864 case IPPROTO_SCTP:
865 if (n->sctp_state == state)
866 ret = 0;
867 break;
868 case IPPROTO_DCCP:
869 if (n->dccp_state == state)
870 ret = 0;
871 break;
872 case IPPROTO_UDP:
873 case IPPROTO_UDPLITE:
874 case IPPROTO_ICMP:
875 case IPPROTO_ICMPV6:
876 ret = 0;
877 break;
880 return ret;
883 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
884 int skip_lines)
886 int maxy;
887 size_t i, j;
888 unsigned int line = 3;
889 struct flow_entry *n;
890 uint8_t protocols[] = {
891 IPPROTO_TCP,
892 IPPROTO_DCCP,
893 IPPROTO_SCTP,
894 IPPROTO_UDP,
895 IPPROTO_UDPLITE,
896 IPPROTO_ICMP,
897 IPPROTO_ICMPV6,
899 size_t protocol_state_size[] = {
900 [IPPROTO_TCP] = array_size(tcp_states),
901 [IPPROTO_DCCP] = array_size(dccp_states),
902 [IPPROTO_SCTP] = array_size(sctp_states),
903 [IPPROTO_UDP] = 1,
904 [IPPROTO_UDPLITE] = 1,
905 [IPPROTO_ICMP] = 1,
906 [IPPROTO_ICMPV6] = 1,
909 curs_set(0);
911 maxy = getmaxy(screen);
912 maxy -= 6;
914 start_color();
915 init_pair(1, COLOR_RED, COLOR_BLACK);
916 init_pair(2, COLOR_BLUE, COLOR_BLACK);
917 init_pair(3, COLOR_YELLOW, COLOR_BLACK);
918 init_pair(4, COLOR_GREEN, COLOR_BLACK);
920 wclear(screen);
921 clear();
923 mvwprintw(screen, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
924 "[+%d]", what & INCLUDE_TCP ? "TCP, " : "" ,
925 what & INCLUDE_UDP ? "UDP, " : "",
926 what & INCLUDE_SCTP ? "SCTP, " : "",
927 what & INCLUDE_DCCP ? "DCCP, " : "",
928 what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
929 what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
930 skip_lines);
932 rcu_read_lock();
934 if (rcu_dereference(fl->head) == NULL)
935 mvwprintw(screen, line, 2, "(No active sessions! "
936 "Is netfilter running?)");
938 for (i = 0; i < array_size(protocols); i++) {
939 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
940 n = rcu_dereference(fl->head);
941 while (n && maxy > 0) {
942 int skip_entry = 0;
944 if (n->l4_proto != protocols[i])
945 skip_entry = 1;
946 if (presenter_flow_wrong_state(n, j))
947 skip_entry = 1;
948 if (presenter_get_port(n->port_src,
949 n->port_dst, 0) == 53)
950 skip_entry = 1;
951 if (skip_entry) {
952 n = rcu_dereference(n->next);
953 continue;
955 if (skip_lines > 0) {
956 n = rcu_dereference(n->next);
957 skip_lines--;
958 continue;
961 presenter_screen_do_line(screen, n, &line);
963 line++;
964 maxy -= (2 + 1 * show_src);
965 n = rcu_dereference(n->next);
970 rcu_read_unlock();
972 wrefresh(screen);
973 refresh();
976 static void presenter(void)
978 int skip_lines = 0;
979 WINDOW *screen;
981 dissector_init_ethernet(0);
982 screen = screen_init(false);
984 rcu_register_thread();
985 while (!sigint) {
986 switch (getch()) {
987 case 'q':
988 sigint = 1;
989 break;
990 case KEY_UP:
991 case 'u':
992 case 'k':
993 skip_lines--;
994 if (skip_lines < 0)
995 skip_lines = 0;
996 break;
997 case KEY_DOWN:
998 case 'd':
999 case 'j':
1000 skip_lines++;
1001 if (skip_lines > SCROLL_MAX)
1002 skip_lines = SCROLL_MAX;
1003 break;
1004 default:
1005 fflush(stdin);
1006 break;
1009 presenter_screen_update(screen, &flow_list, skip_lines);
1010 usleep(100000);
1012 rcu_unregister_thread();
1014 screen_end();
1015 dissector_cleanup_ethernet();
1018 static int collector_cb(enum nf_conntrack_msg_type type,
1019 struct nf_conntrack *ct, void *data __maybe_unused)
1021 if (sigint)
1022 return NFCT_CB_STOP;
1024 synchronize_rcu();
1025 spinlock_lock(&flow_list.lock);
1027 switch (type) {
1028 case NFCT_T_NEW:
1029 flow_list_new_entry(&flow_list, ct);
1030 break;
1031 case NFCT_T_UPDATE:
1032 flow_list_update_entry(&flow_list, ct);
1033 break;
1034 case NFCT_T_DESTROY:
1035 flow_list_destroy_entry(&flow_list, ct);
1036 break;
1037 default:
1038 break;
1041 spinlock_unlock(&flow_list.lock);
1043 return NFCT_CB_CONTINUE;
1046 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1048 nfct_query(handle, NFCT_Q_FLUSH, &family);
1051 static void *collector(void *null __maybe_unused)
1053 int ret;
1054 struct nfct_handle *handle;
1055 struct nfct_filter *filter;
1057 handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1058 NF_NETLINK_CONNTRACK_UPDATE |
1059 NF_NETLINK_CONNTRACK_DESTROY);
1060 if (!handle)
1061 panic("Cannot create a nfct handle!\n");
1063 collector_flush(handle, AF_INET);
1064 collector_flush(handle, AF_INET6);
1066 filter = nfct_filter_create();
1067 if (!filter)
1068 panic("Cannot create a nfct filter!\n");
1070 ret = nfct_filter_attach(nfct_fd(handle), filter);
1071 if (ret < 0)
1072 panic("Cannot attach filter to handle!\n");
1074 if (what & INCLUDE_UDP) {
1075 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1076 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1078 if (what & INCLUDE_TCP)
1079 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1080 if (what & INCLUDE_DCCP)
1081 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1082 if (what & INCLUDE_SCTP)
1083 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1084 if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1085 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1086 if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1087 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1088 if (what & INCLUDE_IPV4) {
1089 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1090 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1092 if (what & INCLUDE_IPV6) {
1093 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1094 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1097 ret = nfct_filter_attach(nfct_fd(handle), filter);
1098 if (ret < 0)
1099 panic("Cannot attach filter to handle!\n");
1101 nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1102 nfct_filter_destroy(filter);
1103 flow_list_init(&flow_list);
1105 rcu_register_thread();
1107 while (!sigint && ret >= 0)
1108 ret = nfct_catch(handle);
1110 rcu_unregister_thread();
1112 flow_list_destroy(&flow_list);
1113 nfct_close(handle);
1115 pthread_exit(NULL);
1118 int main(int argc, char **argv)
1120 pthread_t tid;
1121 int ret, c, opt_index, what_cmd = 0;
1123 setfsuid(getuid());
1124 setfsgid(getgid());
1126 while ((c = getopt_long(argc, argv, short_options, long_options,
1127 &opt_index)) != EOF) {
1128 switch (c) {
1129 case '4':
1130 what_cmd |= INCLUDE_IPV4;
1131 break;
1132 case '6':
1133 what_cmd |= INCLUDE_IPV6;
1134 break;
1135 case 'T':
1136 what_cmd |= INCLUDE_TCP;
1137 break;
1138 case 'U':
1139 what_cmd |= INCLUDE_UDP;
1140 break;
1141 case 'D':
1142 what_cmd |= INCLUDE_DCCP;
1143 break;
1144 case 'I':
1145 what_cmd |= INCLUDE_ICMP;
1146 break;
1147 case 'S':
1148 what_cmd |= INCLUDE_SCTP;
1149 break;
1150 case 's':
1151 show_src = 1;
1152 break;
1153 case 'u':
1154 update_geoip();
1155 die();
1156 break;
1157 case 'h':
1158 help();
1159 break;
1160 case 'v':
1161 version();
1162 break;
1163 default:
1164 break;
1168 if (what_cmd > 0)
1169 what = what_cmd;
1171 rcu_init();
1173 register_signal(SIGINT, signal_handler);
1174 register_signal(SIGHUP, signal_handler);
1176 init_geoip(1);
1178 ret = pthread_create(&tid, NULL, collector, NULL);
1179 if (ret < 0)
1180 panic("Cannot create phthread!\n");
1182 presenter();
1184 destroy_geoip();
1186 return 0;