vde-2/src/vde_switch/plugins/iplog.c

   1 /*   This is part of VDE Virtual Distributed Internet
   2  *
   3  *   iplog: ip logging plugin for vde_switch
   4  *
   5  *   Copyright 2010 Renzo Davoli University of Bologna - Italy
   6  *
   7  *   This program is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU General Public License, version 2, as
   9  *   published by the Free Software Foundation.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License along
  17  *   with this program; if not, write to the Free Software Foundation, Inc.,
  18  *   51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA.
  19  *
  20  */
  21
  22 /* XXX missing:
  23          search ip
  24  */
  25
  26 #define _GNU_SOURCE
  27
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <fcntl.h>
  31 #include <stdint.h>
  32
  33 #include <config.h>
  34 #include <vde.h>
  35 #include <syslog.h>
  36 #include <errno.h>
  37 #include <limits.h>
  38 #include <unistd.h>
  39 #include <sys/types.h>
  40 #include <sys/socket.h>
  41 #include <netdb.h>
  42 #include <stdio.h>
  43 #include <string.h>
  44 #include <netinet/in.h>
  45 #include <sys/uio.h>
  46 #include <pwd.h>
  47 #include <ctype.h>
  48
  49 #include <vdecommon.h>
  50
  51 #include <vdeplugin.h>
  52
  53 static char *logfile;
  54 static int logfilefd=-1;
  55
  56 #define D_LOGIP 0300
  57 static struct dbgcl dl[]= {
  58         {"iplog/newip","show new ip addresses",D_LOGIP|D_PLUS},
  59 };
  60 #define D_LOGIP_NEWIP (dl)
  61
  62 /* lists of ip ranges to log */
  63 struct ip4logaddr {
  64         struct ip4logaddr *next;
  65         uint32_t addr;
  66         uint32_t mask;
  67 };
  68
  69 struct ip6logaddr {
  70         struct ip6logaddr *next;
  71         uint32_t addr[4];
  72         uint32_t mask[4];
  73 };
  74
  75 struct ip4logaddr *ip4loghead;
  76 struct ip6logaddr *ip6loghead;
  77
  78 /* packet header structure layer 2 and 3*/
  79 #define ETH_ALEN 6
  80 struct header {
  81         unsigned char dest[ETH_ALEN];
  82         unsigned char src[ETH_ALEN];
  83         unsigned char proto[2];
  84 };
  85
  86 union body {
  87         struct {
  88                 unsigned char version;
  89                 unsigned char filler[11];
  90                 unsigned char ip4src[4];
  91                 unsigned char ip4dst[4];
  92         } v4;
  93         struct {
  94                 unsigned char version;
  95                 unsigned char filler[7];
  96                 unsigned char ip6src[16];
  97                 unsigned char ip6dst[16];
  98         } v6;
  99         struct {
 100                 unsigned char priovlan[2];
 101         } vlan;
 102 };
 103
 104 /* vde plugin data */
 105 struct plugin vde_plugin_data={
 106         .name="iplog",
 107         .help="log ip/port/user assignment",
 108 };
 109
 110 /* translate ipv4 ipv6 addresses into strings for logging */
 111 static inline int ip42string(uint32_t *addr, char *hostname, unsigned int len)
 112 {
 113         struct sockaddr_in ip4addr;
 114         ip4addr.sin_family=AF_INET;
 115         ip4addr.sin_port=0;
 116         ip4addr.sin_addr.s_addr = *addr;
 117         return getnameinfo((struct sockaddr *)&ip4addr,sizeof(ip4addr),
 118                         hostname,len,NULL,0,NI_NUMERICHOST);
 119 }
 120
 121 static inline int ip62string(uint32_t *addr, char *hostname, unsigned int len)
 122 {
 123         struct sockaddr_in6 ip6addr;
 124         ip6addr.sin6_family=AF_INET6;
 125         ip6addr.sin6_port=0;
 126         ip6addr.sin6_flowinfo=0;
 127         ip6addr.sin6_scope_id=0;
 128         memcpy(&ip6addr.sin6_addr.s6_addr,addr,16);
 129         return getnameinfo((struct sockaddr *)&ip6addr,sizeof(ip6addr),
 130                         hostname,len,NULL,0,NI_NUMERICHOST);
 131 }
 132
 133 /* hash table of recently seen ip addresses, collision lists are double linked */
 134 #define IP_HASH_SIZE 1024
 135
 136 struct ip_hash_entry {
 137         struct ip_hash_entry *next;
 138         struct ip_hash_entry **prev;
 139         time_t last_seen;
 140         int port;
 141         short vlan;
 142         short len;
 143         unsigned char ipaddr[4];
 144 };
 145
 146 static struct ip_hash_entry **iph;
 147
 148 static inline int ip_hash(int len,unsigned char *addr)
 149 {
 150         if (len == 4)
 151                 return((addr[0]+2*addr[1]+3*addr[2]+5*addr[3]) % IP_HASH_SIZE);
 152         else
 153                 return((addr[0]+2*addr[1]+3*addr[2]+5*addr[3]+
 154                                 7*addr[4]+11*addr[5]+13*addr[6]+17*addr[7]+
 155                                 19*addr[8]+23*addr[9]+29*addr[10]+31*addr[11]+
 156                                 37*addr[12]+41*addr[13]+43*addr[14]+47*addr[15]) % IP_HASH_SIZE);
 157 }
 158
 159 /* search ip address into the hash tacle and add it if it does not exist.
 160          log each new item added */
 161 static void ip_find_in_hash_update(int len,unsigned char *addr,int vlan,int port)
 162 {
 163         struct ip_hash_entry *e;
 164         int k = ip_hash(len, addr);
 165         time_t now;
 166         for(e = iph[k]; e && memcmp(e->ipaddr, addr, len) && e->len == len &&
 167                         e->vlan == vlan; e = e->next)
 168                 ;
 169         if(e == NULL) {
 170                 e = (struct ip_hash_entry *) malloc(sizeof(*e)+(len-4));
 171                 if(e == NULL){
 172                         printlog(LOG_WARNING,"Failed to malloc ip_hash entry %s",strerror(errno));
 173                         return;
 174                 }
 175                 memcpy(e->ipaddr, addr, len);
 176                 if(iph[k] != NULL) iph[k]->prev = &(e->next);
 177                 e->next = iph[k];
 178                 e->prev = &(iph[k]);
 179                 e->vlan = vlan;
 180                 e->len = len;
 181                 e->port = -1;
 182                 iph[k] = e;
 183         }
 184         now=qtime();
 185         e->last_seen = now;
 186         if(e->port != port) {
 187                 e->port=port;
 188                 char hostname[100];
 189                 char msg[256];
 190                 char lf[]="\n";
 191                 struct iovec iov[]={{msg,0},{lf,1}};
 192
 193                 if ((len==4 && ip42string((uint32_t *)addr,hostname,sizeof(hostname))==0) ||
 194                                 (len==16 && ip62string((uint32_t *)addr,hostname,sizeof(hostname))==0)) {
 195                         struct passwd *pwd;
 196                         char *username;
 197                         if ((pwd=getpwuid(port_user(port))) == NULL)
 198                                 username="(none)";
 199                         else
 200                                 username=pwd->pw_name;
 201                         iov[0].iov_len=snprintf(msg,sizeof(msg),"ipv%d %s port=%d user=%s",
 202                                         (len==4)?4:6, hostname, port, username);
 203                         if (logfilefd >= 0)
 204                                 writev(logfilefd,iov,2);
 205                         else if (logfilefd != -1)
 206                                 syslog(LOG_INFO, msg);
 207                         DBGOUT(D_LOGIP_NEWIP,"%s",msg);
 208                 }
 209         }
 210 }
 211
 212 /* pass through the hash table and execute function f for each element */
 213 static void ip_for_all_hash(void (*f)(struct ip_hash_entry *, void *), void *arg)
 214 {
 215         int i;
 216         struct ip_hash_entry *e, *next;
 217
 218         for(i = 0; i < IP_HASH_SIZE; i++){
 219                 for(e = iph[i]; e; e = next){
 220                         next = e->next;
 221                         (*f)(e, arg);
 222                 }
 223         }
 224 }
 225
 226 /* delete a hash table entry */
 227 static inline void delete_hash_entry(struct ip_hash_entry *old)
 228 {
 229         *((old)->prev)=(old)->next;
 230         if((old)->next != NULL) (old)->next->prev = (old)->prev;
 231                 free((old));
 232 }
 233
 234
 235 #define IP_GC_INTERVAL 10
 236 #define IP_GC_EXPIRE 360
 237 static int ip_gc_interval=IP_GC_INTERVAL;
 238 static int ip_gc_expire=IP_GC_EXPIRE;
 239 static unsigned int ip_gc_timerno;
 240
 241 /* clean from the hash table entries older than IP_GC_EXPIRE seconds, given that
 242  * 'now' points to a time_t structure describing the current time */
 243 static void ip_gc(struct ip_hash_entry *e, void *expiretime)
 244 {
 245         if(e->last_seen <= *((time_t *)expiretime))
 246                 delete_hash_entry(e);
 247 }
 248
 249 /* clean old entries in the hash table 'h', and prepare the timer to be called
 250           * again between GC_INTERVAL seconds */
 251 static void ip_hash_gc(void *arg)
 252 {
 253         time_t t = qtime() - ip_gc_expire;
 254         ip_for_all_hash(ip_gc, &t);
 255 }
 256
 257 /* delete all ip address on a specific port (when the port is closed) */
 258 static void port_gc(struct ip_hash_entry *e, void *arg)
 259 {
 260         int *port=arg;
 261         if(*port == e->port)
 262                 delete_hash_entry(e);
 263 }
 264
 265 /* upcall from vde: new incomping packet */
 266 #define UINT32(X) (((uint32_t *)&(X)))
 267 static int iplog_pktin(struct dbgcl *event,void *arg,va_list v)
 268 {
 269         int vlan=0;
 270         int port=va_arg(v,int);
 271         unsigned char *buf=va_arg(v,unsigned char *);
 272         //int len=va_arg(v,int);
 273         struct header *ph=(struct header *) buf;
 274         union body *pb=(union body *)(ph+1);
 275         //fprintf(stderr,"packet from port %d len %d\n",port,len);
 276         if (ph->proto[0]==0x81 && ph->proto[1]==0x00) { /*VLAN*/
 277                 vlan=((pb->vlan.priovlan[0] << 8) + pb->vlan.priovlan[1]) & 0xfff;
 278                 ph=(struct header *)(((char *)ph)+4);
 279                 pb=(union body *)(((char *)pb)+4);
 280         }
 281         if (ph->proto[0]==0x08 && ph->proto[1]==0x00 &&
 282                         pb->v4.version == 0x45) {
 283                 /*v4 */
 284                 struct ip4logaddr *ip4scan;
 285                 /* is the packet in one of the logged ranges? */
 286                 for (ip4scan=ip4loghead; ip4scan!=NULL; ip4scan=ip4scan->next) {
 287                         /*printf("%x %x %x\n",UINT32(pb->v4.ip4src[0]) , ip4scan->mask ,
 288                                 ip4scan->addr);*/
 289                         uint32_t *addr=UINT32(pb->v4.ip4src[0]);
 290                         if ((addr[0] & ip4scan->mask) ==
 291                                         ip4scan->addr) {
 292                                 ip_find_in_hash_update(4,pb->v4.ip4src,vlan,port);
 293                                 break;
 294                         }
 295                 }
 296         }
 297         else if (ph->proto[0]==0x86 && ph->proto[1]==0xdd &&
 298                         pb->v4.version == 0x60) {
 299                 /*v6 */
 300                 struct ip6logaddr *ip6scan;
 301                 /* is the packet in one of the logged ranges? */
 302                 for (ip6scan=ip6loghead; ip6scan!=NULL; ip6scan=ip6scan->next) {
 303                         /*printf("%x %x %x:",UINT32(pb->v6.ip6src[0]) , ip6scan->mask[0] , ip6scan->addr[0]);
 304                                 printf("%x %x %x:",UINT32(pb->v6.ip6src[4]) , ip6scan->mask[1] , ip6scan->addr[1]);
 305                                 printf("%x %x %x:",UINT32(pb->v6.ip6src[8]) , ip6scan->mask[2] , ip6scan->addr[2]);
 306                                 printf("%x %x %x:",UINT32(pb->v6.ip6src[12]) , ip6scan->mask[3] , ip6scan->addr[3]);
 307                                 printf("\n");*/
 308                         uint32_t *addr=UINT32(pb->v6.ip6src[0]);
 309                         if (
 310                                         ((addr[0] & ip6scan->mask[0]) == ip6scan->addr[0]) &&
 311                                         ((addr[1] & ip6scan->mask[1]) == ip6scan->addr[1]) &&
 312                                         ((addr[2] & ip6scan->mask[2]) == ip6scan->addr[2]) &&
 313                                         ((addr[3] & ip6scan->mask[3]) == ip6scan->addr[3])
 314                                  )
 315                         {
 316                                 ip_find_in_hash_update(16,pb->v6.ip6src,vlan,port);
 317                                 break;
 318                         }
 319                 }
 320         }
 321         return 0;
 322 }
 323
 324 /* upcall from vde: a port has been closed */
 325 static int iplog_port_minus(struct dbgcl *event,void *arg,va_list v)
 326 {
 327         int port=va_arg(v,int);
 328         ip_for_all_hash(&port_gc, &port);
 329         return 0;
 330 }
 331
 332 /*user interface: chowinfo */
 333 static int ipshowinfo(FILE *fd)
 334 {
 335         printoutc(fd,"iplog: ip/port/user loggin plugin");
 336         if (logfilefd<0) {
 337                 if (logfilefd == -1)
 338                         printoutc(fd,"log disabled");
 339                 else
 340                         printoutc(fd,"log on syslog");
 341         } else
 342                 printoutc(fd,"log on file %s",logfile);
 343         printoutc(fd,"GC interval %d secs",ip_gc_interval);
 344         printoutc(fd,"GC expire %d secs",ip_gc_expire);
 345         return 0;
 346 }
 347
 348 /* close the old log file */
 349 static void closelogfile(void)
 350 {
 351         if (logfilefd >= 0)
 352                 close(logfilefd);
 353         if (logfile != NULL)
 354                 free(logfile);
 355 }
 356
 357 /* change the log file */
 358 static int iplogfile(char *arg)
 359 {
 360         if (*arg) {
 361                 if (strcmp(arg,"-")==0) {
 362                         closelogfile();
 363                         logfilefd=-2;
 364                         return 0;
 365                 } else {
 366                         int fd;
 367                         fd=open(arg,O_CREAT|O_WRONLY|O_APPEND,0600);
 368                         if (fd>=0) {
 369                                 char abspath[PATH_MAX];
 370                                 closelogfile();
 371                                 logfilefd=fd;
 372                                 vde_realpath(arg,abspath);
 373                                 logfile=strdup(abspath);
 374                                 return 0;
 375                         } else
 376                                 return ENOENT;
 377                 }
 378         } else
 379                 return EINVAL;
 380 }
 381
 382 /* add a v4 range (recursive) */
 383 static int iplog4radd(struct ip4logaddr **ph, uint32_t addr, uint32_t mask)
 384 {
 385         if (*ph == NULL) {
 386                 *ph=malloc(sizeof(struct ip4logaddr));
 387                 if (*ph==NULL)
 388                         return ENOMEM;
 389                 else {
 390                         (*ph)->next=NULL;
 391                         (*ph)->addr=addr;
 392                         (*ph)->mask=mask;
 393                         return 0;
 394                 }
 395         } else {
 396                 if ((*ph)->addr==addr && (*ph)->mask==mask)
 397                         return EEXIST;
 398                 else
 399                         return iplog4radd(&((*ph)->next),addr,mask);
 400         }
 401 }
 402
 403 /* add a v6 range (recursive) */
 404 static int iplog6radd(struct ip6logaddr **ph, uint32_t addr[4], uint32_t mask[4])
 405 {
 406         if (*ph == NULL) {
 407                 *ph=malloc(sizeof(struct ip6logaddr));
 408                 if (*ph==NULL)
 409                         return ENOMEM;
 410                 else {
 411                         (*ph)->next=NULL;
 412                         memcpy((void *)((*ph)->addr),addr,16);
 413                         memcpy((void *)((*ph)->mask),mask,16);
 414                         return 0;
 415                 }
 416         } else {
 417                 if (memcmp(&((*ph)->addr),addr,16) == 0 &&
 418                         memcmp(&((*ph)->mask),mask,16) == 0)
 419                         return EEXIST;
 420                 else
 421                         return iplog6radd(&((*ph)->next),addr,mask);
 422         }
 423 }
 424
 425 /* delete a v4 range (recursive) */
 426 static int iplog4rdel(struct ip4logaddr **ph, uint32_t addr, uint32_t mask)
 427 {
 428         if (*ph == NULL) {
 429                 return ENOENT;
 430         } else {
 431                 if ((*ph)->addr==addr && (*ph)->mask==mask) {
 432                         struct ip4logaddr *this=*ph;
 433                         *ph=(*ph)->next;
 434                         free(this);
 435                         return 0;
 436                 } else
 437                         return iplog4rdel(&((*ph)->next),addr,mask);
 438         }
 439 }
 440
 441 /* delete a v6 range (recursive) */
 442 static int iplog6rdel(struct ip6logaddr **ph, uint32_t addr[4], uint32_t mask[4])
 443 {
 444         if (*ph == NULL) {
 445                 return ENOENT;
 446         } else {
 447                 if (memcmp(&((*ph)->addr),addr,16) == 0 &&
 448                         memcmp(&((*ph)->mask),mask,16) == 0) {
 449                         struct ip6logaddr *this=*ph;
 450                         *ph=(*ph)->next;
 451                         free(this);
 452                         return 0;
 453                 } else
 454                         return iplog6rdel(&((*ph)->next),addr,mask);
 455         }
 456 }
 457
 458 /* create a mask from the number of bits */
 459 static void n2mask(int len,int n, uint32_t *out)
 460 {
 461         char m[len];
 462         int i;
 463         for (i=0;i<len;i++,n-=8) {
 464                 if (n>=8)
 465                         m[i]=0xff;
 466                 else if (n>0)
 467                         m[i]=~((1<<(8-n))-1);
 468                 else
 469                         m[i]=0;
 470         }
 471         len=(len+sizeof(uint32_t)-1)/sizeof(uint32_t);
 472         for (i=0;i<len;i++)
 473                 out[i]=*(((uint32_t *)m)+i);
 474 }
 475
 476 /* cumpute the number of bits from a mask */
 477 static int mask2n(int len, void *addr)
 478 {
 479         char *m=addr;
 480         int n=0;
 481         int i,sm;
 482         for (i=0;i<len;i++) {
 483                 for (sm=0x80;sm!=0;sm>>=1) {
 484                         if (m[i] & sm)
 485                                 n++;
 486                         else
 487                                 return n;
 488                 }
 489         }
 490         return n;
 491 }
 492
 493 /* convert an ipv4 or ipv6 address into addr/mask */
 494 static int char2addr_mask(char *arg, uint32_t *addr, uint32_t *mask)
 495 {
 496         struct addrinfo *ai;
 497         char *smask=strrchr(arg,'/');
 498         int len;
 499         if (smask != NULL) {
 500                 *smask=0;
 501                 smask++;
 502         }
 503         if (getaddrinfo(arg,NULL,NULL,&ai) != 0)
 504                 return -1;
 505         else {
 506                 if (ai->ai_family == AF_INET) {
 507                         struct sockaddr_in *ip4addr=(struct sockaddr_in *) ai->ai_addr;
 508                         len=4;
 509                         if (smask != NULL)
 510                                 n2mask(len,atoi(smask),mask);
 511                         else
 512                                 n2mask(len,32,mask);
 513                         addr[0]=ip4addr->sin_addr.s_addr & mask[0];
 514                 } else if (ai->ai_family == AF_INET6) {
 515                         int i;
 516                         struct sockaddr_in6 *ip6addr=(struct sockaddr_in6 *) ai->ai_addr;
 517                         len=16;
 518                         if (smask != NULL)
 519                                 n2mask(len,atoi(smask),mask);
 520                         else
 521                                 n2mask(len,128,mask);
 522                         for (i=0;i<4;i++)
 523                                 addr[i]=*(((uint32_t *)ip6addr->sin6_addr.s6_addr)+i) & mask[i];
 524                 } else
 525                         len=-1;
 526                 freeaddrinfo(ai);
 527                 return len;
 528         }
 529 }
 530
 531 /* user interface: add an ipv4 or ipv6 range */
 532 static int iplogadd(char *arg)
 533 {
 534         uint32_t addr[4],mask[4];
 535         int len=char2addr_mask(arg,addr,mask);
 536         if (len == 4)
 537                 return iplog4radd(&ip4loghead,addr[0],mask[0]);
 538         else if (len == 16)
 539                 return iplog6radd(&ip6loghead,addr,mask);
 540         else
 541                 return EINVAL;
 542 }
 543
 544 /* user interface: delete an ipv4 or ipv6 range */
 545 static int iplogdel(char *arg)
 546 {
 547         uint32_t addr[4],mask[4];
 548         int len=char2addr_mask(arg,addr,mask);
 549         if (len == 4)
 550                 return iplog4rdel(&ip4loghead,addr[0],mask[0]);
 551         else if (len == 16)
 552                 return iplog6rdel(&ip6loghead,addr,mask);
 553         else
 554                 return EINVAL;
 555 }
 556
 557 /* list the ipv4 ranges */
 558 static void iplog4rlist(struct ip4logaddr *ph, FILE *fd)
 559 {
 560         if (ph != NULL) {
 561                 char hostname[20];
 562                 if (ip42string(&ph->addr,hostname,sizeof(hostname)) == 0)
 563                         printoutc(fd,"  ipv4: %s/%d",hostname,mask2n(4,&ph->mask));
 564                 iplog4rlist(ph->next,fd);
 565         }
 566 }
 567
 568 /* list the ipv6 ranges */
 569 static void iplog6rlist(struct ip6logaddr *ph, FILE *fd)
 570 {
 571         if (ph != NULL) {
 572                 char hostname[100];
 573                 if (ip62string(ph->addr,hostname,sizeof(hostname)) == 0)
 574                         printoutc(fd,"  ipv6: %s/%d",hostname,mask2n(16,&ph->mask));
 575                 iplog6rlist(ph->next,fd);
 576         }
 577 }
 578
 579 /* user interfaces list the ip ranges (v4 and v6)*/
 580 static int iploglist(FILE *fd)
 581 {
 582         iplog4rlist(ip4loghead,fd);
 583         iplog6rlist(ip6loghead,fd);
 584         return 0;
 585 }
 586
 587 /* user interfaces set the garbage collection interval*/
 588 int iplog_set_gc_interval(int p)
 589 {
 590         qtimer_del(ip_gc_timerno);
 591         ip_gc_interval=p;
 592         ip_gc_timerno=qtimer_add(ip_gc_interval,0,ip_hash_gc,NULL);
 593         return 0;
 594 }
 595
 596 /* user interfaces set the expire interval*/
 597 int iplog_set_gc_expire(int e)
 598 {
 599         ip_gc_expire=e;
 600         return 0;
 601 }
 602
 603 /* print an item of the recent ip hash table */
 604 static void iplog_iplist_item(struct ip_hash_entry *e, void *arg)
 605 {
 606         FILE *fd=arg;
 607         char hostname[100];
 608         if ((e->len==4 && ip42string((uint32_t *)e->ipaddr,hostname,sizeof(hostname))==0) ||
 609                         (e->len==16 && ip62string((uint32_t *)e->ipaddr,hostname,sizeof(hostname))==0)) {
 610                 struct passwd *pwd;
 611                 char *username;
 612                 if ((pwd=getpwuid(port_user(e->port))) == NULL)
 613                         username="(none)";
 614                 else
 615                         username=pwd->pw_name;
 616                 printoutc(fd,"ipv%d %s port=%d user=%s", (e->len==4)?4:6, hostname, e->port, username);
 617         }
 618 }
 619
 620 /* user interface: list all the ip addresses in the hash table */
 621 static int iplog_iplist(FILE *fd)
 622 {
 623         ip_for_all_hash(iplog_iplist_item, fd);
 624         return 0;
 625 }
 626
 627 /* user interface: list the ip addresses on a specific port */
 628 struct ipport_data {
 629         FILE *fd;
 630         int port;
 631 };
 632
 633 static void iplog_ipport_item(struct ip_hash_entry *e, void *arg)
 634 {
 635         struct ipport_data *pipd=arg;
 636         if (e->port == pipd->port)
 637                 iplog_iplist_item(e,pipd->fd);
 638 }
 639
 640 static int iplog_ipport(FILE *fd,int port)
 641 {
 642         struct ipport_data ipd={fd, port};
 643         ip_for_all_hash(iplog_ipport_item, &ipd);
 644         return 0;
 645 }
 646
 647 /* user interface: list the ip addresses of a specific user */
 648 struct ipuser_data {
 649         FILE *fd;
 650         uid_t user;
 651 };
 652
 653 static void iplog_ipuser_item(struct ip_hash_entry *e, void *arg)
 654 {
 655         struct ipuser_data *piud=arg;
 656         if (port_user(e->port) == piud->user)
 657                 iplog_iplist_item(e,piud->fd);
 658 }
 659
 660 static int iplog_ipuser(FILE *fd,char *user)
 661 {
 662         struct passwd *pwd;
 663         struct ipuser_data iud={.fd=fd};
 664         if (user==NULL || *user==0)
 665                 return EINVAL;
 666         if (isdigit(*user))
 667                 pwd=getpwuid(atoi(user));
 668         else
 669                 pwd=getpwnam(user);
 670         if (pwd == NULL)
 671                 return EINVAL;
 672         iud.user=pwd->pw_uid;
 673         ip_for_all_hash(iplog_ipuser_item, &iud);
 674         return 0;
 675 }
 676
 677 /* user interface: search an ip address in the hash table */
 678 static void iplog_ipsearch_item(int len,unsigned char *addr, FILE *fd)
 679 {
 680         struct ip_hash_entry *e;
 681         int k = ip_hash(len, addr);
 682         for(e = iph[k]; e && memcmp(e->ipaddr, addr, len) && e->len == len; e = e->next)
 683                 ;
 684         if(e != NULL)
 685                 iplog_iplist_item(e,fd);
 686 }
 687
 688 static int iplog_ipsearch(FILE *fd,char *addr)
 689 {
 690         struct addrinfo *ai;
 691         int rv=0;
 692         if (addr==NULL || *addr==0)
 693                     return EINVAL;
 694         if (getaddrinfo(addr,NULL,NULL,&ai) != 0)
 695                 return EINVAL;
 696         if (ai->ai_family == AF_INET) {
 697                 struct sockaddr_in *ip4addr=(struct sockaddr_in *) ai->ai_addr;
 698                 iplog_ipsearch_item(4, (unsigned char *) &ip4addr->sin_addr.s_addr, fd);
 699         } else if (ai->ai_family == AF_INET6) {
 700                 struct sockaddr_in6 *ip6addr=(struct sockaddr_in6 *) ai->ai_addr;
 701                 iplog_ipsearch_item(16, ip6addr->sin6_addr.s6_addr , fd);
 702         } else
 703                 return rv=EINVAL;
 704         freeaddrinfo(ai);
 705         return rv;
 706 }
 707
 708 /* command list */
 709 static struct comlist cl[]={
 710         {"iplog","============","IP/Mac/User Logging",NULL,NOARG},
 711         {"iplog/showinfo","","Show info on logging",ipshowinfo,NOARG|WITHFILE},
 712         {"iplog/logfile","pathname","Set the logfile",iplogfile,STRARG},
 713         {"iplog/ipadd","ipaddr/mask","add an ipv4/v6 range",iplogadd,STRARG},
 714         {"iplog/ipdel","ipaddr/mask","del an ipv6/v6 range",iplogdel,STRARG},
 715         {"iplog/list","","list ip ranges",iploglist,NOARG|WITHFILE},
 716         {"iplog/setgcint","N","change garbage collector interval",iplog_set_gc_interval,INTARG},
 717         {"iplog/setexpire","N","change iplog entries expire time",iplog_set_gc_expire,INTARG},
 718         {"iplog/iplist","","list active IP",iplog_iplist,NOARG|WITHFILE},
 719         {"iplog/ipport","port","list active IP on a port",iplog_ipport,INTARG|WITHFILE},
 720         {"iplog/ipuser","user","list active IP of a user",iplog_ipuser,STRARG|WITHFILE},
 721         {"iplog/ipsearch","ipaddr","search an IP address",iplog_ipsearch,STRARG|WITHFILE},
 722 };
 723
 724         static void
 725         __attribute__ ((constructor))
 726 init (void)
 727 {
 728         iph=calloc(IP_HASH_SIZE,sizeof(struct ip_hash_entry *));
 729         ADDCL(cl);
 730         ADDDBGCL(dl);
 731         ip_gc_timerno=qtimer_add(ip_gc_interval,0,ip_hash_gc,NULL);
 732         eventadd(iplog_pktin, "packet/in", NULL);
 733         eventadd(iplog_port_minus, "port/-", NULL);
 734         /* XXX add event port/minux  */
 735 }
 736
 737         static void
 738         __attribute__ ((destructor))
 739 fini (void)
 740 {
 741         time_t t = qtime();
 742         eventdel(iplog_port_minus, "port/-", NULL);
 743         eventdel(iplog_pktin, "packet/in", NULL);
 744         qtimer_del(ip_gc_timerno);
 745         DELCL(cl);
 746         DELDBGCL(dl);
 747         ip_for_all_hash(ip_gc, &t);
 748         free(iph);
 749 }