?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flowtop: Do not insert DNS flows into list
[netsniff-ng-new.git] / flowtop.c
blobb740ec1caf4bc98f80098d6d12a137451099d940
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2011 - 2013 Daniel Borkmann.
4 * Copyright 2011 Emmanuel Roullit.
5 * Subject to the GPL, version 2.
6 */
7
8 #define _LGPL_SOURCE
9 #include <stdio.h>
10 #include <stdint.h>
11 #include <stdlib.h>
12 #include <signal.h>
13 #include <getopt.h>
14 #include <pthread.h>
15 #include <signal.h>
16 #include <netdb.h>
17 #include <ctype.h>
18 #include <netinet/in.h>
19 #include <curses.h>
20 #include <dirent.h>
21 #include <sys/stat.h>
22 #include <sys/fsuid.h>
23 #include <urcu.h>
24 #include <libgen.h>
25 #include <inttypes.h>
26 #include <poll.h>
27 #include <fcntl.h>
28
29 #include "die.h"
30 #include "xmalloc.h"
31 #include "conntrack.h"
32 #include "config.h"
33 #include "str.h"
34 #include "sig.h"
35 #include "lookup.h"
36 #include "geoip.h"
37 #include "built_in.h"
38 #include "locking.h"
39 #include "pkt_buff.h"
40 #include "screen.h"
41 #include "proc.h"
42 #include "sysctl.h"
43
44 struct flow_entry {
45 uint32_t flow_id, use, status;
46 uint8_t l3_proto, l4_proto;
47 uint32_t ip4_src_addr, ip4_dst_addr;
48 uint32_t ip6_src_addr[4], ip6_dst_addr[4];
49 uint16_t port_src, port_dst;
50 uint8_t tcp_state, tcp_flags, sctp_state, dccp_state;
51 uint64_t src_pkts, src_bytes;
52 uint64_t dst_pkts, dst_bytes;
53 uint64_t timestamp_start, timestamp_stop;
54 char country_src[128], country_dst[128];
55 char city_src[128], city_dst[128];
56 char rev_dns_src[256], rev_dns_dst[256];
57 char cmdline[256];
58 struct flow_entry *next;
59 int inode;
60 unsigned int procnum;
61 bool is_visible;
62 struct nf_conntrack *ct;
63 };
64
65 struct flow_list {
66 struct flow_entry *head;
67 struct spinlock lock;
68 };
69
70 #ifndef ATTR_TIMESTAMP_START
71 # define ATTR_TIMESTAMP_START 63
72 #endif
73 #ifndef ATTR_TIMESTAMP_STOP
74 # define ATTR_TIMESTAMP_STOP 64
75 #endif
76
77 #define SCROLL_MAX 1000
78
79 #define INCLUDE_IPV4 (1 << 0)
80 #define INCLUDE_IPV6 (1 << 1)
81 #define INCLUDE_UDP (1 << 2)
82 #define INCLUDE_TCP (1 << 3)
83 #define INCLUDE_DCCP (1 << 4)
84 #define INCLUDE_ICMP (1 << 5)
85 #define INCLUDE_SCTP (1 << 6)
86
87 static volatile bool is_flow_collecting;
88 static volatile sig_atomic_t sigint = 0;
89 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
90 static struct flow_list flow_list;
91 static int nfct_acct_val = -1;
92
93 static const char *short_options = "vhTUsDIS46u";
94 static const struct option long_options[] = {
95 {"ipv4", no_argument, NULL, '4'},
96 {"ipv6", no_argument, NULL, '6'},
97 {"tcp", no_argument, NULL, 'T'},
98 {"udp", no_argument, NULL, 'U'},
99 {"dccp", no_argument, NULL, 'D'},
100 {"icmp", no_argument, NULL, 'I'},
101 {"sctp", no_argument, NULL, 'S'},
102 {"show-src", no_argument, NULL, 's'},
103 {"update", no_argument, NULL, 'u'},
104 {"version", no_argument, NULL, 'v'},
105 {"help", no_argument, NULL, 'h'},
106 {NULL, 0, NULL, 0}
107 };
108
109 static const char *copyright = "Please report bugs to <bugs@netsniff-ng.org>\n"
110 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
111 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
112 "Swiss federal institute of technology (ETH Zurich)\n"
113 "License: GNU GPL version 2.0\n"
114 "This is free software: you are free to change and redistribute it.\n"
115 "There is NO WARRANTY, to the extent permitted by law.";
116
117 static const char *const l3proto2str[AF_MAX] = {
118 [AF_INET] = "ipv4",
119 [AF_INET6] = "ipv6",
120 };
121
122 static const char *const l4proto2str[IPPROTO_MAX] = {
123 [IPPROTO_TCP] = "tcp",
124 [IPPROTO_UDP] = "udp",
125 [IPPROTO_UDPLITE] = "udplite",
126 [IPPROTO_ICMP] = "icmp",
127 [IPPROTO_ICMPV6] = "icmpv6",
128 [IPPROTO_SCTP] = "sctp",
129 [IPPROTO_GRE] = "gre",
130 [IPPROTO_DCCP] = "dccp",
131 [IPPROTO_IGMP] = "igmp",
132 [IPPROTO_IPIP] = "ipip",
133 [IPPROTO_EGP] = "egp",
134 [IPPROTO_PUP] = "pup",
135 [IPPROTO_IDP] = "idp",
136 [IPPROTO_RSVP] = "rsvp",
137 [IPPROTO_IPV6] = "ip6tun",
138 [IPPROTO_ESP] = "esp",
139 [IPPROTO_AH] = "ah",
140 [IPPROTO_PIM] = "pim",
141 [IPPROTO_COMP] = "comp",
142 };
143
144 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
145 [TCP_CONNTRACK_NONE] = "NOSTATE",
146 [TCP_CONNTRACK_SYN_SENT] = "SYN_SENT",
147 [TCP_CONNTRACK_SYN_RECV] = "SYN_RECV",
148 [TCP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
149 [TCP_CONNTRACK_FIN_WAIT] = "FIN_WAIT",
150 [TCP_CONNTRACK_CLOSE_WAIT] = "CLOSE_WAIT",
151 [TCP_CONNTRACK_LAST_ACK] = "LAST_ACK",
152 [TCP_CONNTRACK_TIME_WAIT] = "TIME_WAIT",
153 [TCP_CONNTRACK_CLOSE] = "CLOSE",
154 [TCP_CONNTRACK_SYN_SENT2] = "SYN_SENT2",
155 };
156
157 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
158 [DCCP_CONNTRACK_NONE] = "NOSTATE",
159 [DCCP_CONNTRACK_REQUEST] = "REQUEST",
160 [DCCP_CONNTRACK_RESPOND] = "RESPOND",
161 [DCCP_CONNTRACK_PARTOPEN] = "PARTOPEN",
162 [DCCP_CONNTRACK_OPEN] = "OPEN",
163 [DCCP_CONNTRACK_CLOSEREQ] = "CLOSEREQ",
164 [DCCP_CONNTRACK_CLOSING] = "CLOSING",
165 [DCCP_CONNTRACK_TIMEWAIT] = "TIMEWAIT",
166 [DCCP_CONNTRACK_IGNORE] = "IGNORE",
167 [DCCP_CONNTRACK_INVALID] = "INVALID",
168 };
169
170 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
171 [SCTP_CONNTRACK_NONE] = "NOSTATE",
172 [SCTP_CONNTRACK_CLOSED] = "CLOSED",
173 [SCTP_CONNTRACK_COOKIE_WAIT] = "COOKIE_WAIT",
174 [SCTP_CONNTRACK_COOKIE_ECHOED] = "COOKIE_ECHOED",
175 [SCTP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
176 [SCTP_CONNTRACK_SHUTDOWN_SENT] = "SHUTDOWN_SENT",
177 [SCTP_CONNTRACK_SHUTDOWN_RECD] = "SHUTDOWN_RECD",
178 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
179 };
180
181 static const struct nfct_filter_ipv4 filter_ipv4 = {
182 .addr = __constant_htonl(INADDR_LOOPBACK),
183 .mask = 0xffffffff,
184 };
185
186 static const struct nfct_filter_ipv6 filter_ipv6 = {
187 .addr = { 0x0, 0x0, 0x0, 0x1 },
188 .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
189 };
190
191 static void signal_handler(int number)
192 {
193 switch (number) {
194 case SIGINT:
195 case SIGQUIT:
196 case SIGTERM:
197 sigint = 1;
198 break;
199 case SIGHUP:
200 default:
201 break;
202 }
203 }
204
205 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
206 static void flow_entry_get_extended(struct flow_entry *n);
207
208 static bool nfct_is_dns(struct nf_conntrack *ct);
209
210 static void help(void)
211 {
212 printf("flowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
213 VERSION_STRING);
214 puts("http://www.netsniff-ng.org\n\n"
215 "Usage: flowtop [options]\n"
216 "Options:\n"
217 " -4|--ipv4 Show only IPv4 flows (default)\n"
218 " -6|--ipv6 Show only IPv6 flows (default)\n"
219 " -T|--tcp Show only TCP flows (default)\n"
220 " -U|--udp Show only UDP flows\n"
221 " -D|--dccp Show only DCCP flows\n"
222 " -I|--icmp Show only ICMP/ICMPv6 flows\n"
223 " -S|--sctp Show only SCTP flows\n"
224 " -s|--show-src Also show source, not only dest\n"
225 " -u|--update Update GeoIP databases\n"
226 " -v|--version Print version and exit\n"
227 " -h|--help Print this help and exit\n\n"
228 "Examples:\n"
229 " flowtop\n"
230 " flowtop -46UTDISs\n\n"
231 "Note:\n"
232 " If netfilter is not running, you can activate it with e.g.:\n"
233 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
234 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n");
235 puts(copyright);
236 die();
237 }
238
239 static void version(void)
240 {
241 printf("flowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
242 puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
243 "http://www.netsniff-ng.org\n");
244 puts(copyright);
245 die();
246 }
247
248 static inline struct flow_entry *flow_entry_xalloc(void)
249 {
250 return xzmalloc(sizeof(struct flow_entry));
251 }
252
253 static inline void flow_entry_xfree(struct flow_entry *n)
254 {
255 if (n->ct)
256 nfct_destroy(n->ct);
257
258 xfree(n);
259 }
260
261 static inline void flow_list_init(struct flow_list *fl)
262 {
263 fl->head = NULL;
264 spinlock_init(&fl->lock);
265 }
266
267 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
268 {
269 struct flow_entry *n;
270
271 /* We don't want to analyze / display DNS itself, since we
272 * use it to resolve reverse dns.
273 */
274 if (nfct_is_dns(ct))
275 return;
276
277 n = flow_entry_xalloc();
278
279 n->ct = nfct_clone(ct);
280
281 flow_entry_from_ct(n, ct);
282 flow_entry_get_extended(n);
283
284 rcu_assign_pointer(n->next, fl->head);
285 rcu_assign_pointer(fl->head, n);
286 }
287
288 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
289 uint32_t id)
290 {
291 struct flow_entry *n = rcu_dereference(fl->head);
292
293 while (n != NULL) {
294 if (n->flow_id == id)
295 return n;
296
297 n = rcu_dereference(n->next);
298 }
299
300 return NULL;
301 }
302
303 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
304 uint32_t id)
305 {
306 struct flow_entry *prev = rcu_dereference(fl->head), *next;
307
308 if (prev->flow_id == id)
309 return NULL;
310
311 while ((next = rcu_dereference(prev->next)) != NULL) {
312 if (next->flow_id == id)
313 return prev;
314
315 prev = next;
316 }
317
318 return NULL;
319 }
320
321 static void flow_list_update_entry(struct flow_list *fl,
322 struct nf_conntrack *ct)
323 {
324 struct flow_entry *n;
325
326 n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
327 if (n == NULL) {
328 flow_list_new_entry(fl, ct);
329 return;
330 }
331
332 flow_entry_from_ct(n, ct);
333 }
334
335 static void flow_list_destroy_entry(struct flow_list *fl,
336 struct nf_conntrack *ct)
337 {
338 struct flow_entry *n1, *n2;
339 uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
340
341 n1 = flow_list_find_id(fl, id);
342 if (n1) {
343 n2 = flow_list_find_prev_id(fl, id);
344 if (n2) {
345 rcu_assign_pointer(n2->next, n1->next);
346 n1->next = NULL;
347
348 flow_entry_xfree(n1);
349 } else {
350 struct flow_entry *next = fl->head->next;
351
352 flow_entry_xfree(fl->head);
353 fl->head = next;
354 }
355 }
356 }
357
358 static void flow_list_destroy(struct flow_list *fl)
359 {
360 struct flow_entry *n;
361
362 while (fl->head != NULL) {
363 n = rcu_dereference(fl->head->next);
364 fl->head->next = NULL;
365
366 flow_entry_xfree(fl->head);
367 rcu_assign_pointer(fl->head, n);
368 }
369
370 synchronize_rcu();
371 spinlock_destroy(&fl->lock);
372 }
373
374 static int walk_process(unsigned int pid, struct flow_entry *n)
375 {
376 int ret;
377 DIR *dir;
378 struct dirent *ent;
379 char path[1024];
380
381 if (snprintf(path, sizeof(path), "/proc/%u/fd", pid) == -1)
382 panic("giant process name! %u\n", pid);
383
384 dir = opendir(path);
385 if (!dir)
386 return 0;
387
388 while ((ent = readdir(dir))) {
389 struct stat statbuf;
390
391 if (snprintf(path, sizeof(path), "/proc/%u/fd/%s",
392 pid, ent->d_name) < 0)
393 continue;
394
395 if (stat(path, &statbuf) < 0)
396 continue;
397
398 if (S_ISSOCK(statbuf.st_mode) && (ino_t) n->inode == statbuf.st_ino) {
399 ret = proc_get_cmdline(pid, n->cmdline, sizeof(n->cmdline));
400 if (ret < 0)
401 panic("Failed to get process cmdline: %s\n", strerror(errno));
402
403 n->procnum = pid;
404 closedir(dir);
405 return 1;
406 }
407 }
408
409 closedir(dir);
410 return 0;
411 }
412
413 static void walk_processes(struct flow_entry *n)
414 {
415 int ret;
416 DIR *dir;
417 struct dirent *ent;
418
419 /* n->inode must be set */
420 if (n->inode <= 0) {
421 n->cmdline[0] = '\0';
422 return;
423 }
424
425 dir = opendir("/proc");
426 if (!dir)
427 panic("Cannot open /proc: %s\n", strerror(errno));
428
429 while ((ent = readdir(dir))) {
430 const char *name = ent->d_name;
431 char *end;
432 unsigned int pid = strtoul(name, &end, 10);
433
434 /* not a PID */
435 if (pid == 0 && end == name)
436 continue;
437
438 ret = walk_process(pid, n);
439 if (ret > 0)
440 break;
441 }
442
443 closedir(dir);
444 }
445
446 static int get_port_inode(uint16_t port, int proto, bool is_ip6)
447 {
448 int ret = -ENOENT;
449 char path[128], buff[1024];
450 FILE *proc;
451
452 memset(path, 0, sizeof(path));
453 snprintf(path, sizeof(path), "/proc/net/%s%s",
454 l4proto2str[proto], is_ip6 ? "6" : "");
455
456 proc = fopen(path, "r");
457 if (!proc)
458 return -EIO;
459
460 memset(buff, 0, sizeof(buff));
461
462 while (fgets(buff, sizeof(buff), proc) != NULL) {
463 int inode = 0;
464 unsigned int lport = 0;
465
466 buff[sizeof(buff) - 1] = 0;
467 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
468 "%*X %*u %*u %u", &lport, &inode) == 2) {
469 if ((uint16_t) lport == port) {
470 ret = inode;
471 break;
472 }
473 }
474
475 memset(buff, 0, sizeof(buff));
476 }
477
478 fclose(proc);
479 return ret;
480 }
481
482 #define CP_NFCT(elem, attr, x) \
483 do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
484 #define CP_NFCT_BUFF(elem, attr) do { \
485 const uint8_t *buff = nfct_get_attr(ct,(attr)); \
486 if (buff != NULL) \
487 memcpy(n->elem, buff, sizeof(n->elem)); \
488 } while (0)
489
490 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
491 {
492 CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
493 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
494
495 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
496 CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
497
498 CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
499 CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
500
501 CP_NFCT(status, ATTR_STATUS, 32);
502
503 CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
504 CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
505 CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
506 CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
507
508 CP_NFCT(src_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
509 CP_NFCT(src_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
510
511 CP_NFCT(dst_pkts, ATTR_REPL_COUNTER_PACKETS, 64);
512 CP_NFCT(dst_bytes, ATTR_REPL_COUNTER_BYTES, 64);
513
514 CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
515 CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
516
517 CP_NFCT(flow_id, ATTR_ID, 32);
518 CP_NFCT(use, ATTR_USE, 32);
519
520 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
521 CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
522
523 n->port_src = ntohs(n->port_src);
524 n->port_dst = ntohs(n->port_dst);
525
526 n->ip4_src_addr = ntohl(n->ip4_src_addr);
527 n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
528 }
529
530 enum flow_entry_direction {
531 flow_entry_src,
532 flow_entry_dst,
533 };
534
535 static bool nfct_is_dns(struct nf_conntrack *ct)
536 {
537 struct flow_entry fl;
538 struct flow_entry *n = &fl;
539
540 CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
541 CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
542
543 return ntohs(n->port_src) == 53 || ntohs(n->port_dst) == 53;
544 }
545
546 #define SELFLD(dir,src_member,dst_member) \
547 (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
548
549 static void flow_entry_get_sain4_obj(struct flow_entry *n,
550 enum flow_entry_direction dir,
551 struct sockaddr_in *sa)
552 {
553 memset(sa, 0, sizeof(*sa));
554 sa->sin_family = PF_INET;
555 sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
556 }
557
558 static void flow_entry_get_sain6_obj(struct flow_entry *n,
559 enum flow_entry_direction dir,
560 struct sockaddr_in6 *sa)
561 {
562 memset(sa, 0, sizeof(*sa));
563 sa->sin6_family = PF_INET6;
564
565 memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
566 sizeof(sa->sin6_addr));
567 }
568
569 static void
570 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
571 enum flow_entry_direction dir)
572 {
573 struct sockaddr_in sa4;
574 struct sockaddr_in6 sa6;
575 const char *city = NULL;
576
577 switch (n->l3_proto) {
578 default:
579 bug();
580
581 case AF_INET:
582 flow_entry_get_sain4_obj(n, dir, &sa4);
583 city = geoip4_city_name(&sa4);
584 break;
585
586 case AF_INET6:
587 flow_entry_get_sain6_obj(n, dir, &sa6);
588 city = geoip6_city_name(&sa6);
589 break;
590 }
591
592 build_bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
593
594 if (city) {
595 memcpy(SELFLD(dir, city_src, city_dst), city,
596 min(sizeof(n->city_src), strlen(city)));
597 } else {
598 memset(SELFLD(dir, city_src, city_dst), 0,
599 sizeof(n->city_src));
600 }
601 }
602
603 static void
604 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
605 enum flow_entry_direction dir)
606 {
607 struct sockaddr_in sa4;
608 struct sockaddr_in6 sa6;
609 const char *country = NULL;
610
611 switch (n->l3_proto) {
612 default:
613 bug();
614
615 case AF_INET:
616 flow_entry_get_sain4_obj(n, dir, &sa4);
617 country = geoip4_country_name(&sa4);
618 break;
619
620 case AF_INET6:
621 flow_entry_get_sain6_obj(n, dir, &sa6);
622 country = geoip6_country_name(&sa6);
623 break;
624 }
625
626 build_bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
627
628 if (country) {
629 memcpy(SELFLD(dir, country_src, country_dst), country,
630 min(sizeof(n->country_src), strlen(country)));
631 } else {
632 memset(SELFLD(dir, country_src, country_dst), 0,
633 sizeof(n->country_src));
634 }
635 }
636
637 static void flow_entry_get_extended_geo(struct flow_entry *n,
638 enum flow_entry_direction dir)
639 {
640 flow_entry_geo_city_lookup_generic(n, dir);
641 flow_entry_geo_country_lookup_generic(n, dir);
642 }
643
644 static void flow_entry_get_extended_revdns(struct flow_entry *n,
645 enum flow_entry_direction dir)
646 {
647 size_t sa_len;
648 struct sockaddr_in sa4;
649 struct sockaddr_in6 sa6;
650 struct sockaddr *sa;
651 struct hostent *hent;
652
653 switch (n->l3_proto) {
654 default:
655 bug();
656
657 case AF_INET:
658 flow_entry_get_sain4_obj(n, dir, &sa4);
659 sa = (struct sockaddr *) &sa4;
660 sa_len = sizeof(sa4);
661 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
662 break;
663
664 case AF_INET6:
665 flow_entry_get_sain6_obj(n, dir, &sa6);
666 sa = (struct sockaddr *) &sa6;
667 sa_len = sizeof(sa6);
668 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
669 break;
670 }
671
672 build_bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
673 getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
674 sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
675
676 if (hent) {
677 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
678 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
679 hent->h_name, min(sizeof(n->rev_dns_src),
680 strlen(hent->h_name)));
681 }
682 }
683
684 static void flow_entry_get_extended(struct flow_entry *n)
685 {
686 if (n->flow_id == 0)
687 return;
688
689 if (show_src) {
690 flow_entry_get_extended_revdns(n, flow_entry_src);
691 flow_entry_get_extended_geo(n, flow_entry_src);
692 }
693
694 flow_entry_get_extended_revdns(n, flow_entry_dst);
695 flow_entry_get_extended_geo(n, flow_entry_dst);
696
697 /* Lookup application */
698 n->inode = get_port_inode(n->port_src, n->l4_proto,
699 n->l3_proto == AF_INET6);
700 if (n->inode > 0)
701 walk_processes(n);
702 }
703
704 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, bool is_tcp)
705 {
706 if (src < dst && src < 1024) {
707 return src;
708 } else if (dst < src && dst < 1024) {
709 return dst;
710 } else {
711 const char *tmp1, *tmp2;
712 if (is_tcp) {
713 tmp1 = lookup_port_tcp(src);
714 tmp2 = lookup_port_tcp(dst);
715 } else {
716 tmp1 = lookup_port_udp(src);
717 tmp2 = lookup_port_udp(dst);
718 }
719 if (tmp1 && !tmp2) {
720 return src;
721 } else if (!tmp1 && tmp2) {
722 return dst;
723 } else {
724 if (src < dst)
725 return src;
726 else
727 return dst;
728 }
729 }
730 }
731
732 static char *bandw2str(double bytes, char *buf, size_t len)
733 {
734 if (bytes > 1000000000.)
735 snprintf(buf, len, "%.1fG", bytes / 1000000000.);
736 else if (bytes > 1000000.)
737 snprintf(buf, len, "%.1fM", bytes / 1000000.);
738 else if (bytes > 1000.)
739 snprintf(buf, len, "%.1fK", bytes / 1000.);
740 else
741 snprintf(buf, len, "%g", bytes);
742
743 return buf;
744 }
745
746 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
747 unsigned int *line)
748 {
749 char tmp[128], *pname = NULL;
750 uint16_t port;
751
752 mvwprintw(screen, *line, 2, "");
753
754 /* PID, application name */
755 if (n->procnum > 0) {
756 slprintf(tmp, sizeof(tmp), "%s(%d)", basename(n->cmdline),
757 n->procnum);
758
759 printw("[");
760 attron(COLOR_PAIR(3));
761 printw("%s", tmp);
762 attroff(COLOR_PAIR(3));
763 printw("]:");
764 }
765
766 /* L3 protocol, L4 protocol, states */
767 printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
768 printw("[");
769 attron(COLOR_PAIR(3));
770 switch (n->l4_proto) {
771 case IPPROTO_TCP:
772 printw("%s", tcp_state2str[n->tcp_state]);
773 break;
774 case IPPROTO_SCTP:
775 printw("%s", sctp_state2str[n->sctp_state]);
776 break;
777 case IPPROTO_DCCP:
778 printw("%s", dccp_state2str[n->dccp_state]);
779 break;
780 case IPPROTO_UDP:
781 case IPPROTO_UDPLITE:
782 case IPPROTO_ICMP:
783 case IPPROTO_ICMPV6:
784 printw("NOSTATE");
785 break;
786 }
787 attroff(COLOR_PAIR(3));
788 printw("]");
789
790 /* Guess application port */
791 switch (n->l4_proto) {
792 case IPPROTO_TCP:
793 port = presenter_get_port(n->port_src, n->port_dst, true);
794 pname = lookup_port_tcp(port);
795 break;
796 case IPPROTO_UDP:
797 case IPPROTO_UDPLITE:
798 port = presenter_get_port(n->port_src, n->port_dst, false);
799 pname = lookup_port_udp(port);
800 break;
801 }
802 if (pname) {
803 attron(A_BOLD);
804 printw(":%s", pname);
805 attroff(A_BOLD);
806 }
807
808 /* Show source information: reverse DNS, port, country, city, counters */
809 if (show_src) {
810 attron(COLOR_PAIR(1));
811 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
812 attroff(COLOR_PAIR(1));
813
814 printw(":%"PRIu16, n->port_src);
815
816 if (n->country_src[0]) {
817 printw(" (");
818
819 attron(COLOR_PAIR(4));
820 printw("%s", n->country_src);
821 attroff(COLOR_PAIR(4));
822
823 if (n->city_src[0])
824 printw(", %s", n->city_src);
825
826 printw(")");
827 }
828
829 if (n->src_pkts > 0 && n->src_bytes > 0) {
830 char bytes_str[64];
831
832 printw(" -> (%"PRIu64" pkts, %s bytes)", n->src_pkts,
833 bandw2str(n->src_bytes, bytes_str,
834 sizeof(bytes_str) - 1));
835 }
836
837 printw(" => ");
838 }
839
840 /* Show dest information: reverse DNS, port, country, city, counters */
841 attron(COLOR_PAIR(2));
842 mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
843 attroff(COLOR_PAIR(2));
844
845 printw(":%"PRIu16, n->port_dst);
846
847 if (n->country_dst[0]) {
848 printw(" (");
849
850 attron(COLOR_PAIR(4));
851 printw("%s", n->country_dst);
852 attroff(COLOR_PAIR(4));
853
854 if (n->city_dst[0])
855 printw(", %s", n->city_dst);
856
857 printw(")");
858 }
859
860 if (n->dst_pkts > 0 && n->dst_bytes > 0) {
861 char bytes_str[64];
862
863 printw(" -> (%"PRIu64" pkts, %s bytes)", n->dst_pkts,
864 bandw2str(n->dst_bytes, bytes_str,
865 sizeof(bytes_str) - 1));
866 }
867 }
868
869 static inline bool presenter_flow_wrong_state(struct flow_entry *n)
870 {
871 switch (n->l4_proto) {
872 case IPPROTO_TCP:
873 switch (n->tcp_state) {
874 case TCP_CONNTRACK_SYN_SENT:
875 case TCP_CONNTRACK_SYN_RECV:
876 case TCP_CONNTRACK_ESTABLISHED:
877 case TCP_CONNTRACK_FIN_WAIT:
878 case TCP_CONNTRACK_CLOSE_WAIT:
879 case TCP_CONNTRACK_LAST_ACK:
880 case TCP_CONNTRACK_TIME_WAIT:
881 case TCP_CONNTRACK_CLOSE:
882 case TCP_CONNTRACK_SYN_SENT2:
883 case TCP_CONNTRACK_NONE:
884 return false;
885 break;
886 }
887 break;
888 case IPPROTO_SCTP:
889 switch (n->sctp_state) {
890 case SCTP_CONNTRACK_NONE:
891 case SCTP_CONNTRACK_CLOSED:
892 case SCTP_CONNTRACK_COOKIE_WAIT:
893 case SCTP_CONNTRACK_COOKIE_ECHOED:
894 case SCTP_CONNTRACK_ESTABLISHED:
895 case SCTP_CONNTRACK_SHUTDOWN_SENT:
896 case SCTP_CONNTRACK_SHUTDOWN_RECD:
897 case SCTP_CONNTRACK_SHUTDOWN_ACK_SENT:
898 return false;
899 break;
900 }
901 break;
902 case IPPROTO_DCCP:
903 switch (n->dccp_state) {
904 case DCCP_CONNTRACK_NONE:
905 case DCCP_CONNTRACK_REQUEST:
906 case DCCP_CONNTRACK_RESPOND:
907 case DCCP_CONNTRACK_PARTOPEN:
908 case DCCP_CONNTRACK_OPEN:
909 case DCCP_CONNTRACK_CLOSEREQ:
910 case DCCP_CONNTRACK_CLOSING:
911 case DCCP_CONNTRACK_TIMEWAIT:
912 case DCCP_CONNTRACK_IGNORE:
913 case DCCP_CONNTRACK_INVALID:
914 return false;
915 break;
916 }
917 break;
918 case IPPROTO_UDP:
919 case IPPROTO_UDPLITE:
920 case IPPROTO_ICMP:
921 case IPPROTO_ICMPV6:
922 return false;
923 break;
924 }
925
926 return true;
927 }
928
929 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
930 int skip_lines)
931 {
932 int maxy;
933 int skip_left = skip_lines;
934 unsigned int flows = 0;
935 unsigned int line = 3;
936 struct flow_entry *n;
937
938 curs_set(0);
939
940 maxy = getmaxy(screen);
941 maxy -= 6;
942
943 start_color();
944 init_pair(1, COLOR_RED, COLOR_BLACK);
945 init_pair(2, COLOR_BLUE, COLOR_BLACK);
946 init_pair(3, COLOR_YELLOW, COLOR_BLACK);
947 init_pair(4, COLOR_GREEN, COLOR_BLACK);
948
949 wclear(screen);
950 clear();
951
952 rcu_read_lock();
953
954 n = rcu_dereference(fl->head);
955 if (!n)
956 mvwprintw(screen, line, 2, "(No active sessions! "
957 "Is netfilter running?)");
958
959 for (; n; n = rcu_dereference(n->next)) {
960 n->is_visible = false;
961
962 if (presenter_flow_wrong_state(n))
963 continue;
964
965 /* count only flows which might be showed */
966 flows++;
967
968 if (maxy <= 0)
969 continue;
970
971 if (skip_left > 0) {
972 skip_left--;
973 continue;
974 }
975
976 n->is_visible = true;
977
978 presenter_screen_do_line(screen, n, &line);
979
980 line++;
981 maxy -= (2 + 1 * show_src);
982 }
983
984 mvwprintw(screen, 1, 2,
985 "Kernel netfilter flows(%u) for %s%s%s%s%s%s"
986 "[+%d]", flows, what & INCLUDE_TCP ? "TCP, " : "",
987 what & INCLUDE_UDP ? "UDP, " : "",
988 what & INCLUDE_SCTP ? "SCTP, " : "",
989 what & INCLUDE_DCCP ? "DCCP, " : "",
990 what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
991 what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
992 skip_lines);
993
994 if (is_flow_collecting)
995 printw(" [Collecting flows ...]");
996
997 rcu_read_unlock();
998
999 wrefresh(screen);
1000 refresh();
1001 }
1002
1003 static void presenter(void)
1004 {
1005 int skip_lines = 0;
1006 WINDOW *screen;
1007
1008 lookup_init_ports(PORTS_TCP);
1009 lookup_init_ports(PORTS_UDP);
1010 screen = screen_init(false);
1011
1012 rcu_register_thread();
1013 while (!sigint) {
1014 switch (getch()) {
1015 case 'q':
1016 sigint = 1;
1017 break;
1018 case KEY_UP:
1019 case 'u':
1020 case 'k':
1021 skip_lines--;
1022 if (skip_lines < 0)
1023 skip_lines = 0;
1024 break;
1025 case KEY_DOWN:
1026 case 'd':
1027 case 'j':
1028 skip_lines++;
1029 if (skip_lines > SCROLL_MAX)
1030 skip_lines = SCROLL_MAX;
1031 break;
1032 default:
1033 fflush(stdin);
1034 break;
1035 }
1036
1037 presenter_screen_update(screen, &flow_list, skip_lines);
1038 usleep(200000);
1039 }
1040 rcu_unregister_thread();
1041
1042 screen_end();
1043 lookup_cleanup_ports(PORTS_UDP);
1044 lookup_cleanup_ports(PORTS_TCP);
1045 }
1046
1047 static int flow_event_cb(enum nf_conntrack_msg_type type,
1048 struct nf_conntrack *ct, void *data __maybe_unused)
1049 {
1050 if (sigint)
1051 return NFCT_CB_STOP;
1052
1053 synchronize_rcu();
1054 spinlock_lock(&flow_list.lock);
1055
1056 switch (type) {
1057 case NFCT_T_NEW:
1058 flow_list_new_entry(&flow_list, ct);
1059 break;
1060 case NFCT_T_UPDATE:
1061 flow_list_update_entry(&flow_list, ct);
1062 break;
1063 case NFCT_T_DESTROY:
1064 flow_list_destroy_entry(&flow_list, ct);
1065 break;
1066 default:
1067 break;
1068 }
1069
1070 spinlock_unlock(&flow_list.lock);
1071
1072 return NFCT_CB_CONTINUE;
1073 }
1074
1075 static void restore_sysctl(void *value)
1076 {
1077 int int_val = *(int *)value;
1078
1079 if (int_val == 0)
1080 sysctl_set_int("net/netfilter/nf_conntrack_acct", int_val);
1081 }
1082
1083 static void on_panic_handler(void *arg)
1084 {
1085 restore_sysctl(arg);
1086 screen_end();
1087 }
1088
1089 static void conntrack_acct_enable(void)
1090 {
1091 /* We can still work w/o traffic accounting so just warn about error */
1092 if (sysctl_get_int("net/netfilter/nf_conntrack_acct", &nfct_acct_val)) {
1093 fprintf(stderr, "Can't read net/netfilter/nf_conntrack_acct: %s\n",
1094 strerror(errno));
1095 }
1096
1097 if (nfct_acct_val == 1)
1098 return;
1099
1100 if (sysctl_set_int("net/netfilter/nf_conntrack_acct", 1)) {
1101 fprintf(stderr, "Can't write net/netfilter/nf_conntrack_acct: %s\n",
1102 strerror(errno));
1103 }
1104 }
1105
1106 static int flow_update_cb(enum nf_conntrack_msg_type type,
1107 struct nf_conntrack *ct, void *data __maybe_unused)
1108 {
1109 struct flow_entry *n;
1110
1111 if (type != NFCT_T_UPDATE)
1112 return NFCT_CB_CONTINUE;
1113
1114 if (sigint)
1115 return NFCT_CB_STOP;
1116
1117 n = flow_list_find_id(&flow_list, nfct_get_attr_u32(ct, ATTR_ID));
1118 if (!n)
1119 return NFCT_CB_CONTINUE;
1120
1121 flow_entry_from_ct(n, ct);
1122
1123 return NFCT_CB_CONTINUE;
1124 }
1125
1126 static void collector_refresh_flows(struct nfct_handle *handle)
1127 {
1128 struct flow_entry *n;
1129
1130 n = rcu_dereference(flow_list.head);
1131 for (; n; n = rcu_dereference(n->next)) {
1132 if (!n->is_visible)
1133 continue;
1134
1135 nfct_query(handle, NFCT_Q_GET, n->ct);
1136 }
1137 }
1138
1139 static void collector_create_filter(struct nfct_handle *nfct)
1140 {
1141 struct nfct_filter *filter;
1142 int ret;
1143
1144 filter = nfct_filter_create();
1145 if (!filter)
1146 panic("Cannot create a nfct filter: %s\n", strerror(errno));
1147
1148 if (what & INCLUDE_UDP) {
1149 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1150 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1151 }
1152 if (what & INCLUDE_TCP)
1153 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1154 if (what & INCLUDE_DCCP)
1155 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1156 if (what & INCLUDE_SCTP)
1157 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1158 if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1159 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1160 if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1161 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1162 if (what & INCLUDE_IPV4) {
1163 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1164 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1165 }
1166 if (what & INCLUDE_IPV6) {
1167 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1168 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1169 }
1170
1171 ret = nfct_filter_attach(nfct_fd(nfct), filter);
1172 if (ret < 0)
1173 panic("Cannot attach filter to handle: %s\n", strerror(errno));
1174
1175 nfct_filter_destroy(filter);
1176 }
1177
1178 /* This hand-crafted filter looks ugly but it allows to do not
1179 * flush nfct connections & filter them by user specified filter.
1180 * May be it is better to replace this one by nfct_cmp. */
1181 static int flow_dump_cb(enum nf_conntrack_msg_type type,
1182 struct nf_conntrack *ct, void *data __maybe_unused)
1183 {
1184 struct flow_entry fl;
1185 struct flow_entry *n = &fl;
1186
1187 if (sigint)
1188 return NFCT_CB_STOP;
1189
1190 synchronize_rcu();
1191 spinlock_lock(&flow_list.lock);
1192
1193 if (!(what & ~(INCLUDE_IPV4 | INCLUDE_IPV6)))
1194 goto check_addr;
1195
1196 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
1197
1198 if (what & INCLUDE_UDP) {
1199 if (n->l4_proto == IPPROTO_UDP)
1200 goto check_addr;
1201
1202 if (n->l4_proto == IPPROTO_UDPLITE)
1203 goto check_addr;
1204
1205 }
1206 if ((what & INCLUDE_TCP) && n->l4_proto == IPPROTO_TCP)
1207 goto check_addr;
1208
1209 if ((what & INCLUDE_DCCP) && n->l4_proto == IPPROTO_DCCP)
1210 goto check_addr;
1211
1212 if ((what & INCLUDE_SCTP) && n->l4_proto == IPPROTO_SCTP)
1213 goto check_addr;
1214
1215 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV4) &&
1216 n->l4_proto == IPPROTO_ICMP) {
1217 goto check_addr;
1218 }
1219
1220 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV6) &&
1221 n->l4_proto == IPPROTO_ICMPV6) {
1222 goto check_addr;
1223 }
1224
1225 goto skip_flow;
1226
1227 check_addr:
1228 /* filter loopback addresses */
1229 if (what & INCLUDE_IPV4) {
1230 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
1231
1232 if (n->ip4_src_addr == filter_ipv4.addr)
1233 goto skip_flow;
1234 }
1235 if (what & INCLUDE_IPV6) {
1236 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
1237
1238 if (n->ip6_src_addr[0] == 0x0 &&
1239 n->ip6_src_addr[1] == 0x0 &&
1240 n->ip6_src_addr[2] == 0x0 &&
1241 n->ip6_src_addr[3] == 0x1)
1242 goto skip_flow;
1243 }
1244
1245 flow_list_new_entry(&flow_list, ct);
1246
1247 skip_flow:
1248 spinlock_unlock(&flow_list.lock);
1249 return NFCT_CB_CONTINUE;
1250 }
1251
1252 static void collector_dump_flows(void)
1253 {
1254 struct nfct_handle *nfct = nfct_open(CONNTRACK, 0);
1255
1256 if (!nfct)
1257 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1258
1259 nfct_callback_register(nfct, NFCT_T_ALL, flow_dump_cb, NULL);
1260
1261 is_flow_collecting = true;
1262 if (what & INCLUDE_IPV4) {
1263 int family = AF_INET;
1264 nfct_query(nfct, NFCT_Q_DUMP, &family);
1265 }
1266 if (what & INCLUDE_IPV6) {
1267 int family = AF_INET6;
1268 nfct_query(nfct, NFCT_Q_DUMP, &family);
1269 }
1270 is_flow_collecting = false;
1271
1272 nfct_close(nfct);
1273 }
1274
1275 static void *collector(void *null __maybe_unused)
1276 {
1277 struct nfct_handle *ct_update;
1278 struct nfct_handle *ct_event;
1279 struct pollfd poll_fd[1];
1280
1281 flow_list_init(&flow_list);
1282
1283 ct_event = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1284 NF_NETLINK_CONNTRACK_UPDATE |
1285 NF_NETLINK_CONNTRACK_DESTROY);
1286 if (!ct_event)
1287 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1288
1289 collector_create_filter(ct_event);
1290
1291 nfct_callback_register(ct_event, NFCT_T_ALL, flow_event_cb, NULL);
1292
1293 ct_update = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_UPDATE);
1294 if (!ct_update)
1295 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1296
1297 nfct_callback_register(ct_update, NFCT_T_ALL, flow_update_cb, NULL);
1298
1299 poll_fd[0].fd = nfct_fd(ct_event);
1300 poll_fd[0].events = POLLIN;
1301
1302 if (fcntl(nfct_fd(ct_event), F_SETFL, O_NONBLOCK) == -1)
1303 panic("Cannot set non-blocking socket: fcntl(): %s\n",
1304 strerror(errno));
1305
1306 if (fcntl(nfct_fd(ct_update), F_SETFL, O_NONBLOCK) == -1)
1307 panic("Cannot set non-blocking socket: fcntl(): %s\n",
1308 strerror(errno));
1309
1310 rcu_register_thread();
1311
1312 collector_dump_flows();
1313
1314 while (!sigint) {
1315 int status;
1316
1317 usleep(300000);
1318
1319 collector_refresh_flows(ct_update);
1320
1321 status = poll(poll_fd, 1, 0);
1322 if (status < 0) {
1323 if (errno == EAGAIN || errno == EINTR)
1324 continue;
1325
1326 panic("Error while polling: %s\n", strerror(errno));
1327 } else if (status == 0) {
1328 continue;
1329 }
1330
1331 if (poll_fd[0].revents & POLLIN)
1332 nfct_catch(ct_event);
1333 }
1334
1335 rcu_unregister_thread();
1336
1337 flow_list_destroy(&flow_list);
1338 nfct_close(ct_event);
1339 nfct_close(ct_update);
1340
1341 pthread_exit(NULL);
1342 }
1343
1344 int main(int argc, char **argv)
1345 {
1346 pthread_t tid;
1347 int ret, c, opt_index, what_cmd = 0;
1348
1349 setfsuid(getuid());
1350 setfsgid(getgid());
1351
1352 while ((c = getopt_long(argc, argv, short_options, long_options,
1353 &opt_index)) != EOF) {
1354 switch (c) {
1355 case '4':
1356 what_cmd |= INCLUDE_IPV4;
1357 break;
1358 case '6':
1359 what_cmd |= INCLUDE_IPV6;
1360 break;
1361 case 'T':
1362 what_cmd |= INCLUDE_TCP;
1363 break;
1364 case 'U':
1365 what_cmd |= INCLUDE_UDP;
1366 break;
1367 case 'D':
1368 what_cmd |= INCLUDE_DCCP;
1369 break;
1370 case 'I':
1371 what_cmd |= INCLUDE_ICMP;
1372 break;
1373 case 'S':
1374 what_cmd |= INCLUDE_SCTP;
1375 break;
1376 case 's':
1377 show_src = 1;
1378 break;
1379 case 'u':
1380 update_geoip();
1381 die();
1382 break;
1383 case 'h':
1384 help();
1385 break;
1386 case 'v':
1387 version();
1388 break;
1389 default:
1390 break;
1391 }
1392 }
1393
1394 if (what_cmd > 0) {
1395 what = what_cmd;
1396
1397 if (!(what & (INCLUDE_IPV4 | INCLUDE_IPV6)))
1398 what |= INCLUDE_IPV4 | INCLUDE_IPV6;
1399 }
1400
1401 rcu_init();
1402
1403 register_signal(SIGINT, signal_handler);
1404 register_signal(SIGQUIT, signal_handler);
1405 register_signal(SIGTERM, signal_handler);
1406 register_signal(SIGHUP, signal_handler);
1407
1408 panic_handler_add(on_panic_handler, &nfct_acct_val);
1409
1410 conntrack_acct_enable();
1411
1412 init_geoip(1);
1413
1414 ret = pthread_create(&tid, NULL, collector, NULL);
1415 if (ret < 0)
1416 panic("Cannot create phthread!\n");
1417
1418 presenter();
1419
1420 destroy_geoip();
1421
1422 restore_sysctl(&nfct_acct_val);
1423
1424 return 0;
1425 }
New netsniff-ng tree