src/flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2011 - 2012 Daniel Borkmann.
   5  * Copyright 2011 Emmanuel Roullit.
   6  * Subject to the GPL, version 2.
   7  *
   8  * A tiny tool to provide top-like netfilter connection tracking information.
   9  *
  10  *   The Dark Lord has Nine. But we have One, mightier than they: the White
  11  *   Rider. He has passed through the fire and the abyss, and they shall
  12  *   fear him. We will go where he leads.
  13  *
  14  *     -- The Lord of the Rings, Aragorn,
  15  *        Chapter 'The White Rider'.
  16  */
  17
  18 #define _LGPL_SOURCE
  19 #include <stdio.h>
  20 #include <stdint.h>
  21 #include <stdlib.h>
  22 #include <signal.h>
  23 #include <getopt.h>
  24 #include <pthread.h>
  25 #include <signal.h>
  26 #include <netdb.h>
  27 #include <ctype.h>
  28 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
  29 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
  30 #include <libnetfilter_conntrack/libnetfilter_conntrack_dccp.h>
  31 #include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
  32 #include <GeoIP.h>
  33 #include <GeoIPCity.h>
  34 #include <netinet/in.h>
  35 #include <curses.h>
  36 #include <dirent.h>
  37 #include <sys/stat.h>
  38 #include <urcu.h>
  39 #include <libgen.h>
  40
  41 #include "die.h"
  42 #include "xmalloc.h"
  43 #include "xio.h"
  44 #include "xutils.h"
  45 #include "built_in.h"
  46 #include "locking.h"
  47 #include "dissector_eth.h"
  48 #include "pkt_buff.h"
  49
  50 struct geo_ip_db {
  51         GeoIP *gi4, *gi6;
  52         char *path4, *path6;
  53 };
  54
  55 struct flow_entry {
  56         uint32_t flow_id, use, status;
  57         uint8_t  l3_proto, l4_proto;
  58         uint32_t ip4_src_addr, ip4_dst_addr;
  59         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  60         uint16_t port_src, port_dst;
  61         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  62         uint64_t counter_pkts, counter_bytes;
  63         uint64_t timestamp_start, timestamp_stop;
  64         char country_src[128], country_dst[128];
  65         char city_src[128], city_dst[128];
  66         char rev_dns_src[256], rev_dns_dst[256];
  67         char cmdline[256];
  68         struct flow_entry *next;
  69         int procnum, inode;
  70         unsigned int flags;
  71 };
  72
  73 struct flow_list {
  74         struct flow_entry *head;
  75         struct spinlock lock;
  76 };
  77
  78 #ifndef ATTR_TIMESTAMP_START
  79 # define ATTR_TIMESTAMP_START 63
  80 #endif
  81 #ifndef ATTR_TIMESTAMP_STOP
  82 # define ATTR_TIMESTAMP_STOP 64
  83 #endif
  84
  85 #define SCROLL_MAX 1000
  86
  87 #define INCLUDE_IPV4    (1 << 0)
  88 #define INCLUDE_IPV6    (1 << 1)
  89 #define INCLUDE_UDP     (1 << 2)
  90 #define INCLUDE_TCP     (1 << 3)
  91 #define INCLUDE_DCCP    (1 << 4)
  92 #define INCLUDE_ICMP    (1 << 5)
  93 #define INCLUDE_SCTP    (1 << 6)
  94
  95 #define PRES_FLAG_COUNTERS      (1 << 0)
  96 #define PRES_FLAG_TCP_STATE     (1 << 1)
  97 #define PRES_FLAG_DCCP_STATE    (1 << 2)
  98 #define PRES_FLAG_SCTP_STATE    (1 << 3)
  99
 100 volatile sig_atomic_t sigint = 0;
 101
 102 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
 103
 104 struct geo_ip_db geo_country, geo_city;
 105
 106 static struct flow_list flow_list;
 107
 108 static const char *short_options = "vhTULKsOPDIS46";
 109 static const struct option long_options[] = {
 110         {"ipv4",        no_argument,            NULL, '4'},
 111         {"ipv6",        no_argument,            NULL, '6'},
 112         {"tcp",         no_argument,            NULL, 'T'},
 113         {"udp",         no_argument,            NULL, 'U'},
 114         {"dccp",        no_argument,            NULL, 'D'},
 115         {"icmp",        no_argument,            NULL, 'I'},
 116         {"sctp",        no_argument,            NULL, 'S'},
 117         {"show-src",    no_argument,            NULL, 's'},
 118         {"city-db4",    required_argument,      NULL, 'L'},
 119         {"country-db4", required_argument,      NULL, 'K'},
 120         {"city-db6",    required_argument,      NULL, 'O'},
 121         {"country-db6", required_argument,      NULL, 'P'},
 122         {"version",     no_argument,            NULL, 'v'},
 123         {"help",        no_argument,            NULL, 'h'},
 124         {NULL, 0, NULL, 0}
 125 };
 126
 127 static const char *const l3proto2str[AF_MAX] = {
 128         [AF_INET]                       = "ipv4",
 129         [AF_INET6]                      = "ipv6",
 130 };
 131
 132 static const char *const l4proto2str[IPPROTO_MAX] = {
 133         [IPPROTO_TCP]                   = "tcp",
 134         [IPPROTO_UDP]                   = "udp",
 135         [IPPROTO_UDPLITE]               = "udplite",
 136         [IPPROTO_ICMP]                  = "icmp",
 137         [IPPROTO_ICMPV6]                = "icmpv6",
 138         [IPPROTO_SCTP]                  = "sctp",
 139         [IPPROTO_GRE]                   = "gre",
 140         [IPPROTO_DCCP]                  = "dccp",
 141         [IPPROTO_IGMP]                  = "igmp",
 142         [IPPROTO_IPIP]                  = "ipip",
 143         [IPPROTO_EGP]                   = "egp",
 144         [IPPROTO_PUP]                   = "pup",
 145         [IPPROTO_IDP]                   = "idp",
 146         [IPPROTO_RSVP]                  = "rsvp",
 147         [IPPROTO_IPV6]                  = "ip6tun",
 148         [IPPROTO_ESP]                   = "esp",
 149         [IPPROTO_AH]                    = "ah",
 150         [IPPROTO_PIM]                   = "pim",
 151         [IPPROTO_COMP]                  = "comp",
 152 };
 153
 154 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 155         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 156         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 157         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 158         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 159         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 160         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 161         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 162         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 163         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 164         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 165 };
 166
 167 static const uint8_t tcp_states[] = {
 168         TCP_CONNTRACK_SYN_SENT,
 169         TCP_CONNTRACK_SYN_RECV,
 170         TCP_CONNTRACK_ESTABLISHED,
 171         TCP_CONNTRACK_FIN_WAIT,
 172         TCP_CONNTRACK_CLOSE_WAIT,
 173         TCP_CONNTRACK_LAST_ACK,
 174         TCP_CONNTRACK_TIME_WAIT,
 175         TCP_CONNTRACK_CLOSE,
 176         TCP_CONNTRACK_SYN_SENT2,
 177         TCP_CONNTRACK_NONE,
 178 };
 179
 180 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 181         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 182         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 183         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 184         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 185         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 186         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 187         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 188         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 189         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 190         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 191 };
 192
 193 static const uint8_t dccp_states[] = {
 194         DCCP_CONNTRACK_NONE,
 195         DCCP_CONNTRACK_REQUEST,
 196         DCCP_CONNTRACK_RESPOND,
 197         DCCP_CONNTRACK_PARTOPEN,
 198         DCCP_CONNTRACK_OPEN,
 199         DCCP_CONNTRACK_CLOSEREQ,
 200         DCCP_CONNTRACK_CLOSING,
 201         DCCP_CONNTRACK_TIMEWAIT,
 202         DCCP_CONNTRACK_IGNORE,
 203         DCCP_CONNTRACK_INVALID,
 204 };
 205
 206 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 207         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 208         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 209         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 210         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 211         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 212         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 213         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 214         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 215 };
 216
 217 static const uint8_t sctp_states[] = {
 218         SCTP_CONNTRACK_NONE,
 219         SCTP_CONNTRACK_CLOSED,
 220         SCTP_CONNTRACK_COOKIE_WAIT,
 221         SCTP_CONNTRACK_COOKIE_ECHOED,
 222         SCTP_CONNTRACK_ESTABLISHED,
 223         SCTP_CONNTRACK_SHUTDOWN_SENT,
 224         SCTP_CONNTRACK_SHUTDOWN_RECD,
 225         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 226 };
 227
 228 static const struct nfct_filter_ipv4 filter_ipv4 = {
 229         .addr = __constant_htonl(INADDR_LOOPBACK),
 230         .mask = 0xffffffff,
 231 };
 232
 233 static const struct nfct_filter_ipv6 filter_ipv6 = {
 234         .addr = { 0x0, 0x0, 0x0, 0x1 },
 235         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 236 };
 237
 238 static void signal_handler(int number)
 239 {
 240         switch (number) {
 241         case SIGINT:
 242                 sigint = 1;
 243                 break;
 244         case SIGHUP:
 245         default:
 246                 break;
 247         }
 248 }
 249
 250 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 251 static void flow_entry_get_extended(struct flow_entry *n);
 252
 253 static void help(void)
 254 {
 255         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 256                VERSION_STRING);
 257         puts("http://www.netsniff-ng.org\n\n"
 258              "Usage: flowtop [options]\n"
 259              "Options:\n"
 260              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 261              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 262              "  -T|--tcp               Show only TCP flows (default)\n"
 263              "  -U|--udp               Show only UDP flows\n"
 264              "  -D|--dccp              Show only DCCP flows\n"
 265              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 266              "  -S|--sctp              Show only SCTP flows\n"
 267              "  -s|--show-src          Also show source, not only dest\n"
 268              "  --city-db4 <path>      Specifiy path for geoip4 city database\n"
 269              "  --country-db4 <path>   Specifiy path for geoip4 country database\n"
 270              "  --city-db6 <path>      Specifiy path for geoip6 city database\n"
 271              "  --country-db6 <path>   Specifiy path for geoip6 country database\n"
 272              "  -v|--version           Print version\n"
 273              "  -h|--help              Print this help\n\n"
 274              "Examples:\n"
 275              "  flowtop\n"
 276              "  flowtop -46UTDISs\n\n"
 277              "Note:\n"
 278              "  If netfilter is not running, you can activate it with e.g.:\n"
 279              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 280              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
 281              "Please report bugs to <bugs@netsniff-ng.org>\n"
 282              "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
 283              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
 284              "License: GNU GPL version 2.0\n"
 285              "This is free software: you are free to change and redistribute it.\n"
 286              "There is NO WARRANTY, to the extent permitted by law.\n");
 287         die();
 288 }
 289
 290 static void version(void)
 291 {
 292         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 293                VERSION_STRING);
 294         puts("http://www.netsniff-ng.org\n\n"
 295              "Please report bugs to <bugs@netsniff-ng.org>\n"
 296              "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
 297              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
 298              "License: GNU GPL version 2.0\n"
 299              "This is free software: you are free to change and redistribute it.\n"
 300              "There is NO WARRANTY, to the extent permitted by law.\n");
 301         die();
 302 }
 303
 304 static inline struct flow_entry *flow_entry_xalloc(void)
 305 {
 306         return xzmalloc(sizeof(struct flow_entry));
 307 }
 308
 309 static inline void flow_entry_xfree(struct flow_entry *n)
 310 {
 311         xfree(n);
 312 }
 313
 314 static inline void flow_list_init(struct flow_list *fl)
 315 {
 316         fl->head = NULL;
 317         spinlock_init(&fl->lock);
 318 }
 319
 320 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 321 {
 322         struct flow_entry *n = flow_entry_xalloc();
 323
 324         flow_entry_from_ct(n, ct);
 325         flow_entry_get_extended(n);
 326
 327         rcu_assign_pointer(n->next, fl->head);
 328         rcu_assign_pointer(fl->head, n);
 329 }
 330
 331 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 332                                             uint32_t id)
 333 {
 334         struct flow_entry *n = rcu_dereference(fl->head);
 335
 336         while (n != NULL) {
 337                 if (n->flow_id == id)
 338                         return n;
 339
 340                 n = rcu_dereference(n->next);
 341         }
 342
 343         return NULL;
 344 }
 345
 346 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 347                                                  uint32_t id)
 348 {
 349         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 350
 351         if (n->flow_id == id)
 352                 return NULL;
 353
 354         while ((tmp = rcu_dereference(n->next)) != NULL) {
 355                 if (tmp->flow_id == id)
 356                         return n;
 357
 358                 n = tmp;
 359         }
 360
 361         return NULL;
 362 }
 363
 364 static void flow_list_update_entry(struct flow_list *fl,
 365                                    struct nf_conntrack *ct)
 366 {
 367         int do_ext = 0;
 368         struct flow_entry *n;
 369
 370         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 371         if (n == NULL) {
 372                 n = flow_entry_xalloc();
 373                 do_ext = 1;
 374         }
 375
 376         flow_entry_from_ct(n, ct);
 377         if (do_ext) {
 378                 flow_entry_get_extended(n);
 379
 380                 rcu_assign_pointer(n->next, fl->head);
 381                 rcu_assign_pointer(fl->head, n);
 382         }
 383 }
 384
 385 static void flow_list_destroy_entry(struct flow_list *fl,
 386                                     struct nf_conntrack *ct)
 387 {
 388         struct flow_entry *n1, *n2;
 389         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 390
 391         n1 = flow_list_find_id(fl, id);
 392         if (n1) {
 393                 n2 = flow_list_find_prev_id(fl, id);
 394                 if (n2) {
 395                         rcu_assign_pointer(n2->next, n1->next);
 396                         rcu_assign_pointer(n1->next, NULL);
 397
 398                         flow_entry_xfree(n1);
 399                 } else {
 400                         flow_entry_xfree(fl->head);
 401
 402                         rcu_assign_pointer(fl->head, NULL);
 403                 }
 404         }
 405 }
 406
 407 static void flow_list_destroy(struct flow_list *fl)
 408 {
 409         struct flow_entry *n;
 410
 411         while (fl->head != NULL) {
 412                 n = rcu_dereference(fl->head->next);
 413                 rcu_assign_pointer(fl->head->next, NULL);
 414
 415                 flow_entry_xfree(fl->head);
 416                 rcu_assign_pointer(fl->head, n);
 417         }
 418
 419         synchronize_rcu();
 420         spinlock_destroy(&fl->lock);
 421 }
 422
 423 static int walk_process(char *process, struct flow_entry *n)
 424 {
 425         int ret;
 426         DIR *dir;
 427         struct dirent *ent;
 428         char path[1024];
 429
 430         if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
 431                 panic("giant process name! %s\n", process);
 432
 433         dir = opendir(path);
 434         if (!dir)
 435                 return 0;
 436
 437         while ((ent = readdir(dir))) {
 438                 struct stat statbuf;
 439
 440                 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
 441                              process, ent->d_name) < 0)
 442                         continue;
 443
 444                 if (stat(path, &statbuf) < 0)
 445                         continue;
 446
 447                 if (S_ISSOCK(statbuf.st_mode) && n->inode == statbuf.st_ino) {
 448                         memset(n->cmdline, 0, sizeof(n->cmdline));
 449
 450                         snprintf(path, sizeof(path), "/proc/%s/exe", process);
 451
 452                         ret = readlink(path, n->cmdline,
 453                                        sizeof(n->cmdline) - 1);
 454                         if (ret < 0)
 455                                 panic("readlink error: %s\n", strerror(errno));
 456
 457                         n->procnum = atoi(process);
 458                         return 1;
 459                 }
 460         }
 461
 462         closedir(dir);
 463         return 0;
 464 }
 465
 466 static void walk_processes(struct flow_entry *n)
 467 {
 468         int ret;
 469         DIR *dir;
 470         struct dirent *ent;
 471
 472         /* n->inode must be set */
 473         if (n->inode <= 0) {
 474                 memset(n->cmdline, 0, sizeof(n->cmdline));
 475                 return;
 476         }
 477
 478         dir = opendir("/proc");
 479         if (!dir)
 480                 panic("Cannot open /proc!\n");
 481
 482         while ((ent = readdir(dir))) {
 483                 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
 484                         ret = walk_process(ent->d_name, n);
 485                         if (ret > 0)
 486                                 break;
 487                 }
 488         }
 489
 490         closedir(dir);
 491 }
 492
 493 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 494 {
 495         int ret = -ENOENT;
 496         char path[128], buff[1024];
 497         FILE *proc;
 498
 499         memset(path, 0, sizeof(path));
 500         snprintf(path, sizeof(path), "/proc/net/%s%s",
 501                  l4proto2str[proto], is_ip6 ? "6" : "");
 502
 503         proc = fopen(path, "r");
 504         if (!proc)
 505                 return -EIO;
 506
 507         memset(buff, 0, sizeof(buff));
 508
 509         while (fgets(buff, sizeof(buff), proc) != NULL) {
 510                 int inode = 0;
 511                 unsigned int lport = 0;
 512
 513                 buff[sizeof(buff) - 1] = 0;
 514                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 515                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 516                         if ((uint16_t) lport == port) {
 517                                 ret = inode;
 518                                 break;
 519                         }
 520                 }
 521
 522                 memset(buff, 0, sizeof(buff));
 523         }
 524
 525         fclose(proc);
 526         return ret;
 527 }
 528
 529 #define CP_NFCT(elem, attr, x)                          \
 530         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 531 #define CP_NFCT_BUFF(elem, attr) do {                   \
 532         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 533         if (buff != NULL)                               \
 534                 memcpy(n->elem, buff, sizeof(n->elem)); \
 535 } while (0)
 536
 537 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 538 {
 539         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 540         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 541
 542         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 543         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 544
 545         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 546         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 547
 548         CP_NFCT(status, ATTR_STATUS, 32);
 549
 550         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 551         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 552         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 553         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 554
 555         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 556         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 557
 558         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 559         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 560
 561         CP_NFCT(flow_id, ATTR_ID, 32);
 562         CP_NFCT(use, ATTR_USE, 32);
 563
 564         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 565         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 566
 567         n->port_src = ntohs(n->port_src);
 568         n->port_dst = ntohs(n->port_dst);
 569
 570         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 571         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 572 }
 573
 574 enum flow_entry_direction {
 575         flow_entry_src,
 576         flow_entry_dst,
 577 };
 578
 579 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 580 {
 581         /* We don't want to analyze / display DNS itself, since we
 582          * use it to resolve reverse dns.
 583          */
 584         return n->port_src == 53 || n->port_dst == 53;
 585 }
 586
 587 #define SELFLD(dir,src_member,dst_member)       \
 588         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 589
 590 static struct sockaddr_in *
 591 flow_entry_get_sain4_obj(struct flow_entry *n, enum flow_entry_direction dir,
 592                          struct sockaddr_in *sa)
 593 {
 594         memset(sa, 0, sizeof(*sa));
 595         sa->sin_family = PF_INET;
 596         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 597
 598         return sa;
 599 }
 600
 601 static struct sockaddr_in6 *
 602 flow_entry_get_sain6_obj(struct flow_entry *n, enum flow_entry_direction dir,
 603                          struct sockaddr_in6 *sa)
 604 {
 605         memset(sa, 0, sizeof(*sa));
 606         sa->sin6_family = PF_INET6;
 607
 608         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 609                sizeof(SELFLD(dir, ip6_src_addr, ip6_dst_addr)));
 610
 611         return sa;
 612 }
 613
 614 static void
 615 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 616                                    enum flow_entry_direction dir)
 617 {
 618         GeoIPRecord *gir = NULL;
 619         struct sockaddr_in sa4;
 620         struct sockaddr_in6 sa6;
 621         const char *city = NULL;
 622
 623         switch (n->l3_proto) {
 624         default:
 625                 bug();
 626
 627         case AF_INET:
 628                 flow_entry_get_sain4_obj(n, dir, &sa4);
 629                 gir = GeoIP_record_by_ipnum(geo_city.gi4,
 630                                             ntohl(sa4.sin_addr.s_addr));
 631                 break;
 632
 633         case AF_INET6:
 634                 flow_entry_get_sain6_obj(n, dir, &sa6);
 635                 gir = GeoIP_record_by_ipnum_v6(geo_city.gi6, sa6.sin6_addr);
 636                 break;
 637         }
 638
 639         if (gir != NULL)
 640                 city = gir->city;
 641
 642         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 643
 644         if (city) {
 645                 memcpy(SELFLD(dir, city_src, city_dst), city,
 646                        min(sizeof(n->city_src), strlen(city)));
 647         } else {
 648                 memset(SELFLD(dir, city_src, city_dst), 0,
 649                        sizeof(n->city_src));
 650         }
 651 }
 652
 653 static void
 654 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 655                                       enum flow_entry_direction dir)
 656 {
 657         struct sockaddr_in sa4;
 658         struct sockaddr_in6 sa6;
 659         inline const char *make_na(const char *p) { return p ? : "N/A"; }
 660         const char *country = NULL;
 661
 662         switch (n->l3_proto) {
 663         default:
 664                 bug();
 665
 666         case AF_INET:
 667                 flow_entry_get_sain4_obj(n, dir, &sa4);
 668                 country = GeoIP_country_name_by_ipnum(geo_country.gi4,
 669                                                 ntohl(sa4.sin_addr.s_addr));
 670                 break;
 671
 672         case AF_INET6:
 673                 flow_entry_get_sain6_obj(n, dir, &sa6);
 674                 country = GeoIP_country_name_by_ipnum_v6(geo_country.gi6,
 675                                                          sa6.sin6_addr);
 676                 break;
 677         }
 678
 679         country = make_na(country);
 680
 681         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 682         memcpy(SELFLD(dir, country_src, country_dst), country,
 683                min(sizeof(n->country_src), strlen(country)));
 684 }
 685
 686 static void flow_entry_get_extended_geo(struct flow_entry *n,
 687                                         enum flow_entry_direction dir)
 688 {
 689         flow_entry_geo_city_lookup_generic(n, dir);
 690         flow_entry_geo_country_lookup_generic(n, dir);
 691 }
 692
 693 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 694                                            enum flow_entry_direction dir)
 695 {
 696         size_t sa_len;
 697         struct sockaddr_in sa4;
 698         struct sockaddr_in6 sa6;
 699         struct sockaddr *sa;
 700         struct hostent *hent;
 701
 702         switch (n->l3_proto) {
 703         default:
 704                 bug();
 705
 706         case AF_INET:
 707                 flow_entry_get_sain4_obj(n, dir, &sa4);
 708                 sa = (struct sockaddr *) &sa4;
 709                 sa_len = sizeof(sa4);
 710                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr),
 711                                      AF_INET);
 712                 break;
 713
 714         case AF_INET6:
 715                 flow_entry_get_sain6_obj(n, dir, &sa6);
 716                 sa = (struct sockaddr *) &sa6;
 717                 sa_len = sizeof(sa6);
 718                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr),
 719                                      AF_INET6);
 720                 break;
 721         }
 722
 723         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 724         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 725                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 726
 727         if (hent) {
 728                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 729                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 730                        hent->h_name, min(sizeof(n->rev_dns_src),
 731                                          strlen(hent->h_name)));
 732         }
 733 }
 734
 735 static void flow_entry_get_extended(struct flow_entry *n)
 736 {
 737         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 738                 return;
 739
 740         flow_entry_get_extended_revdns(n, flow_entry_src);
 741         flow_entry_get_extended_geo(n, flow_entry_src);
 742
 743         flow_entry_get_extended_revdns(n, flow_entry_dst);
 744         flow_entry_get_extended_geo(n, flow_entry_dst);
 745
 746         /* Lookup application */
 747         n->inode = get_port_inode(n->port_src, n->l4_proto,
 748                                   n->l3_proto == AF_INET6);
 749         if (n->inode > 0)
 750                 walk_processes(n);
 751 }
 752
 753 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 754 {
 755         if (src < dst && src < 1024) {
 756                 return src;
 757         } else if (dst < src && dst < 1024) {
 758                 return dst;
 759         } else {
 760                 const char *tmp1, *tmp2;
 761                 if (tcp) {
 762                         tmp1 = lookup_port_tcp(src);
 763                         tmp2 = lookup_port_tcp(dst);
 764                 } else {
 765                         tmp1 = lookup_port_udp(src);
 766                         tmp2 = lookup_port_udp(dst);
 767                 }
 768                 if (tmp1 && !tmp2) {
 769                         return src;
 770                 } else if (!tmp1 && tmp2) {
 771                         return dst;
 772                 } else {
 773                         if (src < dst)
 774                                 return src;
 775                         else
 776                                 return dst;
 777                 }
 778         }
 779 }
 780
 781 static void presenter_screen_init(WINDOW **screen)
 782 {
 783         (*screen) = initscr();
 784         noecho();
 785         cbreak();
 786         keypad(stdscr, TRUE);
 787         nodelay(*screen, TRUE);
 788         refresh();
 789         wrefresh(*screen);
 790 }
 791
 792 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 793                                      unsigned int *line)
 794 {
 795         char tmp[128], *pname = NULL;
 796         uint16_t port;
 797
 798         mvwprintw(screen, *line, 2, "");
 799
 800         /* PID, application name */
 801         if (n->procnum > 0) {
 802                 slprintf(tmp, sizeof(tmp), "%s(%u)", basename(n->cmdline),
 803                          n->procnum);
 804
 805                 printw("[");
 806                 attron(COLOR_PAIR(3));
 807                 printw("%s", tmp);
 808                 attroff(COLOR_PAIR(3));
 809                 printw("]:");
 810         }
 811
 812         /* L3 protocol, L4 protocol, states */
 813         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 814         printw("[");
 815         attron(COLOR_PAIR(3));
 816         switch (n->l4_proto) {
 817         case IPPROTO_TCP:
 818                 printw("%s", tcp_state2str[n->tcp_state]);
 819                 break;
 820         case IPPROTO_SCTP:
 821                 printw("%s", sctp_state2str[n->sctp_state]);
 822                 break;
 823         case IPPROTO_DCCP:
 824                 printw("%s", dccp_state2str[n->dccp_state]);
 825                 break;
 826         case IPPROTO_UDP:
 827         case IPPROTO_UDPLITE:
 828         case IPPROTO_ICMP:
 829         case IPPROTO_ICMPV6:
 830                 printw("NOSTATE");
 831                 break;
 832         }
 833         attroff(COLOR_PAIR(3));
 834         printw("]");
 835
 836         /* Guess application port */
 837         switch (n->l4_proto) {
 838         case IPPROTO_TCP:
 839                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 840                 pname = lookup_port_tcp(port);
 841                 break;
 842         case IPPROTO_UDP:
 843         case IPPROTO_UDPLITE:
 844                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 845                 pname = lookup_port_udp(port);
 846                 break;
 847         }
 848         if (pname) {
 849                 attron(A_BOLD);
 850                 printw(":%s", pname);
 851                 attroff(A_BOLD);
 852         }
 853         printw(" ->");
 854
 855         /* Number packets, bytes */
 856         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 857                 printw(" (%llu pkts, %llu bytes) ->",
 858                        n->counter_pkts, n->counter_bytes);
 859
 860         /* Show source information: reverse DNS, port, country, city */
 861         if (show_src) {
 862                 attron(COLOR_PAIR(1));
 863                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 864                 attroff(COLOR_PAIR(1));
 865
 866                 printw(":%u (", n->port_src);
 867
 868                 attron(COLOR_PAIR(4));
 869                 printw("%s", n->country_src);
 870                 attroff(COLOR_PAIR(4));
 871
 872                 if (n->city_src[0])
 873                         printw(", %s", n->city_src);
 874                 printw(") => ");
 875         }
 876
 877         /* Show dest information: reverse DNS, port, country, city */
 878         attron(COLOR_PAIR(2));
 879         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 880         attroff(COLOR_PAIR(2));
 881
 882         printw(":%u (", n->port_dst);
 883
 884         attron(COLOR_PAIR(4));
 885         printw("%s", n->country_dst);
 886         attroff(COLOR_PAIR(4));
 887
 888         if (n->city_dst[0])
 889                 printw(", %s", n->city_dst);
 890         printw(")");
 891 }
 892
 893 #if 0
 894                         if (n->tcp_state != tcp_states[i] ||
 895                             (i != TCP_CONNTRACK_NONE &&
 896                              n->tcp_state == TCP_CONNTRACK_NONE) ||
 897                             /* Filter out DNS */
 898                             presenter_get_port(n->port_src,
 899                                                n->port_dst, 0) == 53) {
 900                                 n = rcu_dereference(n->next);
 901                                 continue;
 902                         }
 903 #endif
 904
 905 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 906 {
 907         int ret = 1;
 908
 909         switch (n->l4_proto) {
 910         case IPPROTO_TCP:
 911                 if (n->tcp_state == state)
 912                         ret = 0;
 913                 break;
 914         case IPPROTO_SCTP:
 915                 if (n->sctp_state == state)
 916                         ret = 0;
 917                 break;
 918         case IPPROTO_DCCP:
 919                 if (n->dccp_state == state)
 920                         ret = 0;
 921                 break;
 922         case IPPROTO_UDP:
 923         case IPPROTO_UDPLITE:
 924         case IPPROTO_ICMP:
 925         case IPPROTO_ICMPV6:
 926                 ret = 0;
 927                 break;
 928         }
 929
 930         return ret;
 931 }
 932
 933 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 934                                     int skip_lines)
 935 {
 936         int i, j, maxy;
 937         unsigned int line = 3;
 938         struct flow_entry *n;
 939         uint8_t protocols[] = {
 940                 IPPROTO_TCP,
 941                 IPPROTO_DCCP,
 942                 IPPROTO_SCTP,
 943                 IPPROTO_UDP,
 944                 IPPROTO_UDPLITE,
 945                 IPPROTO_ICMP,
 946                 IPPROTO_ICMPV6,
 947         };
 948         size_t protocol_state_size[] = {
 949                 [IPPROTO_TCP] = array_size(tcp_states),
 950                 [IPPROTO_DCCP] = array_size(dccp_states),
 951                 [IPPROTO_SCTP] = array_size(sctp_states),
 952                 [IPPROTO_UDP] = 1,
 953                 [IPPROTO_UDPLITE] = 1,
 954                 [IPPROTO_ICMP] = 1,
 955                 [IPPROTO_ICMPV6] = 1,
 956         };
 957
 958         curs_set(0);
 959
 960         maxy = getmaxy(screen);
 961         maxy -= 6;
 962
 963         start_color();
 964         init_pair(1, COLOR_RED, COLOR_BLACK);
 965         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 966         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 967         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 968
 969         wclear(screen);
 970         clear();
 971
 972         mvwprintw(screen, 1, 2, "Kernel netfilter TCP/UDP "
 973                   "flow statistics, [+%d]", skip_lines);
 974
 975         rcu_read_lock();
 976
 977         if (rcu_dereference(fl->head) == NULL)
 978                 mvwprintw(screen, line, 2, "(No active sessions! "
 979                           "Is netfilter running?)");
 980
 981         for (i = 0; i < array_size(protocols); i++) {
 982                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 983                         n = rcu_dereference(fl->head);
 984                         while (n && maxy > 0) {
 985                                 int skip_entry = 0;
 986
 987                                 if (n->l4_proto != protocols[i])
 988                                         skip_entry = 1;
 989                                 if (presenter_flow_wrong_state(n, j))
 990                                         skip_entry = 1;
 991                                 if (presenter_get_port(n->port_src,
 992                                                        n->port_dst, 0) == 53)
 993                                         skip_entry = 1;
 994                                 if (skip_entry) {
 995                                         n = rcu_dereference(n->next);
 996                                         continue;
 997                                 }
 998                                 if (skip_lines > 0) {
 999                                         n = rcu_dereference(n->next);
1000                                         skip_lines--;
1001                                         continue;
1002                                 }
1003
1004                                 presenter_screen_do_line(screen, n, &line);
1005
1006                                 line++;
1007                                 maxy -= (2 + 1 * show_src);
1008                                 n = rcu_dereference(n->next);
1009                         }
1010                 }
1011         }
1012
1013         rcu_read_unlock();
1014
1015         wrefresh(screen);
1016         refresh();
1017 }
1018
1019 static inline void presenter_screen_end(void)
1020 {
1021         endwin();
1022 }
1023
1024 static void presenter(void)
1025 {
1026         int skip_lines = 0;
1027         WINDOW *screen = NULL;
1028
1029         dissector_init_ethernet(0);
1030         presenter_screen_init(&screen);
1031
1032         rcu_register_thread();
1033         while (!sigint) {
1034                 switch (getch()) {
1035                 case 'q':
1036                         sigint = 1;
1037                         break;
1038                 case KEY_UP:
1039                 case 'u':
1040                 case 'k':
1041                         skip_lines--;
1042                         if (skip_lines < 0)
1043                                 skip_lines = 0;
1044                         break;
1045                 case KEY_DOWN:
1046                 case 'd':
1047                 case 'j':
1048                         skip_lines++;
1049                         if (skip_lines > SCROLL_MAX)
1050                                 skip_lines = SCROLL_MAX;
1051                         break;
1052                 default:
1053                         fflush(stdin);
1054                         break;
1055                 }
1056
1057                 presenter_screen_update(screen, &flow_list, skip_lines);
1058                 usleep(100000);
1059         }
1060         rcu_unregister_thread();
1061
1062         presenter_screen_end();
1063         dissector_cleanup_ethernet();
1064 }
1065
1066 static inline int cb_test_bit(int nr, const u_int32_t *addr)
1067 {
1068         return ((1UL << (nr & 31)) & (addr[nr >> 5])) != 0;
1069 }
1070
1071 static int collector_cb(enum nf_conntrack_msg_type type,
1072                         struct nf_conntrack *ct, void *data)
1073 {
1074         if (sigint)
1075                 return NFCT_CB_STOP;
1076
1077         synchronize_rcu();
1078         spinlock_lock(&flow_list.lock);
1079
1080         switch (type) {
1081         case NFCT_T_NEW:
1082                 flow_list_new_entry(&flow_list, ct);
1083                 break;
1084         case NFCT_T_UPDATE:
1085                 flow_list_update_entry(&flow_list, ct);
1086                 break;
1087         case NFCT_T_DESTROY:
1088                 flow_list_destroy_entry(&flow_list, ct);
1089                 break;
1090         default:
1091                 break;
1092         }
1093
1094         spinlock_unlock(&flow_list.lock);
1095
1096         return NFCT_CB_CONTINUE;
1097 }
1098
1099 static inline GeoIP *collector_geoip_open(const char *path, int type)
1100 {
1101         if (path != NULL)
1102                 return GeoIP_open(path, GEOIP_MMAP_CACHE);
1103         else
1104                 return GeoIP_open_type(type, GEOIP_MMAP_CACHE);
1105 }
1106
1107 static void collector_load_geoip(void)
1108 {
1109         geo_country.gi4 = collector_geoip_open(geo_country.path4,
1110                                                GEOIP_COUNTRY_EDITION);
1111         if (geo_country.gi4 == NULL)
1112                 panic("Cannot open GeoIP4 country database!\n");
1113
1114         geo_country.gi6 = collector_geoip_open(geo_country.path6,
1115                                                GEOIP_COUNTRY_EDITION_V6);
1116         if (geo_country.gi6 == NULL)
1117                 panic("Cannot open GeoIP6 country database!\n");
1118
1119         geo_city.gi4 = collector_geoip_open(geo_city.path4,
1120                                             GEOIP_CITY_EDITION_REV1);
1121         if (geo_city.gi4 == NULL)
1122                 panic("Cannot open GeoIP4 city database!\n");
1123
1124         geo_city.gi6 = collector_geoip_open(geo_city.path6,
1125                                             GEOIP_CITY_EDITION_REV1_V6);
1126         if (geo_city.gi6 == NULL)
1127                 panic("Cannot open GeoIP6 city database!\n");
1128
1129         GeoIP_set_charset(geo_country.gi4, GEOIP_CHARSET_UTF8);
1130         GeoIP_set_charset(geo_country.gi6, GEOIP_CHARSET_UTF8);
1131
1132         GeoIP_set_charset(geo_city.gi4, GEOIP_CHARSET_UTF8);
1133         GeoIP_set_charset(geo_city.gi6, GEOIP_CHARSET_UTF8);
1134 }
1135
1136 static void collector_destroy_geoip(void)
1137 {
1138         GeoIP_delete(geo_country.gi4);
1139         GeoIP_delete(geo_country.gi6);
1140
1141         GeoIP_delete(geo_city.gi4);
1142         GeoIP_delete(geo_city.gi6);
1143 }
1144
1145 static void inline collector_flush(struct nfct_handle *handle, uint8_t family)
1146 {
1147         nfct_query(handle, NFCT_Q_FLUSH, &family);
1148 }
1149
1150 static void *collector(void *null)
1151 {
1152         int ret;
1153         struct nfct_handle *handle;
1154         struct nfct_filter *filter;
1155
1156         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1157                                       NF_NETLINK_CONNTRACK_UPDATE |
1158                                       NF_NETLINK_CONNTRACK_DESTROY);
1159         if (!handle)
1160                 panic("Cannot create a nfct handle!\n");
1161
1162         collector_flush(handle, AF_INET);
1163         collector_flush(handle, AF_INET6);
1164
1165         filter = nfct_filter_create();
1166         if (!filter)
1167                 panic("Cannot create a nfct filter!\n");
1168
1169         ret = nfct_filter_attach(nfct_fd(handle), filter);
1170         if (ret < 0)
1171                 panic("Cannot attach filter to handle!\n");
1172
1173         if (what & INCLUDE_UDP) {
1174                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1175                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1176         }
1177         if (what & INCLUDE_TCP)
1178                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1179         if (what & INCLUDE_DCCP)
1180                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1181         if (what & INCLUDE_SCTP)
1182                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1183         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1184                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1185         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1186                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1187         if (what & INCLUDE_IPV4) {
1188                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4,
1189                                       NFCT_FILTER_LOGIC_NEGATIVE);
1190                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1191         }
1192         if (what & INCLUDE_IPV6) {
1193                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6,
1194                                       NFCT_FILTER_LOGIC_NEGATIVE);
1195                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1196         }
1197
1198         ret = nfct_filter_attach(nfct_fd(handle), filter);
1199         if (ret < 0)
1200                 panic("Cannot attach filter to handle!\n");
1201
1202         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1203
1204         nfct_filter_destroy(filter);
1205
1206         collector_load_geoip();
1207
1208         flow_list_init(&flow_list);
1209
1210         rcu_register_thread();
1211
1212         while (!sigint && ret >= 0)
1213                 ret = nfct_catch(handle);
1214
1215         rcu_unregister_thread();
1216
1217         flow_list_destroy(&flow_list);
1218
1219         collector_destroy_geoip();
1220
1221         nfct_close(handle);
1222
1223         pthread_exit(0);
1224 }
1225
1226 int main(int argc, char **argv)
1227 {
1228         pthread_t tid;
1229         int ret, c, opt_index, what_cmd = 0;
1230
1231         memset(&geo_country, 0, sizeof(geo_country));
1232         memset(&geo_city, 0, sizeof(geo_city));
1233
1234         while ((c = getopt_long(argc, argv, short_options, long_options,
1235                &opt_index)) != EOF) {
1236                 switch (c) {
1237                 case '4':
1238                         what_cmd |= INCLUDE_IPV4;
1239                         break;
1240                 case '6':
1241                         what_cmd |= INCLUDE_IPV6;
1242                         break;
1243                 case 'T':
1244                         what_cmd |= INCLUDE_TCP;
1245                         break;
1246                 case 'U':
1247                         what_cmd |= INCLUDE_UDP;
1248                         break;
1249                 case 'D':
1250                         what_cmd |= INCLUDE_DCCP;
1251                         break;
1252                 case 'I':
1253                         what_cmd |= INCLUDE_ICMP;
1254                         break;
1255                 case 'S':
1256                         what_cmd |= INCLUDE_SCTP;
1257                         break;
1258                 case 's':
1259                         show_src = 1;
1260                         break;
1261                 case 'L':
1262                         geo_city.path4 = xstrdup(optarg);
1263                         break;
1264                 case 'K':
1265                         geo_country.path4 = xstrdup(optarg);
1266                         break;
1267                 case 'O':
1268                         geo_city.path6 = xstrdup(optarg);
1269                         break;
1270                 case 'P':
1271                         geo_country.path6 = xstrdup(optarg);
1272                         break;
1273                 case 'h':
1274                         help();
1275                         break;
1276                 case 'v':
1277                         version();
1278                         break;
1279                 case '?':
1280                         switch (optopt) {
1281                         case 'L':
1282                         case 'K':
1283                         case 'O':
1284                         case 'P':
1285                                 panic("Option -%c requires an argument!\n",
1286                                       optopt);
1287                         default:
1288                                 if (isprint(optopt))
1289                                         whine("Unknown option character "
1290                                               "`0x%X\'!\n", optopt);
1291                                 die();
1292                         }
1293                 default:
1294                         break;
1295                 }
1296         }
1297
1298         if (what_cmd > 0)
1299                 what = what_cmd;
1300
1301         rcu_init();
1302
1303         register_signal(SIGINT, signal_handler);
1304         register_signal(SIGHUP, signal_handler);
1305
1306         ret = pthread_create(&tid, NULL, collector, NULL);
1307         if (ret < 0)
1308                 panic("Cannot create phthread!\n");
1309
1310         presenter();
1311
1312         free(geo_country.path4);
1313         free(geo_country.path6);
1314
1315         free(geo_city.path4);
1316         free(geo_city.path6);
1317
1318         return 0;
1319 }