src/flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2011 - 2012 Daniel Borkmann.
   5  * Copyright 2011 Emmanuel Roullit.
   6  * Subject to the GPL, version 2.
   7  *
   8  * A tiny tool to provide top-like netfilter connection tracking information.
   9  *
  10  *   The Dark Lord has Nine. But we have One, mightier than they: the White
  11  *   Rider. He has passed through the fire and the abyss, and they shall
  12  *   fear him. We will go where he leads.
  13  *
  14  *     -- The Lord of the Rings, Aragorn,
  15  *        Chapter 'The White Rider'.
  16  */
  17
  18 #define _LGPL_SOURCE
  19 #include <stdio.h>
  20 #include <stdint.h>
  21 #include <stdlib.h>
  22 #include <signal.h>
  23 #include <getopt.h>
  24 #include <pthread.h>
  25 #include <signal.h>
  26 #include <netdb.h>
  27 #include <ctype.h>
  28 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
  29 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
  30 #include <libnetfilter_conntrack/libnetfilter_conntrack_dccp.h>
  31 #include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
  32 #include <GeoIP.h>
  33 #include <GeoIPCity.h>
  34 #include <netinet/in.h>
  35 #include <curses.h>
  36 #include <dirent.h>
  37 #include <sys/stat.h>
  38 #include <sys/fsuid.h>
  39 #include <urcu.h>
  40 #include <libgen.h>
  41
  42 #include "die.h"
  43 #include "xmalloc.h"
  44 #include "xio.h"
  45 #include "xutils.h"
  46 #include "built_in.h"
  47 #include "locking.h"
  48 #include "dissector_eth.h"
  49 #include "pkt_buff.h"
  50
  51 struct geo_ip_db {
  52         GeoIP *gi4, *gi6;
  53         char *path4, *path6;
  54 };
  55
  56 struct flow_entry {
  57         uint32_t flow_id, use, status;
  58         uint8_t  l3_proto, l4_proto;
  59         uint32_t ip4_src_addr, ip4_dst_addr;
  60         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  61         uint16_t port_src, port_dst;
  62         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  63         uint64_t counter_pkts, counter_bytes;
  64         uint64_t timestamp_start, timestamp_stop;
  65         char country_src[128], country_dst[128];
  66         char city_src[128], city_dst[128];
  67         char rev_dns_src[256], rev_dns_dst[256];
  68         char cmdline[256];
  69         struct flow_entry *next;
  70         int procnum, inode;
  71 };
  72
  73 struct flow_list {
  74         struct flow_entry *head;
  75         struct spinlock lock;
  76 };
  77
  78 #ifndef ATTR_TIMESTAMP_START
  79 # define ATTR_TIMESTAMP_START 63
  80 #endif
  81 #ifndef ATTR_TIMESTAMP_STOP
  82 # define ATTR_TIMESTAMP_STOP 64
  83 #endif
  84
  85 #define SCROLL_MAX 1000
  86
  87 #define INCLUDE_IPV4    (1 << 0)
  88 #define INCLUDE_IPV6    (1 << 1)
  89 #define INCLUDE_UDP     (1 << 2)
  90 #define INCLUDE_TCP     (1 << 3)
  91 #define INCLUDE_DCCP    (1 << 4)
  92 #define INCLUDE_ICMP    (1 << 5)
  93 #define INCLUDE_SCTP    (1 << 6)
  94
  95 volatile sig_atomic_t sigint = 0;
  96
  97 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
  98
  99 struct geo_ip_db geo_country, geo_city;
 100
 101 static struct flow_list flow_list;
 102
 103 static const char *short_options = "vhTULKsOPDIS46";
 104 static const struct option long_options[] = {
 105         {"ipv4",        no_argument,            NULL, '4'},
 106         {"ipv6",        no_argument,            NULL, '6'},
 107         {"tcp",         no_argument,            NULL, 'T'},
 108         {"udp",         no_argument,            NULL, 'U'},
 109         {"dccp",        no_argument,            NULL, 'D'},
 110         {"icmp",        no_argument,            NULL, 'I'},
 111         {"sctp",        no_argument,            NULL, 'S'},
 112         {"show-src",    no_argument,            NULL, 's'},
 113         {"city-db4",    required_argument,      NULL, 'L'},
 114         {"country-db4", required_argument,      NULL, 'K'},
 115         {"city-db6",    required_argument,      NULL, 'O'},
 116         {"country-db6", required_argument,      NULL, 'P'},
 117         {"version",     no_argument,            NULL, 'v'},
 118         {"help",        no_argument,            NULL, 'h'},
 119         {NULL, 0, NULL, 0}
 120 };
 121
 122 static const char *const l3proto2str[AF_MAX] = {
 123         [AF_INET]                       = "ipv4",
 124         [AF_INET6]                      = "ipv6",
 125 };
 126
 127 static const char *const l4proto2str[IPPROTO_MAX] = {
 128         [IPPROTO_TCP]                   = "tcp",
 129         [IPPROTO_UDP]                   = "udp",
 130         [IPPROTO_UDPLITE]               = "udplite",
 131         [IPPROTO_ICMP]                  = "icmp",
 132         [IPPROTO_ICMPV6]                = "icmpv6",
 133         [IPPROTO_SCTP]                  = "sctp",
 134         [IPPROTO_GRE]                   = "gre",
 135         [IPPROTO_DCCP]                  = "dccp",
 136         [IPPROTO_IGMP]                  = "igmp",
 137         [IPPROTO_IPIP]                  = "ipip",
 138         [IPPROTO_EGP]                   = "egp",
 139         [IPPROTO_PUP]                   = "pup",
 140         [IPPROTO_IDP]                   = "idp",
 141         [IPPROTO_RSVP]                  = "rsvp",
 142         [IPPROTO_IPV6]                  = "ip6tun",
 143         [IPPROTO_ESP]                   = "esp",
 144         [IPPROTO_AH]                    = "ah",
 145         [IPPROTO_PIM]                   = "pim",
 146         [IPPROTO_COMP]                  = "comp",
 147 };
 148
 149 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 150         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 151         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 152         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 153         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 154         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 155         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 156         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 157         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 158         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 159         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 160 };
 161
 162 static const uint8_t tcp_states[] = {
 163         TCP_CONNTRACK_SYN_SENT,
 164         TCP_CONNTRACK_SYN_RECV,
 165         TCP_CONNTRACK_ESTABLISHED,
 166         TCP_CONNTRACK_FIN_WAIT,
 167         TCP_CONNTRACK_CLOSE_WAIT,
 168         TCP_CONNTRACK_LAST_ACK,
 169         TCP_CONNTRACK_TIME_WAIT,
 170         TCP_CONNTRACK_CLOSE,
 171         TCP_CONNTRACK_SYN_SENT2,
 172         TCP_CONNTRACK_NONE,
 173 };
 174
 175 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 176         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 177         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 178         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 179         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 180         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 181         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 182         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 183         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 184         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 185         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 186 };
 187
 188 static const uint8_t dccp_states[] = {
 189         DCCP_CONNTRACK_NONE,
 190         DCCP_CONNTRACK_REQUEST,
 191         DCCP_CONNTRACK_RESPOND,
 192         DCCP_CONNTRACK_PARTOPEN,
 193         DCCP_CONNTRACK_OPEN,
 194         DCCP_CONNTRACK_CLOSEREQ,
 195         DCCP_CONNTRACK_CLOSING,
 196         DCCP_CONNTRACK_TIMEWAIT,
 197         DCCP_CONNTRACK_IGNORE,
 198         DCCP_CONNTRACK_INVALID,
 199 };
 200
 201 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 202         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 203         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 204         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 205         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 206         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 207         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 208         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 209         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 210 };
 211
 212 static const uint8_t sctp_states[] = {
 213         SCTP_CONNTRACK_NONE,
 214         SCTP_CONNTRACK_CLOSED,
 215         SCTP_CONNTRACK_COOKIE_WAIT,
 216         SCTP_CONNTRACK_COOKIE_ECHOED,
 217         SCTP_CONNTRACK_ESTABLISHED,
 218         SCTP_CONNTRACK_SHUTDOWN_SENT,
 219         SCTP_CONNTRACK_SHUTDOWN_RECD,
 220         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 221 };
 222
 223 static const struct nfct_filter_ipv4 filter_ipv4 = {
 224         .addr = __constant_htonl(INADDR_LOOPBACK),
 225         .mask = 0xffffffff,
 226 };
 227
 228 static const struct nfct_filter_ipv6 filter_ipv6 = {
 229         .addr = { 0x0, 0x0, 0x0, 0x1 },
 230         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 231 };
 232
 233 static void signal_handler(int number)
 234 {
 235         switch (number) {
 236         case SIGINT:
 237                 sigint = 1;
 238                 break;
 239         case SIGHUP:
 240         default:
 241                 break;
 242         }
 243 }
 244
 245 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 246 static void flow_entry_get_extended(struct flow_entry *n);
 247
 248 static void help(void)
 249 {
 250         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 251                VERSION_STRING);
 252         puts("http://www.netsniff-ng.org\n\n"
 253              "Usage: flowtop [options]\n"
 254              "Options:\n"
 255              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 256              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 257              "  -T|--tcp               Show only TCP flows (default)\n"
 258              "  -U|--udp               Show only UDP flows\n"
 259              "  -D|--dccp              Show only DCCP flows\n"
 260              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 261              "  -S|--sctp              Show only SCTP flows\n"
 262              "  -s|--show-src          Also show source, not only dest\n"
 263              "  --city-db4 <path>      Specifiy path for geoip4 city database\n"
 264              "  --country-db4 <path>   Specifiy path for geoip4 country database\n"
 265              "  --city-db6 <path>      Specifiy path for geoip6 city database\n"
 266              "  --country-db6 <path>   Specifiy path for geoip6 country database\n"
 267              "  -v|--version           Print version\n"
 268              "  -h|--help              Print this help\n\n"
 269              "Examples:\n"
 270              "  flowtop\n"
 271              "  flowtop -46UTDISs\n\n"
 272              "Note:\n"
 273              "  If netfilter is not running, you can activate it with e.g.:\n"
 274              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 275              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
 276              "Please report bugs to <bugs@netsniff-ng.org>\n"
 277              "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
 278              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
 279              "License: GNU GPL version 2.0\n"
 280              "This is free software: you are free to change and redistribute it.\n"
 281              "There is NO WARRANTY, to the extent permitted by law.\n");
 282         die();
 283 }
 284
 285 static void version(void)
 286 {
 287         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 288                VERSION_STRING);
 289         puts("http://www.netsniff-ng.org\n\n"
 290              "Please report bugs to <bugs@netsniff-ng.org>\n"
 291              "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
 292              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel@netsniff-ng.org>\n"
 293              "License: GNU GPL version 2.0\n"
 294              "This is free software: you are free to change and redistribute it.\n"
 295              "There is NO WARRANTY, to the extent permitted by law.\n");
 296         die();
 297 }
 298
 299 static inline struct flow_entry *flow_entry_xalloc(void)
 300 {
 301         return xzmalloc(sizeof(struct flow_entry));
 302 }
 303
 304 static inline void flow_entry_xfree(struct flow_entry *n)
 305 {
 306         xfree(n);
 307 }
 308
 309 static inline void flow_list_init(struct flow_list *fl)
 310 {
 311         fl->head = NULL;
 312         spinlock_init(&fl->lock);
 313 }
 314
 315 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 316 {
 317         struct flow_entry *n = flow_entry_xalloc();
 318
 319         flow_entry_from_ct(n, ct);
 320         flow_entry_get_extended(n);
 321
 322         rcu_assign_pointer(n->next, fl->head);
 323         rcu_assign_pointer(fl->head, n);
 324 }
 325
 326 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 327                                             uint32_t id)
 328 {
 329         struct flow_entry *n = rcu_dereference(fl->head);
 330
 331         while (n != NULL) {
 332                 if (n->flow_id == id)
 333                         return n;
 334
 335                 n = rcu_dereference(n->next);
 336         }
 337
 338         return NULL;
 339 }
 340
 341 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 342                                                  uint32_t id)
 343 {
 344         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 345
 346         if (n->flow_id == id)
 347                 return NULL;
 348
 349         while ((tmp = rcu_dereference(n->next)) != NULL) {
 350                 if (tmp->flow_id == id)
 351                         return n;
 352
 353                 n = tmp;
 354         }
 355
 356         return NULL;
 357 }
 358
 359 static void flow_list_update_entry(struct flow_list *fl,
 360                                    struct nf_conntrack *ct)
 361 {
 362         int do_ext = 0;
 363         struct flow_entry *n;
 364
 365         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 366         if (n == NULL) {
 367                 n = flow_entry_xalloc();
 368                 do_ext = 1;
 369         }
 370
 371         flow_entry_from_ct(n, ct);
 372         if (do_ext) {
 373                 flow_entry_get_extended(n);
 374
 375                 rcu_assign_pointer(n->next, fl->head);
 376                 rcu_assign_pointer(fl->head, n);
 377         }
 378 }
 379
 380 static void flow_list_destroy_entry(struct flow_list *fl,
 381                                     struct nf_conntrack *ct)
 382 {
 383         struct flow_entry *n1, *n2;
 384         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 385
 386         n1 = flow_list_find_id(fl, id);
 387         if (n1) {
 388                 n2 = flow_list_find_prev_id(fl, id);
 389                 if (n2) {
 390                         rcu_assign_pointer(n2->next, n1->next);
 391                         rcu_assign_pointer(n1->next, NULL);
 392
 393                         flow_entry_xfree(n1);
 394                 } else {
 395                         flow_entry_xfree(fl->head);
 396
 397                         rcu_assign_pointer(fl->head, NULL);
 398                 }
 399         }
 400 }
 401
 402 static void flow_list_destroy(struct flow_list *fl)
 403 {
 404         struct flow_entry *n;
 405
 406         while (fl->head != NULL) {
 407                 n = rcu_dereference(fl->head->next);
 408                 rcu_assign_pointer(fl->head->next, NULL);
 409
 410                 flow_entry_xfree(fl->head);
 411                 rcu_assign_pointer(fl->head, n);
 412         }
 413
 414         synchronize_rcu();
 415         spinlock_destroy(&fl->lock);
 416 }
 417
 418 static int walk_process(char *process, struct flow_entry *n)
 419 {
 420         int ret;
 421         DIR *dir;
 422         struct dirent *ent;
 423         char path[1024];
 424
 425         if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
 426                 panic("giant process name! %s\n", process);
 427
 428         dir = opendir(path);
 429         if (!dir)
 430                 return 0;
 431
 432         while ((ent = readdir(dir))) {
 433                 struct stat statbuf;
 434
 435                 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
 436                              process, ent->d_name) < 0)
 437                         continue;
 438
 439                 if (stat(path, &statbuf) < 0)
 440                         continue;
 441
 442                 if (S_ISSOCK(statbuf.st_mode) && n->inode == statbuf.st_ino) {
 443                         memset(n->cmdline, 0, sizeof(n->cmdline));
 444
 445                         snprintf(path, sizeof(path), "/proc/%s/exe", process);
 446
 447                         ret = readlink(path, n->cmdline,
 448                                        sizeof(n->cmdline) - 1);
 449                         if (ret < 0)
 450                                 panic("readlink error: %s\n", strerror(errno));
 451
 452                         n->procnum = atoi(process);
 453                         return 1;
 454                 }
 455         }
 456
 457         closedir(dir);
 458         return 0;
 459 }
 460
 461 static void walk_processes(struct flow_entry *n)
 462 {
 463         int ret;
 464         DIR *dir;
 465         struct dirent *ent;
 466
 467         /* n->inode must be set */
 468         if (n->inode <= 0) {
 469                 memset(n->cmdline, 0, sizeof(n->cmdline));
 470                 return;
 471         }
 472
 473         dir = opendir("/proc");
 474         if (!dir)
 475                 panic("Cannot open /proc!\n");
 476
 477         while ((ent = readdir(dir))) {
 478                 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
 479                         ret = walk_process(ent->d_name, n);
 480                         if (ret > 0)
 481                                 break;
 482                 }
 483         }
 484
 485         closedir(dir);
 486 }
 487
 488 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 489 {
 490         int ret = -ENOENT;
 491         char path[128], buff[1024];
 492         FILE *proc;
 493
 494         memset(path, 0, sizeof(path));
 495         snprintf(path, sizeof(path), "/proc/net/%s%s",
 496                  l4proto2str[proto], is_ip6 ? "6" : "");
 497
 498         proc = fopen(path, "r");
 499         if (!proc)
 500                 return -EIO;
 501
 502         memset(buff, 0, sizeof(buff));
 503
 504         while (fgets(buff, sizeof(buff), proc) != NULL) {
 505                 int inode = 0;
 506                 unsigned int lport = 0;
 507
 508                 buff[sizeof(buff) - 1] = 0;
 509                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 510                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 511                         if ((uint16_t) lport == port) {
 512                                 ret = inode;
 513                                 break;
 514                         }
 515                 }
 516
 517                 memset(buff, 0, sizeof(buff));
 518         }
 519
 520         fclose(proc);
 521         return ret;
 522 }
 523
 524 #define CP_NFCT(elem, attr, x)                          \
 525         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 526 #define CP_NFCT_BUFF(elem, attr) do {                   \
 527         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 528         if (buff != NULL)                               \
 529                 memcpy(n->elem, buff, sizeof(n->elem)); \
 530 } while (0)
 531
 532 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 533 {
 534         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 535         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 536
 537         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 538         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 539
 540         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 541         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 542
 543         CP_NFCT(status, ATTR_STATUS, 32);
 544
 545         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 546         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 547         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 548         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 549
 550         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 551         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 552
 553         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 554         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 555
 556         CP_NFCT(flow_id, ATTR_ID, 32);
 557         CP_NFCT(use, ATTR_USE, 32);
 558
 559         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 560         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 561
 562         n->port_src = ntohs(n->port_src);
 563         n->port_dst = ntohs(n->port_dst);
 564
 565         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 566         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 567 }
 568
 569 enum flow_entry_direction {
 570         flow_entry_src,
 571         flow_entry_dst,
 572 };
 573
 574 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 575 {
 576         /* We don't want to analyze / display DNS itself, since we
 577          * use it to resolve reverse dns.
 578          */
 579         return n->port_src == 53 || n->port_dst == 53;
 580 }
 581
 582 #define SELFLD(dir,src_member,dst_member)       \
 583         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 584
 585 static struct sockaddr_in *
 586 flow_entry_get_sain4_obj(struct flow_entry *n, enum flow_entry_direction dir,
 587                          struct sockaddr_in *sa)
 588 {
 589         memset(sa, 0, sizeof(*sa));
 590         sa->sin_family = PF_INET;
 591         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 592
 593         return sa;
 594 }
 595
 596 static struct sockaddr_in6 *
 597 flow_entry_get_sain6_obj(struct flow_entry *n, enum flow_entry_direction dir,
 598                          struct sockaddr_in6 *sa)
 599 {
 600         memset(sa, 0, sizeof(*sa));
 601         sa->sin6_family = PF_INET6;
 602
 603         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 604                sizeof(SELFLD(dir, ip6_src_addr, ip6_dst_addr)));
 605
 606         return sa;
 607 }
 608
 609 static void
 610 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 611                                    enum flow_entry_direction dir)
 612 {
 613         GeoIPRecord *gir = NULL;
 614         struct sockaddr_in sa4;
 615         struct sockaddr_in6 sa6;
 616         const char *city = NULL;
 617
 618         switch (n->l3_proto) {
 619         default:
 620                 bug();
 621
 622         case AF_INET:
 623                 flow_entry_get_sain4_obj(n, dir, &sa4);
 624                 gir = GeoIP_record_by_ipnum(geo_city.gi4,
 625                                             ntohl(sa4.sin_addr.s_addr));
 626                 break;
 627
 628         case AF_INET6:
 629                 flow_entry_get_sain6_obj(n, dir, &sa6);
 630                 gir = GeoIP_record_by_ipnum_v6(geo_city.gi6, sa6.sin6_addr);
 631                 break;
 632         }
 633
 634         if (gir != NULL)
 635                 city = gir->city;
 636
 637         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 638
 639         if (city) {
 640                 memcpy(SELFLD(dir, city_src, city_dst), city,
 641                        min(sizeof(n->city_src), strlen(city)));
 642         } else {
 643                 memset(SELFLD(dir, city_src, city_dst), 0,
 644                        sizeof(n->city_src));
 645         }
 646 }
 647
 648 static void
 649 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 650                                       enum flow_entry_direction dir)
 651 {
 652         struct sockaddr_in sa4;
 653         struct sockaddr_in6 sa6;
 654         inline const char *make_na(const char *p) { return p ? : "N/A"; }
 655         const char *country = NULL;
 656
 657         switch (n->l3_proto) {
 658         default:
 659                 bug();
 660
 661         case AF_INET:
 662                 flow_entry_get_sain4_obj(n, dir, &sa4);
 663                 country = GeoIP_country_name_by_ipnum(geo_country.gi4,
 664                                                 ntohl(sa4.sin_addr.s_addr));
 665                 break;
 666
 667         case AF_INET6:
 668                 flow_entry_get_sain6_obj(n, dir, &sa6);
 669                 country = GeoIP_country_name_by_ipnum_v6(geo_country.gi6,
 670                                                          sa6.sin6_addr);
 671                 break;
 672         }
 673
 674         country = make_na(country);
 675
 676         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 677         memcpy(SELFLD(dir, country_src, country_dst), country,
 678                min(sizeof(n->country_src), strlen(country)));
 679 }
 680
 681 static void flow_entry_get_extended_geo(struct flow_entry *n,
 682                                         enum flow_entry_direction dir)
 683 {
 684         flow_entry_geo_city_lookup_generic(n, dir);
 685         flow_entry_geo_country_lookup_generic(n, dir);
 686 }
 687
 688 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 689                                            enum flow_entry_direction dir)
 690 {
 691         size_t sa_len;
 692         struct sockaddr_in sa4;
 693         struct sockaddr_in6 sa6;
 694         struct sockaddr *sa;
 695         struct hostent *hent;
 696
 697         switch (n->l3_proto) {
 698         default:
 699                 bug();
 700
 701         case AF_INET:
 702                 flow_entry_get_sain4_obj(n, dir, &sa4);
 703                 sa = (struct sockaddr *) &sa4;
 704                 sa_len = sizeof(sa4);
 705                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr),
 706                                      AF_INET);
 707                 break;
 708
 709         case AF_INET6:
 710                 flow_entry_get_sain6_obj(n, dir, &sa6);
 711                 sa = (struct sockaddr *) &sa6;
 712                 sa_len = sizeof(sa6);
 713                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr),
 714                                      AF_INET6);
 715                 break;
 716         }
 717
 718         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 719         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 720                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 721
 722         if (hent) {
 723                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 724                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 725                        hent->h_name, min(sizeof(n->rev_dns_src),
 726                                          strlen(hent->h_name)));
 727         }
 728 }
 729
 730 static void flow_entry_get_extended(struct flow_entry *n)
 731 {
 732         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 733                 return;
 734
 735         flow_entry_get_extended_revdns(n, flow_entry_src);
 736         flow_entry_get_extended_geo(n, flow_entry_src);
 737
 738         flow_entry_get_extended_revdns(n, flow_entry_dst);
 739         flow_entry_get_extended_geo(n, flow_entry_dst);
 740
 741         /* Lookup application */
 742         n->inode = get_port_inode(n->port_src, n->l4_proto,
 743                                   n->l3_proto == AF_INET6);
 744         if (n->inode > 0)
 745                 walk_processes(n);
 746 }
 747
 748 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 749 {
 750         if (src < dst && src < 1024) {
 751                 return src;
 752         } else if (dst < src && dst < 1024) {
 753                 return dst;
 754         } else {
 755                 const char *tmp1, *tmp2;
 756                 if (tcp) {
 757                         tmp1 = lookup_port_tcp(src);
 758                         tmp2 = lookup_port_tcp(dst);
 759                 } else {
 760                         tmp1 = lookup_port_udp(src);
 761                         tmp2 = lookup_port_udp(dst);
 762                 }
 763                 if (tmp1 && !tmp2) {
 764                         return src;
 765                 } else if (!tmp1 && tmp2) {
 766                         return dst;
 767                 } else {
 768                         if (src < dst)
 769                                 return src;
 770                         else
 771                                 return dst;
 772                 }
 773         }
 774 }
 775
 776 static void presenter_screen_init(WINDOW **screen)
 777 {
 778         (*screen) = initscr();
 779         noecho();
 780         cbreak();
 781         keypad(stdscr, TRUE);
 782         nodelay(*screen, TRUE);
 783         refresh();
 784         wrefresh(*screen);
 785 }
 786
 787 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 788                                      unsigned int *line)
 789 {
 790         char tmp[128], *pname = NULL;
 791         uint16_t port;
 792
 793         mvwprintw(screen, *line, 2, "");
 794
 795         /* PID, application name */
 796         if (n->procnum > 0) {
 797                 slprintf(tmp, sizeof(tmp), "%s(%u)", basename(n->cmdline),
 798                          n->procnum);
 799
 800                 printw("[");
 801                 attron(COLOR_PAIR(3));
 802                 printw("%s", tmp);
 803                 attroff(COLOR_PAIR(3));
 804                 printw("]:");
 805         }
 806
 807         /* L3 protocol, L4 protocol, states */
 808         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 809         printw("[");
 810         attron(COLOR_PAIR(3));
 811         switch (n->l4_proto) {
 812         case IPPROTO_TCP:
 813                 printw("%s", tcp_state2str[n->tcp_state]);
 814                 break;
 815         case IPPROTO_SCTP:
 816                 printw("%s", sctp_state2str[n->sctp_state]);
 817                 break;
 818         case IPPROTO_DCCP:
 819                 printw("%s", dccp_state2str[n->dccp_state]);
 820                 break;
 821         case IPPROTO_UDP:
 822         case IPPROTO_UDPLITE:
 823         case IPPROTO_ICMP:
 824         case IPPROTO_ICMPV6:
 825                 printw("NOSTATE");
 826                 break;
 827         }
 828         attroff(COLOR_PAIR(3));
 829         printw("]");
 830
 831         /* Guess application port */
 832         switch (n->l4_proto) {
 833         case IPPROTO_TCP:
 834                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 835                 pname = lookup_port_tcp(port);
 836                 break;
 837         case IPPROTO_UDP:
 838         case IPPROTO_UDPLITE:
 839                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 840                 pname = lookup_port_udp(port);
 841                 break;
 842         }
 843         if (pname) {
 844                 attron(A_BOLD);
 845                 printw(":%s", pname);
 846                 attroff(A_BOLD);
 847         }
 848         printw(" ->");
 849
 850         /* Number packets, bytes */
 851         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 852                 printw(" (%llu pkts, %llu bytes) ->",
 853                        n->counter_pkts, n->counter_bytes);
 854
 855         /* Show source information: reverse DNS, port, country, city */
 856         if (show_src) {
 857                 attron(COLOR_PAIR(1));
 858                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 859                 attroff(COLOR_PAIR(1));
 860
 861                 printw(":%u (", n->port_src);
 862
 863                 attron(COLOR_PAIR(4));
 864                 printw("%s", n->country_src);
 865                 attroff(COLOR_PAIR(4));
 866
 867                 if (n->city_src[0])
 868                         printw(", %s", n->city_src);
 869                 printw(") => ");
 870         }
 871
 872         /* Show dest information: reverse DNS, port, country, city */
 873         attron(COLOR_PAIR(2));
 874         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 875         attroff(COLOR_PAIR(2));
 876
 877         printw(":%u (", n->port_dst);
 878
 879         attron(COLOR_PAIR(4));
 880         printw("%s", n->country_dst);
 881         attroff(COLOR_PAIR(4));
 882
 883         if (n->city_dst[0])
 884                 printw(", %s", n->city_dst);
 885         printw(")");
 886 }
 887
 888 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 889 {
 890         int ret = 1;
 891
 892         switch (n->l4_proto) {
 893         case IPPROTO_TCP:
 894                 if (n->tcp_state == state)
 895                         ret = 0;
 896                 break;
 897         case IPPROTO_SCTP:
 898                 if (n->sctp_state == state)
 899                         ret = 0;
 900                 break;
 901         case IPPROTO_DCCP:
 902                 if (n->dccp_state == state)
 903                         ret = 0;
 904                 break;
 905         case IPPROTO_UDP:
 906         case IPPROTO_UDPLITE:
 907         case IPPROTO_ICMP:
 908         case IPPROTO_ICMPV6:
 909                 ret = 0;
 910                 break;
 911         }
 912
 913         return ret;
 914 }
 915
 916 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 917                                     int skip_lines)
 918 {
 919         int i, j, maxy;
 920         unsigned int line = 3;
 921         struct flow_entry *n;
 922         uint8_t protocols[] = {
 923                 IPPROTO_TCP,
 924                 IPPROTO_DCCP,
 925                 IPPROTO_SCTP,
 926                 IPPROTO_UDP,
 927                 IPPROTO_UDPLITE,
 928                 IPPROTO_ICMP,
 929                 IPPROTO_ICMPV6,
 930         };
 931         size_t protocol_state_size[] = {
 932                 [IPPROTO_TCP] = array_size(tcp_states),
 933                 [IPPROTO_DCCP] = array_size(dccp_states),
 934                 [IPPROTO_SCTP] = array_size(sctp_states),
 935                 [IPPROTO_UDP] = 1,
 936                 [IPPROTO_UDPLITE] = 1,
 937                 [IPPROTO_ICMP] = 1,
 938                 [IPPROTO_ICMPV6] = 1,
 939         };
 940
 941         curs_set(0);
 942
 943         maxy = getmaxy(screen);
 944         maxy -= 6;
 945
 946         start_color();
 947         init_pair(1, COLOR_RED, COLOR_BLACK);
 948         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 949         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 950         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 951
 952         wclear(screen);
 953         clear();
 954
 955         mvwprintw(screen, 1, 2, "Kernel netfilter TCP/UDP "
 956                   "flow statistics, [+%d]", skip_lines);
 957
 958         rcu_read_lock();
 959
 960         if (rcu_dereference(fl->head) == NULL)
 961                 mvwprintw(screen, line, 2, "(No active sessions! "
 962                           "Is netfilter running?)");
 963
 964         for (i = 0; i < array_size(protocols); i++) {
 965                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 966                         n = rcu_dereference(fl->head);
 967                         while (n && maxy > 0) {
 968                                 int skip_entry = 0;
 969
 970                                 if (n->l4_proto != protocols[i])
 971                                         skip_entry = 1;
 972                                 if (presenter_flow_wrong_state(n, j))
 973                                         skip_entry = 1;
 974                                 if (presenter_get_port(n->port_src,
 975                                                        n->port_dst, 0) == 53)
 976                                         skip_entry = 1;
 977                                 if (skip_entry) {
 978                                         n = rcu_dereference(n->next);
 979                                         continue;
 980                                 }
 981                                 if (skip_lines > 0) {
 982                                         n = rcu_dereference(n->next);
 983                                         skip_lines--;
 984                                         continue;
 985                                 }
 986
 987                                 presenter_screen_do_line(screen, n, &line);
 988
 989                                 line++;
 990                                 maxy -= (2 + 1 * show_src);
 991                                 n = rcu_dereference(n->next);
 992                         }
 993                 }
 994         }
 995
 996         rcu_read_unlock();
 997
 998         wrefresh(screen);
 999         refresh();
1000 }
1001
1002 static inline void presenter_screen_end(void)
1003 {
1004         endwin();
1005 }
1006
1007 static void presenter(void)
1008 {
1009         int skip_lines = 0;
1010         WINDOW *screen = NULL;
1011
1012         dissector_init_ethernet(0);
1013         presenter_screen_init(&screen);
1014
1015         rcu_register_thread();
1016         while (!sigint) {
1017                 switch (getch()) {
1018                 case 'q':
1019                         sigint = 1;
1020                         break;
1021                 case KEY_UP:
1022                 case 'u':
1023                 case 'k':
1024                         skip_lines--;
1025                         if (skip_lines < 0)
1026                                 skip_lines = 0;
1027                         break;
1028                 case KEY_DOWN:
1029                 case 'd':
1030                 case 'j':
1031                         skip_lines++;
1032                         if (skip_lines > SCROLL_MAX)
1033                                 skip_lines = SCROLL_MAX;
1034                         break;
1035                 default:
1036                         fflush(stdin);
1037                         break;
1038                 }
1039
1040                 presenter_screen_update(screen, &flow_list, skip_lines);
1041                 usleep(100000);
1042         }
1043         rcu_unregister_thread();
1044
1045         presenter_screen_end();
1046         dissector_cleanup_ethernet();
1047 }
1048
1049 static int collector_cb(enum nf_conntrack_msg_type type,
1050                         struct nf_conntrack *ct, void *data)
1051 {
1052         if (sigint)
1053                 return NFCT_CB_STOP;
1054
1055         synchronize_rcu();
1056         spinlock_lock(&flow_list.lock);
1057
1058         switch (type) {
1059         case NFCT_T_NEW:
1060                 flow_list_new_entry(&flow_list, ct);
1061                 break;
1062         case NFCT_T_UPDATE:
1063                 flow_list_update_entry(&flow_list, ct);
1064                 break;
1065         case NFCT_T_DESTROY:
1066                 flow_list_destroy_entry(&flow_list, ct);
1067                 break;
1068         default:
1069                 break;
1070         }
1071
1072         spinlock_unlock(&flow_list.lock);
1073
1074         return NFCT_CB_CONTINUE;
1075 }
1076
1077 static inline GeoIP *collector_geoip_open(const char *path, int type)
1078 {
1079         if (path != NULL)
1080                 return GeoIP_open(path, GEOIP_MMAP_CACHE);
1081         else
1082                 return GeoIP_open_type(type, GEOIP_MMAP_CACHE);
1083 }
1084
1085 static void collector_load_geoip(void)
1086 {
1087         geo_country.gi4 = collector_geoip_open(geo_country.path4,
1088                                                GEOIP_COUNTRY_EDITION);
1089         if (geo_country.gi4 == NULL)
1090                 panic("Cannot open GeoIP4 country database!\n");
1091
1092         geo_country.gi6 = collector_geoip_open(geo_country.path6,
1093                                                GEOIP_COUNTRY_EDITION_V6);
1094         if (geo_country.gi6 == NULL)
1095                 panic("Cannot open GeoIP6 country database!\n");
1096
1097         geo_city.gi4 = collector_geoip_open(geo_city.path4,
1098                                             GEOIP_CITY_EDITION_REV1);
1099         if (geo_city.gi4 == NULL)
1100                 panic("Cannot open GeoIP4 city database!\n");
1101
1102         geo_city.gi6 = collector_geoip_open(geo_city.path6,
1103                                             GEOIP_CITY_EDITION_REV1_V6);
1104         if (geo_city.gi6 == NULL)
1105                 panic("Cannot open GeoIP6 city database!\n");
1106
1107         GeoIP_set_charset(geo_country.gi4, GEOIP_CHARSET_UTF8);
1108         GeoIP_set_charset(geo_country.gi6, GEOIP_CHARSET_UTF8);
1109
1110         GeoIP_set_charset(geo_city.gi4, GEOIP_CHARSET_UTF8);
1111         GeoIP_set_charset(geo_city.gi6, GEOIP_CHARSET_UTF8);
1112 }
1113
1114 static void collector_destroy_geoip(void)
1115 {
1116         GeoIP_delete(geo_country.gi4);
1117         GeoIP_delete(geo_country.gi6);
1118
1119         GeoIP_delete(geo_city.gi4);
1120         GeoIP_delete(geo_city.gi6);
1121 }
1122
1123 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1124 {
1125         nfct_query(handle, NFCT_Q_FLUSH, &family);
1126 }
1127
1128 static void *collector(void *null)
1129 {
1130         int ret;
1131         struct nfct_handle *handle;
1132         struct nfct_filter *filter;
1133
1134         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1135                                       NF_NETLINK_CONNTRACK_UPDATE |
1136                                       NF_NETLINK_CONNTRACK_DESTROY);
1137         if (!handle)
1138                 panic("Cannot create a nfct handle!\n");
1139
1140         collector_flush(handle, AF_INET);
1141         collector_flush(handle, AF_INET6);
1142
1143         filter = nfct_filter_create();
1144         if (!filter)
1145                 panic("Cannot create a nfct filter!\n");
1146
1147         ret = nfct_filter_attach(nfct_fd(handle), filter);
1148         if (ret < 0)
1149                 panic("Cannot attach filter to handle!\n");
1150
1151         if (what & INCLUDE_UDP) {
1152                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1153                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1154         }
1155         if (what & INCLUDE_TCP)
1156                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1157         if (what & INCLUDE_DCCP)
1158                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1159         if (what & INCLUDE_SCTP)
1160                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1161         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1162                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1163         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1164                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1165         if (what & INCLUDE_IPV4) {
1166                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4,
1167                                       NFCT_FILTER_LOGIC_NEGATIVE);
1168                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1169         }
1170         if (what & INCLUDE_IPV6) {
1171                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6,
1172                                       NFCT_FILTER_LOGIC_NEGATIVE);
1173                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1174         }
1175
1176         ret = nfct_filter_attach(nfct_fd(handle), filter);
1177         if (ret < 0)
1178                 panic("Cannot attach filter to handle!\n");
1179
1180         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1181
1182         nfct_filter_destroy(filter);
1183
1184         collector_load_geoip();
1185
1186         flow_list_init(&flow_list);
1187
1188         rcu_register_thread();
1189
1190         while (!sigint && ret >= 0)
1191                 ret = nfct_catch(handle);
1192
1193         rcu_unregister_thread();
1194
1195         flow_list_destroy(&flow_list);
1196
1197         collector_destroy_geoip();
1198
1199         nfct_close(handle);
1200
1201         pthread_exit(0);
1202 }
1203
1204 int main(int argc, char **argv)
1205 {
1206         pthread_t tid;
1207         int ret, c, opt_index, what_cmd = 0;
1208
1209         setfsuid(getuid());
1210         setfsgid(getgid());
1211
1212         memset(&geo_country, 0, sizeof(geo_country));
1213         memset(&geo_city, 0, sizeof(geo_city));
1214
1215         while ((c = getopt_long(argc, argv, short_options, long_options,
1216                &opt_index)) != EOF) {
1217                 switch (c) {
1218                 case '4':
1219                         what_cmd |= INCLUDE_IPV4;
1220                         break;
1221                 case '6':
1222                         what_cmd |= INCLUDE_IPV6;
1223                         break;
1224                 case 'T':
1225                         what_cmd |= INCLUDE_TCP;
1226                         break;
1227                 case 'U':
1228                         what_cmd |= INCLUDE_UDP;
1229                         break;
1230                 case 'D':
1231                         what_cmd |= INCLUDE_DCCP;
1232                         break;
1233                 case 'I':
1234                         what_cmd |= INCLUDE_ICMP;
1235                         break;
1236                 case 'S':
1237                         what_cmd |= INCLUDE_SCTP;
1238                         break;
1239                 case 's':
1240                         show_src = 1;
1241                         break;
1242                 case 'L':
1243                         geo_city.path4 = xstrdup(optarg);
1244                         break;
1245                 case 'K':
1246                         geo_country.path4 = xstrdup(optarg);
1247                         break;
1248                 case 'O':
1249                         geo_city.path6 = xstrdup(optarg);
1250                         break;
1251                 case 'P':
1252                         geo_country.path6 = xstrdup(optarg);
1253                         break;
1254                 case 'h':
1255                         help();
1256                         break;
1257                 case 'v':
1258                         version();
1259                         break;
1260                 case '?':
1261                         switch (optopt) {
1262                         case 'L':
1263                         case 'K':
1264                         case 'O':
1265                         case 'P':
1266                                 panic("Option -%c requires an argument!\n",
1267                                       optopt);
1268                         default:
1269                                 if (isprint(optopt))
1270                                         whine("Unknown option character "
1271                                               "`0x%X\'!\n", optopt);
1272                                 die();
1273                         }
1274                 default:
1275                         break;
1276                 }
1277         }
1278
1279         if (what_cmd > 0)
1280                 what = what_cmd;
1281
1282         rcu_init();
1283
1284         register_signal(SIGINT, signal_handler);
1285         register_signal(SIGHUP, signal_handler);
1286
1287         ret = pthread_create(&tid, NULL, collector, NULL);
1288         if (ret < 0)
1289                 panic("Cannot create phthread!\n");
1290
1291         presenter();
1292
1293         free(geo_country.path4);
1294         free(geo_country.path6);
1295
1296         free(geo_city.path4);
1297         free(geo_city.path6);
1298
1299         return 0;
1300 }