flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2011 - 2013 Daniel Borkmann.
   4  * Copyright 2011 Emmanuel Roullit.
   5  * Subject to the GPL, version 2.
   6  */
   7
   8 #define _LGPL_SOURCE
   9 #include <stdio.h>
  10 #include <stdint.h>
  11 #include <stdlib.h>
  12 #include <signal.h>
  13 #include <getopt.h>
  14 #include <pthread.h>
  15 #include <signal.h>
  16 #include <netdb.h>
  17 #include <ctype.h>
  18 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
  19 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
  20 #include <libnetfilter_conntrack/libnetfilter_conntrack_dccp.h>
  21 #include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
  22 #include <netinet/in.h>
  23 #include <curses.h>
  24 #include <dirent.h>
  25 #include <sys/stat.h>
  26 #include <sys/fsuid.h>
  27 #include <urcu.h>
  28 #include <libgen.h>
  29
  30 #include "die.h"
  31 #include "xmalloc.h"
  32 #include "xio.h"
  33 #include "geoip.h"
  34 #include "xutils.h"
  35 #include "built_in.h"
  36 #include "locking.h"
  37 #include "dissector_eth.h"
  38 #include "pkt_buff.h"
  39
  40 struct flow_entry {
  41         uint32_t flow_id, use, status;
  42         uint8_t  l3_proto, l4_proto;
  43         uint32_t ip4_src_addr, ip4_dst_addr;
  44         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  45         uint16_t port_src, port_dst;
  46         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  47         uint64_t counter_pkts, counter_bytes;
  48         uint64_t timestamp_start, timestamp_stop;
  49         char country_src[128], country_dst[128];
  50         char city_src[128], city_dst[128];
  51         char rev_dns_src[256], rev_dns_dst[256];
  52         char cmdline[256];
  53         struct flow_entry *next;
  54         int procnum, inode;
  55 };
  56
  57 struct flow_list {
  58         struct flow_entry *head;
  59         struct spinlock lock;
  60 };
  61
  62 #ifndef ATTR_TIMESTAMP_START
  63 # define ATTR_TIMESTAMP_START 63
  64 #endif
  65 #ifndef ATTR_TIMESTAMP_STOP
  66 # define ATTR_TIMESTAMP_STOP 64
  67 #endif
  68
  69 #define SCROLL_MAX 1000
  70
  71 #define INCLUDE_IPV4    (1 << 0)
  72 #define INCLUDE_IPV6    (1 << 1)
  73 #define INCLUDE_UDP     (1 << 2)
  74 #define INCLUDE_TCP     (1 << 3)
  75 #define INCLUDE_DCCP    (1 << 4)
  76 #define INCLUDE_ICMP    (1 << 5)
  77 #define INCLUDE_SCTP    (1 << 6)
  78
  79 volatile sig_atomic_t sigint = 0;
  80
  81 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
  82
  83 static struct flow_list flow_list;
  84
  85 static const char *short_options = "vhTUsDIS46u";
  86 static const struct option long_options[] = {
  87         {"ipv4",        no_argument,            NULL, '4'},
  88         {"ipv6",        no_argument,            NULL, '6'},
  89         {"tcp",         no_argument,            NULL, 'T'},
  90         {"udp",         no_argument,            NULL, 'U'},
  91         {"dccp",        no_argument,            NULL, 'D'},
  92         {"icmp",        no_argument,            NULL, 'I'},
  93         {"sctp",        no_argument,            NULL, 'S'},
  94         {"show-src",    no_argument,            NULL, 's'},
  95         {"update",      no_argument,            NULL, 'u'},
  96         {"version",     no_argument,            NULL, 'v'},
  97         {"help",        no_argument,            NULL, 'h'},
  98         {NULL, 0, NULL, 0}
  99 };
 100
 101 static const char *const l3proto2str[AF_MAX] = {
 102         [AF_INET]                       = "ipv4",
 103         [AF_INET6]                      = "ipv6",
 104 };
 105
 106 static const char *const l4proto2str[IPPROTO_MAX] = {
 107         [IPPROTO_TCP]                   = "tcp",
 108         [IPPROTO_UDP]                   = "udp",
 109         [IPPROTO_UDPLITE]               = "udplite",
 110         [IPPROTO_ICMP]                  = "icmp",
 111         [IPPROTO_ICMPV6]                = "icmpv6",
 112         [IPPROTO_SCTP]                  = "sctp",
 113         [IPPROTO_GRE]                   = "gre",
 114         [IPPROTO_DCCP]                  = "dccp",
 115         [IPPROTO_IGMP]                  = "igmp",
 116         [IPPROTO_IPIP]                  = "ipip",
 117         [IPPROTO_EGP]                   = "egp",
 118         [IPPROTO_PUP]                   = "pup",
 119         [IPPROTO_IDP]                   = "idp",
 120         [IPPROTO_RSVP]                  = "rsvp",
 121         [IPPROTO_IPV6]                  = "ip6tun",
 122         [IPPROTO_ESP]                   = "esp",
 123         [IPPROTO_AH]                    = "ah",
 124         [IPPROTO_PIM]                   = "pim",
 125         [IPPROTO_COMP]                  = "comp",
 126 };
 127
 128 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 129         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 130         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 131         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 132         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 133         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 134         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 135         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 136         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 137         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 138         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 139 };
 140
 141 static const uint8_t tcp_states[] = {
 142         TCP_CONNTRACK_SYN_SENT,
 143         TCP_CONNTRACK_SYN_RECV,
 144         TCP_CONNTRACK_ESTABLISHED,
 145         TCP_CONNTRACK_FIN_WAIT,
 146         TCP_CONNTRACK_CLOSE_WAIT,
 147         TCP_CONNTRACK_LAST_ACK,
 148         TCP_CONNTRACK_TIME_WAIT,
 149         TCP_CONNTRACK_CLOSE,
 150         TCP_CONNTRACK_SYN_SENT2,
 151         TCP_CONNTRACK_NONE,
 152 };
 153
 154 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 155         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 156         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 157         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 158         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 159         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 160         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 161         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 162         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 163         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 164         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 165 };
 166
 167 static const uint8_t dccp_states[] = {
 168         DCCP_CONNTRACK_NONE,
 169         DCCP_CONNTRACK_REQUEST,
 170         DCCP_CONNTRACK_RESPOND,
 171         DCCP_CONNTRACK_PARTOPEN,
 172         DCCP_CONNTRACK_OPEN,
 173         DCCP_CONNTRACK_CLOSEREQ,
 174         DCCP_CONNTRACK_CLOSING,
 175         DCCP_CONNTRACK_TIMEWAIT,
 176         DCCP_CONNTRACK_IGNORE,
 177         DCCP_CONNTRACK_INVALID,
 178 };
 179
 180 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 181         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 182         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 183         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 184         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 185         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 186         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 187         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 188         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 189 };
 190
 191 static const uint8_t sctp_states[] = {
 192         SCTP_CONNTRACK_NONE,
 193         SCTP_CONNTRACK_CLOSED,
 194         SCTP_CONNTRACK_COOKIE_WAIT,
 195         SCTP_CONNTRACK_COOKIE_ECHOED,
 196         SCTP_CONNTRACK_ESTABLISHED,
 197         SCTP_CONNTRACK_SHUTDOWN_SENT,
 198         SCTP_CONNTRACK_SHUTDOWN_RECD,
 199         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 200 };
 201
 202 static const struct nfct_filter_ipv4 filter_ipv4 = {
 203         .addr = __constant_htonl(INADDR_LOOPBACK),
 204         .mask = 0xffffffff,
 205 };
 206
 207 static const struct nfct_filter_ipv6 filter_ipv6 = {
 208         .addr = { 0x0, 0x0, 0x0, 0x1 },
 209         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 210 };
 211
 212 static void signal_handler(int number)
 213 {
 214         switch (number) {
 215         case SIGINT:
 216                 sigint = 1;
 217                 break;
 218         case SIGHUP:
 219         default:
 220                 break;
 221         }
 222 }
 223
 224 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 225 static void flow_entry_get_extended(struct flow_entry *n);
 226
 227 static void help(void)
 228 {
 229         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 230                VERSION_STRING);
 231         puts("http://www.netsniff-ng.org\n\n"
 232              "Usage: flowtop [options]\n"
 233              "Options:\n"
 234              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 235              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 236              "  -T|--tcp               Show only TCP flows (default)\n"
 237              "  -U|--udp               Show only UDP flows\n"
 238              "  -D|--dccp              Show only DCCP flows\n"
 239              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 240              "  -S|--sctp              Show only SCTP flows\n"
 241              "  -s|--show-src          Also show source, not only dest\n"
 242              "  -u|--update            Update GeoIP databases\n"
 243              "  -v|--version           Print version\n"
 244              "  -h|--help              Print this help\n\n"
 245              "Examples:\n"
 246              "  flowtop\n"
 247              "  flowtop -46UTDISs\n\n"
 248              "Note:\n"
 249              "  If netfilter is not running, you can activate it with e.g.:\n"
 250              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 251              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
 252              "Please report bugs to <bugs@netsniff-ng.org>\n"
 253              "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 254              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 255              "Swiss federal institute of technology (ETH Zurich)\n"
 256              "License: GNU GPL version 2.0\n"
 257              "This is free software: you are free to change and redistribute it.\n"
 258              "There is NO WARRANTY, to the extent permitted by law.\n");
 259         die();
 260 }
 261
 262 static void version(void)
 263 {
 264         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 265                VERSION_STRING);
 266         puts("http://www.netsniff-ng.org\n\n"
 267              "Please report bugs to <bugs@netsniff-ng.org>\n"
 268              "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 269              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 270              "Swiss federal institute of technology (ETH Zurich)\n"
 271              "License: GNU GPL version 2.0\n"
 272              "This is free software: you are free to change and redistribute it.\n"
 273              "There is NO WARRANTY, to the extent permitted by law.\n");
 274         die();
 275 }
 276
 277 static inline struct flow_entry *flow_entry_xalloc(void)
 278 {
 279         return xzmalloc(sizeof(struct flow_entry));
 280 }
 281
 282 static inline void flow_entry_xfree(struct flow_entry *n)
 283 {
 284         xfree(n);
 285 }
 286
 287 static inline void flow_list_init(struct flow_list *fl)
 288 {
 289         fl->head = NULL;
 290         spinlock_init(&fl->lock);
 291 }
 292
 293 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 294 {
 295         struct flow_entry *n = flow_entry_xalloc();
 296
 297         flow_entry_from_ct(n, ct);
 298         flow_entry_get_extended(n);
 299
 300         rcu_assign_pointer(n->next, fl->head);
 301         rcu_assign_pointer(fl->head, n);
 302 }
 303
 304 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 305                                             uint32_t id)
 306 {
 307         struct flow_entry *n = rcu_dereference(fl->head);
 308
 309         while (n != NULL) {
 310                 if (n->flow_id == id)
 311                         return n;
 312
 313                 n = rcu_dereference(n->next);
 314         }
 315
 316         return NULL;
 317 }
 318
 319 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 320                                                  uint32_t id)
 321 {
 322         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 323
 324         if (n->flow_id == id)
 325                 return NULL;
 326
 327         while ((tmp = rcu_dereference(n->next)) != NULL) {
 328                 if (tmp->flow_id == id)
 329                         return n;
 330
 331                 n = tmp;
 332         }
 333
 334         return NULL;
 335 }
 336
 337 static void flow_list_update_entry(struct flow_list *fl,
 338                                    struct nf_conntrack *ct)
 339 {
 340         int do_ext = 0;
 341         struct flow_entry *n;
 342
 343         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 344         if (n == NULL) {
 345                 n = flow_entry_xalloc();
 346                 do_ext = 1;
 347         }
 348
 349         flow_entry_from_ct(n, ct);
 350         if (do_ext) {
 351                 flow_entry_get_extended(n);
 352
 353                 rcu_assign_pointer(n->next, fl->head);
 354                 rcu_assign_pointer(fl->head, n);
 355         }
 356 }
 357
 358 static void flow_list_destroy_entry(struct flow_list *fl,
 359                                     struct nf_conntrack *ct)
 360 {
 361         struct flow_entry *n1, *n2;
 362         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 363
 364         n1 = flow_list_find_id(fl, id);
 365         if (n1) {
 366                 n2 = flow_list_find_prev_id(fl, id);
 367                 if (n2) {
 368                         rcu_assign_pointer(n2->next, n1->next);
 369                         n1->next = NULL;
 370
 371                         flow_entry_xfree(n1);
 372                 } else {
 373                         flow_entry_xfree(fl->head);
 374                         fl->head = NULL;
 375                 }
 376         }
 377 }
 378
 379 static void flow_list_destroy(struct flow_list *fl)
 380 {
 381         struct flow_entry *n;
 382
 383         while (fl->head != NULL) {
 384                 n = rcu_dereference(fl->head->next);
 385                 fl->head->next = NULL;
 386
 387                 flow_entry_xfree(fl->head);
 388                 rcu_assign_pointer(fl->head, n);
 389         }
 390
 391         synchronize_rcu();
 392         spinlock_destroy(&fl->lock);
 393 }
 394
 395 static int walk_process(char *process, struct flow_entry *n)
 396 {
 397         int ret;
 398         DIR *dir;
 399         struct dirent *ent;
 400         char path[1024];
 401
 402         if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
 403                 panic("giant process name! %s\n", process);
 404
 405         dir = opendir(path);
 406         if (!dir)
 407                 return 0;
 408
 409         while ((ent = readdir(dir))) {
 410                 struct stat statbuf;
 411
 412                 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
 413                              process, ent->d_name) < 0)
 414                         continue;
 415
 416                 if (stat(path, &statbuf) < 0)
 417                         continue;
 418
 419                 if (S_ISSOCK(statbuf.st_mode) && n->inode == statbuf.st_ino) {
 420                         memset(n->cmdline, 0, sizeof(n->cmdline));
 421
 422                         snprintf(path, sizeof(path), "/proc/%s/exe", process);
 423
 424                         ret = readlink(path, n->cmdline,
 425                                        sizeof(n->cmdline) - 1);
 426                         if (ret < 0)
 427                                 panic("readlink error: %s\n", strerror(errno));
 428
 429                         n->procnum = atoi(process);
 430                         closedir(dir);
 431                         return 1;
 432                 }
 433         }
 434
 435         closedir(dir);
 436         return 0;
 437 }
 438
 439 static void walk_processes(struct flow_entry *n)
 440 {
 441         int ret;
 442         DIR *dir;
 443         struct dirent *ent;
 444
 445         /* n->inode must be set */
 446         if (n->inode <= 0) {
 447                 memset(n->cmdline, 0, sizeof(n->cmdline));
 448                 return;
 449         }
 450
 451         dir = opendir("/proc");
 452         if (!dir)
 453                 panic("Cannot open /proc!\n");
 454
 455         while ((ent = readdir(dir))) {
 456                 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
 457                         ret = walk_process(ent->d_name, n);
 458                         if (ret > 0)
 459                                 break;
 460                 }
 461         }
 462
 463         closedir(dir);
 464 }
 465
 466 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 467 {
 468         int ret = -ENOENT;
 469         char path[128], buff[1024];
 470         FILE *proc;
 471
 472         memset(path, 0, sizeof(path));
 473         snprintf(path, sizeof(path), "/proc/net/%s%s",
 474                  l4proto2str[proto], is_ip6 ? "6" : "");
 475
 476         proc = fopen(path, "r");
 477         if (!proc)
 478                 return -EIO;
 479
 480         memset(buff, 0, sizeof(buff));
 481
 482         while (fgets(buff, sizeof(buff), proc) != NULL) {
 483                 int inode = 0;
 484                 unsigned int lport = 0;
 485
 486                 buff[sizeof(buff) - 1] = 0;
 487                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 488                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 489                         if ((uint16_t) lport == port) {
 490                                 ret = inode;
 491                                 break;
 492                         }
 493                 }
 494
 495                 memset(buff, 0, sizeof(buff));
 496         }
 497
 498         fclose(proc);
 499         return ret;
 500 }
 501
 502 #define CP_NFCT(elem, attr, x)                          \
 503         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 504 #define CP_NFCT_BUFF(elem, attr) do {                   \
 505         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 506         if (buff != NULL)                               \
 507                 memcpy(n->elem, buff, sizeof(n->elem)); \
 508 } while (0)
 509
 510 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 511 {
 512         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 513         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 514
 515         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 516         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 517
 518         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 519         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 520
 521         CP_NFCT(status, ATTR_STATUS, 32);
 522
 523         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 524         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 525         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 526         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 527
 528         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 529         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 530
 531         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 532         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 533
 534         CP_NFCT(flow_id, ATTR_ID, 32);
 535         CP_NFCT(use, ATTR_USE, 32);
 536
 537         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 538         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 539
 540         n->port_src = ntohs(n->port_src);
 541         n->port_dst = ntohs(n->port_dst);
 542
 543         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 544         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 545 }
 546
 547 enum flow_entry_direction {
 548         flow_entry_src,
 549         flow_entry_dst,
 550 };
 551
 552 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 553 {
 554         /* We don't want to analyze / display DNS itself, since we
 555          * use it to resolve reverse dns.
 556          */
 557         return n->port_src == 53 || n->port_dst == 53;
 558 }
 559
 560 #define SELFLD(dir,src_member,dst_member)       \
 561         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 562
 563 static void flow_entry_get_sain4_obj(struct flow_entry *n,
 564                                      enum flow_entry_direction dir,
 565                                      struct sockaddr_in *sa)
 566 {
 567         memset(sa, 0, sizeof(*sa));
 568         sa->sin_family = PF_INET;
 569         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 570 }
 571
 572 static void flow_entry_get_sain6_obj(struct flow_entry *n,
 573                                      enum flow_entry_direction dir,
 574                                      struct sockaddr_in6 *sa)
 575 {
 576         memset(sa, 0, sizeof(*sa));
 577         sa->sin6_family = PF_INET6;
 578
 579         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 580                sizeof(SELFLD(dir, ip6_src_addr, ip6_dst_addr)));
 581 }
 582
 583 static void
 584 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 585                                    enum flow_entry_direction dir)
 586 {
 587         struct sockaddr_in sa4;
 588         struct sockaddr_in6 sa6;
 589         const char *city = NULL;
 590
 591         switch (n->l3_proto) {
 592         default:
 593                 bug();
 594
 595         case AF_INET:
 596                 flow_entry_get_sain4_obj(n, dir, &sa4);
 597                 city = geoip4_city_name(sa4);
 598                 break;
 599
 600         case AF_INET6:
 601                 flow_entry_get_sain6_obj(n, dir, &sa6);
 602                 city = geoip6_city_name(sa6);
 603                 break;
 604         }
 605
 606         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 607
 608         if (city) {
 609                 memcpy(SELFLD(dir, city_src, city_dst), city,
 610                        min(sizeof(n->city_src), strlen(city)));
 611         } else {
 612                 memset(SELFLD(dir, city_src, city_dst), 0,
 613                        sizeof(n->city_src));
 614         }
 615 }
 616
 617 static void
 618 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 619                                       enum flow_entry_direction dir)
 620 {
 621         struct sockaddr_in sa4;
 622         struct sockaddr_in6 sa6;
 623         const char *country = NULL;
 624
 625         switch (n->l3_proto) {
 626         default:
 627                 bug();
 628
 629         case AF_INET:
 630                 flow_entry_get_sain4_obj(n, dir, &sa4);
 631                 country = geoip4_country_name(sa4);
 632                 break;
 633
 634         case AF_INET6:
 635                 flow_entry_get_sain6_obj(n, dir, &sa6);
 636                 country = geoip6_country_name(sa6);
 637                 break;
 638         }
 639
 640         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 641
 642         if (country) {
 643                 memcpy(SELFLD(dir, country_src, country_dst), country,
 644                        min(sizeof(n->country_src), strlen(country)));
 645         } else {
 646                 memset(SELFLD(dir, country_src, country_dst), 0,
 647                        sizeof(n->country_src));
 648         }
 649 }
 650
 651 static void flow_entry_get_extended_geo(struct flow_entry *n,
 652                                         enum flow_entry_direction dir)
 653 {
 654         flow_entry_geo_city_lookup_generic(n, dir);
 655         flow_entry_geo_country_lookup_generic(n, dir);
 656 }
 657
 658 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 659                                            enum flow_entry_direction dir)
 660 {
 661         size_t sa_len;
 662         struct sockaddr_in sa4;
 663         struct sockaddr_in6 sa6;
 664         struct sockaddr *sa;
 665         struct hostent *hent;
 666
 667         switch (n->l3_proto) {
 668         default:
 669                 bug();
 670
 671         case AF_INET:
 672                 flow_entry_get_sain4_obj(n, dir, &sa4);
 673                 sa = (struct sockaddr *) &sa4;
 674                 sa_len = sizeof(sa4);
 675                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
 676                 break;
 677
 678         case AF_INET6:
 679                 flow_entry_get_sain6_obj(n, dir, &sa6);
 680                 sa = (struct sockaddr *) &sa6;
 681                 sa_len = sizeof(sa6);
 682                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
 683                 break;
 684         }
 685
 686         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 687         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 688                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 689
 690         if (hent) {
 691                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 692                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 693                        hent->h_name, min(sizeof(n->rev_dns_src),
 694                                          strlen(hent->h_name)));
 695         }
 696 }
 697
 698 static void flow_entry_get_extended(struct flow_entry *n)
 699 {
 700         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 701                 return;
 702
 703         flow_entry_get_extended_revdns(n, flow_entry_src);
 704         flow_entry_get_extended_geo(n, flow_entry_src);
 705
 706         flow_entry_get_extended_revdns(n, flow_entry_dst);
 707         flow_entry_get_extended_geo(n, flow_entry_dst);
 708
 709         /* Lookup application */
 710         n->inode = get_port_inode(n->port_src, n->l4_proto,
 711                                   n->l3_proto == AF_INET6);
 712         if (n->inode > 0)
 713                 walk_processes(n);
 714 }
 715
 716 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 717 {
 718         if (src < dst && src < 1024) {
 719                 return src;
 720         } else if (dst < src && dst < 1024) {
 721                 return dst;
 722         } else {
 723                 const char *tmp1, *tmp2;
 724                 if (tcp) {
 725                         tmp1 = lookup_port_tcp(src);
 726                         tmp2 = lookup_port_tcp(dst);
 727                 } else {
 728                         tmp1 = lookup_port_udp(src);
 729                         tmp2 = lookup_port_udp(dst);
 730                 }
 731                 if (tmp1 && !tmp2) {
 732                         return src;
 733                 } else if (!tmp1 && tmp2) {
 734                         return dst;
 735                 } else {
 736                         if (src < dst)
 737                                 return src;
 738                         else
 739                                 return dst;
 740                 }
 741         }
 742 }
 743
 744 static void presenter_screen_init(WINDOW **screen)
 745 {
 746         (*screen) = initscr();
 747         noecho();
 748         cbreak();
 749         keypad(stdscr, TRUE);
 750         nodelay(*screen, TRUE);
 751         refresh();
 752         wrefresh(*screen);
 753 }
 754
 755 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 756                                      unsigned int *line)
 757 {
 758         char tmp[128], *pname = NULL;
 759         uint16_t port;
 760
 761         mvwprintw(screen, *line, 2, "");
 762
 763         /* PID, application name */
 764         if (n->procnum > 0) {
 765                 slprintf(tmp, sizeof(tmp), "%s(%u)", basename(n->cmdline),
 766                          n->procnum);
 767
 768                 printw("[");
 769                 attron(COLOR_PAIR(3));
 770                 printw("%s", tmp);
 771                 attroff(COLOR_PAIR(3));
 772                 printw("]:");
 773         }
 774
 775         /* L3 protocol, L4 protocol, states */
 776         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 777         printw("[");
 778         attron(COLOR_PAIR(3));
 779         switch (n->l4_proto) {
 780         case IPPROTO_TCP:
 781                 printw("%s", tcp_state2str[n->tcp_state]);
 782                 break;
 783         case IPPROTO_SCTP:
 784                 printw("%s", sctp_state2str[n->sctp_state]);
 785                 break;
 786         case IPPROTO_DCCP:
 787                 printw("%s", dccp_state2str[n->dccp_state]);
 788                 break;
 789         case IPPROTO_UDP:
 790         case IPPROTO_UDPLITE:
 791         case IPPROTO_ICMP:
 792         case IPPROTO_ICMPV6:
 793                 printw("NOSTATE");
 794                 break;
 795         }
 796         attroff(COLOR_PAIR(3));
 797         printw("]");
 798
 799         /* Guess application port */
 800         switch (n->l4_proto) {
 801         case IPPROTO_TCP:
 802                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 803                 pname = lookup_port_tcp(port);
 804                 break;
 805         case IPPROTO_UDP:
 806         case IPPROTO_UDPLITE:
 807                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 808                 pname = lookup_port_udp(port);
 809                 break;
 810         }
 811         if (pname) {
 812                 attron(A_BOLD);
 813                 printw(":%s", pname);
 814                 attroff(A_BOLD);
 815         }
 816         printw(" ->");
 817
 818         /* Number packets, bytes */
 819         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 820                 printw(" (%llu pkts, %llu bytes) ->",
 821                        n->counter_pkts, n->counter_bytes);
 822
 823         /* Show source information: reverse DNS, port, country, city */
 824         if (show_src) {
 825                 attron(COLOR_PAIR(1));
 826                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 827                 attroff(COLOR_PAIR(1));
 828
 829                 printw(":%u", n->port_src);
 830
 831                 if (n->country_src[0]) {
 832                         printw(" (");
 833
 834                         attron(COLOR_PAIR(4));
 835                         printw("%s", n->country_src);
 836                         attroff(COLOR_PAIR(4));
 837
 838                         if (n->city_src[0])
 839                                 printw(", %s", n->city_src);
 840
 841                         printw(")");
 842                 }
 843
 844                 printw(" => ");
 845         }
 846
 847         /* Show dest information: reverse DNS, port, country, city */
 848         attron(COLOR_PAIR(2));
 849         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 850         attroff(COLOR_PAIR(2));
 851
 852         printw(":%u", n->port_dst);
 853
 854         if (n->country_dst[0]) {
 855                 printw(" (");
 856
 857                 attron(COLOR_PAIR(4));
 858                 printw("%s", n->country_dst);
 859                 attroff(COLOR_PAIR(4));
 860
 861                 if (n->city_dst[0])
 862                         printw(", %s", n->city_dst);
 863
 864                 printw(")");
 865         }
 866 }
 867
 868 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 869 {
 870         int ret = 1;
 871
 872         switch (n->l4_proto) {
 873         case IPPROTO_TCP:
 874                 if (n->tcp_state == state)
 875                         ret = 0;
 876                 break;
 877         case IPPROTO_SCTP:
 878                 if (n->sctp_state == state)
 879                         ret = 0;
 880                 break;
 881         case IPPROTO_DCCP:
 882                 if (n->dccp_state == state)
 883                         ret = 0;
 884                 break;
 885         case IPPROTO_UDP:
 886         case IPPROTO_UDPLITE:
 887         case IPPROTO_ICMP:
 888         case IPPROTO_ICMPV6:
 889                 ret = 0;
 890                 break;
 891         }
 892
 893         return ret;
 894 }
 895
 896 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 897                                     int skip_lines)
 898 {
 899         int i, j, maxy;
 900         unsigned int line = 3;
 901         struct flow_entry *n;
 902         uint8_t protocols[] = {
 903                 IPPROTO_TCP,
 904                 IPPROTO_DCCP,
 905                 IPPROTO_SCTP,
 906                 IPPROTO_UDP,
 907                 IPPROTO_UDPLITE,
 908                 IPPROTO_ICMP,
 909                 IPPROTO_ICMPV6,
 910         };
 911         size_t protocol_state_size[] = {
 912                 [IPPROTO_TCP] = array_size(tcp_states),
 913                 [IPPROTO_DCCP] = array_size(dccp_states),
 914                 [IPPROTO_SCTP] = array_size(sctp_states),
 915                 [IPPROTO_UDP] = 1,
 916                 [IPPROTO_UDPLITE] = 1,
 917                 [IPPROTO_ICMP] = 1,
 918                 [IPPROTO_ICMPV6] = 1,
 919         };
 920
 921         curs_set(0);
 922
 923         maxy = getmaxy(screen);
 924         maxy -= 6;
 925
 926         start_color();
 927         init_pair(1, COLOR_RED, COLOR_BLACK);
 928         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 929         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 930         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 931
 932         wclear(screen);
 933         clear();
 934
 935         mvwprintw(screen, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
 936                   "[+%d]", what & INCLUDE_TCP ? "TCP, " : "" ,
 937                   what & INCLUDE_UDP ? "UDP, " : "",
 938                   what & INCLUDE_SCTP ? "SCTP, " : "",
 939                   what & INCLUDE_DCCP ? "DCCP, " : "",
 940                   what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
 941                   what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
 942                   skip_lines);
 943
 944         rcu_read_lock();
 945
 946         if (rcu_dereference(fl->head) == NULL)
 947                 mvwprintw(screen, line, 2, "(No active sessions! "
 948                           "Is netfilter running?)");
 949
 950         for (i = 0; i < array_size(protocols); i++) {
 951                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 952                         n = rcu_dereference(fl->head);
 953                         while (n && maxy > 0) {
 954                                 int skip_entry = 0;
 955
 956                                 if (n->l4_proto != protocols[i])
 957                                         skip_entry = 1;
 958                                 if (presenter_flow_wrong_state(n, j))
 959                                         skip_entry = 1;
 960                                 if (presenter_get_port(n->port_src,
 961                                                        n->port_dst, 0) == 53)
 962                                         skip_entry = 1;
 963                                 if (skip_entry) {
 964                                         n = rcu_dereference(n->next);
 965                                         continue;
 966                                 }
 967                                 if (skip_lines > 0) {
 968                                         n = rcu_dereference(n->next);
 969                                         skip_lines--;
 970                                         continue;
 971                                 }
 972
 973                                 presenter_screen_do_line(screen, n, &line);
 974
 975                                 line++;
 976                                 maxy -= (2 + 1 * show_src);
 977                                 n = rcu_dereference(n->next);
 978                         }
 979                 }
 980         }
 981
 982         rcu_read_unlock();
 983
 984         wrefresh(screen);
 985         refresh();
 986 }
 987
 988 static inline void presenter_screen_end(void)
 989 {
 990         endwin();
 991 }
 992
 993 static void presenter(void)
 994 {
 995         int skip_lines = 0;
 996         WINDOW *screen = NULL;
 997
 998         dissector_init_ethernet(0);
 999         presenter_screen_init(&screen);
1000
1001         rcu_register_thread();
1002         while (!sigint) {
1003                 switch (getch()) {
1004                 case 'q':
1005                         sigint = 1;
1006                         break;
1007                 case KEY_UP:
1008                 case 'u':
1009                 case 'k':
1010                         skip_lines--;
1011                         if (skip_lines < 0)
1012                                 skip_lines = 0;
1013                         break;
1014                 case KEY_DOWN:
1015                 case 'd':
1016                 case 'j':
1017                         skip_lines++;
1018                         if (skip_lines > SCROLL_MAX)
1019                                 skip_lines = SCROLL_MAX;
1020                         break;
1021                 default:
1022                         fflush(stdin);
1023                         break;
1024                 }
1025
1026                 presenter_screen_update(screen, &flow_list, skip_lines);
1027                 usleep(100000);
1028         }
1029         rcu_unregister_thread();
1030
1031         presenter_screen_end();
1032         dissector_cleanup_ethernet();
1033 }
1034
1035 static int collector_cb(enum nf_conntrack_msg_type type,
1036                         struct nf_conntrack *ct, void *data)
1037 {
1038         if (sigint)
1039                 return NFCT_CB_STOP;
1040
1041         synchronize_rcu();
1042         spinlock_lock(&flow_list.lock);
1043
1044         switch (type) {
1045         case NFCT_T_NEW:
1046                 flow_list_new_entry(&flow_list, ct);
1047                 break;
1048         case NFCT_T_UPDATE:
1049                 flow_list_update_entry(&flow_list, ct);
1050                 break;
1051         case NFCT_T_DESTROY:
1052                 flow_list_destroy_entry(&flow_list, ct);
1053                 break;
1054         default:
1055                 break;
1056         }
1057
1058         spinlock_unlock(&flow_list.lock);
1059
1060         return NFCT_CB_CONTINUE;
1061 }
1062
1063 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1064 {
1065         nfct_query(handle, NFCT_Q_FLUSH, &family);
1066 }
1067
1068 static void *collector(void *null)
1069 {
1070         int ret;
1071         struct nfct_handle *handle;
1072         struct nfct_filter *filter;
1073
1074         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1075                                       NF_NETLINK_CONNTRACK_UPDATE |
1076                                       NF_NETLINK_CONNTRACK_DESTROY);
1077         if (!handle)
1078                 panic("Cannot create a nfct handle!\n");
1079
1080         collector_flush(handle, AF_INET);
1081         collector_flush(handle, AF_INET6);
1082
1083         filter = nfct_filter_create();
1084         if (!filter)
1085                 panic("Cannot create a nfct filter!\n");
1086
1087         ret = nfct_filter_attach(nfct_fd(handle), filter);
1088         if (ret < 0)
1089                 panic("Cannot attach filter to handle!\n");
1090
1091         if (what & INCLUDE_UDP) {
1092                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1093                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1094         }
1095         if (what & INCLUDE_TCP)
1096                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1097         if (what & INCLUDE_DCCP)
1098                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1099         if (what & INCLUDE_SCTP)
1100                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1101         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1102                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1103         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1104                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1105         if (what & INCLUDE_IPV4) {
1106                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1107                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1108         }
1109         if (what & INCLUDE_IPV6) {
1110                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1111                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1112         }
1113
1114         ret = nfct_filter_attach(nfct_fd(handle), filter);
1115         if (ret < 0)
1116                 panic("Cannot attach filter to handle!\n");
1117
1118         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1119         nfct_filter_destroy(filter);
1120         flow_list_init(&flow_list);
1121
1122         rcu_register_thread();
1123
1124         while (!sigint && ret >= 0)
1125                 ret = nfct_catch(handle);
1126
1127         rcu_unregister_thread();
1128
1129         flow_list_destroy(&flow_list);
1130         nfct_close(handle);
1131
1132         pthread_exit(0);
1133 }
1134
1135 int main(int argc, char **argv)
1136 {
1137         pthread_t tid;
1138         int ret, c, opt_index, what_cmd = 0;
1139
1140         setfsuid(getuid());
1141         setfsgid(getgid());
1142
1143         while ((c = getopt_long(argc, argv, short_options, long_options,
1144                &opt_index)) != EOF) {
1145                 switch (c) {
1146                 case '4':
1147                         what_cmd |= INCLUDE_IPV4;
1148                         break;
1149                 case '6':
1150                         what_cmd |= INCLUDE_IPV6;
1151                         break;
1152                 case 'T':
1153                         what_cmd |= INCLUDE_TCP;
1154                         break;
1155                 case 'U':
1156                         what_cmd |= INCLUDE_UDP;
1157                         break;
1158                 case 'D':
1159                         what_cmd |= INCLUDE_DCCP;
1160                         break;
1161                 case 'I':
1162                         what_cmd |= INCLUDE_ICMP;
1163                         break;
1164                 case 'S':
1165                         what_cmd |= INCLUDE_SCTP;
1166                         break;
1167                 case 's':
1168                         show_src = 1;
1169                         break;
1170                 case 'u':
1171                         update_geoip();
1172                         die();
1173                         break;
1174                 case 'h':
1175                         help();
1176                         break;
1177                 case 'v':
1178                         version();
1179                         break;
1180                 default:
1181                         break;
1182                 }
1183         }
1184
1185         if (what_cmd > 0)
1186                 what = what_cmd;
1187
1188         rcu_init();
1189
1190         register_signal(SIGINT, signal_handler);
1191         register_signal(SIGHUP, signal_handler);
1192
1193         init_geoip(1);
1194
1195         ret = pthread_create(&tid, NULL, collector, NULL);
1196         if (ret < 0)
1197                 panic("Cannot create phthread!\n");
1198
1199         presenter();
1200
1201         destroy_geoip();
1202
1203         return 0;
1204 }