?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libvdehist: reload the command list when plugins get loaded/unloaded
[vde.git] / vde-2 / src / vde_switch / plugins / iplog.c
blob9e564c6ecb68bd3788d7e210a1abbc96b8e05def
1 /* This is part of VDE Virtual Distributed Internet
2 *
3 * iplog: ip logging plugin for vde_switch
4 *
5 * Copyright 2010 Renzo Davoli University of Bologna - Italy
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License, version 2, as
9 * published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License along
17 * with this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
19 *
20 */
21
22 /* XXX missing:
23 search ip
24 */
25
26 #define _GNU_SOURCE
27
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <fcntl.h>
31 #include <stdint.h>
32
33 #include <config.h>
34 #include <vde.h>
35 #include <syslog.h>
36 #include <errno.h>
37 #include <limits.h>
38 #include <unistd.h>
39 #include <sys/types.h>
40 #include <sys/socket.h>
41 #include <netdb.h>
42 #include <stdio.h>
43 #include <string.h>
44 #include <netinet/in.h>
45 #include <sys/uio.h>
46 #include <pwd.h>
47 #include <ctype.h>
48
49 #include <vdecommon.h>
50
51 #include <vdeplugin.h>
52
53 static char *logfile;
54 static int logfilefd=-1;
55
56 #define D_LOGIP 0300
57 static struct dbgcl dl[]= {
58 {"iplog/newip","show new ip addresses",D_LOGIP|D_PLUS},
59 };
60 #define D_LOGIP_NEWIP (dl)
61
62 /* lists of ip ranges to log */
63 struct ip4logaddr {
64 struct ip4logaddr *next;
65 uint32_t addr;
66 uint32_t mask;
67 };
68
69 struct ip6logaddr {
70 struct ip6logaddr *next;
71 uint32_t addr[4];
72 uint32_t mask[4];
73 };
74
75 struct ip4logaddr *ip4loghead;
76 struct ip6logaddr *ip6loghead;
77
78 /* packet header structure layer 2 and 3*/
79 #define ETH_ALEN 6
80 struct header {
81 unsigned char dest[ETH_ALEN];
82 unsigned char src[ETH_ALEN];
83 unsigned char proto[2];
84 };
85
86 union body {
87 struct {
88 unsigned char version;
89 unsigned char filler[11];
90 unsigned char ip4src[4];
91 unsigned char ip4dst[4];
92 } v4;
93 struct {
94 unsigned char version;
95 unsigned char filler[7];
96 unsigned char ip6src[16];
97 unsigned char ip6dst[16];
98 } v6;
99 struct {
100 unsigned char priovlan[2];
101 } vlan;
102 };
103
104 /* vde plugin data */
105 struct plugin vde_plugin_data={
106 .name="iplog",
107 .help="log ip/port/user assignment",
108 };
109
110 /* translate ipv4 ipv6 addresses into strings for logging */
111 static inline int ip42string(uint32_t *addr, char *hostname, unsigned int len)
112 {
113 struct sockaddr_in ip4addr;
114 ip4addr.sin_family=AF_INET;
115 ip4addr.sin_port=0;
116 ip4addr.sin_addr.s_addr = *addr;
117 return getnameinfo((struct sockaddr *)&ip4addr,sizeof(ip4addr),
118 hostname,len,NULL,0,NI_NUMERICHOST);
119 }
120
121 static inline int ip62string(uint32_t *addr, char *hostname, unsigned int len)
122 {
123 struct sockaddr_in6 ip6addr;
124 ip6addr.sin6_family=AF_INET6;
125 ip6addr.sin6_port=0;
126 ip6addr.sin6_flowinfo=0;
127 ip6addr.sin6_scope_id=0;
128 memcpy(&ip6addr.sin6_addr.s6_addr,addr,16);
129 return getnameinfo((struct sockaddr *)&ip6addr,sizeof(ip6addr),
130 hostname,len,NULL,0,NI_NUMERICHOST);
131 }
132
133 /* hash table of recently seen ip addresses, collision lists are double linked */
134 #define IP_HASH_SIZE 1024
135
136 struct ip_hash_entry {
137 struct ip_hash_entry *next;
138 struct ip_hash_entry **prev;
139 time_t last_seen;
140 int port;
141 short vlan;
142 short len;
143 unsigned char ipaddr[4];
144 };
145
146 static struct ip_hash_entry **iph;
147
148 static inline int ip_hash(int len,unsigned char *addr)
149 {
150 if (len == 4)
151 return((addr[0]+2*addr[1]+3*addr[2]+5*addr[3]) % IP_HASH_SIZE);
152 else
153 return((addr[0]+2*addr[1]+3*addr[2]+5*addr[3]+
154 7*addr[4]+11*addr[5]+13*addr[6]+17*addr[7]+
155 19*addr[8]+23*addr[9]+29*addr[10]+31*addr[11]+
156 37*addr[12]+41*addr[13]+43*addr[14]+47*addr[15]) % IP_HASH_SIZE);
157 }
158
159 /* search ip address into the hash tacle and add it if it does not exist.
160 log each new item added */
161 static void ip_find_in_hash_update(int len,unsigned char *addr,int vlan,int port)
162 {
163 struct ip_hash_entry *e;
164 int k = ip_hash(len, addr);
165 time_t now;
166 for(e = iph[k]; e && memcmp(e->ipaddr, addr, len) && e->len == len &&
167 e->vlan == vlan; e = e->next)
168 ;
169 if(e == NULL) {
170 e = (struct ip_hash_entry *) malloc(sizeof(*e)+(len-4));
171 if(e == NULL){
172 printlog(LOG_WARNING,"Failed to malloc ip_hash entry %s",strerror(errno));
173 return;
174 }
175 memcpy(e->ipaddr, addr, len);
176 if(iph[k] != NULL) iph[k]->prev = &(e->next);
177 e->next = iph[k];
178 e->prev = &(iph[k]);
179 e->vlan = vlan;
180 e->len = len;
181 e->port = -1;
182 iph[k] = e;
183 }
184 now=qtime();
185 e->last_seen = now;
186 if(e->port != port || e->vlan != vlan) {
187 e->port=port;
188 e->vlan = vlan;
189 char hostname[100];
190 char msg[1024];
191 char lf[]="\n";
192 char stime[26];
193 struct iovec iov[]={{stime+4,16},{msg,0},{lf,1}};
194
195 if ((len==4 && ip42string((uint32_t *)addr,hostname,sizeof(hostname))==0) ||
196 (len==16 && ip62string((uint32_t *)addr,hostname,sizeof(hostname))==0)) {
197 struct passwd *pwd;
198 char *username;
199 int epn;
200 char *descr;
201 if ((pwd=getpwuid(port_user(port))) == NULL)
202 username="(none)";
203 else
204 username=pwd->pw_name;
205 iov[1].iov_len=snprintf(msg,sizeof(msg),"ipv%d %s port=%d vlan=%d user=%s",
206 (len==4)?4:6, hostname, port, vlan, username);
207 for (epn=0; (descr=port_descr(port,epn)) != NULL; epn++) {
208 int len=iov[1].iov_len;
209 int descrlen=snprintf(msg+len,sizeof(msg)-len," \"%s\"",descr);
210 iov[1].iov_len+=descrlen;
211 }
212 if (logfilefd >= 0) {
213 time_t ntime=time(&ntime);
214 ctime_r(&ntime,stime);
215 writev(logfilefd,iov,3);
216 } else if (logfilefd != -1)
217 syslog(LOG_INFO, msg);
218 DBGOUT(D_LOGIP_NEWIP,"%s",msg);
219 }
220 }
221 }
222
223 /* pass through the hash table and execute function f for each element */
224 static void ip_for_all_hash(void (*f)(struct ip_hash_entry *, void *), void *arg)
225 {
226 int i;
227 struct ip_hash_entry *e, *next;
228
229 for(i = 0; i < IP_HASH_SIZE; i++){
230 for(e = iph[i]; e; e = next){
231 next = e->next;
232 (*f)(e, arg);
233 }
234 }
235 }
236
237 /* delete a hash table entry */
238 static inline void delete_hash_entry(struct ip_hash_entry *old)
239 {
240 *((old)->prev)=(old)->next;
241 if((old)->next != NULL) (old)->next->prev = (old)->prev;
242 free((old));
243 }
244
245
246 #define IP_GC_INTERVAL 10
247 #define IP_GC_EXPIRE 360
248 static int ip_gc_interval=IP_GC_INTERVAL;
249 static int ip_gc_expire=IP_GC_EXPIRE;
250 static unsigned int ip_gc_timerno;
251
252 /* clean from the hash table entries older than IP_GC_EXPIRE seconds, given that
253 * 'now' points to a time_t structure describing the current time */
254 static void ip_gc(struct ip_hash_entry *e, void *expiretime)
255 {
256 if(e->last_seen <= *((time_t *)expiretime))
257 delete_hash_entry(e);
258 }
259
260 /* clean old entries in the hash table 'h', and prepare the timer to be called
261 * again between GC_INTERVAL seconds */
262 static void ip_hash_gc(void *arg)
263 {
264 time_t t = qtime() - ip_gc_expire;
265 ip_for_all_hash(ip_gc, &t);
266 }
267
268 /* upcall from vde: new incomping packet */
269 #define UINT32(X) (((uint32_t *)&(X)))
270 static int iplog_pktin(struct dbgcl *event,void *arg,va_list v)
271 {
272 int vlan=0;
273 int port=va_arg(v,int);
274 unsigned char *buf=va_arg(v,unsigned char *);
275 //int len=va_arg(v,int);
276 struct header *ph=(struct header *) buf;
277 union body *pb=(union body *)(ph+1);
278 //fprintf(stderr,"packet from port %d len %d\n",port,len);
279 if (ph->proto[0]==0x81 && ph->proto[1]==0x00) { /*VLAN*/
280 vlan=((pb->vlan.priovlan[0] << 8) + pb->vlan.priovlan[1]) & 0xfff;
281 ph=(struct header *)(((char *)ph)+4);
282 pb=(union body *)(((char *)pb)+4);
283 }
284 if (ph->proto[0]==0x08 && ph->proto[1]==0x00 &&
285 pb->v4.version == 0x45) {
286 /*v4 */
287 struct ip4logaddr *ip4scan;
288 /* is the packet in one of the logged ranges? */
289 for (ip4scan=ip4loghead; ip4scan!=NULL; ip4scan=ip4scan->next) {
290 /*printf("%x %x %x\n",UINT32(pb->v4.ip4src[0]) , ip4scan->mask ,
291 ip4scan->addr);*/
292 uint32_t *addr=UINT32(pb->v4.ip4src[0]);
293 if ((addr[0] & ip4scan->mask) ==
294 ip4scan->addr) {
295 ip_find_in_hash_update(4,pb->v4.ip4src,vlan,port);
296 break;
297 }
298 }
299 }
300 else if (ph->proto[0]==0x86 && ph->proto[1]==0xdd &&
301 pb->v4.version == 0x60) {
302 /*v6 */
303 struct ip6logaddr *ip6scan;
304 /* is the packet in one of the logged ranges? */
305 for (ip6scan=ip6loghead; ip6scan!=NULL; ip6scan=ip6scan->next) {
306 /*printf("%x %x %x:",UINT32(pb->v6.ip6src[0]) , ip6scan->mask[0] , ip6scan->addr[0]);
307 printf("%x %x %x:",UINT32(pb->v6.ip6src[4]) , ip6scan->mask[1] , ip6scan->addr[1]);
308 printf("%x %x %x:",UINT32(pb->v6.ip6src[8]) , ip6scan->mask[2] , ip6scan->addr[2]);
309 printf("%x %x %x:",UINT32(pb->v6.ip6src[12]) , ip6scan->mask[3] , ip6scan->addr[3]);
310 printf("\n");*/
311 uint32_t *addr=UINT32(pb->v6.ip6src[0]);
312 if (
313 ((addr[0] & ip6scan->mask[0]) == ip6scan->addr[0]) &&
314 ((addr[1] & ip6scan->mask[1]) == ip6scan->addr[1]) &&
315 ((addr[2] & ip6scan->mask[2]) == ip6scan->addr[2]) &&
316 ((addr[3] & ip6scan->mask[3]) == ip6scan->addr[3])
317 )
318 {
319 ip_find_in_hash_update(16,pb->v6.ip6src,vlan,port);
320 break;
321 }
322 }
323 }
324 return 0;
325 }
326
327 /* delete all ip address on a specific port (when the port is closed) */
328 static void port_gc(struct ip_hash_entry *e, void *arg)
329 {
330 int *port=arg;
331 if(*port == e->port)
332 delete_hash_entry(e);
333 }
334
335 /* upcall from vde: a port has been closed */
336 static int iplog_port_minus(struct dbgcl *event,void *arg,va_list v)
337 {
338 int port=va_arg(v,int);
339 ip_for_all_hash(&port_gc, &port);
340 return 0;
341 }
342
343 /*user interface: showinfo */
344 static int ipshowinfo(FILE *fd)
345 {
346 printoutc(fd,"iplog: ip/port/user logging plugin");
347 if (logfilefd<0) {
348 if (logfilefd == -1)
349 printoutc(fd,"log disabled");
350 else
351 printoutc(fd,"log on syslog");
352 } else
353 printoutc(fd,"log on file %s",logfile);
354 printoutc(fd,"GC interval %d secs",ip_gc_interval);
355 printoutc(fd,"GC expire %d secs",ip_gc_expire);
356 return 0;
357 }
358
359 /* close the old log file */
360 static void closelogfile(void)
361 {
362 if (logfilefd >= 0)
363 close(logfilefd);
364 if (logfile != NULL)
365 free(logfile);
366 }
367
368 /* change the log file */
369 static int iplogfile(char *arg)
370 {
371 if (*arg) {
372 if (strcmp(arg,"-")==0) {
373 closelogfile();
374 logfilefd=-2;
375 return 0;
376 } else {
377 int fd;
378 fd=open(arg,O_CREAT|O_WRONLY|O_APPEND,0600);
379 if (fd>=0) {
380 char abspath[PATH_MAX];
381 closelogfile();
382 logfilefd=fd;
383 vde_realpath(arg,abspath);
384 logfile=strdup(abspath);
385 return 0;
386 } else
387 return ENOENT;
388 }
389 } else
390 return EINVAL;
391 }
392
393 /* add a v4 range (recursive) */
394 static int iplog4radd(struct ip4logaddr **ph, uint32_t addr, uint32_t mask)
395 {
396 if (*ph == NULL) {
397 *ph=malloc(sizeof(struct ip4logaddr));
398 if (*ph==NULL)
399 return ENOMEM;
400 else {
401 (*ph)->next=NULL;
402 (*ph)->addr=addr;
403 (*ph)->mask=mask;
404 return 0;
405 }
406 } else {
407 if ((*ph)->addr==addr && (*ph)->mask==mask)
408 return EEXIST;
409 else
410 return iplog4radd(&((*ph)->next),addr,mask);
411 }
412 }
413
414 /* add a v6 range (recursive) */
415 static int iplog6radd(struct ip6logaddr **ph, uint32_t addr[4], uint32_t mask[4])
416 {
417 if (*ph == NULL) {
418 *ph=malloc(sizeof(struct ip6logaddr));
419 if (*ph==NULL)
420 return ENOMEM;
421 else {
422 (*ph)->next=NULL;
423 memcpy((void *)((*ph)->addr),addr,16);
424 memcpy((void *)((*ph)->mask),mask,16);
425 return 0;
426 }
427 } else {
428 if (memcmp(&((*ph)->addr),addr,16) == 0 &&
429 memcmp(&((*ph)->mask),mask,16) == 0)
430 return EEXIST;
431 else
432 return iplog6radd(&((*ph)->next),addr,mask);
433 }
434 }
435
436 /* delete a v4 range (recursive) */
437 static int iplog4rdel(struct ip4logaddr **ph, uint32_t addr, uint32_t mask)
438 {
439 if (*ph == NULL) {
440 return ENOENT;
441 } else {
442 if ((*ph)->addr==addr && (*ph)->mask==mask) {
443 struct ip4logaddr *this=*ph;
444 *ph=(*ph)->next;
445 free(this);
446 return 0;
447 } else
448 return iplog4rdel(&((*ph)->next),addr,mask);
449 }
450 }
451
452 /* delete a v6 range (recursive) */
453 static int iplog6rdel(struct ip6logaddr **ph, uint32_t addr[4], uint32_t mask[4])
454 {
455 if (*ph == NULL) {
456 return ENOENT;
457 } else {
458 if (memcmp(&((*ph)->addr),addr,16) == 0 &&
459 memcmp(&((*ph)->mask),mask,16) == 0) {
460 struct ip6logaddr *this=*ph;
461 *ph=(*ph)->next;
462 free(this);
463 return 0;
464 } else
465 return iplog6rdel(&((*ph)->next),addr,mask);
466 }
467 }
468
469 /* create a mask from the number of bits */
470 static void n2mask(int len,int n, uint32_t *out)
471 {
472 char m[len];
473 int i;
474 for (i=0;i<len;i++,n-=8) {
475 if (n>=8)
476 m[i]=0xff;
477 else if (n>0)
478 m[i]=~((1<<(8-n))-1);
479 else
480 m[i]=0;
481 }
482 len=(len+sizeof(uint32_t)-1)/sizeof(uint32_t);
483 for (i=0;i<len;i++)
484 out[i]=*(((uint32_t *)m)+i);
485 }
486
487 /* compute the number of bits from a mask */
488 static int mask2n(int len, void *addr)
489 {
490 char *m=addr;
491 int n=0;
492 int i,sm;
493 for (i=0;i<len;i++) {
494 for (sm=0x80;sm!=0;sm>>=1) {
495 if (m[i] & sm)
496 n++;
497 else
498 return n;
499 }
500 }
501 return n;
502 }
503
504 /* convert an ipv4 or ipv6 address into addr/mask */
505 static int char2addr_mask(char *arg, uint32_t *addr, uint32_t *mask)
506 {
507 struct addrinfo *ai;
508 char *smask=strrchr(arg,'/');
509 int len;
510 if (smask != NULL) {
511 *smask=0;
512 smask++;
513 }
514 if (getaddrinfo(arg,NULL,NULL,&ai) != 0)
515 return -1;
516 else {
517 if (ai->ai_family == AF_INET) {
518 struct sockaddr_in *ip4addr=(struct sockaddr_in *) ai->ai_addr;
519 len=4;
520 if (smask != NULL)
521 n2mask(len,atoi(smask),mask);
522 else
523 n2mask(len,32,mask);
524 addr[0]=ip4addr->sin_addr.s_addr & mask[0];
525 } else if (ai->ai_family == AF_INET6) {
526 int i;
527 struct sockaddr_in6 *ip6addr=(struct sockaddr_in6 *) ai->ai_addr;
528 len=16;
529 if (smask != NULL)
530 n2mask(len,atoi(smask),mask);
531 else
532 n2mask(len,128,mask);
533 for (i=0;i<4;i++)
534 addr[i]=*(((uint32_t *)ip6addr->sin6_addr.s6_addr)+i) & mask[i];
535 } else
536 len=-1;
537 freeaddrinfo(ai);
538 return len;
539 }
540 }
541
542 /* user interface: add an ipv4 or ipv6 range */
543 static int iplogadd(char *arg)
544 {
545 uint32_t addr[4],mask[4];
546 int len=char2addr_mask(arg,addr,mask);
547 if (len == 4)
548 return iplog4radd(&ip4loghead,addr[0],mask[0]);
549 else if (len == 16)
550 return iplog6radd(&ip6loghead,addr,mask);
551 else
552 return EINVAL;
553 }
554
555 /* user interface: delete an ipv4 or ipv6 range */
556 static int iplogdel(char *arg)
557 {
558 uint32_t addr[4],mask[4];
559 int len=char2addr_mask(arg,addr,mask);
560 if (len == 4)
561 return iplog4rdel(&ip4loghead,addr[0],mask[0]);
562 else if (len == 16)
563 return iplog6rdel(&ip6loghead,addr,mask);
564 else
565 return EINVAL;
566 }
567
568 /* list the ipv4 ranges */
569 static void iplog4rlist(struct ip4logaddr *ph, FILE *fd)
570 {
571 if (ph != NULL) {
572 char hostname[20];
573 if (ip42string(&ph->addr,hostname,sizeof(hostname)) == 0)
574 printoutc(fd," ipv4: %s/%d",hostname,mask2n(4,&ph->mask));
575 iplog4rlist(ph->next,fd);
576 }
577 }
578
579 /* list the ipv6 ranges */
580 static void iplog6rlist(struct ip6logaddr *ph, FILE *fd)
581 {
582 if (ph != NULL) {
583 char hostname[100];
584 if (ip62string(ph->addr,hostname,sizeof(hostname)) == 0)
585 printoutc(fd," ipv6: %s/%d",hostname,mask2n(16,&ph->mask));
586 iplog6rlist(ph->next,fd);
587 }
588 }
589
590 /* user interfaces list the ip ranges (v4 and v6)*/
591 static int iploglist(FILE *fd)
592 {
593 iplog4rlist(ip4loghead,fd);
594 iplog6rlist(ip6loghead,fd);
595 return 0;
596 }
597
598 /* user interfaces set the garbage collection interval*/
599 int iplog_set_gc_interval(int p)
600 {
601 qtimer_del(ip_gc_timerno);
602 ip_gc_interval=p;
603 ip_gc_timerno=qtimer_add(ip_gc_interval,0,ip_hash_gc,NULL);
604 return 0;
605 }
606
607 /* user interfaces set the expire interval*/
608 int iplog_set_gc_expire(int e)
609 {
610 ip_gc_expire=e;
611 return 0;
612 }
613
614 /* print an item of the recent ip hash table */
615 static void iplog_iplist_item(struct ip_hash_entry *e, void *arg)
616 {
617 FILE *fd=arg;
618 char hostname[100];
619 if ((e->len==4 && ip42string((uint32_t *)e->ipaddr,hostname,sizeof(hostname))==0) ||
620 (e->len==16 && ip62string((uint32_t *)e->ipaddr,hostname,sizeof(hostname))==0)) {
621 struct passwd *pwd;
622 char *username;
623 if ((pwd=getpwuid(port_user(e->port))) == NULL)
624 username="(none)";
625 else
626 username=pwd->pw_name;
627 printoutc(fd,"ipv%d %s port=%d user=%s", (e->len==4)?4:6, hostname, e->port, username);
628 }
629 }
630
631 /* user interface: list all the ip addresses in the hash table */
632 static int iplog_iplist(FILE *fd)
633 {
634 ip_for_all_hash(iplog_iplist_item, fd);
635 return 0;
636 }
637
638 /* user interface: list the ip addresses on a specific port */
639 struct ipport_data {
640 FILE *fd;
641 int port;
642 };
643
644 static void iplog_ipport_item(struct ip_hash_entry *e, void *arg)
645 {
646 struct ipport_data *pipd=arg;
647 if (e->port == pipd->port)
648 iplog_iplist_item(e,pipd->fd);
649 }
650
651 static int iplog_ipport(FILE *fd,int port)
652 {
653 struct ipport_data ipd={fd, port};
654 ip_for_all_hash(iplog_ipport_item, &ipd);
655 return 0;
656 }
657
658 /* user interface: list the ip addresses of a specific user */
659 struct ipuser_data {
660 FILE *fd;
661 uid_t user;
662 };
663
664 static void iplog_ipuser_item(struct ip_hash_entry *e, void *arg)
665 {
666 struct ipuser_data *piud=arg;
667 if (port_user(e->port) == piud->user)
668 iplog_iplist_item(e,piud->fd);
669 }
670
671 static int iplog_ipuser(FILE *fd,char *user)
672 {
673 struct passwd *pwd;
674 struct ipuser_data iud={.fd=fd};
675 if (user==NULL || *user==0)
676 return EINVAL;
677 if (isdigit(*user))
678 pwd=getpwuid(atoi(user));
679 else
680 pwd=getpwnam(user);
681 if (pwd == NULL)
682 return EINVAL;
683 iud.user=pwd->pw_uid;
684 ip_for_all_hash(iplog_ipuser_item, &iud);
685 return 0;
686 }
687
688 /* user interface: search an ip address in the hash table */
689 static void iplog_ipsearch_item(int len,unsigned char *addr, FILE *fd)
690 {
691 struct ip_hash_entry *e;
692 int k = ip_hash(len, addr);
693 for(e = iph[k]; e && memcmp(e->ipaddr, addr, len) && e->len == len; e = e->next)
694 ;
695 if(e != NULL)
696 iplog_iplist_item(e,fd);
697 }
698
699 static int iplog_ipsearch(FILE *fd,char *addr)
700 {
701 struct addrinfo *ai;
702 int rv=0;
703 if (addr==NULL || *addr==0)
704 return EINVAL;
705 if (getaddrinfo(addr,NULL,NULL,&ai) != 0)
706 return EINVAL;
707 if (ai->ai_family == AF_INET) {
708 struct sockaddr_in *ip4addr=(struct sockaddr_in *) ai->ai_addr;
709 iplog_ipsearch_item(4, (unsigned char *) &ip4addr->sin_addr.s_addr, fd);
710 } else if (ai->ai_family == AF_INET6) {
711 struct sockaddr_in6 *ip6addr=(struct sockaddr_in6 *) ai->ai_addr;
712 iplog_ipsearch_item(16, ip6addr->sin6_addr.s6_addr , fd);
713 } else
714 rv=EINVAL;
715 freeaddrinfo(ai);
716 return rv;
717 }
718
719 /* command list */
720 static struct comlist cl[]={
721 {"iplog","============","IP/Mac/User Logging",NULL,NOARG},
722 {"iplog/showinfo","","Show info on logging",ipshowinfo,NOARG|WITHFILE},
723 {"iplog/logfile","pathname","Set the logfile",iplogfile,STRARG},
724 {"iplog/ipadd","ipaddr/mask","add an ipv4/v6 range",iplogadd,STRARG},
725 {"iplog/ipdel","ipaddr/mask","del an ipv6/v6 range",iplogdel,STRARG},
726 {"iplog/list","","list ip ranges",iploglist,NOARG|WITHFILE},
727 {"iplog/setgcint","N","change garbage collector interval",iplog_set_gc_interval,INTARG},
728 {"iplog/setexpire","N","change iplog entries expire time",iplog_set_gc_expire,INTARG},
729 {"iplog/iplist","","list active IP",iplog_iplist,NOARG|WITHFILE},
730 {"iplog/ipport","port","list active IP on a port",iplog_ipport,INTARG|WITHFILE},
731 {"iplog/ipuser","user","list active IP of a user",iplog_ipuser,STRARG|WITHFILE},
732 {"iplog/ipsearch","ipaddr","search an IP address",iplog_ipsearch,STRARG|WITHFILE},
733 };
734
735 static int iplog_hup(struct dbgcl *event,void *arg,va_list v)
736 {
737 if (logfilefd >= 0) {
738 char stime[26];
739 char lf[]="\n";
740 char *prehup="SIGHUP: closing file";
741 char *posthup="SIGHUP: opening file";
742 struct iovec preiov[]={{stime+4,16},{prehup,strlen(prehup)},{lf,1}};
743 struct iovec postiov[]={{stime+4,16},{posthup,strlen(posthup)},{lf,1}};
744 time_t ntime=time(&ntime);
745 ctime_r(&ntime,stime);
746 writev(logfilefd,preiov,3);
747 close(logfilefd);
748 logfilefd=open(logfile,O_CREAT|O_WRONLY|O_APPEND,0600);
749 writev(logfilefd,postiov,3);
750 }
751 return 0;
752 }
753
754 static void
755 __attribute__ ((constructor))
756 init (void)
757 {
758 iph=calloc(IP_HASH_SIZE,sizeof(struct ip_hash_entry *));
759 ADDCL(cl);
760 ADDDBGCL(dl);
761 ip_gc_timerno=qtimer_add(ip_gc_interval,0,ip_hash_gc,NULL);
762 eventadd(iplog_hup, "sig/hup", NULL);
763 eventadd(iplog_pktin, "packet/in", NULL);
764 eventadd(iplog_port_minus, "port/-", NULL);
765 }
766
767 static void
768 __attribute__ ((destructor))
769 fini (void)
770 {
771 time_t t = qtime();
772 closelogfile();
773 eventdel(iplog_port_minus, "port/-", NULL);
774 eventdel(iplog_pktin, "packet/in", NULL);
775 eventdel(iplog_hup, "sig/hup", NULL);
776 qtimer_del(ip_gc_timerno);
777 DELCL(cl);
778 DELDBGCL(dl);
779 ip_for_all_hash(ip_gc, &t);
780 free(iph);
781 }
vde git mirror