flowtop.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2011 - 2013 Daniel Borkmann.
   4  * Copyright 2011 Emmanuel Roullit.
   5  * Subject to the GPL, version 2.
   6  *
   7  *   The Dark Lord has Nine. But we have One, mightier than they: the White
   8  *   Rider. He has passed through the fire and the abyss, and they shall
   9  *   fear him. We will go where he leads.
  10  *
  11  *     -- The Lord of the Rings, Aragorn,
  12  *        Chapter 'The White Rider'.
  13  */
  14
  15 #define _LGPL_SOURCE
  16 #include <stdio.h>
  17 #include <stdint.h>
  18 #include <stdlib.h>
  19 #include <signal.h>
  20 #include <getopt.h>
  21 #include <pthread.h>
  22 #include <signal.h>
  23 #include <netdb.h>
  24 #include <ctype.h>
  25 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
  26 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
  27 #include <libnetfilter_conntrack/libnetfilter_conntrack_dccp.h>
  28 #include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
  29 #include <netinet/in.h>
  30 #include <curses.h>
  31 #include <dirent.h>
  32 #include <sys/stat.h>
  33 #include <sys/fsuid.h>
  34 #include <urcu.h>
  35 #include <libgen.h>
  36
  37 #include "die.h"
  38 #include "xmalloc.h"
  39 #include "xio.h"
  40 #include "geoip.h"
  41 #include "xutils.h"
  42 #include "built_in.h"
  43 #include "locking.h"
  44 #include "dissector_eth.h"
  45 #include "pkt_buff.h"
  46
  47 struct flow_entry {
  48         uint32_t flow_id, use, status;
  49         uint8_t  l3_proto, l4_proto;
  50         uint32_t ip4_src_addr, ip4_dst_addr;
  51         uint32_t ip6_src_addr[4], ip6_dst_addr[4];
  52         uint16_t port_src, port_dst;
  53         uint8_t  tcp_state, tcp_flags, sctp_state, dccp_state;
  54         uint64_t counter_pkts, counter_bytes;
  55         uint64_t timestamp_start, timestamp_stop;
  56         char country_src[128], country_dst[128];
  57         char city_src[128], city_dst[128];
  58         char rev_dns_src[256], rev_dns_dst[256];
  59         char cmdline[256];
  60         struct flow_entry *next;
  61         int procnum, inode;
  62 };
  63
  64 struct flow_list {
  65         struct flow_entry *head;
  66         struct spinlock lock;
  67 };
  68
  69 #ifndef ATTR_TIMESTAMP_START
  70 # define ATTR_TIMESTAMP_START 63
  71 #endif
  72 #ifndef ATTR_TIMESTAMP_STOP
  73 # define ATTR_TIMESTAMP_STOP 64
  74 #endif
  75
  76 #define SCROLL_MAX 1000
  77
  78 #define INCLUDE_IPV4    (1 << 0)
  79 #define INCLUDE_IPV6    (1 << 1)
  80 #define INCLUDE_UDP     (1 << 2)
  81 #define INCLUDE_TCP     (1 << 3)
  82 #define INCLUDE_DCCP    (1 << 4)
  83 #define INCLUDE_ICMP    (1 << 5)
  84 #define INCLUDE_SCTP    (1 << 6)
  85
  86 volatile sig_atomic_t sigint = 0;
  87
  88 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP, show_src = 0;
  89
  90 static struct flow_list flow_list;
  91
  92 static const char *short_options = "vhTUsDIS46u";
  93 static const struct option long_options[] = {
  94         {"ipv4",        no_argument,            NULL, '4'},
  95         {"ipv6",        no_argument,            NULL, '6'},
  96         {"tcp",         no_argument,            NULL, 'T'},
  97         {"udp",         no_argument,            NULL, 'U'},
  98         {"dccp",        no_argument,            NULL, 'D'},
  99         {"icmp",        no_argument,            NULL, 'I'},
 100         {"sctp",        no_argument,            NULL, 'S'},
 101         {"show-src",    no_argument,            NULL, 's'},
 102         {"update",      no_argument,            NULL, 'u'},
 103         {"version",     no_argument,            NULL, 'v'},
 104         {"help",        no_argument,            NULL, 'h'},
 105         {NULL, 0, NULL, 0}
 106 };
 107
 108 static const char *const l3proto2str[AF_MAX] = {
 109         [AF_INET]                       = "ipv4",
 110         [AF_INET6]                      = "ipv6",
 111 };
 112
 113 static const char *const l4proto2str[IPPROTO_MAX] = {
 114         [IPPROTO_TCP]                   = "tcp",
 115         [IPPROTO_UDP]                   = "udp",
 116         [IPPROTO_UDPLITE]               = "udplite",
 117         [IPPROTO_ICMP]                  = "icmp",
 118         [IPPROTO_ICMPV6]                = "icmpv6",
 119         [IPPROTO_SCTP]                  = "sctp",
 120         [IPPROTO_GRE]                   = "gre",
 121         [IPPROTO_DCCP]                  = "dccp",
 122         [IPPROTO_IGMP]                  = "igmp",
 123         [IPPROTO_IPIP]                  = "ipip",
 124         [IPPROTO_EGP]                   = "egp",
 125         [IPPROTO_PUP]                   = "pup",
 126         [IPPROTO_IDP]                   = "idp",
 127         [IPPROTO_RSVP]                  = "rsvp",
 128         [IPPROTO_IPV6]                  = "ip6tun",
 129         [IPPROTO_ESP]                   = "esp",
 130         [IPPROTO_AH]                    = "ah",
 131         [IPPROTO_PIM]                   = "pim",
 132         [IPPROTO_COMP]                  = "comp",
 133 };
 134
 135 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
 136         [TCP_CONNTRACK_NONE]            = "NOSTATE",
 137         [TCP_CONNTRACK_SYN_SENT]        = "SYN_SENT",
 138         [TCP_CONNTRACK_SYN_RECV]        = "SYN_RECV",
 139         [TCP_CONNTRACK_ESTABLISHED]     = "ESTABLISHED",
 140         [TCP_CONNTRACK_FIN_WAIT]        = "FIN_WAIT",
 141         [TCP_CONNTRACK_CLOSE_WAIT]      = "CLOSE_WAIT",
 142         [TCP_CONNTRACK_LAST_ACK]        = "LAST_ACK",
 143         [TCP_CONNTRACK_TIME_WAIT]       = "TIME_WAIT",
 144         [TCP_CONNTRACK_CLOSE]           = "CLOSE",
 145         [TCP_CONNTRACK_SYN_SENT2]       = "SYN_SENT2",
 146 };
 147
 148 static const uint8_t tcp_states[] = {
 149         TCP_CONNTRACK_SYN_SENT,
 150         TCP_CONNTRACK_SYN_RECV,
 151         TCP_CONNTRACK_ESTABLISHED,
 152         TCP_CONNTRACK_FIN_WAIT,
 153         TCP_CONNTRACK_CLOSE_WAIT,
 154         TCP_CONNTRACK_LAST_ACK,
 155         TCP_CONNTRACK_TIME_WAIT,
 156         TCP_CONNTRACK_CLOSE,
 157         TCP_CONNTRACK_SYN_SENT2,
 158         TCP_CONNTRACK_NONE,
 159 };
 160
 161 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
 162         [DCCP_CONNTRACK_NONE]           = "NOSTATE",
 163         [DCCP_CONNTRACK_REQUEST]        = "REQUEST",
 164         [DCCP_CONNTRACK_RESPOND]        = "RESPOND",
 165         [DCCP_CONNTRACK_PARTOPEN]       = "PARTOPEN",
 166         [DCCP_CONNTRACK_OPEN]           = "OPEN",
 167         [DCCP_CONNTRACK_CLOSEREQ]       = "CLOSEREQ",
 168         [DCCP_CONNTRACK_CLOSING]        = "CLOSING",
 169         [DCCP_CONNTRACK_TIMEWAIT]       = "TIMEWAIT",
 170         [DCCP_CONNTRACK_IGNORE]         = "IGNORE",
 171         [DCCP_CONNTRACK_INVALID]        = "INVALID",
 172 };
 173
 174 static const uint8_t dccp_states[] = {
 175         DCCP_CONNTRACK_NONE,
 176         DCCP_CONNTRACK_REQUEST,
 177         DCCP_CONNTRACK_RESPOND,
 178         DCCP_CONNTRACK_PARTOPEN,
 179         DCCP_CONNTRACK_OPEN,
 180         DCCP_CONNTRACK_CLOSEREQ,
 181         DCCP_CONNTRACK_CLOSING,
 182         DCCP_CONNTRACK_TIMEWAIT,
 183         DCCP_CONNTRACK_IGNORE,
 184         DCCP_CONNTRACK_INVALID,
 185 };
 186
 187 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
 188         [SCTP_CONNTRACK_NONE]           = "NOSTATE",
 189         [SCTP_CONNTRACK_CLOSED]         = "CLOSED",
 190         [SCTP_CONNTRACK_COOKIE_WAIT]    = "COOKIE_WAIT",
 191         [SCTP_CONNTRACK_COOKIE_ECHOED]  = "COOKIE_ECHOED",
 192         [SCTP_CONNTRACK_ESTABLISHED]    = "ESTABLISHED",
 193         [SCTP_CONNTRACK_SHUTDOWN_SENT]  = "SHUTDOWN_SENT",
 194         [SCTP_CONNTRACK_SHUTDOWN_RECD]  = "SHUTDOWN_RECD",
 195         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTDOWN_ACK_SENT",
 196 };
 197
 198 static const uint8_t sctp_states[] = {
 199         SCTP_CONNTRACK_NONE,
 200         SCTP_CONNTRACK_CLOSED,
 201         SCTP_CONNTRACK_COOKIE_WAIT,
 202         SCTP_CONNTRACK_COOKIE_ECHOED,
 203         SCTP_CONNTRACK_ESTABLISHED,
 204         SCTP_CONNTRACK_SHUTDOWN_SENT,
 205         SCTP_CONNTRACK_SHUTDOWN_RECD,
 206         SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
 207 };
 208
 209 static const struct nfct_filter_ipv4 filter_ipv4 = {
 210         .addr = __constant_htonl(INADDR_LOOPBACK),
 211         .mask = 0xffffffff,
 212 };
 213
 214 static const struct nfct_filter_ipv6 filter_ipv6 = {
 215         .addr = { 0x0, 0x0, 0x0, 0x1 },
 216         .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
 217 };
 218
 219 static void signal_handler(int number)
 220 {
 221         switch (number) {
 222         case SIGINT:
 223                 sigint = 1;
 224                 break;
 225         case SIGHUP:
 226         default:
 227                 break;
 228         }
 229 }
 230
 231 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct);
 232 static void flow_entry_get_extended(struct flow_entry *n);
 233
 234 static void help(void)
 235 {
 236         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 237                VERSION_STRING);
 238         puts("http://www.netsniff-ng.org\n\n"
 239              "Usage: flowtop [options]\n"
 240              "Options:\n"
 241              "  -4|--ipv4              Show only IPv4 flows (default)\n"
 242              "  -6|--ipv6              Show only IPv6 flows (default)\n"
 243              "  -T|--tcp               Show only TCP flows (default)\n"
 244              "  -U|--udp               Show only UDP flows\n"
 245              "  -D|--dccp              Show only DCCP flows\n"
 246              "  -I|--icmp              Show only ICMP/ICMPv6 flows\n"
 247              "  -S|--sctp              Show only SCTP flows\n"
 248              "  -s|--show-src          Also show source, not only dest\n"
 249              "  -u|--update            Update GeoIP databases\n"
 250              "  -v|--version           Print version\n"
 251              "  -h|--help              Print this help\n\n"
 252              "Examples:\n"
 253              "  flowtop\n"
 254              "  flowtop -46UTDISs\n\n"
 255              "Note:\n"
 256              "  If netfilter is not running, you can activate it with e.g.:\n"
 257              "   iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
 258              "   iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n\n"
 259              "Please report bugs to <bugs@netsniff-ng.org>\n"
 260              "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 261              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 262              "Swiss federal institute of technology (ETH Zurich)\n"
 263              "License: GNU GPL version 2.0\n"
 264              "This is free software: you are free to change and redistribute it.\n"
 265              "There is NO WARRANTY, to the extent permitted by law.\n");
 266         die();
 267 }
 268
 269 static void version(void)
 270 {
 271         printf("\nflowtop %s, top-like netfilter TCP/UDP flow tracking\n",
 272                VERSION_STRING);
 273         puts("http://www.netsniff-ng.org\n\n"
 274              "Please report bugs to <bugs@netsniff-ng.org>\n"
 275              "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
 276              "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
 277              "Swiss federal institute of technology (ETH Zurich)\n"
 278              "License: GNU GPL version 2.0\n"
 279              "This is free software: you are free to change and redistribute it.\n"
 280              "There is NO WARRANTY, to the extent permitted by law.\n");
 281         die();
 282 }
 283
 284 static inline struct flow_entry *flow_entry_xalloc(void)
 285 {
 286         return xzmalloc(sizeof(struct flow_entry));
 287 }
 288
 289 static inline void flow_entry_xfree(struct flow_entry *n)
 290 {
 291         xfree(n);
 292 }
 293
 294 static inline void flow_list_init(struct flow_list *fl)
 295 {
 296         fl->head = NULL;
 297         spinlock_init(&fl->lock);
 298 }
 299
 300 static void flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
 301 {
 302         struct flow_entry *n = flow_entry_xalloc();
 303
 304         flow_entry_from_ct(n, ct);
 305         flow_entry_get_extended(n);
 306
 307         rcu_assign_pointer(n->next, fl->head);
 308         rcu_assign_pointer(fl->head, n);
 309 }
 310
 311 static struct flow_entry *flow_list_find_id(struct flow_list *fl,
 312                                             uint32_t id)
 313 {
 314         struct flow_entry *n = rcu_dereference(fl->head);
 315
 316         while (n != NULL) {
 317                 if (n->flow_id == id)
 318                         return n;
 319
 320                 n = rcu_dereference(n->next);
 321         }
 322
 323         return NULL;
 324 }
 325
 326 static struct flow_entry *flow_list_find_prev_id(struct flow_list *fl,
 327                                                  uint32_t id)
 328 {
 329         struct flow_entry *n = rcu_dereference(fl->head), *tmp;
 330
 331         if (n->flow_id == id)
 332                 return NULL;
 333
 334         while ((tmp = rcu_dereference(n->next)) != NULL) {
 335                 if (tmp->flow_id == id)
 336                         return n;
 337
 338                 n = tmp;
 339         }
 340
 341         return NULL;
 342 }
 343
 344 static void flow_list_update_entry(struct flow_list *fl,
 345                                    struct nf_conntrack *ct)
 346 {
 347         int do_ext = 0;
 348         struct flow_entry *n;
 349
 350         n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
 351         if (n == NULL) {
 352                 n = flow_entry_xalloc();
 353                 do_ext = 1;
 354         }
 355
 356         flow_entry_from_ct(n, ct);
 357         if (do_ext) {
 358                 flow_entry_get_extended(n);
 359
 360                 rcu_assign_pointer(n->next, fl->head);
 361                 rcu_assign_pointer(fl->head, n);
 362         }
 363 }
 364
 365 static void flow_list_destroy_entry(struct flow_list *fl,
 366                                     struct nf_conntrack *ct)
 367 {
 368         struct flow_entry *n1, *n2;
 369         uint32_t id = nfct_get_attr_u32(ct, ATTR_ID);
 370
 371         n1 = flow_list_find_id(fl, id);
 372         if (n1) {
 373                 n2 = flow_list_find_prev_id(fl, id);
 374                 if (n2) {
 375                         rcu_assign_pointer(n2->next, n1->next);
 376                         rcu_assign_pointer(n1->next, NULL);
 377
 378                         flow_entry_xfree(n1);
 379                 } else {
 380                         flow_entry_xfree(fl->head);
 381
 382                         rcu_assign_pointer(fl->head, NULL);
 383                 }
 384         }
 385 }
 386
 387 static void flow_list_destroy(struct flow_list *fl)
 388 {
 389         struct flow_entry *n;
 390
 391         while (fl->head != NULL) {
 392                 n = rcu_dereference(fl->head->next);
 393                 rcu_assign_pointer(fl->head->next, NULL);
 394
 395                 flow_entry_xfree(fl->head);
 396                 rcu_assign_pointer(fl->head, n);
 397         }
 398
 399         synchronize_rcu();
 400         spinlock_destroy(&fl->lock);
 401 }
 402
 403 static int walk_process(char *process, struct flow_entry *n)
 404 {
 405         int ret;
 406         DIR *dir;
 407         struct dirent *ent;
 408         char path[1024];
 409
 410         if (snprintf(path, sizeof(path), "/proc/%s/fd", process) == -1)
 411                 panic("giant process name! %s\n", process);
 412
 413         dir = opendir(path);
 414         if (!dir)
 415                 return 0;
 416
 417         while ((ent = readdir(dir))) {
 418                 struct stat statbuf;
 419
 420                 if (snprintf(path, sizeof(path), "/proc/%s/fd/%s",
 421                              process, ent->d_name) < 0)
 422                         continue;
 423
 424                 if (stat(path, &statbuf) < 0)
 425                         continue;
 426
 427                 if (S_ISSOCK(statbuf.st_mode) && n->inode == statbuf.st_ino) {
 428                         memset(n->cmdline, 0, sizeof(n->cmdline));
 429
 430                         snprintf(path, sizeof(path), "/proc/%s/exe", process);
 431
 432                         ret = readlink(path, n->cmdline,
 433                                        sizeof(n->cmdline) - 1);
 434                         if (ret < 0)
 435                                 panic("readlink error: %s\n", strerror(errno));
 436
 437                         n->procnum = atoi(process);
 438                         return 1;
 439                 }
 440         }
 441
 442         closedir(dir);
 443         return 0;
 444 }
 445
 446 static void walk_processes(struct flow_entry *n)
 447 {
 448         int ret;
 449         DIR *dir;
 450         struct dirent *ent;
 451
 452         /* n->inode must be set */
 453         if (n->inode <= 0) {
 454                 memset(n->cmdline, 0, sizeof(n->cmdline));
 455                 return;
 456         }
 457
 458         dir = opendir("/proc");
 459         if (!dir)
 460                 panic("Cannot open /proc!\n");
 461
 462         while ((ent = readdir(dir))) {
 463                 if (strspn(ent->d_name, "0123456789") == strlen(ent->d_name)) {
 464                         ret = walk_process(ent->d_name, n);
 465                         if (ret > 0)
 466                                 break;
 467                 }
 468         }
 469
 470         closedir(dir);
 471 }
 472
 473 static int get_port_inode(uint16_t port, int proto, int is_ip6)
 474 {
 475         int ret = -ENOENT;
 476         char path[128], buff[1024];
 477         FILE *proc;
 478
 479         memset(path, 0, sizeof(path));
 480         snprintf(path, sizeof(path), "/proc/net/%s%s",
 481                  l4proto2str[proto], is_ip6 ? "6" : "");
 482
 483         proc = fopen(path, "r");
 484         if (!proc)
 485                 return -EIO;
 486
 487         memset(buff, 0, sizeof(buff));
 488
 489         while (fgets(buff, sizeof(buff), proc) != NULL) {
 490                 int inode = 0;
 491                 unsigned int lport = 0;
 492
 493                 buff[sizeof(buff) - 1] = 0;
 494                 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
 495                            "%*X %*u %*u %u", &lport, &inode) == 2) {
 496                         if ((uint16_t) lport == port) {
 497                                 ret = inode;
 498                                 break;
 499                         }
 500                 }
 501
 502                 memset(buff, 0, sizeof(buff));
 503         }
 504
 505         fclose(proc);
 506         return ret;
 507 }
 508
 509 #define CP_NFCT(elem, attr, x)                          \
 510         do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
 511 #define CP_NFCT_BUFF(elem, attr) do {                   \
 512         const uint8_t *buff = nfct_get_attr(ct,(attr)); \
 513         if (buff != NULL)                               \
 514                 memcpy(n->elem, buff, sizeof(n->elem)); \
 515 } while (0)
 516
 517 static void flow_entry_from_ct(struct flow_entry *n, struct nf_conntrack *ct)
 518 {
 519         CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
 520         CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
 521
 522         CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
 523         CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
 524
 525         CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
 526         CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
 527
 528         CP_NFCT(status, ATTR_STATUS, 32);
 529
 530         CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
 531         CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
 532         CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
 533         CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
 534
 535         CP_NFCT(counter_pkts, ATTR_ORIG_COUNTER_PACKETS, 64);
 536         CP_NFCT(counter_bytes, ATTR_ORIG_COUNTER_BYTES, 64);
 537
 538         CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
 539         CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
 540
 541         CP_NFCT(flow_id, ATTR_ID, 32);
 542         CP_NFCT(use, ATTR_USE, 32);
 543
 544         CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
 545         CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
 546
 547         n->port_src = ntohs(n->port_src);
 548         n->port_dst = ntohs(n->port_dst);
 549
 550         n->ip4_src_addr = ntohl(n->ip4_src_addr);
 551         n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
 552 }
 553
 554 enum flow_entry_direction {
 555         flow_entry_src,
 556         flow_entry_dst,
 557 };
 558
 559 static inline int flow_entry_get_extended_is_dns(struct flow_entry *n)
 560 {
 561         /* We don't want to analyze / display DNS itself, since we
 562          * use it to resolve reverse dns.
 563          */
 564         return n->port_src == 53 || n->port_dst == 53;
 565 }
 566
 567 #define SELFLD(dir,src_member,dst_member)       \
 568         (((dir) == flow_entry_src) ? n->src_member : n->dst_member)
 569
 570 static struct sockaddr_in *
 571 flow_entry_get_sain4_obj(struct flow_entry *n, enum flow_entry_direction dir,
 572                          struct sockaddr_in *sa)
 573 {
 574         memset(sa, 0, sizeof(*sa));
 575         sa->sin_family = PF_INET;
 576         sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
 577
 578         return sa;
 579 }
 580
 581 static struct sockaddr_in6 *
 582 flow_entry_get_sain6_obj(struct flow_entry *n, enum flow_entry_direction dir,
 583                          struct sockaddr_in6 *sa)
 584 {
 585         memset(sa, 0, sizeof(*sa));
 586         sa->sin6_family = PF_INET6;
 587
 588         memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
 589                sizeof(SELFLD(dir, ip6_src_addr, ip6_dst_addr)));
 590
 591         return sa;
 592 }
 593
 594 static void
 595 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
 596                                    enum flow_entry_direction dir)
 597 {
 598         struct sockaddr_in sa4;
 599         struct sockaddr_in6 sa6;
 600         const char *city = NULL;
 601
 602         switch (n->l3_proto) {
 603         default:
 604                 bug();
 605
 606         case AF_INET:
 607                 flow_entry_get_sain4_obj(n, dir, &sa4);
 608                 city = geoip4_city_name(sa4);
 609                 break;
 610
 611         case AF_INET6:
 612                 flow_entry_get_sain6_obj(n, dir, &sa6);
 613                 city = geoip6_city_name(sa6);
 614                 break;
 615         }
 616
 617         bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
 618
 619         if (city) {
 620                 memcpy(SELFLD(dir, city_src, city_dst), city,
 621                        min(sizeof(n->city_src), strlen(city)));
 622         } else {
 623                 memset(SELFLD(dir, city_src, city_dst), 0,
 624                        sizeof(n->city_src));
 625         }
 626 }
 627
 628 static void
 629 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
 630                                       enum flow_entry_direction dir)
 631 {
 632         struct sockaddr_in sa4;
 633         struct sockaddr_in6 sa6;
 634         const char *country = NULL;
 635
 636         switch (n->l3_proto) {
 637         default:
 638                 bug();
 639
 640         case AF_INET:
 641                 flow_entry_get_sain4_obj(n, dir, &sa4);
 642                 country = geoip4_country_name(sa4);
 643                 break;
 644
 645         case AF_INET6:
 646                 flow_entry_get_sain6_obj(n, dir, &sa6);
 647                 country = geoip6_country_name(sa6);
 648                 break;
 649         }
 650
 651         bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
 652
 653         if (country) {
 654                 memcpy(SELFLD(dir, country_src, country_dst), country,
 655                        min(sizeof(n->country_src), strlen(country)));
 656         } else {
 657                 memset(SELFLD(dir, country_src, country_dst), 0,
 658                        sizeof(n->country_src));
 659         }
 660 }
 661
 662 static void flow_entry_get_extended_geo(struct flow_entry *n,
 663                                         enum flow_entry_direction dir)
 664 {
 665         flow_entry_geo_city_lookup_generic(n, dir);
 666         flow_entry_geo_country_lookup_generic(n, dir);
 667 }
 668
 669 static void flow_entry_get_extended_revdns(struct flow_entry *n,
 670                                            enum flow_entry_direction dir)
 671 {
 672         size_t sa_len;
 673         struct sockaddr_in sa4;
 674         struct sockaddr_in6 sa6;
 675         struct sockaddr *sa;
 676         struct hostent *hent;
 677
 678         switch (n->l3_proto) {
 679         default:
 680                 bug();
 681
 682         case AF_INET:
 683                 flow_entry_get_sain4_obj(n, dir, &sa4);
 684                 sa = (struct sockaddr *) &sa4;
 685                 sa_len = sizeof(sa4);
 686                 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
 687                 break;
 688
 689         case AF_INET6:
 690                 flow_entry_get_sain6_obj(n, dir, &sa6);
 691                 sa = (struct sockaddr *) &sa6;
 692                 sa_len = sizeof(sa6);
 693                 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
 694                 break;
 695         }
 696
 697         bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
 698         getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
 699                     sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
 700
 701         if (hent) {
 702                 memset(n->rev_dns_dst, 0, sizeof(n->rev_dns_dst));
 703                 memcpy(SELFLD(dir, rev_dns_src, rev_dns_dst),
 704                        hent->h_name, min(sizeof(n->rev_dns_src),
 705                                          strlen(hent->h_name)));
 706         }
 707 }
 708
 709 static void flow_entry_get_extended(struct flow_entry *n)
 710 {
 711         if (n->flow_id == 0 || flow_entry_get_extended_is_dns(n))
 712                 return;
 713
 714         flow_entry_get_extended_revdns(n, flow_entry_src);
 715         flow_entry_get_extended_geo(n, flow_entry_src);
 716
 717         flow_entry_get_extended_revdns(n, flow_entry_dst);
 718         flow_entry_get_extended_geo(n, flow_entry_dst);
 719
 720         /* Lookup application */
 721         n->inode = get_port_inode(n->port_src, n->l4_proto,
 722                                   n->l3_proto == AF_INET6);
 723         if (n->inode > 0)
 724                 walk_processes(n);
 725 }
 726
 727 static uint16_t presenter_get_port(uint16_t src, uint16_t dst, int tcp)
 728 {
 729         if (src < dst && src < 1024) {
 730                 return src;
 731         } else if (dst < src && dst < 1024) {
 732                 return dst;
 733         } else {
 734                 const char *tmp1, *tmp2;
 735                 if (tcp) {
 736                         tmp1 = lookup_port_tcp(src);
 737                         tmp2 = lookup_port_tcp(dst);
 738                 } else {
 739                         tmp1 = lookup_port_udp(src);
 740                         tmp2 = lookup_port_udp(dst);
 741                 }
 742                 if (tmp1 && !tmp2) {
 743                         return src;
 744                 } else if (!tmp1 && tmp2) {
 745                         return dst;
 746                 } else {
 747                         if (src < dst)
 748                                 return src;
 749                         else
 750                                 return dst;
 751                 }
 752         }
 753 }
 754
 755 static void presenter_screen_init(WINDOW **screen)
 756 {
 757         (*screen) = initscr();
 758         noecho();
 759         cbreak();
 760         keypad(stdscr, TRUE);
 761         nodelay(*screen, TRUE);
 762         refresh();
 763         wrefresh(*screen);
 764 }
 765
 766 static void presenter_screen_do_line(WINDOW *screen, struct flow_entry *n,
 767                                      unsigned int *line)
 768 {
 769         char tmp[128], *pname = NULL;
 770         uint16_t port;
 771
 772         mvwprintw(screen, *line, 2, "");
 773
 774         /* PID, application name */
 775         if (n->procnum > 0) {
 776                 slprintf(tmp, sizeof(tmp), "%s(%u)", basename(n->cmdline),
 777                          n->procnum);
 778
 779                 printw("[");
 780                 attron(COLOR_PAIR(3));
 781                 printw("%s", tmp);
 782                 attroff(COLOR_PAIR(3));
 783                 printw("]:");
 784         }
 785
 786         /* L3 protocol, L4 protocol, states */
 787         printw("%s:%s", l3proto2str[n->l3_proto], l4proto2str[n->l4_proto]);
 788         printw("[");
 789         attron(COLOR_PAIR(3));
 790         switch (n->l4_proto) {
 791         case IPPROTO_TCP:
 792                 printw("%s", tcp_state2str[n->tcp_state]);
 793                 break;
 794         case IPPROTO_SCTP:
 795                 printw("%s", sctp_state2str[n->sctp_state]);
 796                 break;
 797         case IPPROTO_DCCP:
 798                 printw("%s", dccp_state2str[n->dccp_state]);
 799                 break;
 800         case IPPROTO_UDP:
 801         case IPPROTO_UDPLITE:
 802         case IPPROTO_ICMP:
 803         case IPPROTO_ICMPV6:
 804                 printw("NOSTATE");
 805                 break;
 806         }
 807         attroff(COLOR_PAIR(3));
 808         printw("]");
 809
 810         /* Guess application port */
 811         switch (n->l4_proto) {
 812         case IPPROTO_TCP:
 813                 port = presenter_get_port(n->port_src, n->port_dst, 1);
 814                 pname = lookup_port_tcp(port);
 815                 break;
 816         case IPPROTO_UDP:
 817         case IPPROTO_UDPLITE:
 818                 port = presenter_get_port(n->port_src, n->port_dst, 0);
 819                 pname = lookup_port_udp(port);
 820                 break;
 821         }
 822         if (pname) {
 823                 attron(A_BOLD);
 824                 printw(":%s", pname);
 825                 attroff(A_BOLD);
 826         }
 827         printw(" ->");
 828
 829         /* Number packets, bytes */
 830         if (n->counter_pkts > 0 && n->counter_bytes > 0)
 831                 printw(" (%llu pkts, %llu bytes) ->",
 832                        n->counter_pkts, n->counter_bytes);
 833
 834         /* Show source information: reverse DNS, port, country, city */
 835         if (show_src) {
 836                 attron(COLOR_PAIR(1));
 837                 mvwprintw(screen, ++(*line), 8, "src: %s", n->rev_dns_src);
 838                 attroff(COLOR_PAIR(1));
 839
 840                 printw(":%u", n->port_src);
 841
 842                 if (n->country_src[0]) {
 843                         printw(" (");
 844
 845                         attron(COLOR_PAIR(4));
 846                         printw("%s", n->country_src);
 847                         attroff(COLOR_PAIR(4));
 848
 849                         if (n->city_src[0])
 850                                 printw(", %s", n->city_src);
 851
 852                         printw(")");
 853                 }
 854
 855                 printw(" => ");
 856         }
 857
 858         /* Show dest information: reverse DNS, port, country, city */
 859         attron(COLOR_PAIR(2));
 860         mvwprintw(screen, ++(*line), 8, "dst: %s", n->rev_dns_dst);
 861         attroff(COLOR_PAIR(2));
 862
 863         printw(":%u", n->port_dst);
 864
 865         if (n->country_dst[0]) {
 866                 printw(" (");
 867
 868                 attron(COLOR_PAIR(4));
 869                 printw("%s", n->country_dst);
 870                 attroff(COLOR_PAIR(4));
 871
 872                 if (n->city_dst[0])
 873                         printw(", %s", n->city_dst);
 874
 875                 printw(")");
 876         }
 877 }
 878
 879 static inline int presenter_flow_wrong_state(struct flow_entry *n, int state)
 880 {
 881         int ret = 1;
 882
 883         switch (n->l4_proto) {
 884         case IPPROTO_TCP:
 885                 if (n->tcp_state == state)
 886                         ret = 0;
 887                 break;
 888         case IPPROTO_SCTP:
 889                 if (n->sctp_state == state)
 890                         ret = 0;
 891                 break;
 892         case IPPROTO_DCCP:
 893                 if (n->dccp_state == state)
 894                         ret = 0;
 895                 break;
 896         case IPPROTO_UDP:
 897         case IPPROTO_UDPLITE:
 898         case IPPROTO_ICMP:
 899         case IPPROTO_ICMPV6:
 900                 ret = 0;
 901                 break;
 902         }
 903
 904         return ret;
 905 }
 906
 907 static void presenter_screen_update(WINDOW *screen, struct flow_list *fl,
 908                                     int skip_lines)
 909 {
 910         int i, j, maxy;
 911         unsigned int line = 3;
 912         struct flow_entry *n;
 913         uint8_t protocols[] = {
 914                 IPPROTO_TCP,
 915                 IPPROTO_DCCP,
 916                 IPPROTO_SCTP,
 917                 IPPROTO_UDP,
 918                 IPPROTO_UDPLITE,
 919                 IPPROTO_ICMP,
 920                 IPPROTO_ICMPV6,
 921         };
 922         size_t protocol_state_size[] = {
 923                 [IPPROTO_TCP] = array_size(tcp_states),
 924                 [IPPROTO_DCCP] = array_size(dccp_states),
 925                 [IPPROTO_SCTP] = array_size(sctp_states),
 926                 [IPPROTO_UDP] = 1,
 927                 [IPPROTO_UDPLITE] = 1,
 928                 [IPPROTO_ICMP] = 1,
 929                 [IPPROTO_ICMPV6] = 1,
 930         };
 931
 932         curs_set(0);
 933
 934         maxy = getmaxy(screen);
 935         maxy -= 6;
 936
 937         start_color();
 938         init_pair(1, COLOR_RED, COLOR_BLACK);
 939         init_pair(2, COLOR_BLUE, COLOR_BLACK);
 940         init_pair(3, COLOR_YELLOW, COLOR_BLACK);
 941         init_pair(4, COLOR_GREEN, COLOR_BLACK);
 942
 943         wclear(screen);
 944         clear();
 945
 946         mvwprintw(screen, 1, 2, "Kernel netfilter flows for %s%s%s%s%s%s"
 947                   "[+%d]", what & INCLUDE_TCP ? "TCP, " : "" ,
 948                   what & INCLUDE_UDP ? "UDP, " : "",
 949                   what & INCLUDE_SCTP ? "SCTP, " : "",
 950                   what & INCLUDE_DCCP ? "DCCP, " : "",
 951                   what & INCLUDE_ICMP && what & INCLUDE_IPV4 ? "ICMP, " : "",
 952                   what & INCLUDE_ICMP && what & INCLUDE_IPV6 ? "ICMP6, " : "",
 953                   skip_lines);
 954
 955         rcu_read_lock();
 956
 957         if (rcu_dereference(fl->head) == NULL)
 958                 mvwprintw(screen, line, 2, "(No active sessions! "
 959                           "Is netfilter running?)");
 960
 961         for (i = 0; i < array_size(protocols); i++) {
 962                 for (j = 0; j < protocol_state_size[protocols[i]]; j++) {
 963                         n = rcu_dereference(fl->head);
 964                         while (n && maxy > 0) {
 965                                 int skip_entry = 0;
 966
 967                                 if (n->l4_proto != protocols[i])
 968                                         skip_entry = 1;
 969                                 if (presenter_flow_wrong_state(n, j))
 970                                         skip_entry = 1;
 971                                 if (presenter_get_port(n->port_src,
 972                                                        n->port_dst, 0) == 53)
 973                                         skip_entry = 1;
 974                                 if (skip_entry) {
 975                                         n = rcu_dereference(n->next);
 976                                         continue;
 977                                 }
 978                                 if (skip_lines > 0) {
 979                                         n = rcu_dereference(n->next);
 980                                         skip_lines--;
 981                                         continue;
 982                                 }
 983
 984                                 presenter_screen_do_line(screen, n, &line);
 985
 986                                 line++;
 987                                 maxy -= (2 + 1 * show_src);
 988                                 n = rcu_dereference(n->next);
 989                         }
 990                 }
 991         }
 992
 993         rcu_read_unlock();
 994
 995         wrefresh(screen);
 996         refresh();
 997 }
 998
 999 static inline void presenter_screen_end(void)
1000 {
1001         endwin();
1002 }
1003
1004 static void presenter(void)
1005 {
1006         int skip_lines = 0;
1007         WINDOW *screen = NULL;
1008
1009         dissector_init_ethernet(0);
1010         presenter_screen_init(&screen);
1011
1012         rcu_register_thread();
1013         while (!sigint) {
1014                 switch (getch()) {
1015                 case 'q':
1016                         sigint = 1;
1017                         break;
1018                 case KEY_UP:
1019                 case 'u':
1020                 case 'k':
1021                         skip_lines--;
1022                         if (skip_lines < 0)
1023                                 skip_lines = 0;
1024                         break;
1025                 case KEY_DOWN:
1026                 case 'd':
1027                 case 'j':
1028                         skip_lines++;
1029                         if (skip_lines > SCROLL_MAX)
1030                                 skip_lines = SCROLL_MAX;
1031                         break;
1032                 default:
1033                         fflush(stdin);
1034                         break;
1035                 }
1036
1037                 presenter_screen_update(screen, &flow_list, skip_lines);
1038                 usleep(100000);
1039         }
1040         rcu_unregister_thread();
1041
1042         presenter_screen_end();
1043         dissector_cleanup_ethernet();
1044 }
1045
1046 static int collector_cb(enum nf_conntrack_msg_type type,
1047                         struct nf_conntrack *ct, void *data)
1048 {
1049         if (sigint)
1050                 return NFCT_CB_STOP;
1051
1052         synchronize_rcu();
1053         spinlock_lock(&flow_list.lock);
1054
1055         switch (type) {
1056         case NFCT_T_NEW:
1057                 flow_list_new_entry(&flow_list, ct);
1058                 break;
1059         case NFCT_T_UPDATE:
1060                 flow_list_update_entry(&flow_list, ct);
1061                 break;
1062         case NFCT_T_DESTROY:
1063                 flow_list_destroy_entry(&flow_list, ct);
1064                 break;
1065         default:
1066                 break;
1067         }
1068
1069         spinlock_unlock(&flow_list.lock);
1070
1071         return NFCT_CB_CONTINUE;
1072 }
1073
1074 static inline void collector_flush(struct nfct_handle *handle, uint8_t family)
1075 {
1076         nfct_query(handle, NFCT_Q_FLUSH, &family);
1077 }
1078
1079 static void *collector(void *null)
1080 {
1081         int ret;
1082         struct nfct_handle *handle;
1083         struct nfct_filter *filter;
1084
1085         handle = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1086                                       NF_NETLINK_CONNTRACK_UPDATE |
1087                                       NF_NETLINK_CONNTRACK_DESTROY);
1088         if (!handle)
1089                 panic("Cannot create a nfct handle!\n");
1090
1091         collector_flush(handle, AF_INET);
1092         collector_flush(handle, AF_INET6);
1093
1094         filter = nfct_filter_create();
1095         if (!filter)
1096                 panic("Cannot create a nfct filter!\n");
1097
1098         ret = nfct_filter_attach(nfct_fd(handle), filter);
1099         if (ret < 0)
1100                 panic("Cannot attach filter to handle!\n");
1101
1102         if (what & INCLUDE_UDP) {
1103                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1104                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1105         }
1106         if (what & INCLUDE_TCP)
1107                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1108         if (what & INCLUDE_DCCP)
1109                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1110         if (what & INCLUDE_SCTP)
1111                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1112         if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1113                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1114         if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1115                 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1116         if (what & INCLUDE_IPV4) {
1117                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1118                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1119         }
1120         if (what & INCLUDE_IPV6) {
1121                 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1122                 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1123         }
1124
1125         ret = nfct_filter_attach(nfct_fd(handle), filter);
1126         if (ret < 0)
1127                 panic("Cannot attach filter to handle!\n");
1128
1129         nfct_callback_register(handle, NFCT_T_ALL, collector_cb, NULL);
1130         nfct_filter_destroy(filter);
1131         flow_list_init(&flow_list);
1132
1133         rcu_register_thread();
1134
1135         while (!sigint && ret >= 0)
1136                 ret = nfct_catch(handle);
1137
1138         rcu_unregister_thread();
1139
1140         flow_list_destroy(&flow_list);
1141         nfct_close(handle);
1142
1143         pthread_exit(0);
1144 }
1145
1146 int main(int argc, char **argv)
1147 {
1148         pthread_t tid;
1149         int ret, c, opt_index, what_cmd = 0;
1150
1151         setfsuid(getuid());
1152         setfsgid(getgid());
1153
1154         while ((c = getopt_long(argc, argv, short_options, long_options,
1155                &opt_index)) != EOF) {
1156                 switch (c) {
1157                 case '4':
1158                         what_cmd |= INCLUDE_IPV4;
1159                         break;
1160                 case '6':
1161                         what_cmd |= INCLUDE_IPV6;
1162                         break;
1163                 case 'T':
1164                         what_cmd |= INCLUDE_TCP;
1165                         break;
1166                 case 'U':
1167                         what_cmd |= INCLUDE_UDP;
1168                         break;
1169                 case 'D':
1170                         what_cmd |= INCLUDE_DCCP;
1171                         break;
1172                 case 'I':
1173                         what_cmd |= INCLUDE_ICMP;
1174                         break;
1175                 case 'S':
1176                         what_cmd |= INCLUDE_SCTP;
1177                         break;
1178                 case 's':
1179                         show_src = 1;
1180                         break;
1181                 case 'u':
1182                         update_geoip();
1183                         die();
1184                         break;
1185                 case 'h':
1186                         help();
1187                         break;
1188                 case 'v':
1189                         version();
1190                         break;
1191                 default:
1192                         break;
1193                 }
1194         }
1195
1196         if (what_cmd > 0)
1197                 what = what_cmd;
1198
1199         rcu_init();
1200
1201         register_signal(SIGINT, signal_handler);
1202         register_signal(SIGHUP, signal_handler);
1203
1204         init_geoip(1);
1205
1206         ret = pthread_create(&tid, NULL, collector, NULL);
1207         if (ret < 0)
1208                 panic("Cannot create phthread!\n");
1209
1210         presenter();
1211
1212         destroy_geoip();
1213
1214         return 0;
1215 }