capture/iface_monitor.c

   1 /* iface_monitor.c
   2  * interface monitor by Pontus Fuchs <pontus.fuchs@gmail.com>
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "config.h"
  12 #include "iface_monitor.h"
  13
  14 #ifdef HAVE_LIBPCAP
  15
  16 #if defined(HAVE_LIBNL)
  17
  18 /*
  19  * Linux with libnl.
  20  *
  21  * Use Netlink to get indications of new/removed intrfaces.
  22  */
  23
  24 #include <stdio.h>
  25 #include <string.h>
  26 #include <errno.h>
  27
  28 DIAG_OFF_PEDANTIC
  29 #include <netlink/msg.h>
  30 DIAG_ON_PEDANTIC
  31 #include <netlink/attr.h>
  32 DIAG_OFF_PEDANTIC
  33 #include <netlink/route/link.h>
  34 DIAG_ON_PEDANTIC
  35
  36 #ifndef IFF_UP
  37 /*
  38  * Apparently, some versions of libnl drag in headers that define IFF_UP
  39  * and others don't.  Include <net/if.h> iff IFF_UP isn't already defined,
  40  * so that if <linux/if.h> has been included by some or all of the
  41  * netlink headers, we don't include <net/if.h> and get a bunch of
  42  * complaints about various structures being redefined.
  43  */
  44 #include <net/if.h>
  45 #endif
  46
  47 /* libnl 1.x compatibility code */
  48 #ifdef HAVE_LIBNL1
  49 #define nl_sock nl_handle
  50 #define nl_socket_disable_seq_check nl_disable_sequence_check
  51
  52 static inline struct nl_handle *nl_socket_alloc(void)
  53 {
  54     return nl_handle_alloc();
  55 }
  56
  57 static inline void nl_socket_free(struct nl_sock *h)
  58 {
  59     nl_handle_destroy(h);
  60 }
  61 #endif /* HAVE_LIBNL1 */
  62
  63 static struct nl_sock *iface_mon_sock;
  64
  65 static void
  66 iface_mon_handler2(struct nl_object *obj, void *arg)
  67 {
  68     struct rtnl_link *filter;
  69     struct rtnl_link *link_obj;
  70     int flags, up;
  71     char *ifname;
  72     iface_mon_cb cb = (iface_mon_cb)arg;
  73
  74     filter = rtnl_link_alloc();
  75     if (!filter) {
  76         fprintf(stderr, "error allocating filter\n");
  77         return;
  78     }
  79
  80     if (nl_object_match_filter (obj, OBJ_CAST (filter)) == 0) {
  81         rtnl_link_put(filter);
  82         return;
  83     }
  84
  85     link_obj = (struct rtnl_link *) obj;
  86     flags = rtnl_link_get_flags (link_obj);
  87     ifname = rtnl_link_get_name(link_obj);
  88
  89     /*
  90      * You can't bind a PF_PACKET socket to an interface that's not
  91      * up, so an interface going down is an "interface should be
  92      * removed" indication.
  93      *
  94      * XXX - what indication, if any, do we get if the interface
  95      * *completely goes away*?
  96      *
  97      * XXX - can we get events if an interface's link-layer or
  98      * network addresses change?
  99      */
 100     up = (flags & IFF_UP) ? 1 : 0;
 101
 102 #ifdef HAVE_LIBNL1
 103     cb(ifname, 0, up);
 104 #else
 105     int msg_type = nl_object_get_msgtype(obj);
 106
 107     switch (msg_type) {
 108     case RTM_NEWLINK:
 109         cb(ifname, 1, up);
 110         break;
 111     case RTM_DELLINK:
 112         cb(ifname, 0, 0);
 113         break;
 114     default:
 115         /* Ignore other events */
 116         break;
 117     }
 118 #endif
 119
 120     rtnl_link_put(filter);
 121
 122     return;
 123 }
 124
 125 static int
 126 iface_mon_handler(struct nl_msg *msg, void *arg)
 127 {
 128     nl_msg_parse (msg, &iface_mon_handler2, arg);
 129     return 0;
 130 }
 131
 132 void
 133 iface_mon_event(void)
 134 {
 135     nl_recvmsgs_default(iface_mon_sock);
 136 }
 137
 138 int
 139 iface_mon_get_sock(void)
 140 {
 141     return nl_socket_get_fd(iface_mon_sock);
 142 }
 143
 144 int
 145 iface_mon_start(iface_mon_cb cb)
 146 {
 147     int err;
 148
 149     iface_mon_sock = nl_socket_alloc();
 150     if (!iface_mon_sock) {
 151         fprintf(stderr, "Failed to allocate netlink socket.\n");
 152         return -ENOMEM;
 153     }
 154
 155     nl_socket_disable_seq_check(iface_mon_sock);
 156
 157     nl_socket_modify_cb(iface_mon_sock, NL_CB_VALID, NL_CB_CUSTOM, iface_mon_handler, (void *)cb);
 158
 159     if (nl_connect(iface_mon_sock, NETLINK_ROUTE)) {
 160         fprintf(stderr, "Failed to connect to generic netlink.\n");
 161         err = -ENOLINK;
 162         goto out_handle_destroy;
 163     }
 164
 165     nl_socket_add_membership(iface_mon_sock, RTNLGRP_LINK);
 166
 167     return 0;
 168
 169 out_handle_destroy:
 170     nl_socket_free(iface_mon_sock);
 171     return err;
 172 }
 173
 174 void
 175 iface_mon_stop(void)
 176 {
 177     if(iface_mon_sock)
 178         nl_socket_free(iface_mon_sock);
 179     iface_mon_sock = NULL;
 180 }
 181
 182 void
 183 iface_mon_enable(bool enable)
 184 {
 185     if (!iface_mon_sock)
 186         return;
 187
 188     if (enable) {
 189         nl_socket_add_membership(iface_mon_sock, RTNLGRP_LINK);
 190     } else {
 191         nl_socket_drop_membership(iface_mon_sock, RTNLGRP_LINK);
 192     }
 193 }
 194
 195 #elif defined(__APPLE__)
 196
 197 /*
 198  * macOS.
 199  *
 200  * Use a PF_SYSTEM socket to get indications of new/removed intrfaces.
 201  */
 202
 203 #include <stddef.h>
 204 #include <stdio.h>
 205 #include <errno.h>
 206 #include <unistd.h>
 207
 208 #include <sys/socket.h>
 209 #include <sys/ioctl.h>
 210 #include <sys/types.h>
 211 #include <net/if.h>
 212 #include <sys/kern_event.h>
 213
 214 #include <glib.h>
 215
 216 static int s;
 217 static iface_mon_cb callback;
 218
 219 int
 220 iface_mon_start(iface_mon_cb cb)
 221 {
 222     int ret;
 223     struct kev_request key;
 224
 225     /* Create a socket of type PF_SYSTEM to listen for events. */
 226     s = socket(PF_SYSTEM, SOCK_RAW, SYSPROTO_EVENT);
 227     if (s == -1)
 228         return -errno;
 229
 230     /*
 231      * Ask for DLIL messages.
 232      *
 233      * XXX - also ask for KEV_INET_SUBCLASS and KEV_INET6_SUBCLASS,
 234      * to detect new or changed network addresses, so those can be
 235      * updated as well?  Can we specify multiple filters on a socket,
 236      * or must we specify KEV_ANY_SUBCLASS and filter the events after
 237      * receiving them?
 238      */
 239     key.vendor_code = KEV_VENDOR_APPLE;
 240     key.kev_class = KEV_NETWORK_CLASS;
 241     key.kev_subclass = KEV_DL_SUBCLASS;
 242     if (ioctl(s, SIOCSKEVFILT, &key) == -1) {
 243         ret = -errno;
 244         close(s);
 245         return ret;
 246     }
 247
 248     callback = cb;
 249     return 0;
 250 }
 251
 252 void
 253 iface_mon_stop(void)
 254 {
 255     close(s);
 256 }
 257
 258 int
 259 iface_mon_get_sock(void)
 260 {
 261     return s;
 262 }
 263
 264 /*
 265  * Size of buffer for kernel network event.
 266  */
 267 #define NET_EVENT_DATA_SIZE    (KEV_MSG_HEADER_SIZE + sizeof (struct net_event_data))
 268
 269 void
 270 iface_mon_event(void)
 271 {
 272     char msg[NET_EVENT_DATA_SIZE];
 273     ssize_t received;
 274     struct kern_event_msg *kem;
 275     struct net_event_data *evd;
 276     size_t evd_len;
 277     char ifr_name[IFNAMSIZ];
 278
 279     received = recv(s, msg, sizeof msg, 0);
 280     if (received < 0) {
 281         /* Error - ignore. */
 282         return;
 283     }
 284     if ((size_t)received < sizeof msg) {
 285         /* Short read - ignore. */
 286         return;
 287     }
 288     kem = (struct kern_event_msg *)msg;
 289     evd_len = kem->total_size - KEV_MSG_HEADER_SIZE;
 290     if (evd_len != sizeof (struct net_event_data)) {
 291         /* Length of the message is bogus. */
 292         return;
 293     }
 294     evd = (struct net_event_data *)&kem->event_data[0];
 295     snprintf(ifr_name, IFNAMSIZ, "%s%u", evd->if_name, evd->if_unit);
 296
 297     /*
 298      * Check type of event.
 299      *
 300      * Note: if we also ask for KEV_INET_SUBCLASS, we will get
 301      * events with keys
 302      *
 303      *    KEV_INET_NEW_ADDR
 304      *    KEV_INET_CHANGED_ADDR
 305      *    KEV_INET_CHANGED_ADDR
 306      *    KEV_INET_SIFDSTADDR
 307      *    KEV_INET_SIFBRDADDR
 308      *    KEV_INET_SIFNETMASK
 309      *
 310      * reflecting network address changes, with the data being a
 311      * struct kev_in_data rather than struct net_event_data, and
 312      * if we also ask for KEV_INET6_SUBCLASS, we will get events
 313      * with keys
 314      *
 315      *    KEV_INET6_NEW_LL_ADDR
 316      *    KEV_INET6_NEW_USER_ADDR
 317      *    KEV_INET6_NEW_RTADV_ADDR
 318      *    KEV_INET6_ADDR_DELETED
 319      *
 320      * with the data being a struct kev_in6_data.
 321      */
 322     switch (kem->event_code) {
 323
 324     case KEV_DL_IF_ATTACHED:
 325         /*
 326          * A new interface has arrived.
 327          *
 328          * XXX - what we really want is "a new BPFable interface
 329          * has arrived", but that's not available.  While we're
 330          * asking for additional help from BPF, it'd also be
 331          * nice if we could ask it for a list of all interfaces
 332          * that have had bpfattach()/bpf_attach() done on them,
 333          * so we don't have to try to open the device in order
 334          * to see whether we should show it as something on
 335          * which we can capture.
 336          */
 337         callback(ifr_name, 1, 1);
 338         break;
 339
 340     case KEV_DL_IF_DETACHED:
 341         /*
 342          * An existing interface has been removed.
 343          *
 344          * XXX - use KEV_DL_IF_DETACHING instead, as that's
 345          * called shortly after bpfdetach() is called, and
 346          * bpfdetach() makes an interface no longer BPFable,
 347          * and that's what we *really* care about.
 348          */
 349         callback(ifr_name, 0, 0);
 350         break;
 351
 352     default:
 353         /*
 354          * Is there any reason to care about:
 355          *
 356          *    KEV_DL_LINK_ON
 357          *    KEV_DL_LINK_OFF
 358          *    KEV_DL_SIFFLAGS
 359          *    KEV_DL_LINK_ADDRESS_CHANGED
 360          *    KEV_DL_IFCAP_CHANGED
 361          *
 362          * or any of the other events?  On Snow Leopard and, I think,
 363          * earlier releases, you can't attach a BPF device to an
 364          * interface that's not up, so KEV_DL_SIFFLAGS might be
 365          * worth listening to so that we only say "here's a new
 366          * interface" when it goes up; on Lion (and possibly Mountain
 367          * Lion), an interface doesn't have to be up in order to
 368          * have a BPF device attached to it.
 369          */
 370         break;
 371     }
 372 }
 373
 374 void
 375 iface_mon_enable(bool enable _U_)
 376 {
 377 }
 378
 379 #elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
 380
 381 /*
 382  * FreeBSD, NetBSD, OpenBSD, DragonFly BSD.
 383  *
 384  * Use a PF_ROUTE socket to get indications of new/removed intrfaces.
 385  */
 386 #include <stdio.h>
 387 #include <stdlib.h>
 388 #include <string.h>
 389 #include <errno.h>
 390 #include <unistd.h>
 391
 392 #include <sys/types.h>
 393 #include <sys/socket.h>
 394 #include <net/if.h>
 395 #include <net/route.h>
 396 #include <net/if_dl.h>
 397
 398 #include <netinet/in.h>
 399 #include <netinet/in_var.h>
 400
 401 static int s;
 402 static iface_mon_cb callback;
 403
 404 int
 405 iface_mon_start(iface_mon_cb cb)
 406 {
 407 #ifdef RO_MSGFILTER
 408     unsigned char msgfilter[] = {
 409         RTM_IFANNOUNCE,
 410     };
 411 #endif
 412
 413     /* Create a socket of type PF_ROUTE to listen for events. */
 414     s = socket(PF_ROUTE, SOCK_RAW, 0);
 415     if (s == -1)
 416         return -errno;
 417
 418 #ifdef RO_MSGFILTER
 419     /*
 420      * This OS supports filtering PF_ROUTE sockets for specific
 421      * events; we only want interface announcement events.
 422      *
 423      * If this fails, we just live with extra events that we ignore,
 424      * which we also do on platforms that don't support filtering.
 425      */
 426     (void) setsockopt(s, PF_ROUTE, RO_MSGFILTER, &msgfilter, sizeof msgfilter);
 427 #endif
 428 #ifdef SO_RERROR
 429     /*
 430      * This OS supports getting error reports from recvmsg() if a
 431      * receive buffer overflow occurs.  If that happens, it means
 432      * that we may have lost interface reports, so we should
 433      * probably just refetch all interface data.
 434      *
 435      * If we can't get those error reports, we're out of luck.
 436      */
 437     int n = 1;
 438     (void) setsockopt(s, SOL_SOCKET, SO_RERROR, &n, sizeof(n));
 439 #endif
 440
 441     callback = cb;
 442     return 0;
 443 }
 444
 445 void
 446 iface_mon_stop(void)
 447 {
 448     close(s);
 449 }
 450
 451 int
 452 iface_mon_get_sock(void)
 453 {
 454     return s;
 455 }
 456
 457 void
 458 iface_mon_event(void)
 459 {
 460     union msgbuf {
 461         char buf[2048];
 462         struct rt_msghdr hd;
 463         struct if_announcemsghdr ifan;
 464     } msgbuf;
 465     struct iovec iov[1];
 466     struct msghdr msg;
 467     bool message_seen = false;
 468     ssize_t received;
 469
 470     iov[0].iov_base = &msgbuf;
 471     iov[0].iov_len = sizeof msgbuf;
 472     memset(&msg, 0, sizeof msg);
 473     msg.msg_iov = iov;
 474     msg.msg_iovlen = 1;
 475
 476     while (!message_seen) {
 477         received = recvmsg(s, &msg, 0);
 478         if (received == -1) {
 479             if (errno == ENOBUFS) {
 480                 /*
 481                  * Receive buffer overflow.  Keep reading,
 482                  * to get any messages in the socket buffer.
 483                  *
 484                  * XXX - that means we may have lost indications;
 485                  * should there be a callback that indicates that
 486                  * all interface data should be refreshed?
 487                  */
 488                 continue;
 489             } else {
 490                 /*
 491                  * Other error - just ignore.
 492                  */
 493                 return;
 494             }
 495         }
 496
 497         /*
 498          * We've seen a message.
 499          */
 500         message_seen = true;
 501     }
 502     if (received != 0) {
 503         /*
 504          * XXX - should we check received, to make sure it's large
 505          * enough?
 506          */
 507         if (msgbuf.hd.rtm_version != RTM_VERSION)
 508             return;
 509
 510         switch (msgbuf.hd.rtm_type) {
 511
 512         case RTM_IFANNOUNCE:
 513             switch (msgbuf.ifan.ifan_what) {
 514
 515             case IFAN_ARRIVAL:
 516                 /*
 517                  * A new interface has arrived.
 518                  *
 519                  * XXX - see comment about interface arrivals in the
 520                  * macOS section; it applies here as well.
 521                  */
 522                 callback(msgbuf.ifan.ifan_name, 1, 1);
 523                 break;
 524
 525             case IFAN_DEPARTURE:
 526                 /*
 527                  * An existing interface has been removed.
 528                  */
 529                 callback(msgbuf.ifan.ifan_name, 0, 0);
 530                 break;
 531
 532             default:
 533                 /*
 534                  * Ignore other notifications.
 535                  */
 536                 break;
 537             }
 538             break;
 539
 540         default:
 541             /*
 542              * Ignore other messages.
 543              */
 544             break;
 545         }
 546     }
 547 }
 548
 549 void
 550 iface_mon_enable(bool enable _U_)
 551 {
 552 }
 553
 554 #else /* don't have something we support */
 555
 556 int
 557 iface_mon_start(iface_mon_cb cb _U_)
 558 {
 559     return -1;
 560 }
 561
 562 void
 563 iface_mon_stop(void)
 564 {
 565 }
 566
 567 int
 568 iface_mon_get_sock(void)
 569 {
 570     return -1;
 571 }
 572
 573 void
 574 iface_mon_event(void)
 575 {
 576 }
 577
 578 void
 579 iface_mon_enable(bool enable _U_)
 580 {
 581 }
 582
 583 #endif /* HAVE_LIBNL */
 584
 585 #endif /* HAVE_LIBPCAP */
 586
 587 /*
 588  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 589  *
 590  * Local variables:
 591  * c-basic-offset: 4
 592  * tab-width: 8
 593  * indent-tabs-mode: nil
 594  * End:
 595  *
 596  * vi: set shiftwidth=4 tabstop=8 expandtab:
 597  * :indentSize=4:tabSize=8:noTabs=true:
 598  */