4 * Copyright (C) 2001-2006 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
9 #define SOLARIS (defined(__SVR4) || defined(__svr4__)) && defined(sun)
12 #include <sys/types.h>
14 #include <sys/param.h>
20 #include <sys/socket.h>
21 #include <sys/ioctl.h>
29 #if !defined(__SVR4) && !defined(__svr4__)
30 # if (__FreeBSD_version >= 300000)
31 # include <sys/dirent.h>
36 # include <sys/filio.h>
37 # include <sys/byteorder.h>
39 #if !defined(__hpux) && (!defined(__SVR4) && !defined(__GNUC__))
45 #include <netinet/in.h>
46 #include <netinet/in_systm.h>
48 #include <netinet/ip.h>
49 #if !defined(__hpux) && !defined(linux)
50 # include <netinet/tcp_fsm.h>
53 #include <arpa/inet.h>
54 #include <arpa/nameser.h>
61 # include <sys/protosw.h>
62 # include <netinet/ip_var.h>
65 #include <netinet/tcp.h>
66 #include <netinet/ip_icmp.h>
71 #include "netinet/ip_compat.h"
72 #include <netinet/tcpip.h>
73 #include "netinet/ip_fil.h"
74 #include "netinet/ip_nat.h"
75 #include "netinet/ip_state.h"
76 #include "netinet/ip_proxy.h"
80 static const char sccsid[] = "@(#)ipmon.c 1.21 6/5/96 (C)1993-2000 Darren Reed";
81 static const char rcsid[] = "@(#)$Id: ipmon.c,v 1.33.2.20 2007/09/20 12:51:56 darrenr Exp $";
85 #if defined(sun) && !defined(SOLARIS2)
86 #define STRERROR(x) sys_errlist[x]
87 extern char *sys_errlist[];
89 #define STRERROR(x) strerror(x)
99 typedef struct icmp_subtype {
104 typedef struct icmp_type {
106 struct icmp_subtype *it_subtable;
112 #define IST_SZ(x) (sizeof(x)/sizeof(icmp_subtype_t))
115 struct flags tcpfl[] = {
128 static char *pidfile = "/etc/opt/ipf/ipmon.pid";
131 static char *pidfile = "/var/run/ipmon.pid";
133 static char *pidfile = "/etc/ipmon.pid";
137 static char line[2048];
139 static char *logfile = NULL;
140 static FILE *binarylog = NULL;
141 static char *binarylogfile = NULL;
142 static int donehup = 0;
143 static void usage __P((char *));
144 static void handlehup __P((int));
145 static void flushlogs __P((char *, FILE *));
146 static void print_log __P((int, FILE *, char *, int));
147 static void print_ipflog __P((FILE *, char *, int));
148 static void print_natlog __P((FILE *, char *, int));
149 static void print_statelog __P((FILE *, char *, int));
150 static int read_log __P((int, int *, char *, int));
151 static void write_pid __P((char *));
152 static char *icmpname __P((u_int, u_int));
153 static char *icmpname6 __P((u_int, u_int));
154 static icmp_type_t *find_icmptype __P((int, icmp_type_t *, size_t));
155 static icmp_subtype_t *find_icmpsubtype __P((int, icmp_subtype_t *, size_t));
157 static struct tm *get_tm __P((u_32_t));
159 static struct tm *get_tm __P((time_t));
162 char *hostname __P((int, int, u_32_t *));
163 char *portname __P((int, char *, u_int));
164 int main __P((int, char *[]));
166 static void logopts __P((int, char *));
167 static void init_tabs __P((void));
168 static char *getproto __P((u_int));
170 static char **protocols = NULL;
171 static char **udp_ports = NULL;
172 static char **tcp_ports = NULL;
173 static char *conf_file = NULL;
176 #define OPT_SYSLOG 0x001
177 #define OPT_RESOLVE 0x002
178 #define OPT_HEXBODY 0x004
179 #define OPT_VERBOSE 0x008
180 #define OPT_HEXHDR 0x010
181 #define OPT_TAIL 0x020
182 #define OPT_NAT 0x080
183 #define OPT_STATE 0x100
184 #define OPT_FILTER 0x200
185 #define OPT_PORTNUM 0x400
186 #define OPT_LOGALL (OPT_NAT|OPT_STATE|OPT_FILTER)
187 #define OPT_LOGBODY 0x800
189 #define HOSTNAME_V4(a,b) hostname((a), 4, (u_32_t *)&(b))
192 #define LOGFAC LOG_LOCAL0
197 static icmp_subtype_t icmpunreachnames[] = {
198 { ICMP_UNREACH_NET, "net" },
199 { ICMP_UNREACH_HOST, "host" },
200 { ICMP_UNREACH_PROTOCOL, "protocol" },
201 { ICMP_UNREACH_PORT, "port" },
202 { ICMP_UNREACH_NEEDFRAG, "needfrag" },
203 { ICMP_UNREACH_SRCFAIL, "srcfail" },
204 { ICMP_UNREACH_NET_UNKNOWN, "net_unknown" },
205 { ICMP_UNREACH_HOST_UNKNOWN, "host_unknown" },
206 { ICMP_UNREACH_NET, "isolated" },
207 { ICMP_UNREACH_NET_PROHIB, "net_prohib" },
208 { ICMP_UNREACH_NET_PROHIB, "host_prohib" },
209 { ICMP_UNREACH_TOSNET, "tosnet" },
210 { ICMP_UNREACH_TOSHOST, "toshost" },
211 { ICMP_UNREACH_ADMIN_PROHIBIT, "admin_prohibit" },
215 static icmp_subtype_t redirectnames[] = {
216 { ICMP_REDIRECT_NET, "net" },
217 { ICMP_REDIRECT_HOST, "host" },
218 { ICMP_REDIRECT_TOSNET, "tosnet" },
219 { ICMP_REDIRECT_TOSHOST, "toshost" },
223 static icmp_subtype_t timxceednames[] = {
224 { ICMP_TIMXCEED_INTRANS, "transit" },
225 { ICMP_TIMXCEED_REASS, "reassem" },
229 static icmp_subtype_t paramnames[] = {
230 { ICMP_PARAMPROB_ERRATPTR, "errata_pointer" },
231 { ICMP_PARAMPROB_OPTABSENT, "optmissing" },
232 { ICMP_PARAMPROB_LENGTH, "length" },
236 static icmp_type_t icmptypes[] = {
237 { ICMP_ECHOREPLY, NULL, 0, "echoreply" },
238 { -1, NULL, 0, NULL },
239 { -1, NULL, 0, NULL },
240 { ICMP_UNREACH, icmpunreachnames,
241 IST_SZ(icmpunreachnames),"unreach" },
242 { ICMP_SOURCEQUENCH, NULL, 0, "sourcequench" },
243 { ICMP_REDIRECT, redirectnames,
244 IST_SZ(redirectnames), "redirect" },
245 { -1, NULL, 0, NULL },
246 { -1, NULL, 0, NULL },
247 { ICMP_ECHO, NULL, 0, "echo" },
248 { ICMP_ROUTERADVERT, NULL, 0, "routeradvert" },
249 { ICMP_ROUTERSOLICIT, NULL, 0, "routersolicit" },
250 { ICMP_TIMXCEED, timxceednames,
251 IST_SZ(timxceednames), "timxceed" },
252 { ICMP_PARAMPROB, paramnames,
253 IST_SZ(paramnames), "paramprob" },
254 { ICMP_TSTAMP, NULL, 0, "timestamp" },
255 { ICMP_TSTAMPREPLY, NULL, 0, "timestampreply" },
256 { ICMP_IREQ, NULL, 0, "inforeq" },
257 { ICMP_IREQREPLY, NULL, 0, "inforeply" },
258 { ICMP_MASKREQ, NULL, 0, "maskreq" },
259 { ICMP_MASKREPLY, NULL, 0, "maskreply" },
260 { -2, NULL, 0, NULL }
263 static icmp_subtype_t icmpredirect6[] = {
264 { ICMP6_DST_UNREACH_NOROUTE, "noroute" },
265 { ICMP6_DST_UNREACH_ADMIN, "admin" },
266 { ICMP6_DST_UNREACH_NOTNEIGHBOR, "neighbour" },
267 { ICMP6_DST_UNREACH_ADDR, "address" },
268 { ICMP6_DST_UNREACH_NOPORT, "noport" },
272 static icmp_subtype_t icmptimexceed6[] = {
273 { ICMP6_TIME_EXCEED_TRANSIT, "intransit" },
274 { ICMP6_TIME_EXCEED_REASSEMBLY, "reassem" },
278 static icmp_subtype_t icmpparamprob6[] = {
279 { ICMP6_PARAMPROB_HEADER, "header" },
280 { ICMP6_PARAMPROB_NEXTHEADER, "nextheader" },
281 { ICMP6_PARAMPROB_OPTION, "option" },
285 static icmp_subtype_t icmpquerysubject6[] = {
286 { ICMP6_NI_SUBJ_IPV6, "ipv6" },
287 { ICMP6_NI_SUBJ_FQDN, "fqdn" },
288 { ICMP6_NI_SUBJ_IPV4, "ipv4" },
292 static icmp_subtype_t icmpnodeinfo6[] = {
293 { ICMP6_NI_SUCCESS, "success" },
294 { ICMP6_NI_REFUSED, "refused" },
295 { ICMP6_NI_UNKNOWN, "unknown" },
299 static icmp_subtype_t icmprenumber6[] = {
300 { ICMP6_ROUTER_RENUMBERING_COMMAND, "command" },
301 { ICMP6_ROUTER_RENUMBERING_RESULT, "result" },
302 { ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET, "seqnum_reset" },
306 static icmp_type_t icmptypes6[] = {
307 { 0, NULL, 0, NULL },
308 { ICMP6_DST_UNREACH, icmpredirect6,
309 IST_SZ(icmpredirect6), "unreach" },
310 { ICMP6_PACKET_TOO_BIG, NULL, 0, "toobig" },
311 { ICMP6_TIME_EXCEEDED, icmptimexceed6,
312 IST_SZ(icmptimexceed6), "timxceed" },
313 { ICMP6_PARAM_PROB, icmpparamprob6,
314 IST_SZ(icmpparamprob6), "paramprob" },
315 { ICMP6_ECHO_REQUEST, NULL, 0, "echo" },
316 { ICMP6_ECHO_REPLY, NULL, 0, "echoreply" },
317 { ICMP6_MEMBERSHIP_QUERY, icmpquerysubject6,
318 IST_SZ(icmpquerysubject6), "groupmemberquery" },
319 { ICMP6_MEMBERSHIP_REPORT,NULL, 0, "groupmemberreport" },
320 { ICMP6_MEMBERSHIP_REDUCTION,NULL, 0, "groupmemberterm" },
321 { ND_ROUTER_SOLICIT, NULL, 0, "routersolicit" },
322 { ND_ROUTER_ADVERT, NULL, 0, "routeradvert" },
323 { ND_NEIGHBOR_SOLICIT, NULL, 0, "neighborsolicit" },
324 { ND_NEIGHBOR_ADVERT, NULL, 0, "neighboradvert" },
325 { ND_REDIRECT, NULL, 0, "redirect" },
326 { ICMP6_ROUTER_RENUMBERING, icmprenumber6,
327 IST_SZ(icmprenumber6), "routerrenumber" },
328 { ICMP6_WRUREQUEST, NULL, 0, "whoareyourequest" },
329 { ICMP6_WRUREPLY, NULL, 0, "whoareyoureply" },
330 { ICMP6_FQDN_QUERY, NULL, 0, "fqdnquery" },
331 { ICMP6_FQDN_REPLY, NULL, 0, "fqdnreply" },
332 { ICMP6_NI_QUERY, icmpnodeinfo6,
333 IST_SZ(icmpnodeinfo6), "nodeinforequest" },
334 { ICMP6_NI_REPLY, NULL, 0, "nodeinforeply" },
335 { MLD6_MTRACE_RESP, NULL, 0, "mtraceresponse" },
336 { MLD6_MTRACE, NULL, 0, "mtracerequest" },
337 { -2, NULL, 0, NULL }
340 static icmp_subtype_t *find_icmpsubtype(type, table, tablesz)
342 icmp_subtype_t *table;
351 if ((type < 0) || (type > table[tablesz - 2].ist_val))
355 if (table[type].ist_val == type)
358 for (i = 0, ist = table; ist->ist_val != -2; i++, ist++)
359 if (ist->ist_val == type)
365 static icmp_type_t *find_icmptype(type, table, tablesz)
376 if ((type < 0) || (type > table[tablesz - 2].it_val))
380 if (table[type].it_val == type)
383 for (i = 0, it = table; it->it_val != -2; i++, it++)
384 if (it->it_val == type)
390 static void handlehup(sig)
393 signal(SIGHUP, handlehup);
398 static void init_tabs()
405 if (protocols != NULL) {
406 for (i = 0; i < 256; i++)
407 if (protocols[i] != NULL) {
414 protocols = (char **)malloc(256 * sizeof(*protocols));
415 if (protocols != NULL) {
416 bzero((char *)protocols, 256 * sizeof(*protocols));
419 while ((p = getprotoent()) != NULL)
420 if (p->p_proto >= 0 && p->p_proto <= 255 &&
421 p->p_name != NULL && protocols[p->p_proto] == NULL)
422 protocols[p->p_proto] = strdup(p->p_name);
428 free(protocols[252]);
430 protocols[252] = NULL;
434 if (udp_ports != NULL) {
435 for (i = 0; i < 65536; i++)
436 if (udp_ports[i] != NULL) {
443 udp_ports = (char **)malloc(65536 * sizeof(*udp_ports));
444 if (udp_ports != NULL)
445 bzero((char *)udp_ports, 65536 * sizeof(*udp_ports));
447 if (tcp_ports != NULL) {
448 for (i = 0; i < 65536; i++)
449 if (tcp_ports[i] != NULL) {
456 tcp_ports = (char **)malloc(65536 * sizeof(*tcp_ports));
457 if (tcp_ports != NULL)
458 bzero((char *)tcp_ports, 65536 * sizeof(*tcp_ports));
461 while ((s = getservent()) != NULL) {
462 if (s->s_proto == NULL)
464 else if (!strcmp(s->s_proto, "tcp")) {
465 port = ntohs(s->s_port);
468 } else if (!strcmp(s->s_proto, "udp")) {
469 port = ntohs(s->s_port);
474 if ((port < 0 || port > 65535) || (name == NULL))
477 tab[port] = strdup(name);
483 static char *getproto(p)
490 s = protocols ? protocols[p] : NULL;
492 sprintf(pnum, "%u", p);
499 static int read_log(fd, lenp, buf, bufsize)
500 int fd, bufsize, *lenp;
505 nr = read(fd, buf, bufsize);
508 if ((nr < 0) && (errno != EINTR))
515 char *hostname(res, v, ip)
519 # define MAX_INETA 16
520 static char hname[MAXHOSTNAMELEN + MAX_INETA + 3];
522 static char hostbuf[MAXHOSTNAMELEN+1];
530 return inet_ntoa(ipa);
531 hp = gethostbyaddr((char *)ip, sizeof(*ip), AF_INET);
533 return inet_ntoa(ipa);
534 sprintf(hname, "%.*s[%s]", MAXHOSTNAMELEN, hp->h_name,
539 (void) inet_ntop(AF_INET6, ip, hostbuf, sizeof(hostbuf) - 1);
540 hostbuf[MAXHOSTNAMELEN] = '\0';
548 char *portname(res, proto, port)
553 static char pname[8];
558 (void) sprintf(pname, "%u", port);
559 if (!res || (opts & OPT_PORTNUM))
562 if (!strcmp(proto, "tcp"))
564 else if (!strcmp(proto, "udp"))
572 static char *icmpname(type, code)
576 static char name[80];
582 it = find_icmptype(type, icmptypes, sizeof(icmptypes) / sizeof(*it));
587 sprintf(name, "icmptype(%d)/", type);
589 sprintf(name, "%s/", s);
592 if (it != NULL && it->it_subtable != NULL)
593 ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
595 if (ist != NULL && ist->ist_name != NULL)
596 strcat(name, ist->ist_name);
598 sprintf(name + strlen(name), "%d", code);
603 static char *icmpname6(type, code)
607 static char name[80];
613 it = find_icmptype(type, icmptypes6, sizeof(icmptypes6) / sizeof(*it));
618 sprintf(name, "icmpv6type(%d)/", type);
620 sprintf(name, "%s/", s);
623 if (it != NULL && it->it_subtable != NULL)
624 ist = find_icmpsubtype(code, it->it_subtable, it->it_stsize);
626 if (ist != NULL && ist->ist_name != NULL)
627 strcat(name, ist->ist_name);
629 sprintf(name + strlen(name), "%d", code);
635 void dumphex(log, dopts, buf, len)
643 u_char *s = (u_char *)buf, *t = (u_char *)hline;
645 if (buf == NULL || len == 0)
650 for (i = len, j = 0; i; i--, j++, s++) {
651 if (j && !(j & 0xf)) {
654 if ((dopts & OPT_SYSLOG))
655 syslog(LOG_INFO, "%s", hline);
656 else if (log != NULL)
661 sprintf((char *)t, "%02x", *s & 0xff);
663 if (!((j + 1) & 0xf)) {
665 sprintf((char *)t, " ");
667 for (k = 16; k; k--, s++)
668 *t++ = (ISPRINT(*s) ? *s : '.');
677 for (k = 16 - (j & 0xf); k; k--) {
682 sprintf((char *)t, " ");
685 for (k = j & 0xf; k; k--, s++)
686 *t++ = (ISPRINT(*s) ? *s : '.');
690 if ((dopts & OPT_SYSLOG) != 0)
691 syslog(LOG_INFO, "%s", hline);
692 else if (log != NULL) {
699 static struct tm *get_tm(sec)
714 static void print_natlog(log, buf, blen)
720 iplog_t *ipl = (iplog_t *)buf;
726 nl = (struct natlog *)((char *)ipl + sizeof(*ipl));
727 res = (opts & OPT_RESOLVE) ? 1 : 0;
728 tm = get_tm(ipl->ipl_sec);
730 if (!(opts & OPT_SYSLOG)) {
731 (void) strftime(t, len, "%d/%m/%Y ", tm);
736 (void) strftime(t, len, "%T", tm);
738 (void) sprintf(t, ".%-.6ld @%hd ", ipl->ipl_usec, nl->nl_rule + 1);
741 if (nl->nl_type == NL_NEWMAP)
742 strcpy(t, "NAT:MAP ");
743 else if (nl->nl_type == NL_NEWRDR)
744 strcpy(t, "NAT:RDR ");
745 else if (nl->nl_type == NL_FLUSH)
746 strcpy(t, "NAT:FLUSH ");
747 else if (nl->nl_type == NL_EXPIRE)
748 strcpy(t, "NAT:EXPIRE ");
749 else if (nl->nl_type == NL_NEWBIMAP)
750 strcpy(t, "NAT:BIMAP ");
751 else if (nl->nl_type == NL_NEWBLOCK)
752 strcpy(t, "NAT:MAPBLOCK ");
753 else if (nl->nl_type == NL_CLONE)
754 strcpy(t, "NAT:CLONE ");
755 else if (nl->nl_type == NL_DESTROY)
756 strcpy(t, "NAT:DESTROY ");
758 sprintf(t, "Type: %d ", nl->nl_type);
761 proto = getproto(nl->nl_p);
763 (void) sprintf(t, "%s,%s <- -> ", HOSTNAME_V4(res, nl->nl_inip),
764 portname(res, proto, (u_int)nl->nl_inport));
766 (void) sprintf(t, "%s,%s ", HOSTNAME_V4(res, nl->nl_outip),
767 portname(res, proto, (u_int)nl->nl_outport));
769 (void) sprintf(t, "[%s,%s PR %s]", HOSTNAME_V4(res, nl->nl_origip),
770 portname(res, proto, (u_int)nl->nl_origport),
773 if (nl->nl_type == NL_EXPIRE) {
775 (void) sprintf(t, " Pkts %qd/%qd Bytes %qd/%qd",
776 (long long)nl->nl_pkts[0],
777 (long long)nl->nl_pkts[1],
778 (long long)nl->nl_bytes[0],
779 (long long)nl->nl_bytes[1]);
781 (void) sprintf(t, " Pkts %ld/%ld Bytes %ld/%ld",
782 nl->nl_pkts[0], nl->nl_pkts[1],
783 nl->nl_bytes[0], nl->nl_bytes[1]);
790 if (opts & OPT_SYSLOG)
791 syslog(LOG_INFO, "%s", line);
792 else if (log != NULL)
793 (void) fprintf(log, "%s", line);
797 static void print_statelog(log, buf, blen)
803 iplog_t *ipl = (iplog_t *)buf;
804 char *t = line, *proto;
808 sl = (struct ipslog *)((char *)ipl + sizeof(*ipl));
809 res = (opts & OPT_RESOLVE) ? 1 : 0;
810 tm = get_tm(ipl->ipl_sec);
812 if (!(opts & OPT_SYSLOG)) {
813 (void) strftime(t, len, "%d/%m/%Y ", tm);
818 (void) strftime(t, len, "%T", tm);
820 (void) sprintf(t, ".%-.6ld ", ipl->ipl_usec);
823 switch (sl->isl_type)
826 strcpy(t, "STATE:NEW ");
830 strcpy(t, "STATE:CLONED ");
834 if ((sl->isl_p == IPPROTO_TCP) &&
835 (sl->isl_state[0] > IPF_TCPS_ESTABLISHED ||
836 sl->isl_state[1] > IPF_TCPS_ESTABLISHED))
837 strcpy(t, "STATE:CLOSE ");
839 strcpy(t, "STATE:EXPIRE ");
843 strcpy(t, "STATE:FLUSH ");
846 case ISL_INTERMEDIATE :
847 strcpy(t, "STATE:INTERMEDIATE ");
851 strcpy(t, "STATE:REMOVE ");
855 strcpy(t, "STATE:KILLED ");
859 strcpy(t, "STATE:UNLOAD ");
863 sprintf(t, "Type: %d ", sl->isl_type);
868 proto = getproto(sl->isl_p);
870 if (sl->isl_p == IPPROTO_TCP || sl->isl_p == IPPROTO_UDP) {
871 (void) sprintf(t, "%s,%s -> ",
872 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_src),
873 portname(res, proto, (u_int)sl->isl_sport));
875 (void) sprintf(t, "%s,%s PR %s",
876 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
877 portname(res, proto, (u_int)sl->isl_dport), proto);
878 } else if (sl->isl_p == IPPROTO_ICMP) {
879 (void) sprintf(t, "%s -> ", hostname(res, sl->isl_v,
880 (u_32_t *)&sl->isl_src));
882 (void) sprintf(t, "%s PR icmp %d",
883 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
885 } else if (sl->isl_p == IPPROTO_ICMPV6) {
886 (void) sprintf(t, "%s -> ", hostname(res, sl->isl_v,
887 (u_32_t *)&sl->isl_src));
889 (void) sprintf(t, "%s PR icmpv6 %d",
890 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
893 (void) sprintf(t, "%s -> ",
894 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_src));
896 (void) sprintf(t, "%s PR %s",
897 hostname(res, sl->isl_v, (u_32_t *)&sl->isl_dst),
901 if (sl->isl_tag != FR_NOLOGTAG) {
902 (void) sprintf(t, " tag %u", sl->isl_tag);
905 if (sl->isl_type != ISL_NEW) {
909 " Forward: Pkts in %" PRId64 " Bytes in %" PRId64
910 " Pkts out %" PRId64 " Bytes out %" PRId64
911 " Backward: Pkts in %" PRId64 " Bytes in %" PRId64
912 " Pkts out %" PRId64 " Bytes out %" PRId64,
914 " Forward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd Backward: Pkts in %qd Bytes in %qd Pkts out %qd Bytes out %qd",
917 " Forward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld Backward: Pkts in %ld Bytes in %ld Pkts out %ld Bytes out %ld",
919 sl->isl_pkts[0], sl->isl_bytes[0],
920 sl->isl_pkts[1], sl->isl_bytes[1],
921 sl->isl_pkts[2], sl->isl_bytes[2],
922 sl->isl_pkts[3], sl->isl_bytes[3]);
929 if (opts & OPT_SYSLOG)
930 syslog(LOG_INFO, "%s", line);
931 else if (log != NULL)
932 (void) fprintf(log, "%s", line);
936 static void print_log(logtype, log, buf, blen)
942 char *bp = NULL, *bpo = NULL;
946 ipl = (iplog_t *)buf;
947 if ((u_long)ipl & (sizeof(long)-1)) {
950 bp = (char *)malloc(blen);
951 bcopy((char *)ipl, bp, blen);
960 psize = ipl->ipl_dsize;
965 fwrite(buf, psize, 1, binarylog);
969 if (logtype == IPL_LOGIPF) {
970 if (ipl->ipl_magic == IPL_MAGIC)
971 print_ipflog(log, buf, psize);
973 } else if (logtype == IPL_LOGNAT) {
974 if (ipl->ipl_magic == IPL_MAGIC_NAT)
975 print_natlog(log, buf, psize);
977 } else if (logtype == IPL_LOGSTATE) {
978 if (ipl->ipl_magic == IPL_MAGIC_STATE)
979 print_statelog(log, buf, psize);
991 static void print_ipflog(log, buf, blen)
1001 int i, v, lvl, res, len, off, plen, ipoff, defaction;
1008 struct ip6_ext *ehp;
1014 ipl = (iplog_t *)buf;
1015 ipf = (ipflog_t *)((char *)buf + sizeof(*ipl));
1016 ip = (ip_t *)((char *)ipf + sizeof(*ipf));
1018 res = (opts & OPT_RESOLVE) ? 1 : 0;
1021 tm = get_tm(ipl->ipl_sec);
1024 if (!(opts & OPT_SYSLOG)) {
1025 (void) strftime(t, len, "%d/%m/%Y ", tm);
1030 (void) strftime(t, len, "%T", tm);
1032 (void) sprintf(t, ".%-.6ld ", ipl->ipl_usec);
1034 if (ipl->ipl_count > 1) {
1035 (void) sprintf(t, "%dx ", ipl->ipl_count);
1038 #if (defined(MENTAT) || \
1039 (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
1040 (defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) || \
1041 (defined(OpenBSD) && (OpenBSD >= 199603))) || defined(linux)
1043 char ifname[sizeof(ipf->fl_ifname) + 1];
1045 strncpy(ifname, ipf->fl_ifname, sizeof(ipf->fl_ifname));
1046 ifname[sizeof(ipf->fl_ifname)] = '\0';
1047 (void) sprintf(t, "%s", ifname);
1049 # if defined(MENTAT) || defined(linux)
1050 if (ISALPHA(*(t - 1))) {
1051 sprintf(t, "%d", ipf->fl_unit);
1057 for (len = 0; len < 3; len++)
1058 if (ipf->fl_ifname[len] == '\0')
1060 if (ipf->fl_ifname[len])
1062 (void) sprintf(t, "%*.*s%u", len, len, ipf->fl_ifname, ipf->fl_unit);
1065 if ((ipf->fl_group[0] == (char)~0) && (ipf->fl_group[1] == '\0'))
1067 else if (ipf->fl_group[0] == '\0')
1068 (void) strcpy(t, " @0:");
1070 (void) sprintf(t, " @%s:", ipf->fl_group);
1072 if (ipf->fl_rule == 0xffffffff)
1075 (void) sprintf(t, "%u ", ipf->fl_rule + 1);
1080 if (ipf->fl_lflags & FI_SHORT) {
1085 if (FR_ISPASS(ipf->fl_flags)) {
1086 if (ipf->fl_flags & FR_LOGP)
1090 } else if (FR_ISBLOCK(ipf->fl_flags)) {
1091 if (ipf->fl_flags & FR_LOGB)
1096 } else if ((ipf->fl_flags & FR_LOGMASK) == FR_LOG) {
1099 } else if (ipf->fl_flags & FF_LOGNOMATCH) {
1105 if (ipf->fl_loglevel != 0xffff)
1106 lvl = ipf->fl_loglevel;
1116 p = (u_short)ip6->ip6_nxt;
1117 s = (u_32_t *)&ip6->ip6_src;
1118 d = (u_32_t *)&ip6->ip6_dst;
1119 plen = hl + ntohs(ip6->ip6_plen);
1121 ehp = (struct ip6_ext *)((char *)ip6 + hl);
1125 case IPPROTO_HOPOPTS :
1126 case IPPROTO_MOBILITY :
1127 case IPPROTO_DSTOPTS :
1128 case IPPROTO_ROUTING :
1131 ehl = 8 + (ehp->ip6e_len << 3);
1133 ehp = (struct ip6_ext *)((char *)ehp + ehl);
1135 case IPPROTO_FRAGMENT :
1136 hl += sizeof(struct ip6_frag);
1147 } else if (v == 4) {
1148 hl = IP_HL(ip) << 2;
1150 off = ipoff & IP_OFFMASK;
1151 p = (u_short)ip->ip_p;
1152 s = (u_32_t *)&ip->ip_src;
1153 d = (u_32_t *)&ip->ip_dst;
1158 proto = getproto(p);
1160 if ((p == IPPROTO_TCP || p == IPPROTO_UDP) && !off) {
1161 tp = (tcphdr_t *)((char *)ip + hl);
1162 if (!(ipf->fl_lflags & FI_SHORT)) {
1163 (void) sprintf(t, "%s,%s -> ", hostname(res, v, s),
1164 portname(res, proto, (u_int)tp->th_sport));
1166 (void) sprintf(t, "%s,%s PR %s len %hu %hu",
1167 hostname(res, v, d),
1168 portname(res, proto, (u_int)tp->th_dport),
1172 if (p == IPPROTO_TCP) {
1175 for (i = 0; tcpfl[i].value; i++)
1176 if (tp->th_flags & tcpfl[i].value)
1177 *t++ = tcpfl[i].flag;
1178 if (opts & OPT_VERBOSE) {
1179 (void) sprintf(t, " %lu %lu %hu",
1180 (u_long)(ntohl(tp->th_seq)),
1181 (u_long)(ntohl(tp->th_ack)),
1188 (void) sprintf(t, "%s -> ", hostname(res, v, s));
1190 (void) sprintf(t, "%s PR %s len %hu %hu",
1191 hostname(res, v, d), proto, hl, plen);
1193 } else if ((p == IPPROTO_ICMPV6) && !off && (v == 6)) {
1194 ic = (struct icmp *)((char *)ip + hl);
1195 (void) sprintf(t, "%s -> ", hostname(res, v, s));
1197 (void) sprintf(t, "%s PR icmpv6 len %hu %hu icmpv6 %s",
1198 hostname(res, v, d), hl, plen,
1199 icmpname6(ic->icmp_type, ic->icmp_code));
1200 } else if ((p == IPPROTO_ICMP) && !off && (v == 4)) {
1201 ic = (struct icmp *)((char *)ip + hl);
1202 (void) sprintf(t, "%s -> ", hostname(res, v, s));
1204 (void) sprintf(t, "%s PR icmp len %hu %hu icmp %s",
1205 hostname(res, v, d), hl, plen,
1206 icmpname(ic->icmp_type, ic->icmp_code));
1207 if (ic->icmp_type == ICMP_UNREACH ||
1208 ic->icmp_type == ICMP_SOURCEQUENCH ||
1209 ic->icmp_type == ICMP_PARAMPROB ||
1210 ic->icmp_type == ICMP_REDIRECT ||
1211 ic->icmp_type == ICMP_TIMXCEED) {
1213 i = ntohs(ipc->ip_len);
1215 * XXX - try to guess endian of ip_len in ICMP
1220 ipoff = ntohs(ipc->ip_off);
1221 proto = getproto(ipc->ip_p);
1223 if (!(ipoff & IP_OFFMASK) &&
1224 ((ipc->ip_p == IPPROTO_TCP) ||
1225 (ipc->ip_p == IPPROTO_UDP))) {
1226 tp = (tcphdr_t *)((char *)ipc + hl);
1228 (void) sprintf(t, " for %s,%s -",
1229 HOSTNAME_V4(res, ipc->ip_src),
1230 portname(res, proto,
1231 (u_int)tp->th_sport));
1233 (void) sprintf(t, " %s,%s PR %s len %hu %hu",
1234 HOSTNAME_V4(res, ipc->ip_dst),
1235 portname(res, proto,
1236 (u_int)tp->th_dport),
1237 proto, IP_HL(ipc) << 2, i);
1238 } else if (!(ipoff & IP_OFFMASK) &&
1239 (ipc->ip_p == IPPROTO_ICMP)) {
1240 icmp = (icmphdr_t *)((char *)ipc + hl);
1243 (void) sprintf(t, " for %s -",
1244 HOSTNAME_V4(res, ipc->ip_src));
1247 " %s PR icmp len %hu %hu icmp %d/%d",
1248 HOSTNAME_V4(res, ipc->ip_dst),
1250 icmp->icmp_type, icmp->icmp_code);
1253 (void) sprintf(t, " for %s -",
1254 HOSTNAME_V4(res, ipc->ip_src));
1256 (void) sprintf(t, " %s PR %s len %hu (%hu)",
1257 HOSTNAME_V4(res, ipc->ip_dst), proto,
1258 IP_HL(ipc) << 2, i);
1260 if (ipoff & IP_OFFMASK) {
1262 "(frag %d:%hu@%hu%s%s)",
1264 i - (IP_HL(ipc) << 2),
1265 (ipoff & IP_OFFMASK) << 3,
1266 ipoff & IP_MF ? "+" : "",
1267 ipoff & IP_DF ? "-" : "");
1273 (void) sprintf(t, "%s -> ", hostname(res, v, s));
1275 (void) sprintf(t, "%s PR %s len %hu (%hu)",
1276 hostname(res, v, d), proto, hl, plen);
1278 if (off & IP_OFFMASK)
1279 (void) sprintf(t, " (frag %d:%hu@%hu%s%s)",
1281 plen - hl, (off & IP_OFFMASK) << 3,
1282 ipoff & IP_MF ? "+" : "",
1283 ipoff & IP_DF ? "-" : "");
1288 if (ipf->fl_flags & FR_KEEPSTATE) {
1289 (void) strcpy(t, " K-S");
1293 if (ipf->fl_flags & FR_KEEPFRAG) {
1294 (void) strcpy(t, " K-F");
1298 if (ipf->fl_dir == 0)
1300 else if (ipf->fl_dir == 1)
1303 if (ipf->fl_logtag != 0) {
1304 sprintf(t, " log-tag %d", ipf->fl_logtag);
1307 if (ipf->fl_nattag.ipt_num[0] != 0) {
1308 strcpy(t, " nat-tag ");
1310 strncpy(t, ipf->fl_nattag.ipt_tag, sizeof(ipf->fl_nattag));
1313 if ((ipf->fl_lflags & FI_LOWTTL) != 0) {
1314 strcpy(t, " low-ttl");
1317 if ((ipf->fl_lflags & FI_OOW) != 0) {
1321 if ((ipf->fl_lflags & FI_BAD) != 0) {
1325 if ((ipf->fl_lflags & FI_NATED) != 0) {
1329 if ((ipf->fl_lflags & FI_BADNAT) != 0) {
1330 strcpy(t, " bad-NAT");
1333 if ((ipf->fl_lflags & FI_BADSRC) != 0) {
1334 strcpy(t, " bad-src");
1337 if ((ipf->fl_lflags & FI_MULTICAST) != 0) {
1338 strcpy(t, " multicast");
1341 if ((ipf->fl_lflags & FI_BROADCAST) != 0) {
1342 strcpy(t, " broadcast");
1345 if ((ipf->fl_lflags & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST)) ==
1347 strcpy(t, " mbcast");
1353 if (conf_file != NULL)
1354 defaction = check_action(buf, line, opts, lvl);
1355 if (defaction == 0) {
1356 if (opts & OPT_SYSLOG)
1357 syslog(lvl, "%s", line);
1358 else if (log != NULL)
1359 (void) fprintf(log, "%s", line);
1361 if (opts & OPT_HEXHDR)
1362 dumphex(log, opts, buf,
1363 sizeof(iplog_t) + sizeof(*ipf));
1364 if (opts & OPT_HEXBODY)
1365 dumphex(log, opts, (char *)ip,
1366 ipf->fl_plen + ipf->fl_hlen);
1367 else if ((opts & OPT_LOGBODY) && (ipf->fl_flags & FR_LOGBODY))
1368 dumphex(log, opts, (char *)ip + ipf->fl_hlen,
1374 static void usage(prog)
1377 fprintf(stderr, "%s: [-NFhstvxX] [-f <logfile>]\n", prog);
1382 static void write_pid(file)
1388 if ((fd = open(file, O_CREAT|O_TRUNC|O_WRONLY, 0644)) >= 0) {
1389 fp = fdopen(fd, "w");
1393 "unable to open/create pid file: %s\n", file);
1396 fprintf(fp, "%d", getpid());
1402 static void flushlogs(file, log)
1406 int fd, flushed = 0;
1408 if ((fd = open(file, O_RDWR)) == -1) {
1409 (void) fprintf(stderr, "%s: open: %s\n",
1410 file, STRERROR(errno));
1414 if (ioctl(fd, SIOCIPFFB, &flushed) == 0) {
1415 printf("%d bytes flushed from log buffer\n",
1419 perror("SIOCIPFFB");
1423 if (opts & OPT_SYSLOG) {
1424 syslog(LOG_INFO, "%d bytes flushed from log\n",
1426 } else if ((log != stdout) && (log != NULL)) {
1427 fprintf(log, "%d bytes flushed from log\n", flushed);
1433 static void logopts(turnon, options)
1440 for (s = options; *s; s++)
1451 flags |= OPT_FILTER;
1454 fprintf(stderr, "Unknown log option %c\n", *s);
1466 int main(argc, argv)
1473 int fd[3], doread, n, i;
1474 int tr, nr, regular[3], c;
1475 int fdt[3], devices = 0, make_daemon = 0;
1476 char buf[DEFAULT_IPFLOGSIZE], *iplfile[3], *s;
1478 extern char *optarg;
1480 fd[0] = fd[1] = fd[2] = -1;
1481 fdt[0] = fdt[1] = fdt[2] = -1;
1482 iplfile[0] = IPL_NAME;
1483 iplfile[1] = IPNAT_NAME;
1484 iplfile[2] = IPSTATE_NAME;
1486 while ((c = getopt(argc, argv,
1487 "?abB:C:Df:FhL:nN:o:O:pP:sS:tvxX")) != -1)
1492 fdt[0] = IPL_LOGIPF;
1493 fdt[1] = IPL_LOGNAT;
1494 fdt[2] = IPL_LOGSTATE;
1497 opts |= OPT_LOGBODY;
1500 binarylogfile = optarg;
1501 binarylog = fopen(optarg, "a");
1509 case 'f' : case 'I' :
1511 fdt[0] = IPL_LOGIPF;
1512 iplfile[0] = optarg;
1515 flushlogs(iplfile[0], log);
1516 flushlogs(iplfile[1], log);
1517 flushlogs(iplfile[2], log);
1520 logfac = fac_findname(optarg);
1523 "Unknown syslog facility '%s'\n",
1529 opts |= OPT_RESOLVE;
1533 fdt[1] = IPL_LOGNAT;
1534 iplfile[1] = optarg;
1536 case 'o' : case 'O' :
1537 logopts(c == 'o', optarg);
1538 fdt[0] = fdt[1] = fdt[2] = -1;
1539 if (opts & OPT_FILTER)
1540 fdt[0] = IPL_LOGIPF;
1542 fdt[1] = IPL_LOGNAT;
1543 if (opts & OPT_STATE)
1544 fdt[2] = IPL_LOGSTATE;
1547 opts |= OPT_PORTNUM;
1553 s = strrchr(argv[0], '/');
1558 openlog(s, LOG_NDELAY|LOG_PID, logfac);
1565 fdt[2] = IPL_LOGSTATE;
1566 iplfile[2] = optarg;
1572 opts |= OPT_VERBOSE;
1575 opts |= OPT_HEXBODY;
1588 if (load_config(conf_file) == -1)
1592 * Default action is to only open the filter log file.
1594 if ((fdt[0] == -1) && (fdt[1] == -1) && (fdt[2] == -1))
1595 fdt[0] = IPL_LOGIPF;
1597 for (i = 0; i < 3; i++) {
1600 if (!strcmp(iplfile[i], "-"))
1603 if ((fd[i] = open(iplfile[i], O_RDONLY)) == -1) {
1604 (void) fprintf(stderr,
1605 "%s: open: %s\n", iplfile[i],
1610 if (fstat(fd[i], &sb) == -1) {
1611 (void) fprintf(stderr, "%d: fstat: %s\n",
1612 fd[i], STRERROR(errno));
1616 if (!(regular[i] = !S_ISCHR(sb.st_mode)))
1621 if (!(opts & OPT_SYSLOG)) {
1622 logfile = argv[optind];
1623 log = logfile ? fopen(logfile, "a") : stdout;
1625 (void) fprintf(stderr, "%s: fopen: %s\n",
1626 argv[optind], STRERROR(errno));
1630 setvbuf(log, NULL, _IONBF, 0);
1634 if (make_daemon && ((log != stdout) || (opts & OPT_SYSLOG))) {
1636 daemon(0, !(opts & OPT_SYSLOG));
1639 if ((pid = fork()) > 0)
1642 (void) fprintf(stderr, "%s: fork() failed: %s\n",
1643 argv[0], STRERROR(errno));
1648 if ((opts & OPT_SYSLOG))
1656 signal(SIGHUP, handlehup);
1658 for (doread = 1; doread; ) {
1661 for (i = 0; i < 3; i++) {
1666 if (ioctl(fd[i], FIONREAD, &tr) == -1) {
1667 if (opts & OPT_SYSLOG)
1669 "ioctl(FIONREAD): %m");
1671 perror("ioctl(FIONREAD)");
1676 tr = (lseek(fd[i], 0, SEEK_CUR) < sb.st_size);
1677 if (!tr && !(opts & OPT_TAIL))
1685 tr = read_log(fd[i], &n, buf, sizeof(buf));
1687 if (logfile && (fp = fopen(logfile, "a"))) {
1691 if (binarylogfile &&
1692 (fp = fopen(binarylogfile, "a"))) {
1697 if (conf_file != NULL)
1698 load_config(conf_file);
1705 if (opts & OPT_SYSLOG)
1706 syslog(LOG_CRIT, "read: %m\n");
1712 if (opts & OPT_SYSLOG)
1713 syslog(LOG_CRIT, "aborting logging\n");
1714 else if (log != NULL)
1715 fprintf(log, "aborting logging\n");
1722 print_log(fdt[i], log, buf, n);
1723 if (!(opts & OPT_SYSLOG))
1729 if (!nr && ((opts & OPT_TAIL) || devices))