1 /*
2 * copy diverted (or tee'd) packets to a file in 'tcpdump' format
3 * (ie. this uses the '-lpcap' routines).
4 *
5 * example usage:
6 * # ipfwpcap -r 8091 divt.log &
7 * # ipfw add 2864 divert 8091 ip from 128.432.53.82 to any
8 * # ipfw add 2864 divert 8091 ip from any to 128.432.53.82
9 *
10 * the resulting dump file can be read with ...
11 * # tcpdump -nX -r divt.log
12 */
13 /*
14 * Written by P Kern { pkern [AT] cns.utoronto.ca }
15 *
16 * Copyright (c) 2004 University of Toronto. All rights reserved.
17 * Anyone may use or copy this software except that this copyright
18 * notice remain intact and that credit is given where it is due.
19 * The University of Toronto and the author make no warranty and
20 * accept no liability for this software.
21 *
22 * From: Header: /local/src/local.lib/SRC/ipfwpcap/RCS/ipfwpcap.c,v 1.4 2004/01/15 16:19:07 pkern Exp
23 */
24
25 #include <stdio.h>
26 #include <errno.h>
27 #include <paths.h>
28 #include <fcntl.h>
29 #include <signal.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <unistd.h>
33 #include <sys/types.h>
34 #include <sys/time.h>
35 #include <sys/param.h> /* for MAXPATHLEN */
36 #include <sys/socket.h>
37 #include <netinet/in.h>
38
39 #include <netinet/in_systm.h> /* for IP_MAXPACKET */
40 #include <netinet/ip.h> /* for IP_MAXPACKET */
41
42 #include <net/bpf.h>
43
44 /* XXX normally defined in config.h */
45 #define HAVE_STRLCPY 1
46 #define HAVE_SNPRINTF 1
47 #define HAVE_VSNPRINTF 1
48 #include <pcap-int.h> /* see pcap(3) and /usr/src/contrib/libpcap/. */
49
50 #ifdef IP_MAXPACKET
51 #define BUFMAX IP_MAXPACKET
52 #else
53 #define BUFMAX 65535
54 #endif
55
56 #ifndef MAXPATHLEN
57 #define MAXPATHLEN 1024
58 #endif
59
60 static int debug = 0;
61 static int reflect = 0; /* 1 == write packet back to socket. */
62
63 static ssize_t totbytes = 0, maxbytes = 0;
64 static ssize_t totpkts = 0, maxpkts = 0;
65
66 static char *prog = NULL;
67 static char pidfile[MAXPATHLEN];
68
69 /*
70 * tidy up.
71 */
72 static void
quit(int sig)73 quit(int sig)
74 {
75 (void) unlink(pidfile);
76 exit(sig);
77 }
78
79 /*
80 * do the "paper work"
81 * - save my own pid in /var/run/$0.{port#}.pid
82 */
83 static void
okay(int pn)84 okay(int pn)
85 {
86 int fd;
87 char *p, numbuf[80];
88
89 if (pidfile[0] == '\0') {
90 p = strrchr(prog, '/');
91 p = (p == NULL) ? prog : p + 1;
92
93 snprintf(pidfile, sizeof pidfile,
94 "%s%s.%d.pid", _PATH_VARRUN, p, pn);
95 }
96
97 fd = open(pidfile, O_WRONLY|O_CREAT|O_EXCL, 0644);
98 if (fd < 0) {
99 perror(pidfile);
100 exit(21);
101 }
102
103 siginterrupt(SIGTERM, 1);
104 siginterrupt(SIGHUP, 1);
105 signal(SIGTERM, quit);
106 signal(SIGHUP, quit);
107 signal(SIGINT, quit);
108
109 snprintf(numbuf, sizeof numbuf, "%d\n", getpid());
110 if (write(fd, numbuf, strlen(numbuf)) < 0) {
111 perror(pidfile);
112 quit(23);
113 }
114 (void) close(fd);
115 }
116
117 static void
usage(void)118 usage(void)
119 {
120 fprintf(stderr,
121 "\n"
122 "usage:\n"
123 " %s [-dr] [-b maxbytes] [-p maxpkts] [-P pidfile] portnum dumpfile\n"
124 "\n"
125 "where:\n"
126 " '-d' = enable debugging messages.\n"
127 " '-r' = reflect. write packets back to the divert socket.\n"
128 " (ie. simulate the original intent of \"ipfw tee\").\n"
129 " '-rr' = indicate that it is okay to quit if packet-count or\n"
130 " byte-count limits are reached (see the NOTE below\n"
131 " about what this implies).\n"
132 " '-b bytcnt' = stop dumping after {bytcnt} bytes.\n"
133 " '-p pktcnt' = stop dumping after {pktcnt} packets.\n"
134 " '-P pidfile' = alternate file to store the PID\n"
135 " (default: /var/run/%s.{portnum}.pid).\n"
136 "\n"
137 " portnum = divert(4) socket port number.\n"
138 " dumpfile = file to write captured packets (tcpdump format).\n"
139 " (specify '-' to write packets to stdout).\n"
140 "\n"
141 "The '-r' option should not be necessary, but because \"ipfw tee\" is broken\n"
142 "(see BUGS in ipfw(8) for details) this feature can be used along with\n"
143 "an \"ipfw divert\" rule to simulate the original intent of \"ipfw tee\".\n"
144 "\n"
145 "NOTE: With an \"ipfw divert\" rule, diverted packets will silently\n"
146 " disappear if there is nothing listening to the divert socket.\n"
147 "\n", prog, prog);
148 exit(1);
149 }
150
151 int
main(int ac,char * av[])152 main(int ac, char *av[])
153 {
154 int r, sd, portnum, l;
155 struct sockaddr_in sin;
156 int errflg = 0;
157
158 int nfd;
159 fd_set rds;
160
161 ssize_t nr;
162
163 char *dumpf, buf[BUFMAX];
164
165 pcap_t *p;
166 pcap_dumper_t *dp;
167 struct pcap_pkthdr phd;
168
169 prog = av[0];
170
171 while ((r = getopt(ac, av, "drb:p:P:")) != -1) {
172 switch (r) {
173 case 'd':
174 debug++;
175 break;
176 case 'r':
177 reflect++;
178 break;
179 case 'b':
180 maxbytes = (ssize_t) atol(optarg);
181 break;
182 case 'p':
183 maxpkts = (ssize_t) atoi(optarg);
184 break;
185 case 'P':
186 strcpy(pidfile, optarg);
187 break;
188 case '?':
189 default:
190 errflg++;
191 break;
192 }
193 }
194
195 if ((ac - optind) != 2 || errflg)
196 usage();
197
198 portnum = atoi(av[optind++]);
199 dumpf = av[optind];
200
201 if (debug) fprintf(stderr, "bind to %d.\ndump to '%s'.\n", portnum, dumpf);
202
203 if ((r = socket(PF_DIVERT, SOCK_RAW, 0)) == -1) {
204 perror("socket(DIVERT)");
205 exit(2);
206 }
207 sd = r;
208
209 sin.sin_port = htons(portnum);
210 sin.sin_family = AF_INET;
211 sin.sin_addr.s_addr = INADDR_ANY;
212
213 if (bind(sd, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
214 perror("bind(divert)");
215 exit(3);
216 }
217
218 p = pcap_open_dead(DLT_RAW, BUFMAX);
219 dp = pcap_dump_open(p, dumpf);
220 if (dp == NULL) {
221 pcap_perror(p, dumpf);
222 exit(4);
223 }
224
225 okay(portnum);
226
227 nfd = sd + 1;
228 for (;;) {
229 FD_ZERO(&rds);
230 FD_SET(sd, &rds);
231
232 r = select(nfd, &rds, NULL, NULL, NULL);
233 if (r == -1) {
234 if (errno == EINTR) continue;
235 perror("select");
236 quit(11);
237 }
238
239 if (!FD_ISSET(sd, &rds))
240 /* hmm. no work. */
241 continue;
242
243 /*
244 * use recvfrom(3 and sendto(3) as in natd(8).
245 * see /usr/src/sbin/natd/natd.c
246 * see ipfw(8) about using 'divert' and 'tee'.
247 */
248
249 /*
250 * read packet.
251 */
252 l = sizeof(sin);
253 nr = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&sin, &l);
254 if (debug) fprintf(stderr, "recvfrom(%d) = %zd (%d)\n", sd, nr, l);
255 if (nr < 0 && errno != EINTR) {
256 perror("recvfrom(sd)");
257 quit(12);
258 }
259 if (nr <= 0) continue;
260
261 if (reflect) {
262 /*
263 * write packet back so it can continue
264 * being processed by any further IPFW rules.
265 */
266 l = sizeof(sin);
267 r = sendto(sd, buf, nr, 0, (struct sockaddr *)&sin, l);
268 if (debug) fprintf(stderr, " sendto(%d) = %d\n", sd, r);
269 if (r < 0) { perror("sendto(sd)"); quit(13); }
270 }
271
272 /*
273 * check maximums, if any.
274 * but don't quit if must continue reflecting packets.
275 */
276 if (maxpkts) {
277 totpkts++;
278 if (totpkts > maxpkts) {
279 if (reflect == 1) continue;
280 quit(0);
281 }
282 }
283 if (maxbytes) {
284 totbytes += nr;
285 if (totbytes > maxbytes) {
286 if (reflect == 1) continue;
287 quit(0);
288 }
289 }
290
291 /*
292 * save packet in tcpdump(1) format. see pcap(3).
293 * divert packets are fully assembled. see ipfw(8).
294 */
295 (void) gettimeofday(&(phd.ts), NULL);
296 phd.caplen = phd.len = nr;
297 pcap_dump((u_char *)dp, &phd, buf);
298 if (ferror((FILE *)dp)) { perror(dumpf); quit(14); }
299 (void) fflush((FILE *)dp);
300 }
301
302 quit(0);
303 }
304