1/*
2 * copy diverted (or tee'd) packets to a file in 'tcpdump' format
3 * (ie. this uses the '-lpcap' routines).
4 *
5 * example usage:
6 *	# ipfwpcap -r 8091 divt.log &
7 *	# ipfw add 2864 divert 8091 ip from 128.432.53.82 to any
8 *	# ipfw add 2864 divert 8091 ip from any to 128.432.53.82
9 *
10 *   the resulting dump file can be read with ...
11 *	# tcpdump -nX -r divt.log
12 */
13/*
14 * Written by P Kern { pkern [AT] cns.utoronto.ca }
15 *
16 * Copyright (c) 2004 University of Toronto. All rights reserved.
17 * Anyone may use or copy this software except that this copyright
18 * notice remain intact and that credit is given where it is due.
19 * The University of Toronto and the author make no warranty and
20 * accept no liability for this software.
21 *
22 * From: Header: /local/src/local.lib/SRC/ipfwpcap/RCS/ipfwpcap.c,v 1.4 2004/01/15 16:19:07 pkern Exp
23 *
24 * $FreeBSD$
25 */
26
27#include <stdio.h>
28#include <errno.h>
29#include <paths.h>
30#include <fcntl.h>
31#include <signal.h>
32#include <stdlib.h>
33#include <string.h>
34#include <unistd.h>
35#include <sys/types.h>
36#include <sys/time.h>
37#include <sys/param.h>		/* for MAXPATHLEN */
38#include <sys/socket.h>
39#include <netinet/in.h>
40
41#include <netinet/in_systm.h>	/* for IP_MAXPACKET */
42#include <netinet/ip.h>		/* for IP_MAXPACKET */
43
44/* XXX normally defined in config.h */
45#define HAVE_STRLCPY 1
46#define HAVE_SNPRINTF 1
47#define HAVE_VSNPRINTF 1
48#include <pcap-int.h>	/* see pcap(3) and /usr/src/contrib/libpcap/. */
49
50#ifdef IP_MAXPACKET
51#define BUFMAX	IP_MAXPACKET
52#else
53#define BUFMAX	65535
54#endif
55
56#ifndef MAXPATHLEN
57#define MAXPATHLEN	1024
58#endif
59
60static int debug = 0;
61static int reflect = 0;		/* 1 == write packet back to socket. */
62
63static ssize_t totbytes = 0, maxbytes = 0;
64static ssize_t totpkts = 0, maxpkts = 0;
65
66static char *prog = NULL;
67static char pidfile[MAXPATHLEN];
68
69/*
70 * tidy up.
71 */
72static void
73quit(int sig)
74{
75	(void) unlink(pidfile);
76	exit(sig);
77}
78
79/*
80 * do the "paper work"
81 *	- save my own pid in /var/run/$0.{port#}.pid
82 */
83static void
84okay(int pn)
85{
86	int fd;
87	char *p, numbuf[80];
88
89	if (pidfile[0] == '\0') {
90		p = rindex(prog, '/');
91		p = (p == NULL) ? prog : p + 1;
92
93		snprintf(pidfile, sizeof pidfile,
94			"%s%s.%d.pid", _PATH_VARRUN, p, pn);
95	}
96
97	fd = open(pidfile, O_WRONLY|O_CREAT|O_EXCL, 0644);
98	if (fd < 0) {
99		perror(pidfile);
100		exit(21);
101	}
102
103	siginterrupt(SIGTERM, 1);
104	siginterrupt(SIGHUP, 1);
105	signal(SIGTERM, quit);
106	signal(SIGHUP, quit);
107	signal(SIGINT, quit);
108
109	snprintf(numbuf, sizeof numbuf, "%d\n", getpid());
110	if (write(fd, numbuf, strlen(numbuf)) < 0) {
111		perror(pidfile);
112		quit(23);
113	}
114	(void) close(fd);
115}
116
117static void
118usage(void)
119{
120	fprintf(stderr,
121"\n"
122"usage:\n"
123"    %s [-dr] [-b maxbytes] [-p maxpkts] [-P pidfile] portnum dumpfile\n"
124"\n"
125"where:\n"
126"	'-d'  = enable debugging messages.\n"
127"	'-r'  = reflect. write packets back to the divert socket.\n"
128"		(ie. simulate the original intent of \"ipfw tee\").\n"
129"	'-rr' = indicate that it is okay to quit if packet-count or\n"
130"		byte-count limits are reached (see the NOTE below\n"
131"		about what this implies).\n"
132"	'-b bytcnt'   = stop dumping after {bytcnt} bytes.\n"
133"	'-p pktcnt'   = stop dumping after {pktcnt} packets.\n"
134"	'-P pidfile'  = alternate file to store the PID\n"
135"			(default: /var/run/%s.{portnum}.pid).\n"
136"\n"
137"	portnum  = divert(4) socket port number.\n"
138"	dumpfile = file to write captured packets (tcpdump format).\n"
139"		   (specify '-' to write packets to stdout).\n"
140"\n"
141"The '-r' option should not be necessary, but because \"ipfw tee\" is broken\n"
142"(see BUGS in ipfw(8) for details) this feature can be used along with\n"
143"an \"ipfw divert\" rule to simulate the original intent of \"ipfw tee\".\n"
144"\n"
145"NOTE: With an \"ipfw divert\" rule, diverted packets will silently\n"
146"      disappear if there is nothing listening to the divert socket.\n"
147"\n", prog, prog);
148	exit(1);
149}
150
151int
152main(int ac, char *av[])
153{
154	int r, sd, portnum, l;
155        struct sockaddr_in sin;
156	int errflg = 0;
157
158	int nfd;
159	fd_set rds;
160
161	ssize_t nr;
162
163	char *dumpf, buf[BUFMAX];
164
165	pcap_t *p;
166	pcap_dumper_t *dp;
167	struct pcap_pkthdr phd;
168
169	prog = av[0];
170
171	while ((r = getopt(ac, av, "drb:p:P:")) != -1) {
172		switch (r) {
173		case 'd':
174			debug++;
175			break;
176		case 'r':
177			reflect++;
178			break;
179		case 'b':
180			maxbytes = (ssize_t) atol(optarg);
181			break;
182		case 'p':
183			maxpkts = (ssize_t) atoi(optarg);
184			break;
185		case 'P':
186			strcpy(pidfile, optarg);
187			break;
188		case '?':
189		default:
190			errflg++;
191			break;
192		}
193	}
194
195	if ((ac - optind) != 2 || errflg)
196		usage();
197
198	portnum = atoi(av[optind++]);
199	dumpf = av[optind];
200
201if (debug) fprintf(stderr, "bind to %d.\ndump to '%s'.\n", portnum, dumpf);
202
203	if ((r = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) {
204		perror("socket(DIVERT)");
205		exit(2);
206	}
207	sd = r;
208
209	sin.sin_port = htons(portnum);
210	sin.sin_family = AF_INET;
211	sin.sin_addr.s_addr = INADDR_ANY;
212
213	if (bind(sd, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
214		perror("bind(divert)");
215		exit(3);
216	}
217
218	p = pcap_open_dead(DLT_RAW, BUFMAX);
219	dp = pcap_dump_open(p, dumpf);
220	if (dp == NULL) {
221		pcap_perror(p, dumpf);
222		exit(4);
223	}
224
225	okay(portnum);
226
227	nfd = sd + 1;
228	for (;;) {
229		FD_ZERO(&rds);
230		FD_SET(sd, &rds);
231
232		r = select(nfd, &rds, NULL, NULL, NULL);
233		if (r == -1) {
234			if (errno == EINTR) continue;
235			perror("select");
236			quit(11);
237		}
238
239		if (!FD_ISSET(sd, &rds))
240			/* hmm. no work. */
241			continue;
242
243		/*
244		 * use recvfrom(3 and sendto(3) as in natd(8).
245		 * see /usr/src/sbin/natd/natd.c
246		 * see ipfw(8) about using 'divert' and 'tee'.
247		 */
248
249		/*
250		 * read packet.
251		 */
252		l = sizeof(sin);
253		nr = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&sin, &l);
254if (debug) fprintf(stderr, "recvfrom(%d) = %zd (%d)\n", sd, nr, l);
255		if (nr < 0 && errno != EINTR) {
256			perror("recvfrom(sd)");
257			quit(12);
258		}
259		if (nr <= 0) continue;
260
261		if (reflect) {
262			/*
263			 * write packet back so it can continue
264			 * being processed by any further IPFW rules.
265			 */
266			l = sizeof(sin);
267			r = sendto(sd, buf, nr, 0, (struct sockaddr *)&sin, l);
268if (debug) fprintf(stderr, "  sendto(%d) = %d\n", sd, r);
269			if (r < 0) { perror("sendto(sd)"); quit(13); }
270		}
271
272		/*
273		 * check maximums, if any.
274		 * but don't quit if must continue reflecting packets.
275		 */
276		if (maxpkts) {
277			totpkts++;
278			if (totpkts > maxpkts) {
279				if (reflect == 1) continue;
280				quit(0);
281			}
282		}
283		if (maxbytes) {
284			totbytes += nr;
285			if (totbytes > maxbytes) {
286				if (reflect == 1) continue;
287				quit(0);
288			}
289		}
290
291		/*
292		 * save packet in tcpdump(1) format. see pcap(3).
293		 * divert packets are fully assembled. see ipfw(8).
294		 */
295		(void) gettimeofday(&(phd.ts), NULL);
296		phd.caplen = phd.len = nr;
297		pcap_dump((u_char *)dp, &phd, buf);
298		if (ferror((FILE *)dp)) { perror(dumpf); quit(14); }
299		(void) fflush((FILE *)dp);
300	}
301
302	quit(0);
303}
304