Beispiel #1
0
void hostmon(time_t facilitytime, char *ifptr)
{
	int logging = options.logging;
	struct ethtab table;
	struct ethtabent *entry;

	char scratch_saddr[ETH_ALEN];
	char scratch_daddr[ETH_ALEN];
	unsigned int idx = 1;
	int is_ip;
	int ch;

	char *ifname = ifptr;

	struct timeval tv;
	struct timeval tv_rate;
	time_t now = 0;
	time_t statbegin = 0;
	time_t startlog = 0;
	struct timeval updtime;

	struct eth_desc *list = NULL;

	FILE *logfile = NULL;

	int pkt_result;

	WINDOW *sortwin;
	PANEL *sortpanel;
	int keymode = 0;

	int fd;

	if (ifptr && !dev_up(ifptr)) {
		err_iface_down();
		return;
	}

	LIST_HEAD(promisc);
	if (options.promisc) {
		promisc_init(&promisc, ifptr);
		promisc_set_list(&promisc);
	}

	hostmonhelp();

	initethtab(&table);

	/* Ethernet description list */
	struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER);

	/* FDDI description list */
	struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI);

	if (logging) {
		if (strcmp(current_logfile, "") == 0) {
			strncpy(current_logfile,
				gen_instance_logname(LANLOG, getpid()), 80);

			if (!daemonized)
				input_logfile(current_logfile, &logging);
		}
	}

	if (logging) {
		opentlog(&logfile, current_logfile);

		if (logfile == NULL)
			logging = 0;
	}
	if (logging) {
		signal(SIGUSR1, rotate_lanlog);

		rotate_flag = 0;
		writelog(logging, logfile,
			 "******** LAN traffic monitor started ********");
	}

	leaveok(table.tabwin, TRUE);

	fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
	if(fd == -1) {
		write_error("Unable to obtain monitoring socket");
		goto err;
	}
	if(ifptr && dev_bind_ifname(fd, ifptr) == -1) {
		write_error("Unable to bind interface on the socket");
		goto err_close;
	}

	exitloop = 0;
	gettimeofday(&tv, NULL);
	tv_rate = tv;
	updtime = tv;
	statbegin = startlog = tv.tv_sec;

	PACKET_INIT(pkt);

	do {
		gettimeofday(&tv, NULL);
		now = tv.tv_sec;

		unsigned long msecs = timeval_diff_msec(&tv, &tv_rate);
		if (msecs >= 1000) {
			printelapsedtime(statbegin, now, LINES - 3, 15,
					 table.borderwin);
			updateethrates(&table, msecs, idx);
			tv_rate = tv;
		}
		if (logging) {
			check_rotate_flag(&logfile);
			if ((now - startlog) >= options.logspan) {
				writeethlog(table.head, now - statbegin,
					    logfile);
				startlog = now;
			}
		}
		if (screen_update_needed(&tv, &updtime)) {
			update_panels();
			doupdate();

			updtime = tv;
		}

		if ((facilitytime != 0)
		    && (((now - statbegin) / 60) >= facilitytime))
			exitloop = 1;

		if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) {
			write_error("Packet receive failed");
			exitloop = 1;
			break;
		}

		if (ch != ERR) {
			if (keymode == 0) {
				switch (ch) {
				case KEY_UP:
					scrollethwin(&table, SCROLLDOWN, &idx);
					break;
				case KEY_DOWN:
					scrollethwin(&table, SCROLLUP, &idx);
					break;
				case KEY_PPAGE:
				case '-':
					pageethwin(&table, SCROLLDOWN, &idx);
					break;
				case KEY_NPAGE:
				case ' ':
					pageethwin(&table, SCROLLUP, &idx);
					break;
				case 12:
				case 'l':
				case 'L':
					tx_refresh_screen();
					break;
				case 's':
				case 'S':
					show_hostsort_keywin(&sortwin,
							     &sortpanel);
					keymode = 1;
					break;
				case 'q':
				case 'Q':
				case 'x':
				case 'X':
				case 27:
				case 24:
					exitloop = 1;
				}
			} else if (keymode == 1) {
				del_panel(sortpanel);
				delwin(sortwin);
				sort_hosttab(&table, &idx, ch);
				keymode = 0;
			}
		}

		if (pkt.pkt_len <= 0)
			continue;

		char ifnamebuf[IFNAMSIZ];

		pkt_result =
			packet_process(&pkt, NULL, NULL, NULL,
				       MATCH_OPPOSITE_USECONFIG,
				       0);

		if (pkt_result != PACKET_OK)
			continue;

		if (!ifptr) {
			/* we're capturing on "All interfaces", */
			/* so get the name of the interface */
			/* of this packet */
			int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf);
			if (r != 0) {
				write_error("Unable to get interface name");
				break;	/* can't get interface name, get out! */
			}
			ifname = ifnamebuf;
		}

		/* get HW addresses */
		switch (pkt.pkt_hatype) {
		case ARPHRD_ETHER: {
			memcpy(scratch_saddr, pkt.ethhdr->h_source, ETH_ALEN);
			memcpy(scratch_daddr, pkt.ethhdr->h_dest, ETH_ALEN);
			list = elist;
			break; }
		case ARPHRD_FDDI: {
			memcpy(scratch_saddr, pkt.fddihdr->saddr, FDDI_K_ALEN);
			memcpy(scratch_daddr, pkt.fddihdr->daddr, FDDI_K_ALEN);
			list = flist;
			break; }
		default:
			/* unknown link protocol */
			continue;
		}

		switch(pkt.pkt_protocol) {
		case ETH_P_IP:
		case ETH_P_IPV6:
			is_ip = 1;
			break;
		default:
			is_ip = 0;
			break;
		}

		/* Check source address entry */
		entry = in_ethtable(&table, pkt.pkt_hatype,
				    scratch_saddr);

		if (!entry)
			entry = addethentry(&table, pkt.pkt_hatype,
					    ifname, scratch_saddr, list);

		if (entry != NULL) {
			updateethent(entry, pkt.pkt_len, is_ip, 1);
			if (!entry->prev_entry->un.desc.printed)
				printethent(&table, entry->prev_entry,
					    idx);

			printethent(&table, entry, idx);
		}

		/* Check destination address entry */
		entry = in_ethtable(&table, pkt.pkt_hatype,
				    scratch_daddr);
		if (!entry)
			entry = addethentry(&table, pkt.pkt_hatype,
					    ifname, scratch_daddr, list);

		if (entry != NULL) {
			updateethent(entry, pkt.pkt_len, is_ip, 0);
			if (!entry->prev_entry->un.desc.printed)
				printethent(&table, entry->prev_entry,
					    idx);

			printethent(&table, entry, idx);
		}
	} while (!exitloop);

err_close:
	close(fd);

err:
	if (options.promisc) {
		promisc_restore_list(&promisc);
		promisc_destroy(&promisc);
	}

	if (logging) {
		signal(SIGUSR1, SIG_DFL);
		writeethlog(table.head, time(NULL) - statbegin, logfile);
		writelog(logging, logfile,
			 "******** LAN traffic monitor stopped ********");
		fclose(logfile);
	}


	del_panel(table.tabpanel);
	delwin(table.tabwin);
	del_panel(table.borderpanel);
	delwin(table.borderwin);
	update_panels();
	doupdate();
	destroyethtab(&table);

	free_eth_desc(elist);
	free_eth_desc(flist);

	strcpy(current_logfile, "");
}
Beispiel #2
0
void hostmon(const struct OPTIONS *options, time_t facilitytime, char *ifptr,
	     struct filterstate *ofilter)
{
	int logging = options->logging;
	struct ethtab table;
	struct ethtabent *entry;

	char scratch_saddr[ETH_ALEN];
	char scratch_daddr[ETH_ALEN];
	unsigned int idx = 1;
	int is_ip;
	int ch;

	char *ifname = ifptr;

	struct timeval tv;
	time_t starttime;
	time_t now = 0;
	unsigned long long unow = 0;
	time_t statbegin = 0;
	time_t startlog = 0;
	time_t updtime = 0;
	unsigned long long updtime_usec = 0;

	struct eth_desc *list = NULL;

	FILE *logfile = NULL;

	int pkt_result;

	WINDOW *sortwin;
	PANEL *sortpanel;
	int keymode = 0;

	int instance_id;

	int fd;

	struct promisc_states *promisc_list;

	if (!facility_active(LANMONIDFILE, ifptr))
		mark_facility(LANMONIDFILE, "LAN monitor", ifptr);
	else {
		write_error("LAN station monitor already running on %s",
			 gen_iface_msg(ifptr));
		return;
	}

	if (ifptr != NULL) {
		if (!dev_up(ifptr)) {
			err_iface_down();
			unmark_facility(LANMONIDFILE, ifptr);
			return;
		}
	}

	if ((first_active_facility()) && (options->promisc)) {
		init_promisc_list(&promisc_list);
		save_promisc_list(promisc_list);
		srpromisc(1, promisc_list);
		destroy_promisc_list(&promisc_list);
	}

	adjust_instance_count(PROCCOUNTFILE, 1);
	instance_id = adjust_instance_count(LANMONCOUNTFILE, 1);

	hostmonhelp();

	initethtab(&table, options->actmode);

	/* Ethernet description list */
	struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER);

	/* FDDI description list */
	struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI);

	if (logging) {
		if (strcmp(current_logfile, "") == 0) {
			strncpy(current_logfile,
				gen_instance_logname(LANLOG, instance_id), 80);

			if (!daemonized)
				input_logfile(current_logfile, &logging);
		}
	}

	if (logging) {
		opentlog(&logfile, current_logfile);

		if (logfile == NULL)
			logging = 0;
	}
	if (logging) {
		signal(SIGUSR1, rotate_lanlog);

		rotate_flag = 0;
		writelog(logging, logfile,
			 "******** LAN traffic monitor started ********");
	}

	leaveok(table.tabwin, TRUE);

	fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
	if(fd == -1) {
		write_error("Unable to obtain monitoring socket");
		goto err;
	}
	if(ifptr && dev_bind_ifname(fd, ifptr) == -1) {
		write_error("Unable to bind interface on the socket");
		goto err_close;
	}

	exitloop = 0;
	gettimeofday(&tv, NULL);
	starttime = statbegin = startlog = tv.tv_sec;

	PACKET_INIT(pkt);

	do {
		gettimeofday(&tv, NULL);
		now = tv.tv_sec;
		unow = tv.tv_sec * 1000000ULL + tv.tv_usec;

		if ((now - starttime) >= 5) {
			printelapsedtime(statbegin, now, LINES - 3, 15,
					 table.borderwin);
			updateethrates(&table, options->actmode, starttime, now,
				       idx);
			starttime = now;
		}
		if (logging) {
			check_rotate_flag(&logfile);
			if ((now - startlog) >= options->logspan) {
				writeethlog(table.head, options->actmode,
					    now - statbegin, logfile);
				startlog = now;
			}
		}
		if (((options->updrate != 0)
		     && (now - updtime >= options->updrate))
		    || ((options->updrate == 0)
			&& (unow - updtime_usec >= DEFAULT_UPDATE_DELAY))) {
			update_panels();
			doupdate();
			updtime = now;
			updtime_usec = unow;
		}

		if ((facilitytime != 0)
		    && (((now - statbegin) / 60) >= facilitytime))
			exitloop = 1;

		if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) {
			write_error("Packet receive failed");
			exitloop = 1;
			break;
		}

		if (ch != ERR) {
			if (keymode == 0) {
				switch (ch) {
				case KEY_UP:
					scrollethwin(&table, SCROLLDOWN, &idx);
					break;
				case KEY_DOWN:
					scrollethwin(&table, SCROLLUP, &idx);
					break;
				case KEY_PPAGE:
				case '-':
					pageethwin(&table, SCROLLDOWN, &idx);
					break;
				case KEY_NPAGE:
				case ' ':
					pageethwin(&table, SCROLLUP, &idx);
					break;
				case 12:
				case 'l':
				case 'L':
					tx_refresh_screen();
					break;
				case 's':
				case 'S':
					show_hostsort_keywin(&sortwin,
							     &sortpanel);
					keymode = 1;
					break;
				case 'q':
				case 'Q':
				case 'x':
				case 'X':
				case 27:
				case 24:
					exitloop = 1;
				}
			} else if (keymode == 1) {
				del_panel(sortpanel);
				delwin(sortwin);
				sort_hosttab(&table, &idx, ch);
				keymode = 0;
			}
		}
		if (pkt.pkt_len > 0) {
			char ifnamebuf[IFNAMSIZ];

			pkt_result =
			    packet_process(&pkt, NULL, NULL, NULL,
					  ofilter,
					  MATCH_OPPOSITE_USECONFIG,
					  0);

			if (pkt_result != PACKET_OK)
				continue;

			if (!ifptr) {
				/* we're capturing on "All interfaces", */
				/* so get the name of the interface */
				/* of this packet */
				int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf);
				if (r != 0) {
					write_error("Unable to get interface name");
					break;	/* can't get interface name, get out! */
				}
				ifname = ifnamebuf;
			}

			/* get HW addresses */
			switch (pkt.pkt_hatype) {
			case ARPHRD_ETHER: {
				struct ethhdr *hdr_eth =
					(struct ethhdr *)pkt.pkt_buf;
				memcpy(scratch_saddr, hdr_eth->h_source,
				       ETH_ALEN);
				memcpy(scratch_daddr, hdr_eth->h_dest,
				       ETH_ALEN);
				list = elist;
				break; }
			case ARPHRD_FDDI: {
				struct fddihdr *hdr_fddi =
					(struct fddihdr *)pkt.pkt_buf;
				memcpy(scratch_saddr, hdr_fddi->saddr,
				       FDDI_K_ALEN);
				memcpy(scratch_daddr, hdr_fddi->daddr,
				       FDDI_K_ALEN);
				list = flist;
				break; }
			case ARPHRD_IEEE802:
			case ARPHRD_IEEE802_TR: {
				struct trh_hdr *hdr_trh =
					(struct trh_hdr *)pkt.pkt_buf;
				memcpy(scratch_saddr, hdr_trh->saddr,
				       TR_ALEN);
				memcpy(scratch_daddr, hdr_trh->daddr,
				       TR_ALEN);
				list = flist;
				break; }
			default:
				/* unknown link protocol */
				continue;
			}

			switch(pkt.pkt_protocol) {
			case ETH_P_IP:
			case ETH_P_IPV6:
				is_ip = 1;
				break;
			default:
				is_ip = 0;
				break;
			}

			/* Check source address entry */
			entry = in_ethtable(&table, pkt.pkt_hatype,
					scratch_saddr);

			if (!entry)
				entry = addethentry(&table, pkt.pkt_hatype,
						ifname, scratch_saddr, list);

			if (entry != NULL) {
				updateethent(entry, pkt.pkt_len, is_ip, 1);
				if (!entry->prev_entry->un.desc.printed)
					printethent(&table, entry->prev_entry,
						    idx);

				printethent(&table, entry, idx);
			}

			/* Check destination address entry */
			entry = in_ethtable(&table, pkt.pkt_hatype,
					scratch_daddr);
			if (!entry)
				entry = addethentry(&table, pkt.pkt_hatype,
						ifname, scratch_daddr, list);

			if (entry != NULL) {
				updateethent(entry, pkt.pkt_len, is_ip, 0);
				if (!entry->prev_entry->un.desc.printed)
					printethent(&table, entry->prev_entry,
						    idx);

				printethent(&table, entry, idx);
			}
		}
	} while (!exitloop);

err_close:
	close(fd);

err:
	if ((options->promisc) && (is_last_instance())) {
		load_promisc_list(&promisc_list);
		srpromisc(0, promisc_list);
		destroy_promisc_list(&promisc_list);
	}

	adjust_instance_count(PROCCOUNTFILE, -1);
	adjust_instance_count(LANMONCOUNTFILE, -1);

	if (logging) {
		signal(SIGUSR1, SIG_DFL);
		writeethlog(table.head, options->actmode,
			    time(NULL) - statbegin, logfile);
		writelog(logging, logfile,
			 "******** LAN traffic monitor stopped ********");
		fclose(logfile);
	}


	del_panel(table.tabpanel);
	delwin(table.tabwin);
	del_panel(table.borderpanel);
	delwin(table.borderwin);
	update_panels();
	doupdate();
	destroyethtab(&table);

	free_eth_desc(elist);
	free_eth_desc(flist);

	unmark_facility(LANMONIDFILE, ifptr);
	strcpy(current_logfile, "");
}