The Tcpdump Group git mirrors - libpcap/blob - pcap-netfilter-linux.c

   1 /*
   2  * Copyright (c) 2011 Jakub Zawadzki
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  * notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  * notice, this list of conditions and the following disclaimer in the
  13  * documentation and/or other materials provided with the distribution.
  14  * 3. The name of the author may not be used to endorse or promote
  15  * products derived from this software without specific prior written
  16  * permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 #include "config.h"
  33 #endif
  34
  35 #include "pcap-int.h"
  36
  37 #ifdef NEED_STRERROR_H
  38 #include "strerror.h"
  39 #endif
  40
  41 #include <errno.h>
  42 #include <stdlib.h>
  43 #include <unistd.h>
  44 #include <string.h>
  45 #include <sys/socket.h>
  46 #include <arpa/inet.h>
  47
  48 #include <time.h>
  49 #include <sys/time.h>
  50 #include <netinet/in.h>
  51 #include <linux/types.h>
  52
  53 #include <linux/netlink.h>
  54 #include <linux/netfilter/nfnetlink.h>
  55 #include <linux/netfilter/nfnetlink_log.h>
  56
  57 #define HDR_LENGTH (NLMSG_LENGTH(NLMSG_ALIGN(sizeof(struct nfgenmsg))))
  58
  59 #define NFLOG_IFACE "nflog"
  60
  61 static int
  62 nflog_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
  63 {
  64         const unsigned char *buf;
  65         int count = 0;
  66         int len;
  67
  68         /* ignore interrupt system call error */
  69         do {
  70                 len = recv(handle->fd, handle->buffer, handle->bufsize, 0);
  71                 if (handle->break_loop) {
  72                         handle->break_loop = 0;
  73                         return -2;
  74                 }
  75         } while ((len == -1) && (errno == EINTR));
  76
  77         if (len < 0) {
  78                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't receive packet %d:%s", errno, pcap_strerror(errno));
  79                 return -1;
  80         }
  81
  82         buf = handle->buffer;
  83         while (len >= NLMSG_SPACE(0)) {
  84                 const struct nlmsghdr *nlh = (const struct nlmsghdr *) buf;
  85                 u_int32_t msg_len;
  86
  87                 if (nlh->nlmsg_len < sizeof(struct nlmsghdr) || len < nlh->nlmsg_len) {
  88                         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Message truncated: (got: %d) (nlmsg_len: %u)", len, nlh->nlmsg_len);
  89                         return -1;
  90                 }
  91
  92                 if (NFNL_SUBSYS_ID(nlh->nlmsg_type) == NFNL_SUBSYS_ULOG &&
  93                         NFNL_MSG_TYPE(nlh->nlmsg_type) == NFULNL_MSG_PACKET)
  94                 {
  95                         const struct nfattr *payload_attr = NULL;
  96
  97                         if (nlh->nlmsg_len < HDR_LENGTH) {
  98                                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Malformed message: (nlmsg_len: %u)", nlh->nlmsg_len);
  99                                 return -1;
 100                         }
 101
 102                         if (nlh->nlmsg_len > HDR_LENGTH) {
 103                                 struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
 104                                 int attr_len = nlh->nlmsg_len - NLMSG_ALIGN(HDR_LENGTH);
 105
 106                                 while (NFA_OK(attr, attr_len)) {
 107                                         switch (NFA_TYPE(attr)) {
 108                                                 case NFULA_PAYLOAD:
 109                                                         payload_attr = attr;
 110                                                         break;
 111                                         }
 112                                         attr = NFA_NEXT(attr, attr_len);
 113                                 }
 114                         }
 115
 116                         if (payload_attr) {
 117                                 struct pcap_pkthdr pkth;
 118
 119                                 const unsigned char *payload = NFA_DATA(payload_attr);
 120                                 int payload_len = NFA_PAYLOAD(payload_attr);
 121
 122                                 pkth.len = pkth.caplen = payload_len;
 123                                 /* pkth.caplen = min (payload_len, handle->snapshot); */
 124
 125                                 gettimeofday(&pkth.ts, NULL);
 126                                 if (handle->fcode.bf_insns == NULL ||
 127                                                 bpf_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen))
 128                                 {
 129                                         handle->md.packets_read++;
 130                                         callback(user, &pkth, payload);
 131                                         count++;
 132                                 }
 133                         }
 134                 }
 135
 136                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
 137                 if (msg_len > len)
 138                         msg_len = len;
 139
 140                 len -= msg_len;
 141                 buf += msg_len;
 142         }
 143         return count;
 144 }
 145
 146 static int
 147 netfilter_stats_linux(pcap_t *handle, struct pcap_stat *stats)
 148 {
 149         stats->ps_recv = handle->md.packets_read;
 150         stats->ps_drop = 0;
 151         stats->ps_ifdrop = 0;
 152         return 0;
 153 }
 154
 155 static int
 156 netfilter_inject_linux(pcap_t *handle, const void *buf, size_t size)
 157 {
 158         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "inject not supported on netfilter devices");
 159         return (-1);
 160 }
 161
 162 struct my_nfattr {
 163         u_int16_t nfa_len;
 164         u_int16_t nfa_type;
 165         void *data;
 166 };
 167
 168 static int
 169 nflog_send_config_msg(const pcap_t *handle, u_int8_t family, u_int16_t res_id, const struct my_nfattr *mynfa)
 170 {
 171         char buf[1024] __attribute__ ((aligned));
 172
 173         struct nlmsghdr *nlh = (struct nlmsghdr *) buf;
 174         struct nfgenmsg *nfg = (struct nfgenmsg *) (buf + sizeof(struct nlmsghdr));
 175
 176         struct sockaddr_nl snl;
 177         static unsigned int seq_id;
 178
 179         if (!seq_id)
 180                 seq_id = time(NULL);
 181         ++seq_id;
 182
 183         nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 184         nlh->nlmsg_type = (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
 185         nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
 186         nlh->nlmsg_pid = 0;     /* to kernel */
 187         nlh->nlmsg_seq = seq_id;
 188
 189         nfg->nfgen_family = family;
 190         nfg->version = NFNETLINK_V0;
 191         nfg->res_id = htons(res_id);
 192
 193         if (mynfa) {
 194                 struct nfattr *nfa = (struct nfattr *) (buf + NLMSG_ALIGN(nlh->nlmsg_len));
 195
 196                 nfa->nfa_type = mynfa->nfa_type;
 197                 nfa->nfa_len = NFA_LENGTH(mynfa->nfa_len);
 198                 memcpy(NFA_DATA(nfa), mynfa->data, mynfa->nfa_len);
 199                 nlh->nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len) + NFA_ALIGN(nfa->nfa_len);
 200         }
 201
 202         memset(&snl, 0, sizeof(snl));
 203         snl.nl_family = AF_NETLINK;
 204
 205         if (sendto(handle->fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr *) &snl, sizeof(snl)) == -1)
 206                 return -1;
 207
 208         /* waiting for reply loop */
 209         do {
 210                 socklen_t addrlen = sizeof(snl);
 211                 int len;
 212
 213                 /* ignore interrupt system call error */
 214                 do {
 215                         len = recvfrom(handle->fd, buf, sizeof(buf), 0, (struct sockaddr *) &snl, &addrlen);
 216                 } while ((len == -1) && (errno == EINTR));
 217
 218                 if (len <= 0)
 219                         return len;
 220
 221                 if (addrlen != sizeof(snl) || snl.nl_family != AF_NETLINK) {
 222                         errno = EINVAL;
 223                         return -1;
 224                 }
 225
 226                 nlh = (struct nlmsghdr *) buf;
 227                 if (snl.nl_pid != 0 || seq_id != nlh->nlmsg_seq)        /* if not from kernel or wrong sequence skip */
 228                         continue;
 229
 230                 while (len >= NLMSG_SPACE(0) && NLMSG_OK(nlh, len)) {
 231                         if (nlh->nlmsg_type == NLMSG_ERROR || (nlh->nlmsg_type == NLMSG_DONE && nlh->nlmsg_flags & NLM_F_MULTI)) {
 232                                 if (nlh->nlmsg_len < NLMSG_ALIGN(sizeof(struct nlmsgerr))) {
 233                                         errno = EBADMSG;
 234                                         return -1;
 235                                 }
 236                                 errno = -(*((int *)NLMSG_DATA(nlh)));
 237                                 return (errno == 0) ? 0 : -1;
 238                         }
 239                         nlh = NLMSG_NEXT(nlh, len);
 240                 }
 241         } while (1);
 242
 243         return -1; /* never here */
 244 }
 245
 246 static int
 247 nflog_send_config_cmd(const pcap_t *handle, u_int16_t group_id, u_int8_t cmd, u_int8_t family)
 248 {
 249         struct nfulnl_msg_config_cmd msg;
 250         struct my_nfattr nfa;
 251
 252         msg.command = cmd;
 253
 254         nfa.data = &msg;
 255         nfa.nfa_type = NFULA_CFG_CMD;
 256         nfa.nfa_len = sizeof(msg);
 257
 258         return nflog_send_config_msg(handle, family, group_id, &nfa);
 259 }
 260
 261 static int
 262 nflog_send_config_mode(const pcap_t *handle, u_int16_t group_id, u_int8_t copy_mode, u_int32_t copy_range)
 263 {
 264         struct nfulnl_msg_config_mode msg;
 265         struct my_nfattr nfa;
 266
 267         msg.copy_range = htonl(copy_range);
 268         msg.copy_mode = copy_mode;
 269
 270         nfa.data = &msg;
 271         nfa.nfa_type = NFULA_CFG_MODE;
 272         nfa.nfa_len = sizeof(msg);
 273
 274         return nflog_send_config_msg(handle, AF_UNSPEC, group_id, &nfa);
 275 }
 276
 277 static int
 278 nflog_activate(pcap_t* handle)
 279 {
 280         const char *dev = handle->opt.source;
 281         unsigned short groups[32];
 282         int group_count = 0;
 283         int i;
 284
 285         if (strncmp(dev, NFLOG_IFACE, strlen(NFLOG_IFACE)) == 0) {
 286                 dev += strlen(NFLOG_IFACE);
 287
 288                 /* nflog:30,33,42 looks nice, allow it */
 289                 if (*dev == ':')
 290                         dev++;
 291
 292                 while (*dev) {
 293                         long int group_id;
 294                         char *end_dev;
 295
 296                         if (group_count == 32) {
 297                                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 298                                                 "Maximum 32 netfilter groups! dev: %s",
 299                                                 handle->opt.source);
 300                                 return PCAP_ERROR;
 301                         }
 302
 303                         group_id = strtol(dev, &end_dev, 0);
 304                         if (end_dev != dev) {
 305                                 if (group_id < 0 || group_id > 65535) {
 306                                         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 307                                                         "Netfilter group range from 0 to 65535 (got %ld)",
 308                                                         group_id);
 309                                         return PCAP_ERROR;
 310                                 }
 311
 312                                 groups[group_count++] = (unsigned short) group_id;
 313                                 dev = end_dev;
 314                         }
 315                         if (*dev != ',')
 316                                 break;
 317                         dev++;
 318                 }
 319         }
 320
 321         if (*dev) {
 322                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 323                                 "Can't get netfilter group(s) index from %s",
 324                                 handle->opt.source);
 325                 return PCAP_ERROR;
 326         }
 327
 328         /* if no groups, add default: 0 */
 329         if (!group_count) {
 330                 groups[0] = 0;
 331                 group_count = 1;
 332         }
 333
 334         /* Initialize some components of the pcap structure. */
 335         handle->bufsize = 128 + handle->snapshot;
 336         handle->offset = 0;
 337         handle->linktype = DLT_IPV4;
 338         handle->read_op = nflog_read_linux;
 339         handle->inject_op = netfilter_inject_linux;
 340         handle->setfilter_op = install_bpf_program; /* no kernel filtering */
 341         handle->setdirection_op = NULL;
 342         handle->set_datalink_op = NULL;
 343         handle->getnonblock_op = pcap_getnonblock_fd;
 344         handle->setnonblock_op = pcap_setnonblock_fd;
 345         handle->stats_op = netfilter_stats_linux;
 346
 347         /* Create netlink socket */
 348         handle->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
 349         if (handle->fd < 0) {
 350                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't create raw socket %d:%s", errno, pcap_strerror(errno));
 351                 return PCAP_ERROR;
 352         }
 353
 354         handle->buffer = malloc(handle->bufsize);
 355         if (!handle->buffer) {
 356                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate dump buffer: %s", pcap_strerror(errno));
 357                 goto close_fail;
 358         }
 359
 360         if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_UNBIND, AF_INET) < 0) {
 361                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_UNBIND: %s", pcap_strerror(errno));
 362                 goto close_fail;
 363         }
 364
 365         if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_BIND, AF_INET) < 0) {
 366                 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_BIND: %s", pcap_strerror(errno));
 367                 goto close_fail;
 368         }
 369
 370         /* Bind socket to the nflog groups */
 371         for (i = 0; i < group_count; i++) {
 372                 if (nflog_send_config_cmd(handle, groups[i], NFULNL_CFG_CMD_BIND, AF_UNSPEC) < 0) {
 373                         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't listen on group group index: %s", pcap_strerror(errno));
 374                         goto close_fail;
 375                 }
 376
 377                 if (nflog_send_config_mode(handle, groups[i], NFULNL_COPY_PACKET, handle->snapshot) < 0) {
 378                         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_COPY_PACKET: %s", pcap_strerror(errno));
 379                         goto close_fail;
 380                 }
 381         }
 382
 383         if (handle->opt.rfmon) {
 384                 /*
 385                  * Monitor mode doesn't apply to netfilter devices.
 386                  */
 387                 pcap_cleanup_live_common(handle);
 388                 return PCAP_ERROR_RFMON_NOTSUP;
 389         }
 390
 391         if (handle->opt.buffer_size != 0) {
 392                 /*
 393                  * Set the socket buffer size to the specified value.
 394                  */
 395                 if (setsockopt(handle->fd, SOL_SOCKET, SO_RCVBUF, &handle->opt.buffer_size, sizeof(handle->opt.buffer_size)) == -1) {
 396                         snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "SO_RCVBUF: %s", pcap_strerror(errno));
 397                         goto close_fail;
 398                 }
 399         }
 400
 401         handle->selectable_fd = handle->fd;
 402         return 0;
 403
 404 close_fail:
 405         pcap_cleanup_live_common(handle);
 406         return PCAP_ERROR;
 407 }
 408
 409 pcap_t *
 410 nflog_create(const char *device, char *ebuf)
 411 {
 412         pcap_t *p;
 413
 414         p = pcap_create_common(device, ebuf);
 415         if (p == NULL)
 416                 return (NULL);
 417
 418         p->activate_op = nflog_activate;
 419         return (p);
 420 }
 421
 422 int
 423 netfilter_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
 424 {
 425         pcap_if_t *found_dev = *alldevsp;
 426         int sock;
 427
 428         sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
 429         if (sock < 0) {
 430                 /* if netlink is not supported this this is not fatal */
 431                 if (errno == EAFNOSUPPORT)
 432                         return 0;
 433                 snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't open netlink socket %d:%s",
 434                         errno, pcap_strerror(errno));
 435                 return -1;
 436         }
 437         close(sock);
 438
 439         if (pcap_add_if(&found_dev, NFLOG_IFACE, 0, "Linux netfilter log (NFLOG) interface", err_str) < 0)
 440                 return -1;
 441         return 0;
 442 }
 443