[pve-firewall.git] / src / pvefw-logger.c

/*

  Copyright (C) 2014 Proxmox Server Solutions GmbH

  This software is written by Proxmox Server Solutions GmbH <support@proxmox.com>

  This program is free software: you can redistribute it and/or modify
  it under the terms of the GNU Affero General Public License as published by
  the Free Software Foundation, either version 3 of the License, or
  (at your option) any later version.

  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU Affero General Public License for more details.

  You should have received a copy of the GNU Affero General Public License
  along with this program.  If not, see <http://www.gnu.org/licenses/>.

  Author: Dietmar Maurer <dietmar@proxmox.com>

*/

#define _GNU_SOURCE

#include <stdlib.h>
#include <stdio.h>
#include <errno.h>
#include <stdarg.h>
#include <string.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <sys/file.h>
#include <linux/netlink.h>
#include <libnfnetlink/libnfnetlink.h>
#include <libnetfilter_log/libnetfilter_log.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/udp.h>
#include <netinet/tcp.h>
#include <netinet/if_ether.h>
#include <syslog.h>

#include <glib.h>
#include <glib-unix.h>

static struct nflog_handle *logh = NULL;
static struct nlif_handle *nlifh = NULL;
GMainLoop *main_loop;

/*

LOG FORMAT:

Special care was taken to allow fast parsing (and filer messages for a singl VM).

<VMID> <LOGLEVEL> <CHAIN> <TIME> <TIMEZONE> <MSG>

Example:

117 6 tap117i0-IN 14/Mar/2014:12:47:07 +0100 policy REJECT: IN=vmbr1 ...

*/

#define LOGFILE "/var/log/pve-firewall.log"

#define LOCKFILE "/var/lock/pvefw-logger.lck"
#define PIDFILE "/var/run/pvefw-logger.pid"

#define LQ_LEN 512
#define LE_MAX (512 - 16) // try to fit into 512 bytes

#define MAX_CHAIN_LEN 28

struct log_entry {
    guint32 len; // max LE_MAX chars
    char buf[LE_MAX];
};

int outfd = -1;

gboolean terminate_threads = FALSE;

static gboolean write_pidfile(pid_t pid)
{
    gboolean res;

    char *strpid = g_strdup_printf("%d\n", pid);
    res = g_file_set_contents(PIDFILE, strpid, strlen(strpid), NULL);
    g_free(strpid);

    return res;
}

static GAsyncQueue *queue;

ssize_t
safe_write(int fd, char *buf, size_t count)
{
  ssize_t n;

  do {
    n = write(fd, buf, count);
  } while (n < 0 && errno == EINTR);

  return n;
}

static gpointer
log_writer_thread(gpointer data)
{
    while (1) {
        struct log_entry *le = (struct log_entry *)g_async_queue_timeout_pop(queue, 250000);
        if (le == NULL) {
            if (terminate_threads) {
                return NULL;
            }
            continue;
        }

        int res = safe_write(outfd, le->buf, le->len);

        g_free(le);

        if (res < 0) {
            syslog(3, "writing log failed, stopping daemon - %s", strerror (errno));
            g_main_loop_quit(main_loop);
            return NULL;
        }
    }

    return NULL;
}

static int skipped_logs = 0;

static void log_status_message(guint loglevel, const char *fmt, ...);

static void
queue_log_entry(struct log_entry *le)
{
    gint len = g_async_queue_length(queue);

    if (skipped_logs > 0) {
        if (len >= (LQ_LEN - 1)) {
            skipped_logs++;
        } else {
            int skip_tmp = skipped_logs;
            skipped_logs = 0; // clear before calling log_status_message()
            log_status_message(3, "skipped %d log entries (queue full)", skip_tmp);
            g_async_queue_push(queue, le);
        }
    } else {
        if (len >= LQ_LEN) {
            skipped_logs++;
        } else {
            g_async_queue_push(queue, le);
        }
    }
}


#define LEPRINTF(format, ...) { if (le->len < LE_MAX) le->len += snprintf(le->buf + le->len, LE_MAX - le->len, format, ##__VA_ARGS__); }
#define LEPRINTTIME(sec) { time_t tmp_sec = sec; if (le->len < (LE_MAX - 30)) le->len += strftime(le->buf + le->len, LE_MAX - le->len, "%d/%b/%Y:%H:%M:%S %z ", localtime(&tmp_sec)); }

static void
log_status_message(guint loglevel, const char *fmt, ...)
{
    va_list ap;
    va_start(ap, fmt);

    if (loglevel > 7 ) loglevel = 7; // syslog defines level 0-7

    struct log_entry *le = g_new0(struct log_entry, 1);

    LEPRINTF("0 %d - ", loglevel);

    LEPRINTTIME(time(NULL));

    le->len += vsnprintf(le->buf + le->len, LE_MAX - le->len, fmt, ap);

    LEPRINTF("\n");

    queue_log_entry(le);

    // also log to syslog

    vsyslog(loglevel, fmt, ap);
}

static int
print_tcp(struct log_entry *le, struct tcphdr *h, int payload_len)
{
    LEPRINTF("PROTO=TCP ");

    if (payload_len < sizeof(struct tcphdr)) {
        LEPRINTF("LEN=%d ", payload_len);
        LEPRINTF("INVALID=LEN ");
        return -1;
    }

    LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
    LEPRINTF("SEQ=%u ACK=%u ", ntohl(h->seq), ntohl(h->ack_seq));
    LEPRINTF("WINDOW=%u ", ntohs(h->window));

    if (h->urg) LEPRINTF("URG ");
    if (h->ack) LEPRINTF("ACK ");
    if (h->psh) LEPRINTF("PSH ");
    if (h->rst) LEPRINTF("RST ");
    if (h->syn) LEPRINTF("SYN ");
    if (h->fin) LEPRINTF("FIN ");

    if (h->urg) LEPRINTF("URGP=%u ",ntohs(h->urg_ptr));

    return 0;
}

static int
print_udp(struct log_entry *le, struct udphdr *h, int payload_len)
{
    LEPRINTF("PROTO=UDP ");

    if (payload_len < sizeof(struct udphdr)) {
        LEPRINTF("LEN=%d ", payload_len);
        LEPRINTF("INVALID=LEN ");
        return -1;
    }

    LEPRINTF("SPT=%u DPT=%u LEN=%u", ntohs(h->source), ntohs(h->dest), ntohs(h->len));

    return 0;
}

static int
print_icmp(struct log_entry *le, struct icmphdr *h, int payload_len)
{
    char tmp[INET_ADDRSTRLEN];
    u_int32_t gateway;

    LEPRINTF("PROTO=ICMP ");

    if (payload_len < sizeof(struct icmphdr)) {
        LEPRINTF("LEN=%d ", payload_len);
        LEPRINTF("INVALID=LEN ");
        return -1;
    }

    LEPRINTF("TYPE=%u CODE=%u ", h->type, h->code);

    switch (h->type) {
    case ICMP_ECHO:
    case ICMP_ECHOREPLY:
        LEPRINTF("ID=%u SEQ=%u ", ntohs(h->un.echo.id), ntohs(h->un.echo.sequence));
        break;
    case ICMP_PARAMETERPROB:
        LEPRINTF("PARAMETER=%u ", ntohl(h->un.gateway) >> 24);
        break;
    case ICMP_REDIRECT:
        gateway = ntohl(h->un.gateway);
        inet_ntop(AF_INET, &gateway, tmp, sizeof(tmp));
        LEPRINTF("GATEWAY=%s ", tmp);
        break;
    case ICMP_DEST_UNREACH:
        if (h->code == ICMP_FRAG_NEEDED) {
            LEPRINTF("MTU=%u ", ntohs(h->un.frag.mtu));
        }
        break;
    }

    return 0;
}

/* Section 3.1.  SCTP Common Header Format */
typedef struct sctphdr {
	__be16 source;
	__be16 dest;
	__be32 vtag;
	__be32 checksum;
} __attribute__((packed)) sctp_sctphdr_t;

static int
print_sctp(struct log_entry *le, struct sctphdr *h, int payload_len)
{
    LEPRINTF("PROTO=SCTP ");

    if (payload_len < sizeof(struct sctphdr)) {
        LEPRINTF("LEN=%d ", payload_len);
        LEPRINTF("INVALID=LEN ");
        return -1;
    }

    LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));

    return 0;
}

static int
print_iphdr(struct log_entry *le, char * payload, int payload_len)
{
    if (payload_len < sizeof(struct iphdr)) {
       LEPRINTF("LEN=%d ", payload_len);
       LEPRINTF("INVALID=LEN ");
       return -1;
    }

    struct iphdr *h = (struct iphdr *)payload;

    if (payload_len <= (u_int32_t)(h->ihl * 4)) {
        LEPRINTF("INVALID=IHL ");
        return -1;
    }

    char tmp[INET_ADDRSTRLEN];

    inet_ntop(AF_INET, &h->saddr, tmp, sizeof(tmp));
    LEPRINTF("SRC=%s ", tmp);
    inet_ntop(AF_INET, &h->daddr, tmp, sizeof(tmp));
    LEPRINTF("DST=%s ", tmp);

    LEPRINTF("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
             ntohs(h->tot_len),  h->tos & IPTOS_TOS_MASK,
             h->tos & IPTOS_PREC_MASK, h->ttl, ntohs(h->id));

    short ip_off = ntohs(h->frag_off);
    if (ip_off & IP_OFFMASK)
        LEPRINTF("FRAG=%u ", ip_off & IP_OFFMASK);

    if (ip_off & IP_DF) LEPRINTF("DF ");
    if (ip_off & IP_MF) LEPRINTF("MF ");

    void *nexthdr = (u_int32_t *)h + h->ihl;
    payload_len -= h->ihl * 4;

    switch (h->protocol) {
    case IPPROTO_TCP:
        print_tcp(le, (struct tcphdr *)nexthdr, payload_len);
        break;
    case IPPROTO_UDP:
        print_udp(le, (struct udphdr *)nexthdr, payload_len);
        break;
    case IPPROTO_ICMP:
        print_icmp(le, (struct icmphdr *)nexthdr, payload_len);
        break;
    case IPPROTO_SCTP:
        print_sctp(le, (struct sctphdr *)nexthdr, payload_len);
        break;
    case IPPROTO_AH:
        LEPRINTF("PROTO=AH ");
        break;
    case IPPROTO_ESP:
        LEPRINTF("PROTO=ESP ");
        break;
    case IPPROTO_IGMP:
        LEPRINTF("PROTO=IGMP ");
        break;
     default:
        LEPRINTF("PROTO=%u ", h->protocol);
    }

    return 0;
}

static int
print_ip6hdr(struct log_entry *le, char * payload, int payload_len)
{
    LEPRINTF("IPV6 logging not implemented ");

    return 0;
}

// ebtables -I FORWARD --nflog --nflog-group 0
static int
print_arp(struct log_entry *le, struct ether_arp *h, int payload_len)
{
    if (payload_len < sizeof(struct ether_arp)) {
        LEPRINTF("LEN=%d ", payload_len);
        LEPRINTF("INVALID=LEN ");
        return -1;
    }

    LEPRINTF("SRC=%u.%u.%u.%u ", h->arp_spa[0], h->arp_spa[1],
             h->arp_spa[2], h->arp_spa[3]);

    LEPRINTF("DST=%u.%u.%u.%u ", h->arp_tpa[0], h->arp_tpa[1],
             h->arp_tpa[2], h->arp_tpa[3]);

    LEPRINTF("PROTO=ARP ");

    unsigned short code = ntohs(h->arp_op);
    switch (code) {
    case ARPOP_REQUEST:
        LEPRINTF("REQUEST ");
        break;
    case ARPOP_REPLY:
        LEPRINTF("REPLY MAC=%02x:%02x:%02x:%02x:%02x:%02x ",
                 h->arp_sha[0], h->arp_sha[1], h->arp_sha[2],
                 h->arp_sha[3], h->arp_sha[4], h->arp_sha[5]);
        break;
    case ARPOP_NAK:
        LEPRINTF("NAK ");
        break;
    default:
        LEPRINTF("CODE=%u ", code);
    }


    // LEPRINTF("HTYPE=%u ", ntohs(h->arp_hrd));

    // LEPRINTF("PTYPE=%u ", ntohs(h->arp_pro));

    return 0;
}


static int print_pkt(struct log_entry *le, struct nflog_data *ldata, u_int8_t family)
{
    u_int32_t mark = nflog_get_nfmark(ldata);
    u_int32_t indev = nflog_get_indev(ldata);
    u_int32_t outdev = nflog_get_outdev(ldata);
    u_int32_t physindev = nflog_get_physindev(ldata);
    u_int32_t physoutdev = nflog_get_physoutdev(ldata);

    char *prefix = nflog_get_prefix(ldata);
    char *payload;
    char devname[256];

    guint32 vmid = 0;

    guint8 log_level = 6; // info

    char *chain_name = "-";

    if (prefix != NULL) {
        // Note: parse ":$vmid:$loglevel:$chain: $msg"
        if (prefix[0] == ':') {
            char *p = prefix + 1;
            guint32 tmpid = 0;
            while(*p  >= '0' && *p <= '9') { tmpid *= 10; tmpid += *p - '0'; p++; }

            if ((*p == ':') &&
                (p[1] >= '0' && p[1] <= '7') &&
                (p[2] == ':')) {

                guint8 tmp_level = p[1] - '0'; // store for later use
                char *chain_start = p + 3; // store for later use
                p = chain_start;
                while (*p && *p != ':' && *p != ' ') p++;
                int len = p - chain_start;

                if (*p == ':' && p[1] == ' ' && len && (len <= MAX_CHAIN_LEN)) {
                    // parsing successful

                    *p = 0; // terminate string

                    vmid = tmpid;
                    log_level = tmp_level;
                    chain_name = chain_start;
                    prefix = p + 2; // the rest
                }
            }
        }
    }

    LEPRINTF("%d ", vmid);

    LEPRINTF("%d ", log_level);

    LEPRINTF("%s ", chain_name);

    struct timeval ts;
    nflog_get_timestamp(ldata, &ts);

    LEPRINTTIME(ts.tv_sec);

    if (prefix != NULL) {
        LEPRINTF("%s", prefix);
    }

    if (indev > 0) {
        if (nlif_index2name(nlifh, indev, devname) != -1) {
            LEPRINTF("IN=%s ", devname);
        } else {
            LEPRINTF("IN=%u ", indev);
        }
    }

    if (outdev > 0) {
        if (nlif_index2name(nlifh, outdev, devname) != -1) {
            LEPRINTF("OUT=%s ", devname);
        } else {
            LEPRINTF("OUT=%u ", outdev);
        }
    }

    if (physindev > 0) {
        if (nlif_index2name(nlifh, physindev, devname) != -1) {
            LEPRINTF("PHYSIN=%s ", devname);
        } else {
            LEPRINTF("PHYSIN=%u ", physindev);
        }
    }

    if (physoutdev > 0) {
        if (nlif_index2name(nlifh, physoutdev, devname) != -1) {
            LEPRINTF("PHYSOUT=%s ", devname);
        } else {
            LEPRINTF("PHYSOUT=%u ", physoutdev);
        }
    }

    int payload_len = nflog_get_payload(ldata, &payload);

    int hwhdrlen = nflog_get_msg_packet_hwhdrlen(ldata);
    if (hwhdrlen > 0) {
        unsigned char *hwhdr = (unsigned char *)nflog_get_msg_packet_hwhdr(ldata);
        if (hwhdr != NULL) {
            int i;
            LEPRINTF("MAC=");
            for (i = 0; i < hwhdrlen; i++) {
                LEPRINTF("%02x", hwhdr[i]);
                if (i < (hwhdrlen -1 )) LEPRINTF(":");
            }
            LEPRINTF(" ");
        }
    }

    u_int16_t hw_protocol = 0;
    struct nfulnl_msg_packet_hdr *ph = NULL;

    switch (family) {
    case AF_INET:
        print_iphdr(le, payload, payload_len);
        break;
    case AF_INET6:
        print_ip6hdr(le, payload, payload_len);
        break;
    case AF_BRIDGE:
        ph = nflog_get_msg_packet_hdr(ldata);
        if (ph) hw_protocol = ntohs(ph->hw_protocol);

        switch (hw_protocol) {
        case ETH_P_IP:
            print_iphdr(le, payload, payload_len);
            break;
        case ETH_P_IPV6:
             print_ip6hdr(le, payload, payload_len);
            break;
        case ETH_P_ARP:
            print_arp(le, (struct ether_arp *)payload, payload_len);
            break;
        }
        break;
    }

    if (mark) LEPRINTF("mark=%u ", mark);


    return 0;

}

static int
nflog_cb(struct nflog_g_handle *gh, struct nfgenmsg *nfmsg,
               struct nflog_data *nfa, void *data)
{
    struct log_entry *le = g_new0(struct log_entry, 1);

    print_pkt(le, nfa, nfmsg->nfgen_family);

    LEPRINTF("\n"); // add newline

    queue_log_entry(le);

    return 0;
}

static gboolean
nflog_read_cb(GIOChannel *source,
              GIOCondition condition,
              gpointer data)
{
    int rv = 0;
    gchar buf[8192];

    int fd =  g_io_channel_unix_get_fd(source);

    if ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) {
         nflog_handle_packet(logh, buf, rv);
    }

    return TRUE;
}

static gboolean
nlif_read_cb(GIOChannel *source,
             GIOCondition condition,
             gpointer data)
{
    static int last_res = 0;
    int res;

    if ((res = nlif_catch(nlifh)) < 0) {
        if (last_res == 0) { // only report once
            log_status_message(3, "nlif_catch failed (res = %d)", res);
        }
        last_res = res;
    } else {
        last_res = 0;
    }

    return TRUE;
}

static gboolean
terminate_request(gpointer data)
{
    terminate_threads = TRUE;

    log_status_message(5, "received terminate request (signal)");

    g_main_loop_quit(main_loop);

    return TRUE;
}


int
main(int argc, char *argv[])
{
    int lockfd = -1;
    gboolean foreground = FALSE;
    gboolean wrote_pidfile = FALSE;

    g_thread_init(NULL);

    openlog("pvepw-logger", LOG_CONS|LOG_PID, LOG_DAEMON);

    if ((lockfd = open(LOCKFILE, O_RDWR|O_CREAT|O_APPEND, 0644)) == -1) {
        fprintf(stderr, "unable to create lock '%s': %s", LOCKFILE, strerror (errno) );
        exit(-1);
    }

    for (int i = 10; i >= 0; i--) {
        if (flock(lockfd, LOCK_EX|LOCK_NB) != 0) {
            if (!i) {
                fprintf(stderr, "unable to aquire lock '%s': %s", LOCKFILE, strerror (errno));
                exit(-1);
            }
            if (i == 10)
                fprintf(stderr, "unable to aquire lock '%s' - trying again.\n", LOCKFILE);

            sleep(1);
        }
    }

    if ((outfd = open(LOGFILE, O_WRONLY|O_CREAT|O_APPEND, 0644)) == -1) {
        fprintf(stderr, "unable to open file '%s': %s", LOGFILE, strerror (errno));
        exit(-1);
    }

    if ((logh = nflog_open())  == NULL) {
        fprintf(stderr, "unable to open nflog\n");
        exit(-1);
    }

    if (!nflog_bind_pf(logh, AF_INET) <= 0) {
        fprintf(stderr, "nflog_bind_pf AF_INET failed\n");
        exit(-1);
    }

#if 0
    if (!nflog_bind_pf(logh, AF_INET6) <= 0) {
        fprintf(stderr, "nflog_bind_pf AF_INET6 failed\n");
        exit(-1);
    }
#endif

    if (!nflog_bind_pf(logh, AF_BRIDGE) <= 0) {
        fprintf(stderr, "nflog_bind_pf AF_BRIDGE failed\n");
        exit(-1);
    }

    struct nflog_g_handle *qh = nflog_bind_group(logh, 0);
    if (!qh) {
        fprintf(stderr, "no handle for group 1\n");
        exit(-1);
    }

    if (nflog_set_mode(qh, NFULNL_COPY_PACKET, 0xffff) < 0) {
        fprintf(stderr, "can't set packet copy mode\n");
        exit(-1);
    }

    if ((nlifh = nlif_open()) == NULL) {
        fprintf(stderr, "unable to open netlink interface handle\n");
        exit(-1);
    }

    if (!foreground) {
        pid_t cpid = fork();

        if (cpid == -1) {
            fprintf(stderr, "failed to daemonize program - %s\n", strerror (errno));
            exit(-1);
        } else if (cpid) {
            write_pidfile(cpid);
            _exit(0);
        } else {
            int nullfd;

            if (chroot("/") != 0) fprintf(stderr, "chroot '/' failed - %s\n", strerror (errno));

            if ((nullfd = open("/dev/null", O_RDWR, 0)) != -1) {
                dup2(nullfd, 0);
                dup2(nullfd, 1);
                dup2(nullfd, 2);
                if (nullfd > 2)
                    close (nullfd);
            }

            setsid();
        }
    } else {
        write_pidfile(getpid());
    }

    wrote_pidfile = TRUE;

    nflog_callback_register(qh, &nflog_cb, logh);

    queue = g_async_queue_new_full(g_free);

    log_status_message(5, "starting pvefw logger");

    nlif_query(nlifh);

    GIOChannel *nlif_ch = g_io_channel_unix_new(nlif_fd(nlifh));

    g_io_add_watch(nlif_ch, G_IO_IN, nlif_read_cb, NULL);

    int logfd = nflog_fd(logh);
    GIOChannel *nflog_ch = g_io_channel_unix_new(logfd);

    g_io_add_watch(nflog_ch, G_IO_IN, nflog_read_cb, NULL);

    GThread *wthread = g_thread_new("log_writer_thread", log_writer_thread, NULL);

    main_loop = g_main_loop_new(NULL, TRUE);

    g_unix_signal_add(SIGINT, terminate_request, NULL);
    g_unix_signal_add(SIGTERM, terminate_request, NULL);

    g_main_loop_run(main_loop);

    log_status_message(5, "stopping pvefw logger");

    g_thread_join(wthread);

    close(outfd);

    nflog_close(logh);

    if (wrote_pidfile)
        unlink(PIDFILE);

    exit(0);
}
Commit	Line	Data
ba0b3a0a DM	1	/*
	2
	3	Copyright (C) 2014 Proxmox Server Solutions GmbH
	4
	5	This software is written by Proxmox Server Solutions GmbH <support@proxmox.com>
	6
	7	This program is free software: you can redistribute it and/or modify
	8	it under the terms of the GNU Affero General Public License as published by
	9	the Free Software Foundation, either version 3 of the License, or
	10	(at your option) any later version.
	11
	12	This program is distributed in the hope that it will be useful,
	13	but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	GNU Affero General Public License for more details.
	16
	17	You should have received a copy of the GNU Affero General Public License
	18	along with this program. If not, see <http://www.gnu.org/licenses/>.
	19
	20	Author: Dietmar Maurer <dietmar@proxmox.com>
	21
	22	*/
	23
	24	#define _GNU_SOURCE
	25
	26	#include <stdlib.h>
	27	#include <stdio.h>
	28	#include <errno.h>
	29	#include <stdarg.h>
	30	#include <string.h>
	31	#include <signal.h>
7bb6e8dd	32	#include <sys/types.h>
ba0b3a0a DM	33	#include <sys/stat.h>
	34	#include <fcntl.h>
	35	#include <unistd.h>
	36	#include <arpa/inet.h>
	37	#include <sys/socket.h>
	38	#include <sys/file.h>
	39	#include <linux/netlink.h>
	40	#include <libnfnetlink/libnfnetlink.h>
	41	#include <libnetfilter_log/libnetfilter_log.h>
	42	#include <netinet/ip.h>
	43	#include <netinet/ip_icmp.h>
	44	#include <netinet/udp.h>
	45	#include <netinet/tcp.h>
	46	#include <netinet/if_ether.h>
9da3465c	47	#include <syslog.h>
ba0b3a0a DM	48
	49	#include <glib.h>
	50	#include <glib-unix.h>
	51
	52	static struct nflog_handle *logh = NULL;
	53	static struct nlif_handle *nlifh = NULL;
7bb6e8dd	54	GMainLoop *main_loop;
ba0b3a0a	55
782c4cde	56	/*
7bb6e8dd	57
782c4cde DM	58	LOG FORMAT:
	59
	60	Special care was taken to allow fast parsing (and filer messages for a singl VM).
	61
7bb6e8dd	62	<VMID> <LOGLEVEL> <CHAIN> <TIME> <TIMEZONE> <MSG>
782c4cde DM	63
	64	Example:
	65
	66	117 6 tap117i0-IN 14/Mar/2014:12:47:07 +0100 policy REJECT: IN=vmbr1 ...
7bb6e8dd	67
782c4cde DM	68	*/
782c4cde DM	69
ba0b3a0a DM	70	#define LOGFILE "/var/log/pve-firewall.log"
	71
	72	#define LOCKFILE "/var/lock/pvefw-logger.lck"
	73	#define PIDFILE "/var/run/pvefw-logger.pid"
	74
	75	#define LQ_LEN 512
	76	#define LE_MAX (512 - 16) // try to fit into 512 bytes
	77
782c4cde DM	78	#define MAX_CHAIN_LEN 28
782c4cde DM	79
7bb6e8dd	80	struct log_entry {
ba0b3a0a DM	81	guint32 len; // max LE_MAX chars
	82	char buf[LE_MAX];
	83	};
	84
	85	int outfd = -1;
	86
	87	gboolean terminate_threads = FALSE;
	88
	89	static gboolean write_pidfile(pid_t pid)
	90	{
	91	gboolean res;
	92
	93	char *strpid = g_strdup_printf("%d\n", pid);
	94	res = g_file_set_contents(PIDFILE, strpid, strlen(strpid), NULL);
	95	g_free(strpid);
	96
	97	return res;
	98	}
	99
	100	static GAsyncQueue *queue;
	101
7bb6e8dd	102	ssize_t
ba0b3a0a DM	103	safe_write(int fd, char *buf, size_t count)
	104	{
	105	ssize_t n;
	106
	107	do {
	108	n = write(fd, buf, count);
	109	} while (n < 0 && errno == EINTR);
	110
	111	return n;
	112	}
	113
	114	static gpointer
7bb6e8dd	115	log_writer_thread(gpointer data)
ba0b3a0a DM	116	{
	117	while (1) {
	118	struct log_entry le = (struct log_entry )g_async_queue_timeout_pop(queue, 250000);
	119	if (le == NULL) {
	120	if (terminate_threads) {
	121	return NULL;
	122	}
	123	continue;
	124	}
7bb6e8dd	125
ba0b3a0a	126	int res = safe_write(outfd, le->buf, le->len);
7bb6e8dd	127
ba0b3a0a DM	128	g_free(le);
	129
	130	if (res < 0) {
9da3465c	131	syslog(3, "writing log failed, stopping daemon - %s", strerror (errno));
7bb6e8dd	132	g_main_loop_quit(main_loop);
9da3465c	133	return NULL;
ba0b3a0a DM	134	}
	135	}
	136
	137	return NULL;
	138	}
	139
	140	static int skipped_logs = 0;
	141
782c4cde	142	static void log_status_message(guint loglevel, const char *fmt, ...);
7bb6e8dd	143
ba0b3a0a DM	144	static void
	145	queue_log_entry(struct log_entry *le)
	146	{
	147	gint len = g_async_queue_length(queue);
	148
	149	if (skipped_logs > 0) {
	150	if (len >= (LQ_LEN - 1)) {
	151	skipped_logs++;
	152	} else {
7bb6e8dd	153	int skip_tmp = skipped_logs;
ba0b3a0a	154	skipped_logs = 0; // clear before calling log_status_message()
782c4cde	155	log_status_message(3, "skipped %d log entries (queue full)", skip_tmp);
ba0b3a0a DM	156	g_async_queue_push(queue, le);
	157	}
	158	} else {
	159	if (len >= LQ_LEN) {
	160	skipped_logs++;
	161	} else {
	162	g_async_queue_push(queue, le);
	163	}
	164	}
	165	}
	166
	167
	168	#define LEPRINTF(format, ...) { if (le->len < LE_MAX) le->len += snprintf(le->buf + le->len, LE_MAX - le->len, format, ##__VA_ARGS__); }
	169	#define LEPRINTTIME(sec) { time_t tmp_sec = sec; if (le->len < (LE_MAX - 30)) le->len += strftime(le->buf + le->len, LE_MAX - le->len, "%d/%b/%Y:%H:%M:%S %z ", localtime(&tmp_sec)); }
	170
7bb6e8dd DM	171	static void
7bb6e8dd DM	172	log_status_message(guint loglevel, const char *fmt, ...)
ba0b3a0a DM	173	{
	174	va_list ap;
	175	va_start(ap, fmt);
7bb6e8dd	176
782c4cde DM	177	if (loglevel > 7 ) loglevel = 7; // syslog defines level 0-7
782c4cde DM	178
ba0b3a0a DM	179	struct log_entry *le = g_new0(struct log_entry, 1);
ba0b3a0a DM	180
782c4cde DM	181	LEPRINTF("0 %d - ", loglevel);
782c4cde DM	182
ba0b3a0a DM	183	LEPRINTTIME(time(NULL));
	184
	185	le->len += vsnprintf(le->buf + le->len, LE_MAX - le->len, fmt, ap);
	186
	187	LEPRINTF("\n");
	188
	189	queue_log_entry(le);
9da3465c DM	190
	191	// also log to syslog
	192
	193	vsyslog(loglevel, fmt, ap);
ba0b3a0a DM	194	}
ba0b3a0a DM	195
7bb6e8dd	196	static int
ba0b3a0a DM	197	print_tcp(struct log_entry le, struct tcphdr h, int payload_len)
	198	{
	199	LEPRINTF("PROTO=TCP ");
	200
	201	if (payload_len < sizeof(struct tcphdr)) {
	202	LEPRINTF("LEN=%d ", payload_len);
	203	LEPRINTF("INVALID=LEN ");
	204	return -1;
	205	}
	206
	207	LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
	208	LEPRINTF("SEQ=%u ACK=%u ", ntohl(h->seq), ntohl(h->ack_seq));
	209	LEPRINTF("WINDOW=%u ", ntohs(h->window));
	210
	211	if (h->urg) LEPRINTF("URG ");
	212	if (h->ack) LEPRINTF("ACK ");
	213	if (h->psh) LEPRINTF("PSH ");
	214	if (h->rst) LEPRINTF("RST ");
	215	if (h->syn) LEPRINTF("SYN ");
	216	if (h->fin) LEPRINTF("FIN ");
	217
	218	if (h->urg) LEPRINTF("URGP=%u ",ntohs(h->urg_ptr));
	219
	220	return 0;
	221	}
	222
7bb6e8dd	223	static int
ba0b3a0a DM	224	print_udp(struct log_entry le, struct udphdr h, int payload_len)
	225	{
	226	LEPRINTF("PROTO=UDP ");
	227
	228	if (payload_len < sizeof(struct udphdr)) {
	229	LEPRINTF("LEN=%d ", payload_len);
	230	LEPRINTF("INVALID=LEN ");
	231	return -1;
	232	}
	233
	234	LEPRINTF("SPT=%u DPT=%u LEN=%u", ntohs(h->source), ntohs(h->dest), ntohs(h->len));
	235
	236	return 0;
	237	}
	238
7bb6e8dd	239	static int
ba0b3a0a DM	240	print_icmp(struct log_entry le, struct icmphdr h, int payload_len)
	241	{
	242	char tmp[INET_ADDRSTRLEN];
	243	u_int32_t gateway;
	244
	245	LEPRINTF("PROTO=ICMP ");
	246
	247	if (payload_len < sizeof(struct icmphdr)) {
	248	LEPRINTF("LEN=%d ", payload_len);
	249	LEPRINTF("INVALID=LEN ");
	250	return -1;
	251	}
	252
	253	LEPRINTF("TYPE=%u CODE=%u ", h->type, h->code);
	254
	255	switch (h->type) {
	256	case ICMP_ECHO:
	257	case ICMP_ECHOREPLY:
	258	LEPRINTF("ID=%u SEQ=%u ", ntohs(h->un.echo.id), ntohs(h->un.echo.sequence));
	259	break;
	260	case ICMP_PARAMETERPROB:
	261	LEPRINTF("PARAMETER=%u ", ntohl(h->un.gateway) >> 24);
	262	break;
	263	case ICMP_REDIRECT:
	264	gateway = ntohl(h->un.gateway);
7bb6e8dd	265	inet_ntop(AF_INET, &gateway, tmp, sizeof(tmp));
ba0b3a0a DM	266	LEPRINTF("GATEWAY=%s ", tmp);
	267	break;
	268	case ICMP_DEST_UNREACH:
	269	if (h->code == ICMP_FRAG_NEEDED) {
	270	LEPRINTF("MTU=%u ", ntohs(h->un.frag.mtu));
	271	}
	272	break;
	273	}
	274
	275	return 0;
	276	}
	277
	278	/* Section 3.1. SCTP Common Header Format */
	279	typedef struct sctphdr {
	280	__be16 source;
	281	__be16 dest;
	282	__be32 vtag;
	283	__be32 checksum;
	284	} __attribute__((packed)) sctp_sctphdr_t;
	285
7bb6e8dd	286	static int
ba0b3a0a DM	287	print_sctp(struct log_entry le, struct sctphdr h, int payload_len)
	288	{
	289	LEPRINTF("PROTO=SCTP ");
	290
	291	if (payload_len < sizeof(struct sctphdr)) {
	292	LEPRINTF("LEN=%d ", payload_len);
	293	LEPRINTF("INVALID=LEN ");
	294	return -1;
	295	}
	296
	297	LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
	298
	299	return 0;
	300	}
	301
7bb6e8dd	302	static int
ba0b3a0a DM	303	print_iphdr(struct log_entry le, char payload, int payload_len)
	304	{
	305	if (payload_len < sizeof(struct iphdr)) {
	306	LEPRINTF("LEN=%d ", payload_len);
	307	LEPRINTF("INVALID=LEN ");
	308	return -1;
	309	}
	310
	311	struct iphdr h = (struct iphdr )payload;
7bb6e8dd	312
ba0b3a0a DM	313	if (payload_len <= (u_int32_t)(h->ihl * 4)) {
	314	LEPRINTF("INVALID=IHL ");
	315	return -1;
	316	}
	317
	318	char tmp[INET_ADDRSTRLEN];
7bb6e8dd DM	319
7bb6e8dd DM	320	inet_ntop(AF_INET, &h->saddr, tmp, sizeof(tmp));
ba0b3a0a	321	LEPRINTF("SRC=%s ", tmp);
7bb6e8dd	322	inet_ntop(AF_INET, &h->daddr, tmp, sizeof(tmp));
ba0b3a0a DM	323	LEPRINTF("DST=%s ", tmp);
	324
	325	LEPRINTF("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
	326	ntohs(h->tot_len), h->tos & IPTOS_TOS_MASK,
	327	h->tos & IPTOS_PREC_MASK, h->ttl, ntohs(h->id));
7bb6e8dd	328
ba0b3a0a	329	short ip_off = ntohs(h->frag_off);
7bb6e8dd	330	if (ip_off & IP_OFFMASK)
ba0b3a0a DM	331	LEPRINTF("FRAG=%u ", ip_off & IP_OFFMASK);
	332
	333	if (ip_off & IP_DF) LEPRINTF("DF ");
	334	if (ip_off & IP_MF) LEPRINTF("MF ");
	335
	336	void nexthdr = (u_int32_t )h + h->ihl;
	337	payload_len -= h->ihl * 4;
	338
	339	switch (h->protocol) {
	340	case IPPROTO_TCP:
	341	print_tcp(le, (struct tcphdr *)nexthdr, payload_len);
	342	break;
	343	case IPPROTO_UDP:
	344	print_udp(le, (struct udphdr *)nexthdr, payload_len);
	345	break;
	346	case IPPROTO_ICMP:
	347	print_icmp(le, (struct icmphdr *)nexthdr, payload_len);
	348	break;
	349	case IPPROTO_SCTP:
	350	print_sctp(le, (struct sctphdr *)nexthdr, payload_len);
	351	break;
	352	case IPPROTO_AH:
	353	LEPRINTF("PROTO=AH ");
	354	break;
	355	case IPPROTO_ESP:
	356	LEPRINTF("PROTO=ESP ");
	357	break;
	358	case IPPROTO_IGMP:
	359	LEPRINTF("PROTO=IGMP ");
	360	break;
	361	default:
	362	LEPRINTF("PROTO=%u ", h->protocol);
	363	}
	364
	365	return 0;
	366	}
	367
7bb6e8dd	368	static int
ba0b3a0a DM	369	print_ip6hdr(struct log_entry le, char payload, int payload_len)
	370	{
	371	LEPRINTF("IPV6 logging not implemented ");
	372
	373	return 0;
	374	}
	375
	376	// ebtables -I FORWARD --nflog --nflog-group 0
7bb6e8dd	377	static int
ba0b3a0a DM	378	print_arp(struct log_entry le, struct ether_arp h, int payload_len)
	379	{
	380	if (payload_len < sizeof(struct ether_arp)) {
	381	LEPRINTF("LEN=%d ", payload_len);
	382	LEPRINTF("INVALID=LEN ");
	383	return -1;
	384	}
	385
	386	LEPRINTF("SRC=%u.%u.%u.%u ", h->arp_spa[0], h->arp_spa[1],
	387	h->arp_spa[2], h->arp_spa[3]);
	388
	389	LEPRINTF("DST=%u.%u.%u.%u ", h->arp_tpa[0], h->arp_tpa[1],
	390	h->arp_tpa[2], h->arp_tpa[3]);
	391
	392	LEPRINTF("PROTO=ARP ");
	393
	394	unsigned short code = ntohs(h->arp_op);
	395	switch (code) {
	396	case ARPOP_REQUEST:
	397	LEPRINTF("REQUEST ");
	398	break;
	399	case ARPOP_REPLY:
7bb6e8dd DM	400	LEPRINTF("REPLY MAC=%02x:%02x:%02x:%02x:%02x:%02x ",
7bb6e8dd DM	401	h->arp_sha[0], h->arp_sha[1], h->arp_sha[2],
ba0b3a0a DM	402	h->arp_sha[3], h->arp_sha[4], h->arp_sha[5]);
	403	break;
	404	case ARPOP_NAK:
	405	LEPRINTF("NAK ");
	406	break;
	407	default:
	408	LEPRINTF("CODE=%u ", code);
	409	}
	410
	411
	412	// LEPRINTF("HTYPE=%u ", ntohs(h->arp_hrd));
	413
	414	// LEPRINTF("PTYPE=%u ", ntohs(h->arp_pro));
	415
	416	return 0;
	417	}
	418
	419
	420	static int print_pkt(struct log_entry le, struct nflog_data ldata, u_int8_t family)
	421	{
	422	u_int32_t mark = nflog_get_nfmark(ldata);
	423	u_int32_t indev = nflog_get_indev(ldata);
	424	u_int32_t outdev = nflog_get_outdev(ldata);
	425	u_int32_t physindev = nflog_get_physindev(ldata);
	426	u_int32_t physoutdev = nflog_get_physoutdev(ldata);
	427
	428	char *prefix = nflog_get_prefix(ldata);
	429	char *payload;
	430	char devname[256];
7bb6e8dd	431
782c4cde DM	432	guint32 vmid = 0;
	433
	434	guint8 log_level = 6; // info
	435
	436	char *chain_name = "-";
	437
	438	if (prefix != NULL) {
	439	// Note: parse ":$vmid:$loglevel:$chain: $msg"
	440	if (prefix[0] == ':') {
	441	char *p = prefix + 1;
	442	guint32 tmpid = 0;
	443	while(p >= '0' && p <= '9') { tmpid = 10; tmpid += p - '0'; p++; }
	444
	445	if ((*p == ':') &&
	446	(p[1] >= '0' && p[1] <= '7') &&
	447	(p[2] == ':')) {
	448
	449	guint8 tmp_level = p[1] - '0'; // store for later use
	450	char *chain_start = p + 3; // store for later use
	451	p = chain_start;
	452	while (p && p != ':' && *p != ' ') p++;
	453	int len = p - chain_start;
	454
	455	if (*p == ':' && p[1] == ' ' && len && (len <= MAX_CHAIN_LEN)) {
	456	// parsing successful
	457
	458	*p = 0; // terminate string
	459
	460	vmid = tmpid;
	461	log_level = tmp_level;
	462	chain_name = chain_start;
	463	prefix = p + 2; // the rest
7bb6e8dd	464	}
782c4cde DM	465	}
	466	}
	467	}
	468
	469	LEPRINTF("%d ", vmid);
	470
	471	LEPRINTF("%d ", log_level);
	472
	473	LEPRINTF("%s ", chain_name);
	474
ba0b3a0a DM	475	struct timeval ts;
	476	nflog_get_timestamp(ldata, &ts);
	477
	478	LEPRINTTIME(ts.tv_sec);
	479
ba0b3a0a DM	480	if (prefix != NULL) {
	481	LEPRINTF("%s", prefix);
	482	}
7bb6e8dd DM	483
7bb6e8dd DM	484	if (indev > 0) {
e7ceb650	485	if (nlif_index2name(nlifh, indev, devname) != -1) {
7bb6e8dd	486	LEPRINTF("IN=%s ", devname);
e7ceb650	487	} else {
7bb6e8dd	488	LEPRINTF("IN=%u ", indev);
e7ceb650	489	}
ba0b3a0a DM	490	}
ba0b3a0a DM	491
e7ceb650 DM	492	if (outdev > 0) {
	493	if (nlif_index2name(nlifh, outdev, devname) != -1) {
	494	LEPRINTF("OUT=%s ", devname);
	495	} else {
	496	LEPRINTF("OUT=%u ", outdev);
	497	}
ba0b3a0a DM	498	}
ba0b3a0a DM	499
7bb6e8dd	500	if (physindev > 0) {
e7ceb650 DM	501	if (nlif_index2name(nlifh, physindev, devname) != -1) {
	502	LEPRINTF("PHYSIN=%s ", devname);
	503	} else {
	504	LEPRINTF("PHYSIN=%u ", physindev);
	505	}
ba0b3a0a	506	}
7bb6e8dd	507
e7ceb650 DM	508	if (physoutdev > 0) {
	509	if (nlif_index2name(nlifh, physoutdev, devname) != -1) {
	510	LEPRINTF("PHYSOUT=%s ", devname);
	511	} else {
	512	LEPRINTF("PHYSOUT=%u ", physoutdev);
	513	}
ba0b3a0a DM	514	}
	515
	516	int payload_len = nflog_get_payload(ldata, &payload);
	517
	518	int hwhdrlen = nflog_get_msg_packet_hwhdrlen(ldata);
	519	if (hwhdrlen > 0) {
	520	unsigned char hwhdr = (unsigned char )nflog_get_msg_packet_hwhdr(ldata);
	521	if (hwhdr != NULL) {
	522	int i;
	523	LEPRINTF("MAC=");
	524	for (i = 0; i < hwhdrlen; i++) {
	525	LEPRINTF("%02x", hwhdr[i]);
	526	if (i < (hwhdrlen -1 )) LEPRINTF(":");
	527	}
	528	LEPRINTF(" ");
	529	}
	530	}
	531
	532	u_int16_t hw_protocol = 0;
	533	struct nfulnl_msg_packet_hdr *ph = NULL;
	534
	535	switch (family) {
7bb6e8dd	536	case AF_INET:
ba0b3a0a DM	537	print_iphdr(le, payload, payload_len);
	538	break;
	539	case AF_INET6:
	540	print_ip6hdr(le, payload, payload_len);
	541	break;
	542	case AF_BRIDGE:
	543	ph = nflog_get_msg_packet_hdr(ldata);
	544	if (ph) hw_protocol = ntohs(ph->hw_protocol);
	545
	546	switch (hw_protocol) {
	547	case ETH_P_IP:
	548	print_iphdr(le, payload, payload_len);
	549	break;
	550	case ETH_P_IPV6:
	551	print_ip6hdr(le, payload, payload_len);
	552	break;
	553	case ETH_P_ARP:
	554	print_arp(le, (struct ether_arp *)payload, payload_len);
	555	break;
	556	}
	557	break;
	558	}
	559
	560	if (mark) LEPRINTF("mark=%u ", mark);
	561
	562
	563	return 0;
	564
	565	}
	566
7bb6e8dd	567	static int
ba0b3a0a DM	568	nflog_cb(struct nflog_g_handle gh, struct nfgenmsg nfmsg,
	569	struct nflog_data nfa, void data)
	570	{
	571	struct log_entry *le = g_new0(struct log_entry, 1);
7bb6e8dd	572
ba0b3a0a DM	573	print_pkt(le, nfa, nfmsg->nfgen_family);
	574
	575	LEPRINTF("\n"); // add newline
	576
	577	queue_log_entry(le);
	578
	579	return 0;
	580	}
	581
	582	static gboolean
	583	nflog_read_cb(GIOChannel *source,
	584	GIOCondition condition,
	585	gpointer data)
	586	{
	587	int rv = 0;
	588	gchar buf[8192];
	589
	590	int fd = g_io_channel_unix_get_fd(source);
7bb6e8dd	591
ba0b3a0a DM	592	if ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) {
	593	nflog_handle_packet(logh, buf, rv);
	594	}
	595
	596	return TRUE;
	597	}
	598
	599	static gboolean
	600	nlif_read_cb(GIOChannel *source,
	601	GIOCondition condition,
	602	gpointer data)
	603	{
9da3465c DM	604	static int last_res = 0;
	605	int res;
	606
	607	if ((res = nlif_catch(nlifh)) < 0) {
	608	if (last_res == 0) { // only report once
	609	log_status_message(3, "nlif_catch failed (res = %d)", res);
	610	}
	611	last_res = res;
	612	} else {
	613	last_res = 0;
	614	}
	615
7bb6e8dd	616	return TRUE;
ba0b3a0a DM	617	}
ba0b3a0a DM	618
ba0b3a0a	619	static gboolean
7bb6e8dd	620	terminate_request(gpointer data)
ba0b3a0a DM	621	{
	622	terminate_threads = TRUE;
	623
782c4cde	624	log_status_message(5, "received terminate request (signal)");
ba0b3a0a DM	625
ba0b3a0a DM	626	g_main_loop_quit(main_loop);
7bb6e8dd	627
ba0b3a0a DM	628	return TRUE;
ba0b3a0a DM	629	}
7bb6e8dd	630
ba0b3a0a DM	631
	632	int
	633	main(int argc, char *argv[])
	634	{
	635	int lockfd = -1;
	636	gboolean foreground = FALSE;
	637	gboolean wrote_pidfile = FALSE;
	638
	639	g_thread_init(NULL);
	640
9da3465c DM	641	openlog("pvepw-logger", LOG_CONS\|LOG_PID, LOG_DAEMON);
9da3465c DM	642
ba0b3a0a	643	if ((lockfd = open(LOCKFILE, O_RDWR\|O_CREAT\|O_APPEND, 0644)) == -1) {
9da3465c	644	fprintf(stderr, "unable to create lock '%s': %s", LOCKFILE, strerror (errno) );
ba0b3a0a DM	645	exit(-1);
	646	}
	647
	648	for (int i = 10; i >= 0; i--) {
	649	if (flock(lockfd, LOCK_EX\|LOCK_NB) != 0) {
	650	if (!i) {
	651	fprintf(stderr, "unable to aquire lock '%s': %s", LOCKFILE, strerror (errno));
	652	exit(-1);
	653	}
	654	if (i == 10)
	655	fprintf(stderr, "unable to aquire lock '%s' - trying again.\n", LOCKFILE);
7bb6e8dd	656
ba0b3a0a DM	657	sleep(1);
	658	}
	659	}
	660
	661	if ((outfd = open(LOGFILE, O_WRONLY\|O_CREAT\|O_APPEND, 0644)) == -1) {
	662	fprintf(stderr, "unable to open file '%s': %s", LOGFILE, strerror (errno));
	663	exit(-1);
	664	}
	665
	666	if ((logh = nflog_open()) == NULL) {
	667	fprintf(stderr, "unable to open nflog\n");
	668	exit(-1);
	669	}
	670
	671	if (!nflog_bind_pf(logh, AF_INET) <= 0) {
	672	fprintf(stderr, "nflog_bind_pf AF_INET failed\n");
	673	exit(-1);
	674	}
	675
	676	#if 0
	677	if (!nflog_bind_pf(logh, AF_INET6) <= 0) {
	678	fprintf(stderr, "nflog_bind_pf AF_INET6 failed\n");
	679	exit(-1);
	680	}
	681	#endif
7bb6e8dd	682
ba0b3a0a DM	683	if (!nflog_bind_pf(logh, AF_BRIDGE) <= 0) {
	684	fprintf(stderr, "nflog_bind_pf AF_BRIDGE failed\n");
	685	exit(-1);
	686	}
	687
	688	struct nflog_g_handle *qh = nflog_bind_group(logh, 0);
	689	if (!qh) {
	690	fprintf(stderr, "no handle for group 1\n");
	691	exit(-1);
	692	}
7bb6e8dd	693
ba0b3a0a DM	694	if (nflog_set_mode(qh, NFULNL_COPY_PACKET, 0xffff) < 0) {
	695	fprintf(stderr, "can't set packet copy mode\n");
	696	exit(-1);
	697	}
	698
	699	if ((nlifh = nlif_open()) == NULL) {
	700	fprintf(stderr, "unable to open netlink interface handle\n");
	701	exit(-1);
	702	}
	703
	704	if (!foreground) {
	705	pid_t cpid = fork();
	706
	707	if (cpid == -1) {
	708	fprintf(stderr, "failed to daemonize program - %s\n", strerror (errno));
	709	exit(-1);
	710	} else if (cpid) {
	711	write_pidfile(cpid);
	712	_exit(0);
	713	} else {
	714	int nullfd;
	715
	716	if (chroot("/") != 0) fprintf(stderr, "chroot '/' failed - %s\n", strerror (errno));
	717
	718	if ((nullfd = open("/dev/null", O_RDWR, 0)) != -1) {
	719	dup2(nullfd, 0);
	720	dup2(nullfd, 1);
	721	dup2(nullfd, 2);
	722	if (nullfd > 2)
	723	close (nullfd);
	724	}
	725
	726	setsid();
	727	}
	728	} else {
	729	write_pidfile(getpid());
	730	}
	731
	732	wrote_pidfile = TRUE;
	733
	734	nflog_callback_register(qh, &nflog_cb, logh);
	735
	736	queue = g_async_queue_new_full(g_free);
	737
782c4cde	738	log_status_message(5, "starting pvefw logger");
ba0b3a0a DM	739
	740	nlif_query(nlifh);
	741
	742	GIOChannel *nlif_ch = g_io_channel_unix_new(nlif_fd(nlifh));
	743
	744	g_io_add_watch(nlif_ch, G_IO_IN, nlif_read_cb, NULL);
	745
	746	int logfd = nflog_fd(logh);
	747	GIOChannel *nflog_ch = g_io_channel_unix_new(logfd);
	748
	749	g_io_add_watch(nflog_ch, G_IO_IN, nflog_read_cb, NULL);
	750
	751	GThread *wthread = g_thread_new("log_writer_thread", log_writer_thread, NULL);
7bb6e8dd	752
ba0b3a0a	753	main_loop = g_main_loop_new(NULL, TRUE);
7bb6e8dd	754
ba0b3a0a DM	755	g_unix_signal_add(SIGINT, terminate_request, NULL);
ba0b3a0a DM	756	g_unix_signal_add(SIGTERM, terminate_request, NULL);
7bb6e8dd	757
ba0b3a0a DM	758	g_main_loop_run(main_loop);
ba0b3a0a DM	759
782c4cde	760	log_status_message(5, "stopping pvefw logger");
ba0b3a0a DM	761
	762	g_thread_join(wthread);
	763
	764	close(outfd);
	765
	766	nflog_close(logh);
	767
	768	if (wrote_pidfile)
	769	unlink(PIDFILE);
	770
	771	exit(0);
	772	}