factor out IPPROTO switch for reuse
[pve-firewall.git] / src / pvefw-logger.c
CommitLineData
ba0b3a0a
DM
1/*
2
3 Copyright (C) 2014 Proxmox Server Solutions GmbH
4
5 This software is written by Proxmox Server Solutions GmbH <support@proxmox.com>
6
7 This program is free software: you can redistribute it and/or modify
8 it under the terms of the GNU Affero General Public License as published by
9 the Free Software Foundation, either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU Affero General Public License for more details.
16
17 You should have received a copy of the GNU Affero General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19
20 Author: Dietmar Maurer <dietmar@proxmox.com>
21
22*/
23
24#define _GNU_SOURCE
25
26#include <stdlib.h>
27#include <stdio.h>
28#include <errno.h>
29#include <stdarg.h>
30#include <string.h>
31#include <signal.h>
985fd74e 32#include <sys/signalfd.h>
7bb6e8dd 33#include <sys/types.h>
ba0b3a0a
DM
34#include <sys/stat.h>
35#include <fcntl.h>
36#include <unistd.h>
37#include <arpa/inet.h>
38#include <sys/socket.h>
39#include <sys/file.h>
40#include <linux/netlink.h>
41#include <libnfnetlink/libnfnetlink.h>
42#include <libnetfilter_log/libnetfilter_log.h>
43#include <netinet/ip.h>
44#include <netinet/ip_icmp.h>
45#include <netinet/udp.h>
46#include <netinet/tcp.h>
47#include <netinet/if_ether.h>
9da3465c 48#include <syslog.h>
ba0b3a0a
DM
49
50#include <glib.h>
ba0b3a0a
DM
51
52static struct nflog_handle *logh = NULL;
53static struct nlif_handle *nlifh = NULL;
7bb6e8dd 54GMainLoop *main_loop;
ba0b3a0a 55
84786ec0
DM
56gboolean foreground = FALSE;
57gboolean debug = FALSE;
58
782c4cde 59/*
7bb6e8dd 60
782c4cde
DM
61LOG FORMAT:
62
63Special care was taken to allow fast parsing (and filer messages for a singl VM).
64
7bb6e8dd 65<VMID> <LOGLEVEL> <CHAIN> <TIME> <TIMEZONE> <MSG>
782c4cde
DM
66
67Example:
68
69117 6 tap117i0-IN 14/Mar/2014:12:47:07 +0100 policy REJECT: IN=vmbr1 ...
7bb6e8dd 70
782c4cde
DM
71*/
72
ba0b3a0a
DM
73#define LOGFILE "/var/log/pve-firewall.log"
74
75#define LOCKFILE "/var/lock/pvefw-logger.lck"
76#define PIDFILE "/var/run/pvefw-logger.pid"
77
78#define LQ_LEN 512
5b06fd6c 79#define LE_MAX (512 - 4) // try to fit into 512 bytes
ba0b3a0a 80
782c4cde
DM
81#define MAX_CHAIN_LEN 28
82
7bb6e8dd 83struct log_entry {
ba0b3a0a
DM
84 guint32 len; // max LE_MAX chars
85 char buf[LE_MAX];
86};
87
5b06fd6c
DM
88#define STATIC_ASSERT(cond) \
89 extern void pve_static_assert(int test[(cond) ? 1 : -1])
90
91STATIC_ASSERT(sizeof(struct log_entry) == 512);
92
ba0b3a0a
DM
93int outfd = -1;
94
95gboolean terminate_threads = FALSE;
96
97static gboolean write_pidfile(pid_t pid)
98{
99 gboolean res;
100
101 char *strpid = g_strdup_printf("%d\n", pid);
102 res = g_file_set_contents(PIDFILE, strpid, strlen(strpid), NULL);
103 g_free(strpid);
104
105 return res;
106}
107
108static GAsyncQueue *queue;
109
7bb6e8dd 110ssize_t
ba0b3a0a
DM
111safe_write(int fd, char *buf, size_t count)
112{
113 ssize_t n;
114
115 do {
116 n = write(fd, buf, count);
117 } while (n < 0 && errno == EINTR);
118
119 return n;
120}
121
122static gpointer
7bb6e8dd 123log_writer_thread(gpointer data)
ba0b3a0a
DM
124{
125 while (1) {
126 struct log_entry *le = (struct log_entry *)g_async_queue_timeout_pop(queue, 250000);
127 if (le == NULL) {
128 if (terminate_threads) {
129 return NULL;
130 }
131 continue;
132 }
7bb6e8dd 133
84786ec0
DM
134 if (debug) fputs(le->buf, stdout);
135
ba0b3a0a 136 int res = safe_write(outfd, le->buf, le->len);
7bb6e8dd 137
ba0b3a0a
DM
138 g_free(le);
139
140 if (res < 0) {
9da3465c 141 syslog(3, "writing log failed, stopping daemon - %s", strerror (errno));
7bb6e8dd 142 g_main_loop_quit(main_loop);
9da3465c 143 return NULL;
ba0b3a0a
DM
144 }
145 }
146
147 return NULL;
148}
149
150static int skipped_logs = 0;
151
782c4cde 152static void log_status_message(guint loglevel, const char *fmt, ...);
7bb6e8dd 153
ba0b3a0a
DM
154static void
155queue_log_entry(struct log_entry *le)
156{
157 gint len = g_async_queue_length(queue);
158
159 if (skipped_logs > 0) {
160 if (len >= (LQ_LEN - 1)) {
161 skipped_logs++;
162 } else {
7bb6e8dd 163 int skip_tmp = skipped_logs;
ba0b3a0a 164 skipped_logs = 0; // clear before calling log_status_message()
782c4cde 165 log_status_message(3, "skipped %d log entries (queue full)", skip_tmp);
ba0b3a0a
DM
166 g_async_queue_push(queue, le);
167 }
168 } else {
169 if (len >= LQ_LEN) {
170 skipped_logs++;
171 } else {
172 g_async_queue_push(queue, le);
173 }
174 }
175}
176
177
6c293b5d
WB
178#define LEPRINTF(format, ...) \
179 do { \
180 if (le->len < LE_MAX) \
181 le->len += snprintf(le->buf + le->len, LE_MAX - le->len, format, ##__VA_ARGS__); \
182 } while (0)
183#define LEPRINTTIME(sec) \
184 do { \
185 time_t tmp_sec = sec; \
186 if (le->len < (LE_MAX - 30)) \
187 le->len += strftime(le->buf + le->len, LE_MAX - le->len, "%d/%b/%Y:%H:%M:%S %z ", localtime(&tmp_sec)); \
188 } while (0)
ba0b3a0a 189
7bb6e8dd
DM
190static void
191log_status_message(guint loglevel, const char *fmt, ...)
ba0b3a0a
DM
192{
193 va_list ap;
194 va_start(ap, fmt);
7bb6e8dd 195
782c4cde
DM
196 if (loglevel > 7 ) loglevel = 7; // syslog defines level 0-7
197
ba0b3a0a
DM
198 struct log_entry *le = g_new0(struct log_entry, 1);
199
782c4cde
DM
200 LEPRINTF("0 %d - ", loglevel);
201
ba0b3a0a
DM
202 LEPRINTTIME(time(NULL));
203
204 le->len += vsnprintf(le->buf + le->len, LE_MAX - le->len, fmt, ap);
205
206 LEPRINTF("\n");
207
208 queue_log_entry(le);
9da3465c
DM
209
210 // also log to syslog
211
212 vsyslog(loglevel, fmt, ap);
ba0b3a0a
DM
213}
214
7bb6e8dd 215static int
ba0b3a0a
DM
216print_tcp(struct log_entry *le, struct tcphdr *h, int payload_len)
217{
218 LEPRINTF("PROTO=TCP ");
219
220 if (payload_len < sizeof(struct tcphdr)) {
221 LEPRINTF("LEN=%d ", payload_len);
222 LEPRINTF("INVALID=LEN ");
223 return -1;
224 }
225
226 LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
227 LEPRINTF("SEQ=%u ACK=%u ", ntohl(h->seq), ntohl(h->ack_seq));
228 LEPRINTF("WINDOW=%u ", ntohs(h->window));
229
230 if (h->urg) LEPRINTF("URG ");
231 if (h->ack) LEPRINTF("ACK ");
232 if (h->psh) LEPRINTF("PSH ");
233 if (h->rst) LEPRINTF("RST ");
234 if (h->syn) LEPRINTF("SYN ");
235 if (h->fin) LEPRINTF("FIN ");
236
237 if (h->urg) LEPRINTF("URGP=%u ",ntohs(h->urg_ptr));
238
239 return 0;
240}
241
7bb6e8dd 242static int
ba0b3a0a
DM
243print_udp(struct log_entry *le, struct udphdr *h, int payload_len)
244{
245 LEPRINTF("PROTO=UDP ");
246
247 if (payload_len < sizeof(struct udphdr)) {
248 LEPRINTF("LEN=%d ", payload_len);
249 LEPRINTF("INVALID=LEN ");
250 return -1;
251 }
252
253 LEPRINTF("SPT=%u DPT=%u LEN=%u", ntohs(h->source), ntohs(h->dest), ntohs(h->len));
254
255 return 0;
256}
257
7bb6e8dd 258static int
ba0b3a0a
DM
259print_icmp(struct log_entry *le, struct icmphdr *h, int payload_len)
260{
261 char tmp[INET_ADDRSTRLEN];
262 u_int32_t gateway;
263
264 LEPRINTF("PROTO=ICMP ");
265
266 if (payload_len < sizeof(struct icmphdr)) {
267 LEPRINTF("LEN=%d ", payload_len);
268 LEPRINTF("INVALID=LEN ");
269 return -1;
270 }
271
272 LEPRINTF("TYPE=%u CODE=%u ", h->type, h->code);
273
274 switch (h->type) {
275 case ICMP_ECHO:
276 case ICMP_ECHOREPLY:
277 LEPRINTF("ID=%u SEQ=%u ", ntohs(h->un.echo.id), ntohs(h->un.echo.sequence));
278 break;
279 case ICMP_PARAMETERPROB:
280 LEPRINTF("PARAMETER=%u ", ntohl(h->un.gateway) >> 24);
281 break;
282 case ICMP_REDIRECT:
283 gateway = ntohl(h->un.gateway);
7bb6e8dd 284 inet_ntop(AF_INET, &gateway, tmp, sizeof(tmp));
ba0b3a0a
DM
285 LEPRINTF("GATEWAY=%s ", tmp);
286 break;
287 case ICMP_DEST_UNREACH:
288 if (h->code == ICMP_FRAG_NEEDED) {
289 LEPRINTF("MTU=%u ", ntohs(h->un.frag.mtu));
290 }
291 break;
292 }
293
294 return 0;
295}
296
297/* Section 3.1. SCTP Common Header Format */
298typedef struct sctphdr {
299 __be16 source;
300 __be16 dest;
301 __be32 vtag;
302 __be32 checksum;
303} __attribute__((packed)) sctp_sctphdr_t;
304
7bb6e8dd 305static int
ba0b3a0a
DM
306print_sctp(struct log_entry *le, struct sctphdr *h, int payload_len)
307{
308 LEPRINTF("PROTO=SCTP ");
309
310 if (payload_len < sizeof(struct sctphdr)) {
311 LEPRINTF("LEN=%d ", payload_len);
312 LEPRINTF("INVALID=LEN ");
313 return -1;
314 }
315
316 LEPRINTF("SPT=%u DPT=%u ", ntohs(h->source), ntohs(h->dest));
317
318 return 0;
319}
320
f5b3bf34
WB
321static int
322print_ipproto(struct log_entry *le, char * nexthdr, int payload_len, u_int8_t proto)
323{
324 switch (proto) {
325 case IPPROTO_TCP:
326 print_tcp(le, (struct tcphdr *)nexthdr, payload_len);
327 break;
328 case IPPROTO_UDP:
329 print_udp(le, (struct udphdr *)nexthdr, payload_len);
330 break;
331 case IPPROTO_ICMP:
332 print_icmp(le, (struct icmphdr *)nexthdr, payload_len);
333 break;
334 case IPPROTO_SCTP:
335 print_sctp(le, (struct sctphdr *)nexthdr, payload_len);
336 break;
337 case IPPROTO_AH:
338 LEPRINTF("PROTO=AH ");
339 break;
340 case IPPROTO_ESP:
341 LEPRINTF("PROTO=ESP ");
342 break;
343 case IPPROTO_IGMP:
344 LEPRINTF("PROTO=IGMP ");
345 break;
346 default:
347 return -1;
348 }
349 return 0;
350}
351
7bb6e8dd 352static int
ba0b3a0a
DM
353print_iphdr(struct log_entry *le, char * payload, int payload_len)
354{
355 if (payload_len < sizeof(struct iphdr)) {
356 LEPRINTF("LEN=%d ", payload_len);
357 LEPRINTF("INVALID=LEN ");
358 return -1;
359 }
360
361 struct iphdr *h = (struct iphdr *)payload;
7bb6e8dd 362
ba0b3a0a
DM
363 if (payload_len <= (u_int32_t)(h->ihl * 4)) {
364 LEPRINTF("INVALID=IHL ");
365 return -1;
366 }
367
368 char tmp[INET_ADDRSTRLEN];
7bb6e8dd
DM
369
370 inet_ntop(AF_INET, &h->saddr, tmp, sizeof(tmp));
ba0b3a0a 371 LEPRINTF("SRC=%s ", tmp);
7bb6e8dd 372 inet_ntop(AF_INET, &h->daddr, tmp, sizeof(tmp));
ba0b3a0a
DM
373 LEPRINTF("DST=%s ", tmp);
374
375 LEPRINTF("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
376 ntohs(h->tot_len), h->tos & IPTOS_TOS_MASK,
377 h->tos & IPTOS_PREC_MASK, h->ttl, ntohs(h->id));
7bb6e8dd 378
ba0b3a0a 379 short ip_off = ntohs(h->frag_off);
7bb6e8dd 380 if (ip_off & IP_OFFMASK)
ba0b3a0a
DM
381 LEPRINTF("FRAG=%u ", ip_off & IP_OFFMASK);
382
383 if (ip_off & IP_DF) LEPRINTF("DF ");
384 if (ip_off & IP_MF) LEPRINTF("MF ");
385
386 void *nexthdr = (u_int32_t *)h + h->ihl;
387 payload_len -= h->ihl * 4;
388
f5b3bf34 389 if (print_ipproto(le, nexthdr, payload_len, h->protocol) < 0) {
ba0b3a0a
DM
390 LEPRINTF("PROTO=%u ", h->protocol);
391 }
392
393 return 0;
394}
395
7bb6e8dd 396static int
ba0b3a0a
DM
397print_ip6hdr(struct log_entry *le, char * payload, int payload_len)
398{
399 LEPRINTF("IPV6 logging not implemented ");
400
401 return 0;
402}
403
404// ebtables -I FORWARD --nflog --nflog-group 0
7bb6e8dd 405static int
ba0b3a0a
DM
406print_arp(struct log_entry *le, struct ether_arp *h, int payload_len)
407{
408 if (payload_len < sizeof(struct ether_arp)) {
409 LEPRINTF("LEN=%d ", payload_len);
410 LEPRINTF("INVALID=LEN ");
411 return -1;
412 }
413
414 LEPRINTF("SRC=%u.%u.%u.%u ", h->arp_spa[0], h->arp_spa[1],
415 h->arp_spa[2], h->arp_spa[3]);
416
417 LEPRINTF("DST=%u.%u.%u.%u ", h->arp_tpa[0], h->arp_tpa[1],
418 h->arp_tpa[2], h->arp_tpa[3]);
419
420 LEPRINTF("PROTO=ARP ");
421
422 unsigned short code = ntohs(h->arp_op);
423 switch (code) {
424 case ARPOP_REQUEST:
425 LEPRINTF("REQUEST ");
426 break;
427 case ARPOP_REPLY:
7bb6e8dd
DM
428 LEPRINTF("REPLY MAC=%02x:%02x:%02x:%02x:%02x:%02x ",
429 h->arp_sha[0], h->arp_sha[1], h->arp_sha[2],
ba0b3a0a
DM
430 h->arp_sha[3], h->arp_sha[4], h->arp_sha[5]);
431 break;
432 case ARPOP_NAK:
433 LEPRINTF("NAK ");
434 break;
435 default:
436 LEPRINTF("CODE=%u ", code);
437 }
438
439
440 // LEPRINTF("HTYPE=%u ", ntohs(h->arp_hrd));
441
442 // LEPRINTF("PTYPE=%u ", ntohs(h->arp_pro));
443
444 return 0;
445}
446
447
448static int print_pkt(struct log_entry *le, struct nflog_data *ldata, u_int8_t family)
449{
450 u_int32_t mark = nflog_get_nfmark(ldata);
451 u_int32_t indev = nflog_get_indev(ldata);
452 u_int32_t outdev = nflog_get_outdev(ldata);
453 u_int32_t physindev = nflog_get_physindev(ldata);
454 u_int32_t physoutdev = nflog_get_physoutdev(ldata);
455
456 char *prefix = nflog_get_prefix(ldata);
457 char *payload;
458 char devname[256];
7bb6e8dd 459
782c4cde
DM
460 guint32 vmid = 0;
461
462 guint8 log_level = 6; // info
463
464 char *chain_name = "-";
465
466 if (prefix != NULL) {
467 // Note: parse ":$vmid:$loglevel:$chain: $msg"
468 if (prefix[0] == ':') {
469 char *p = prefix + 1;
470 guint32 tmpid = 0;
471 while(*p >= '0' && *p <= '9') { tmpid *= 10; tmpid += *p - '0'; p++; }
472
473 if ((*p == ':') &&
474 (p[1] >= '0' && p[1] <= '7') &&
475 (p[2] == ':')) {
476
477 guint8 tmp_level = p[1] - '0'; // store for later use
478 char *chain_start = p + 3; // store for later use
479 p = chain_start;
480 while (*p && *p != ':' && *p != ' ') p++;
481 int len = p - chain_start;
482
483 if (*p == ':' && p[1] == ' ' && len && (len <= MAX_CHAIN_LEN)) {
484 // parsing successful
485
486 *p = 0; // terminate string
487
488 vmid = tmpid;
489 log_level = tmp_level;
490 chain_name = chain_start;
491 prefix = p + 2; // the rest
7bb6e8dd 492 }
782c4cde
DM
493 }
494 }
495 }
496
497 LEPRINTF("%d ", vmid);
498
499 LEPRINTF("%d ", log_level);
500
501 LEPRINTF("%s ", chain_name);
502
ba0b3a0a
DM
503 struct timeval ts;
504 nflog_get_timestamp(ldata, &ts);
505
506 LEPRINTTIME(ts.tv_sec);
507
ba0b3a0a
DM
508 if (prefix != NULL) {
509 LEPRINTF("%s", prefix);
510 }
7bb6e8dd
DM
511
512 if (indev > 0) {
e7ceb650 513 if (nlif_index2name(nlifh, indev, devname) != -1) {
7bb6e8dd 514 LEPRINTF("IN=%s ", devname);
e7ceb650 515 } else {
7bb6e8dd 516 LEPRINTF("IN=%u ", indev);
e7ceb650 517 }
ba0b3a0a
DM
518 }
519
e7ceb650
DM
520 if (outdev > 0) {
521 if (nlif_index2name(nlifh, outdev, devname) != -1) {
522 LEPRINTF("OUT=%s ", devname);
523 } else {
524 LEPRINTF("OUT=%u ", outdev);
525 }
ba0b3a0a
DM
526 }
527
7bb6e8dd 528 if (physindev > 0) {
e7ceb650
DM
529 if (nlif_index2name(nlifh, physindev, devname) != -1) {
530 LEPRINTF("PHYSIN=%s ", devname);
531 } else {
532 LEPRINTF("PHYSIN=%u ", physindev);
533 }
ba0b3a0a 534 }
7bb6e8dd 535
e7ceb650
DM
536 if (physoutdev > 0) {
537 if (nlif_index2name(nlifh, physoutdev, devname) != -1) {
538 LEPRINTF("PHYSOUT=%s ", devname);
539 } else {
540 LEPRINTF("PHYSOUT=%u ", physoutdev);
541 }
ba0b3a0a
DM
542 }
543
544 int payload_len = nflog_get_payload(ldata, &payload);
545
546 int hwhdrlen = nflog_get_msg_packet_hwhdrlen(ldata);
547 if (hwhdrlen > 0) {
548 unsigned char *hwhdr = (unsigned char *)nflog_get_msg_packet_hwhdr(ldata);
549 if (hwhdr != NULL) {
550 int i;
551 LEPRINTF("MAC=");
552 for (i = 0; i < hwhdrlen; i++) {
553 LEPRINTF("%02x", hwhdr[i]);
554 if (i < (hwhdrlen -1 )) LEPRINTF(":");
555 }
556 LEPRINTF(" ");
557 }
558 }
559
560 u_int16_t hw_protocol = 0;
561 struct nfulnl_msg_packet_hdr *ph = NULL;
562
563 switch (family) {
7bb6e8dd 564 case AF_INET:
ba0b3a0a
DM
565 print_iphdr(le, payload, payload_len);
566 break;
567 case AF_INET6:
568 print_ip6hdr(le, payload, payload_len);
569 break;
570 case AF_BRIDGE:
571 ph = nflog_get_msg_packet_hdr(ldata);
572 if (ph) hw_protocol = ntohs(ph->hw_protocol);
573
574 switch (hw_protocol) {
575 case ETH_P_IP:
576 print_iphdr(le, payload, payload_len);
577 break;
578 case ETH_P_IPV6:
579 print_ip6hdr(le, payload, payload_len);
580 break;
581 case ETH_P_ARP:
582 print_arp(le, (struct ether_arp *)payload, payload_len);
583 break;
584 }
585 break;
586 }
587
588 if (mark) LEPRINTF("mark=%u ", mark);
589
590
591 return 0;
592
593}
594
7bb6e8dd 595static int
ba0b3a0a
DM
596nflog_cb(struct nflog_g_handle *gh, struct nfgenmsg *nfmsg,
597 struct nflog_data *nfa, void *data)
598{
599 struct log_entry *le = g_new0(struct log_entry, 1);
7bb6e8dd 600
ba0b3a0a
DM
601 print_pkt(le, nfa, nfmsg->nfgen_family);
602
603 LEPRINTF("\n"); // add newline
604
605 queue_log_entry(le);
606
607 return 0;
608}
609
610static gboolean
611nflog_read_cb(GIOChannel *source,
612 GIOCondition condition,
613 gpointer data)
614{
615 int rv = 0;
616 gchar buf[8192];
617
618 int fd = g_io_channel_unix_get_fd(source);
7bb6e8dd 619
ba0b3a0a
DM
620 if ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) {
621 nflog_handle_packet(logh, buf, rv);
622 }
623
624 return TRUE;
625}
626
627static gboolean
628nlif_read_cb(GIOChannel *source,
629 GIOCondition condition,
630 gpointer data)
631{
9da3465c
DM
632 static int last_res = 0;
633 int res;
634
635 if ((res = nlif_catch(nlifh)) < 0) {
636 if (last_res == 0) { // only report once
637 log_status_message(3, "nlif_catch failed (res = %d)", res);
638 }
639 last_res = res;
640 } else {
641 last_res = 0;
642 }
643
7bb6e8dd 644 return TRUE;
ba0b3a0a
DM
645}
646
ba0b3a0a 647static gboolean
985fd74e
DM
648signal_read_cb(GIOChannel *source,
649 GIOCondition condition,
650 gpointer data)
ba0b3a0a 651{
985fd74e
DM
652 int rv = 0;
653 struct signalfd_siginfo si;
ba0b3a0a 654
985fd74e 655 int fd = g_io_channel_unix_get_fd(source);
ba0b3a0a 656
985fd74e
DM
657 if ((rv = read(fd, &si, sizeof(si))) && rv >= 0) {
658 terminate_threads = TRUE;
659 log_status_message(5, "received terminate request (signal)");
660 g_main_loop_quit(main_loop);
661 }
7bb6e8dd 662
ba0b3a0a
DM
663 return TRUE;
664}
7bb6e8dd 665
ba0b3a0a
DM
666int
667main(int argc, char *argv[])
668{
669 int lockfd = -1;
985fd74e
DM
670 int sigfd = -1;
671
ba0b3a0a
DM
672 gboolean wrote_pidfile = FALSE;
673
9da3465c
DM
674 openlog("pvepw-logger", LOG_CONS|LOG_PID, LOG_DAEMON);
675
84786ec0
DM
676 GOptionContext *context;
677
678 GOptionEntry entries[] = {
679 { "debug", 'd', 0, G_OPTION_ARG_NONE, &debug, "Turn on debug messages", NULL },
680 { "foreground", 'f', 0, G_OPTION_ARG_NONE, &foreground, "Do not daemonize server", NULL },
681 { NULL },
682 };
683
684 context = g_option_context_new("");
685 g_option_context_add_main_entries (context, entries, NULL);
686
687 GError *err = NULL;
688 if (!g_option_context_parse (context, &argc, &argv, &err)) {
689 fprintf(stderr, "error: %s\n", err->message);
690 fprintf(stderr, "%s", g_option_context_get_help(context, FALSE, NULL));
691 g_error_free (err);
692 exit(-1);
693 }
694
695 if (optind < argc) {
696 fprintf(stderr, "error: too many arguments\n");
697 fprintf(stderr, "%s", g_option_context_get_help(context, FALSE, NULL));
698 exit(-1);
699 }
700
701 g_option_context_free(context);
702
703 if (debug) foreground = TRUE;
704
ba0b3a0a 705 if ((lockfd = open(LOCKFILE, O_RDWR|O_CREAT|O_APPEND, 0644)) == -1) {
84786ec0 706 fprintf(stderr, "unable to create lock '%s': %s\n", LOCKFILE, strerror (errno) );
ba0b3a0a
DM
707 exit(-1);
708 }
709
710 for (int i = 10; i >= 0; i--) {
711 if (flock(lockfd, LOCK_EX|LOCK_NB) != 0) {
712 if (!i) {
84786ec0 713 fprintf(stderr, "unable to aquire lock '%s': %s\n", LOCKFILE, strerror (errno));
ba0b3a0a
DM
714 exit(-1);
715 }
716 if (i == 10)
717 fprintf(stderr, "unable to aquire lock '%s' - trying again.\n", LOCKFILE);
7bb6e8dd 718
ba0b3a0a
DM
719 sleep(1);
720 }
721 }
722
723 if ((outfd = open(LOGFILE, O_WRONLY|O_CREAT|O_APPEND, 0644)) == -1) {
84786ec0 724 fprintf(stderr, "unable to open file '%s': %s\n", LOGFILE, strerror (errno));
ba0b3a0a
DM
725 exit(-1);
726 }
727
728 if ((logh = nflog_open()) == NULL) {
729 fprintf(stderr, "unable to open nflog\n");
730 exit(-1);
731 }
732
733 if (!nflog_bind_pf(logh, AF_INET) <= 0) {
734 fprintf(stderr, "nflog_bind_pf AF_INET failed\n");
735 exit(-1);
736 }
737
738#if 0
739 if (!nflog_bind_pf(logh, AF_INET6) <= 0) {
740 fprintf(stderr, "nflog_bind_pf AF_INET6 failed\n");
741 exit(-1);
742 }
743#endif
7bb6e8dd 744
ba0b3a0a
DM
745 if (!nflog_bind_pf(logh, AF_BRIDGE) <= 0) {
746 fprintf(stderr, "nflog_bind_pf AF_BRIDGE failed\n");
747 exit(-1);
748 }
749
750 struct nflog_g_handle *qh = nflog_bind_group(logh, 0);
751 if (!qh) {
84786ec0 752 fprintf(stderr, "no nflog handle for group 0\n");
ba0b3a0a
DM
753 exit(-1);
754 }
7bb6e8dd 755
ba0b3a0a
DM
756 if (nflog_set_mode(qh, NFULNL_COPY_PACKET, 0xffff) < 0) {
757 fprintf(stderr, "can't set packet copy mode\n");
758 exit(-1);
759 }
760
761 if ((nlifh = nlif_open()) == NULL) {
762 fprintf(stderr, "unable to open netlink interface handle\n");
763 exit(-1);
764 }
765
985fd74e
DM
766 sigset_t mask;
767 sigemptyset(&mask);
768 sigaddset(&mask, SIGINT);
769 sigaddset(&mask, SIGTERM);
770
771 sigprocmask(SIG_BLOCK, &mask, NULL);
772
773 if ((sigfd = signalfd(-1, &mask, SFD_NONBLOCK)) < 0) {
774 fprintf(stderr, "unable to open signalfd: %s\n", strerror (errno));
775 exit(-1);
776 }
777
ba0b3a0a
DM
778 if (!foreground) {
779 pid_t cpid = fork();
780
781 if (cpid == -1) {
782 fprintf(stderr, "failed to daemonize program - %s\n", strerror (errno));
783 exit(-1);
784 } else if (cpid) {
785 write_pidfile(cpid);
786 _exit(0);
787 } else {
788 int nullfd;
789
790 if (chroot("/") != 0) fprintf(stderr, "chroot '/' failed - %s\n", strerror (errno));
791
792 if ((nullfd = open("/dev/null", O_RDWR, 0)) != -1) {
793 dup2(nullfd, 0);
794 dup2(nullfd, 1);
795 dup2(nullfd, 2);
796 if (nullfd > 2)
797 close (nullfd);
798 }
799
800 setsid();
801 }
802 } else {
803 write_pidfile(getpid());
804 }
805
806 wrote_pidfile = TRUE;
807
808 nflog_callback_register(qh, &nflog_cb, logh);
809
810 queue = g_async_queue_new_full(g_free);
811
782c4cde 812 log_status_message(5, "starting pvefw logger");
ba0b3a0a
DM
813
814 nlif_query(nlifh);
815
816 GIOChannel *nlif_ch = g_io_channel_unix_new(nlif_fd(nlifh));
817
818 g_io_add_watch(nlif_ch, G_IO_IN, nlif_read_cb, NULL);
819
820 int logfd = nflog_fd(logh);
821 GIOChannel *nflog_ch = g_io_channel_unix_new(logfd);
822
823 g_io_add_watch(nflog_ch, G_IO_IN, nflog_read_cb, NULL);
824
985fd74e 825 GIOChannel *sig_ch = g_io_channel_unix_new(sigfd);
985fd74e 826 if (!g_io_add_watch(sig_ch, G_IO_IN, signal_read_cb, NULL)) {
e2beb7aa 827 exit(-1);
985fd74e
DM
828 }
829
ba0b3a0a 830 GThread *wthread = g_thread_new("log_writer_thread", log_writer_thread, NULL);
7bb6e8dd 831
ba0b3a0a 832 main_loop = g_main_loop_new(NULL, TRUE);
7bb6e8dd 833
ba0b3a0a
DM
834 g_main_loop_run(main_loop);
835
782c4cde 836 log_status_message(5, "stopping pvefw logger");
ba0b3a0a
DM
837
838 g_thread_join(wthread);
839
840 close(outfd);
841
842 nflog_close(logh);
843
844 if (wrote_pidfile)
845 unlink(PIDFILE);
846
847 exit(0);
848}